Custody Rules

1. INTRODUCTION

These Custody Rules set forth how Coinmate a.s. (hereinafter “we,” “us,” “our,” “Coinmate,” the“Company”) stores and manages your crypto-assets (hereinafter “your,” “you”, “client”, “customer”) in accordance with the Markets in Crypto-Assets Regulation (EU) 2023/1114, Article 75 (hereinafter “MiCA”).

These Custody Rules supplement the provisions of the Terms and provide detailed technical information on the custody and management of DCs in accordance with the requirements of the MiCA Regulation. By using our Custody Service, you agree to these Custody Rules.

1.1. DESCRIPTION OF THE CUSTODY SERVICE

The Custody Service allows you to securely store your DCs through our Platform. The purpose of these Custody Rules is to define, in particular:

(i) a description of how the Custody Service works; (ii) the methods of holding your DCs; (iii) the security of your DCs; (iv) communication between you and Coinmate in connection with the Custody Service.

1.2. DEFINITIONS

(i) a Hot Wallet is an online wallet for everyday transactions involving smaller amounts of DC; (ii) a Warm Wallet functions as an online wallet with a higher level of security for medium-term storage of DC; (iii) a cold wallet is a hardware wallet with the highest level of security for long-term storage of DC; (iv) a Sub-custodian is a person or organization authorized by the Company to hold clients’ DC.

1.3. FEES

Services provided under Custody are provided to customers free of charge. Additional fees, including the DC withdrawal fee, are governed by the Company’s current price list available here.

1.4. MEANS OF COMMUNICATION

Communication regarding Custody may take place:

(i) Via the form available on the Company’s website under the Contact section: https://coinmate.io/cs/support;

(ii) Via the form in the Support Interface available under the „Customer Support“ button (https://coinmate.io/cs/customer-support);

(iii) By letter to the Company’s registered office at: Pernerova 697/35, Karlín, 186 00 Prague 8.

2. CUSTODY PRINCIPLES

2.1. BASIC CUSTODY PRINCIPLES

Coinmate holds your DCs as your custodian, which means it provides DC custody on your behalf.

You have full rights to the financial value of the DCs that Coinmate holds for you. You also have full control over your DCs, and we will act solely in accordance with your instructions, except in the cases specified in Section 3 of these Custody Rules and subject to the specific technical limitations for cryptoassets in the Exchange Service as set forth in Section 4.1 of the Custody Rules.

2.2. SEGREGATION OF ASSETS

The Company strictly segregates your assets from its own assets. Your DCs are maintained separately from the Company’s DCs. Coinmate’s record-keeping system ensures the systematic and unambiguous identification of client assets in a manner that allows for the distinction at any time between DCs held for one customer and DCs held for other customers, as well as from the Company’s own DCs.

DCs held by Coinmate on behalf of customers are legally segregated from Coinmate’s assets so that Coinmate’s creditors have no claim to customer DCs, particularly in the event of Coinmate’s insolvency.

2.3. PROHIBITION ON THE USE OF CLIENT ASSETS

The Company is authorized to use a client’s DC exclusively for that specific client’s trades. With each settled trade, the trading platform’s accounting system recalculates the Company’s liabilities to the customer.

2.4. TRANSPARENCY AND CLIENT INFORMATION

The Company ensures that clients are regularly informed about the status of their assets, the availability of information regarding security measures for protecting DC, and a transparent trade settlement process.

Upon request and at least once every three months, Coinmate will provide you with an electronic statement of the DCs held in your name. The statement is also available after the client logs into the Platform. This statement includes the current balance, the value of the DCs, and information about transfers for the given period. Coinmate will also notify you as soon as possible about transactions that require your response.

2.5. POOLING OF DC

Your DCs may be pooled with the DCs of other clients. Therefore, you do not have a separate account for DCs. Through the Coinmate Platform, you can view the amount of DCs we hold for you.

By using our services, you expressly consent to the pooling of your DC with the DC of other clients.

You represent that you are and will remain the ultimate and beneficial owner of all DCs held by us at all times, that you will not act as an agent or trustee for any other person, and that you will not transfer, assign, pledge, encumber, or otherwise create any security interest in such DCs without the prior written notice and consent of Coinmate.

2.6. SUB-CUSTODIAN

The Company is obligated to exercise all due care and diligence in the selection, appointment, and regular review of any Sub-custodian selected and appointed by the Company, and in arranging for the holding and safekeeping of your DCs.

We reserve the right, if necessary, to appoint another person or organization to hold your DCs. No contractual relationship is established between you and the Sub-custodian we appoint.

2.7. ADDITIONAL MEASURES FOR SUB-CUSTODIANS

(i) The Company conducts a regular audit of all Sub-custodians at least once a year;

(ii) The Company has a process in place to identify and address potential conflicts of interest between the Company and Sub-custodians;

(iii) The selection and evaluation of Sub-custodians is based on strict criteria, including financial stability, regulatory compliance, technological sophistication, and security measures;

(iv) Clients will be notified of any significant changes in the use of Sub-custodians at least 30 days in advance.

2.8. USE OF SUB-CUSTODIANS

The Company uses the following Sub-custodian in connection with the custody of DCs:

(i) a wallet maintained by Payward Europe Solutions Limited, a company incorporated in Ireland, company registration number: 711781, for the execution of DC exchanges and their custody within the Exchange Service (i.e., for cryptoassets marked in the Platform interface with a notice regarding a specific transfer regime).

2.9. REGISTER OF CLIENT POSITIONS AND TECHNOLOGICAL CHANGES

The Company maintains a register of positions opened in the name of each client who uses our Custody Services. Our custody policies are designed to ensure that our Custody Services comply with applicable laws, regulations, ICT standards, and best practices. The primary objective of our custody policies is:

(i) to protect your DC;

(ii) to minimize the risk of loss, fraud, theft, cyber threats, or negligence; and

(iii) prevent unauthorized use of your DCs.

2.10. EXERCISE AND MODIFICATION OF RIGHTS RELATED TO DC

Rights associated with DCs (e.g., governance, etc.) cannot be exercised through the Platform. To exercise these rights, you must transfer the DCs to your own wallet. For details, see Section 4 below.

The Client acknowledges and expressly agrees that the Company does not support new or additional assets created on the network (in particular airdrops, hard forks). The Client waives any claim to such additional assets, unless the Company decides otherwise in exceptional cases.       

3. PROTECTION OF DC

3.1. MULTI-LAYER SECURITY SYSTEM

The Company uses three basic types of wallets to manage your DCs:

3.1.1. Cold Wallet

When transferring DCs from a cold wallet, the physical presence of several designated individuals at a specific location at a specific time is required, along with their unique access codes and verification. The Company implements strict rules for access to physical cold wallet devices, multi-factor authentication, and storage in secure facilities.

3.1.2. Warm Wallet

Fireblocks, as Coinmate’s custody partner, enables the configuration of so-called Warm wallets, which represent a compromise between the security of cold storage and the speed of Hot wallets. These wallets are ideal for operations where a balance between security and fund availability is required. The server has only passive access to the warm wallet for balance monitoring, but no active access for sending transactions. The warm wallet is primarily used for rebalancing using the Fireblocks MPC tool.

3.1.3. Hot Wallet

A hot wallet allows the transfer of only those DCs for which the rules for this type of wallet permit it. Excess DCs are automatically and continuously transferred to a warm wallet to prevent a high concentration of funds in this type of wallet.

3.2. OTHER WALLET TYPES

3.2.1. Self-custody wallet

Self-custody wallets are generally wallets for which Coinmate holds the private keys. Fireblocks is the provider of the relevant IT infrastructure for Coinmate, and as such, it does not need to be licensed under MiCA because it does not provide any crypto-asset custody or management services on behalf of customers. Coinmate securely holds and manages the private keys to these wallets. All DCs held through Fireblocks are stored in self-custody wallets.

3.3. SECURITY OF PRIVATE KEYS

Within Fireblocks’ MPC technology, the private key is divided into three distinct parts, each of which is stored in a separate and secure environment:

1. First part of the key

This part is managed by Coinmate in secure enclaves, such as Intel SGX, located in the clouds of several providers, such as Microsoft Azure and IBM Cloud.

1. The second part of the key

This part is also managed by Fireblocks and stored in the same type of secure environment, ensuring redundancy and enhanced security.

1. Third part of the key

This part is under Coinmate’s control and can be stored in various ways, depending on the type of wallet.

This distribution ensures that the entire private key is never assembled in one place, which significantly increases security when managing DC. One of the two MPC parts was provided by Fireblocks to Coinmate during the creation of the backup and is held by Coinmate on a secure and encrypted device that requires access by multiple authorized persons. Two out of three keys are required to sign a transaction.

3.4. MONITORING AND RECONCILIATION

The Company regularly monitors the balance of funds in hot, warm, and cold wallets. Deposits and transactions are monitored. In the event of a breach of user accounts, liabilities decrease, which is detected by monitoring coverage against liabilities. The company regularly compares the actual DC balance with recorded liabilities to clients, implements automatic detection of discrepancies, and issues alerts for potential security incidents.

4. WITHDRAWING DC FROM CUSTODY

Clients may withdraw DC to their wallet or to another DC custodian at any time, with the exception of DC obtained through the Exchange service, as specified in Section 4.1 below. Withdrawals of DC are governed, among other things, by the Transfer Rules, which constitute Appendix No. 2 to the Terms.

4.1. SPECIAL RULES FOR DCs ACQUIRED THROUGH THE EXCHANGE SERVICE

DCs acquired through the Exchange service (i.e., cryptoassets marked in the Platform interface with a notice regarding restricted transfers) do not support automated withdrawals to an external wallet or transfers to another service provider. This restriction is of a technical nature and results from the specific method of securing these DCs through our partners. 

However, upon the client’s request, the Company will facilitate a manual withdrawal of DC to the client’s own wallet, exclusively after verifying that the destination wallet is indeed owned by the client. Coinmate charges an administrative fee for such a withdrawal, the amount of which is specified in the price list available here. Due to the significant technical complexity of withdrawing DCs offered through the Exchange service, please note that processing a withdrawal request takes an average of 7 days from the date of contacting customer support. However, a withdrawal will never take longer than 30 days (exceptions may include technical issues, errors on the blockchain network, and other situations that are not objectively attributable to the Company).

To make a withdrawal of DC offered through the Exchange Service, contact customer support either (i) via the form available on the Company’s website under the Contact section: https://coinmate.io/cs/support; or (ii) via the form in the Support Interface available under the Customer Support button (https://coinmate.io/cs/customer-support).

5. RISK MANAGEMENT

5.1. RISK MITIGATION MEASURES

The Company implements measures to minimize identified risks. It strictly adheres to the principle of asset segregation and ensures multi-level security for access to wallets and accounts. The Company conducts regular security audits and testing, organizes regular employee training, and secures insurance against selected risks. All processes are transparently documented.

5.2. EMERGENCY RESPONSE

In the event of an emergency (e.g., a security incident, technical failure, or insolvency of the sub-custodian), the Company informs clients of the situation and the measures taken, cooperates with the relevant regulatory authorities, minimizes the impact on clients and their assets, and implements corrective measures.

5.3. LIABILITY FOR LOSSES

Coinmate is liable for the loss of DC or means of access to such DC if the loss occurs as a result of an incident attributable to Coinmate. In such a case, Coinmate’s liability is limited to the market value of the lost DC at the time of the incident. 

Coinmate is not liable for losses caused by independent factors, such as, but not limited to, technical issues with the distributed ledger beyond its control. The use of Sub-custodians does not result in a delegation of Coinmate’s liability to customers. Coinmate is liable for the loss of DC or access credentials even as a result of the actions of Sub-custodians, to the extent specified above in this section. 

Coinmate is responsible for the ultimate recoverability of DCs held with Sub-custodians; however, in accordance with Section 9.8 of the Terms, it is not liable for delays in accessing these funds caused by third-party technical processes or manual processing procedures at the Exchange Service.

6. GOVERNANCE AND RESPONSIBILITIES

6.1. ORGANIZATIONAL STRUCTURE AND RESPONSIBILITIES

Coinmate’s statutory body bears ultimate responsibility for the implementation of and compliance with these Custody Rules. The Compliance Department oversees compliance with regulatory requirements and conducts regular audits. IT Security ensures the technical security of wallets and systems.

6.2. REPORTING AND AUDITING

The company generates regular internal reports on the status of client assets, arranges for independent audits of compliance with custody principles, and regularly reviews and updates them.