JCBA Publishes Draft Security Best Practices for Crypto Asset Clients, Comprising 347 Items with Key Management as an Independent Domain

On October 20, according to CoinPost, the Security and Systems Subcommittee of the Japan Cryptocurrency Business Association (JCBA) announced on October 20 the establishment of the Crypto Asset Delegation Management Working Group (WG) and released a draft of the "Practical Guidelines" for delegator security measures. The draft comprises 347 items spanning ten major areas, including governance, personnel and physical security, BCP, and re-delegation management, with "Key Management and Signature Operation" designated as a standalone category. Delegator service models are classified into five types—"Holding Type," "Intervention Type," "Supply Type," "Reference Type," and "Other"—accompanied by an Excel-based self-assessment form and a confirmation document management ledger. JCBA noted that general third-party assurance reports such as SOC 2 are insufficient to adequately assess crypto asset-specific risks such as private key lifecycle management.