(1) An institution that conducts qualified crypto custody business must ensure that customers' cryptographic instruments and private cryptographic keys are held in custody separately from the institution's own cryptographic instruments and private cryptographic keys. Where the cryptographic instruments of several customers are held in custody in a pool (pooled custody), it must be ensured that the shares belonging to individual customers in the total pooled holding can be determined at any time.
(2) The institution must ensure that the customer's cryptographic instruments and private cryptographic keys held in custody cannot be disposed of for the institution's own account, or for the account of another person, without the customer's express consent.
5e.
Special duties relating to environmental, social, and governance risks