A. As used in this section, unless the context requires a different meaning: “Bank” has the same meaning as provided in § 6.2-800. “Custody services” means the role of a bank in the safekeeping and custody of various customer assets. “Self-assessment” has the same meaning as provided in § 6.2-947. “Virtual currency” means an electronic representation of value intended to be used as a medium of exchange, unit of account, or store of value. “Virtual currency” does not exist in a physical form; it is intangible and exists only on the blockchain or distributed ledger associated with a particular virtual currency. The owner of virtual currency holds cryptographic keys associated with the specific unit of virtual currency in a digital wallet, which allows the rightful owner of the virtual currency to access and utilize it.
B. A bank may provide its customers with virtual currency custody services so long as the bank has adequate protocols in place to effectively manage risks and comply with applicable laws. Prior to a bank offering virtual currency custody services, the bank shall carefully examine the risks involved in offering such services through a methodical self-assessment process. If the bank decides to move forward with offering such services, the bank shall:
1. Implement effective risk management systems and controls to measure, monitor, and control relevant risks associated with custody of digital assets such as virtual currency;
2. Confirm that it has adequate insurance coverage for such services; and
3. Maintain a service provider oversight program, to the extent that the bank engages with a service provider to provide virtual currency custody services, to address risks to service provider relationships as a result of engaging in virtual currency custody services.
C. A bank may provide virtual currency custody services in either a nonfiduciary or fiduciary capacity. In providing such services in a nonfiduciary capacity, the bank shall act as a bailee, taking possession of the customer’s asset for safekeeping while legal title remains with the customer, meaning that the customer retains direct control over the keys associated with their virtual currency. In providing such services in a fiduciary capacity, a bank is required to possess trust powers as described in § 6.2-819 and have a trust department pursuant to § 6.2-821. Acting in a fiduciary capacity, the bank shall require customers to transfer their virtual currencies to the control of the bank by creating new private keys to be held by the bank. In its fiduciary capacity, a bank shall have authority to manage virtual currency assets as it would any other type of asset held in such capacity.