Custody & Safeguarding

1. Purpose

CoinJar Europe Limited ("CoinJar Europe", "CEL", "the Firm", "we", "our" or "the Company") is a wholly-owned subsidiary of CoinJar Group Holdings Pty Ltd and is authorised by the Central Bank of Ireland (“CBI”) as a Crypto-Asset Service Provider (“CASP”).

Safeguarding the crypto-assets and fiat held on a temporary basis for our customers is at the heart of everything we do. It underpins market integrity, protects our brand and meets the legitimate expectations of regulators, auditors and most importantly of our customers.

This Custody & Administration Disclosure articulates how we maintain continuous, verifiable control over client crypto-assets and fiat, from the moment they enter our custody through to their safe return or are used for an exchange service. It explains our governance model, technology, operational processes and assurance activities in clear, measurable terms so that stakeholders can judge the adequacy of our control environment.

Collectively, these documents demonstrate our commitment to the highest standards of customer-asset protection across the entire asset-lifecycle, even in the face of market stress or Firm wind-down.

Regulatory Permissions

ARTICLE 3 (1)(16) DEFINITIONS	Use Case
Providing custody and administration of crypto assets on behalf of clients	CoinJar Europe is responsible for the safekeeping or controlling, on behalf of its customers, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys.
Exchange of crypto-assets for funds	CoinJar Europe receives fiat funds from its customers to purchase crypto assets. CoinJar Europe acts as the principal in conversion using its own crypto-asset inventory.
Exchange of crypto-assets for other crypto-assets	Enabling CoinJar Europe to buy crypto assets from their customers who wish to convert from one crypto asset to another type of crypto asset. CoinJar Europe acts as the principal in conversion using its crypto-asset inventory.
J) Providing transfer services for crypto assets on behalf of clients	CoinJar Europe receives a request from a customer to transfer the custodianship of a virtual asset to another entity or wallet.
Scope of the Custody and Administration Service

This Disclosure applies to all custody and administration services provided by CoinJar Europe. These services include:

• Safekeeping of crypto assets on behalf of clients.
• Administration of crypto-assets, including facilitating client access and exercising rights attached to the crypto-assets.
• Safekeeping of client fiat funds on behalf of clients
• Ensuring the return of crypto assets and fiat funds or means of access to clients upon request or during insolvency scenarios.

The scope covers (combined known as “relevant assets”):

• Crypto assets under custody held directly by CoinJar Europe apply to all client types.
• Fiat balances held by CoinJar Europe while awaiting instructions from clients

Regulatory Framework

This Disclosure is developed in accordance with Regulation (EU) 2023/1114, specifically Article 75, which governs the custody and administration of crypto assets. It aligns with the requirements outlined in Article 62 for crypto-asset service providers seeking authorisation. CoinJar Europe adheres to all relevant regulatory obligations, including:

• Ensuring compliance with Article 75(8) regarding safekeeping and control of client crypto-assets.
• Providing clients with a summary of the custody Disclosure, as required by Article 75(3).

2. Definitions

Term	Meaning
Client Asset	A crypto-asset or the cryptographic means of access (e.g., private-key share, seed phrase, hardware signer) entrusted to the Firm for the benefit of the client.
Custody	The holding of the means of access sufficient to unilaterally dispose of a crypto-asset.
Administration	Book-keeping, reconciliation, order action processing and other back-office functions that evidence the client’s title to a crypto-asset.
MPC-CMP	Fireblocks’ Multi-Party Computation – Conditional Multi-Party protocol whereby multiple key shares are held in separate secure enclaves, so that the full private key never exists in a single place. All key shares are required for a transaction.
Vault Class	Classification of wallet clusters (Hot, Warm, Cold) based on their connectivity, signing-key location and transaction limits.
HCAO	Head of Client Asset Oversight is the Controlling Function 45 under CBI Fitness & Probity.
RTO / RPO	Recovery Time Objective / Recovery Point Objective as defined in ISO 22301.
TPSP	Third-Party Service Provider—any external party contracted to provide ICT or operational services relevant to Client Assets (presently this is “Fireblocks”).

3. Risk Appetite Statement

CoinJar Europe recognises the critical importance of protecting relevant funds due to customers. It has a zero-tolerance approach to risks that could compromise the protection, segregation, and proper management of relevant funds:

• Zero-tolerance stance: The Board will not accept any risk that could compromise the segregation, protection, or timely return of relevant funds.
• Regulatory primacy: MiCAR and Central Bank safeguarding rules take precedence over operational convenience or commercial gain.
• Segregation & co-mingling prohibition: Relevant funds must always be held in designated accounts/wallets; the assets of CoinJar Europe, or any other CoinJar entity, may never share those accounts/wallets.
• Operational controls: Only a very low tolerance exists for errors or system failures. Operation breaks must be escalated and remediated immediately, and related scenarios are captured in the risk register.
• Third-party vetting: Minimal tolerance for risks posed by technical partners, banks or payment partners. Rigorous due diligence and monitoring are mandatory.
• Liquidity discipline: Zero appetite for any activity that could create a shortfall or delay in meeting customer withdrawals. Insolvency and wind-down preparedness: Frameworks and contingency plans must guarantee full protection of client assets if the Firm becomes insolvent or decides to wind down.
• Reputational vigilance: Low tolerance for potential damage arising from regulatory findings or public scrutiny of safeguarding practices.

4. Core Principles

CoinJar Europe segregates relevant assets by means of a segregation method that is, by keeping customer fiat and crypto assets separate (non-commingled) from all other funds/assets held by CoinJar Europe.

The following high-level principles apply to the segregation of customers’ relevant assets by CoinJar Europe:

Fiat Funds Held

1. CoinJar Europe uses a segregated/client money bank account opened with authorised credit institutions to segregate and safeguard the customers’ funds entrusted. CoinJar acknowledges that it is not a bank or payment firm; therefore, controls are in place to ensure that funds held for customers are not indefinitely maintained in the client money account (held at Clear.Bank Europe).

2. Funds received are deemed relevant funds once available and are segregated immediately through the use of virtual IBANs (“vIBANs”).

3. CoinJar Europe will make sure that assets held on the client money account(s) are always matched at least one to one to the value of the customer's funds that must be segregated and will conduct reconciliation of the customers funds daily to ensure that the parity is achieved by the end of the operating day.

4. CoinJar Europe will keep an efficient and adequate process to ensure it can identify customer funds held at any moment.

5. CoinJar Europe will ensure that proper due diligence is conducted when selecting a new client money account provider, and that periodic monitoring of the provider is conducted by the Head of Risk.

6. Client money letters are kept on file, which clearly sets out that the funds held on behalf of the customer do not form part of CoinJar’s estate.

Crypto Assets Held in Custody

1. CoinJar Europe safeguards customers’ crypto-assets in dedicated on-chain wallets that are pooled.

2. Once an inbound transaction receives the requisite network confirmations, the crypto assets are treated as “relevant assets” and are automatically swept into the customer’s unique deposit wallet address and onto a segregated pooled wallet (known internally as “omnibus”).

3. CoinJar Europe maintains a minimum 1:1 match between the on-chain balances in client wallets and the entitlements recorded in its internal ledger. Full reconciliations are performed each business day so that any break is identified and rectified before the close of business.

4. Robust ledgering, wallet-tagging, and blockchain analytics tools enable CoinJar Europe to identify, at any moment, the precise quantity and location of each client’s crypto-assets.

5. Custody Arrangements

Custody Service Offered

CoinJar Europe provides a crypto (digital) asset custody service using omnibus digital wallets. This structure has the following characteristics:

• Client crypto assets are received into unique client wallets to enable unambiguous identification and are recorded on-chain as such.
• Client assets are then pooled into collective omnibus accounts. This enables operational efficiency while maintaining robust tracking mechanisms. Customers provide explicit consent to the use of omnibus accounts when agreeing to CoinJar Europe Terms & Conditions.
• Segregation of individual client holdings is achieved at the ledger level, where detailed records ensure accurate identification and reconciliation of each client’s assets. This is a live ledger that is automatically updated and regularly reconciled.
• All client assets are strictly separated from CoinJar’s proprietary assets, in compliance with regulatory requirements.

Description of the Custody Process and Procedures

The custody process follows a structured approach to ensure the safekeeping and administration of client crypto assets:

1. Asset Onboarding:
   • Once an account is verified, dedicated wallet addresses are assigned to each client for incoming transactions, enabling unambiguous identification of funds.
   • Upon receipt of client crypto-assets, CoinJar performs verification and reconciliation on the blockchain to confirm ownership and integrity.
2. Safekeeping:
   • CoinJar Europe leverages Fireblocks MPC (Multi-Party Computation) technology to ensure the highest level of security for client crypto-assets. Key features include:
     • Cryptographic splitting of private keys into multiple shares, ensuring the private key is never fully reconstructed.
     • Use of Intel SGX (Software Guard Extensions) hardware-isolated enclaves to securely store MPC key shares.
     • Distributed signing processes across tier-1 cloud environments, reducing single points of failure.
     • Key Management Processes including assigning an Owner of the Fireblocks Workstation responsible for approving Key Signers. In CEL’s case, the HCAO is the Owner of the Fireblocks EU Workstation.
3. Ledger-Based Segregation:
   • Individual client holdings are segregated and automatically tracked at the ledger level, ensuring transparency and accountability. These ledgers are reconciled frequently.
4. Monitoring and Reporting:
   • Continuous monitoring and reconciliation of custody accounts is conducted to identify and mitigate risks. Clients have real-time online access to our web and mobile applications with details of their holdings and transactions.
   • As CoinJar does not provide banking services, customers cannot hold fiat currency in their CoinJar account indefinitely. The HCAO is responsible for monitoring customer’s fiat ‘time spent’ in the ClearBank Fiat accounts. Any fiat not used to transact within 12 months, will be returned to the customer.
5. Asset Return:
   • Processes are in place to ensure the timely return of crypto-assets or means of access upon client request or during insolvency scenarios.

6. Systems and Controls

CoinJar Europe employs comprehensive systems and internal control arrangements to manage operational and ICT risks, ensuring the safekeeping and administration of client crypto assets as well as the timely execution of client orders:

1. Segregation of Client Assets:
   • All client crypto assets are stored in secure wallets, leveraging Fireblocks MPC technology to ensure cryptographic security and operational resilience.
   • Client holdings are segregated at the ledger level to ensure accurate tracking and reconciliation.
   • Dedicated wallet addresses are assigned for incoming transactions to enable unambiguous identification.
   • Fiat funds in holding are maintained in dedicated client money accounts at ClearBank.
2. Access Control Mechanisms:
   • Strict Role-Based Access Control (“RBAC”) is enforced to limit access to custody systems and sensitive data.
   • Multi-Factor Authentication (“MFA”) is required for all administrators and users accessing the custody platform.
3. Transaction Authorisation Policies:
   • Comprehensive policies are in place to enforce transaction limits, approval workflows, and risk-based authorisation parameters.
   • Admin quorum requirements ensure that sensitive actions require approval from multiple administrators.
4. Client Rights and Asset Return:
   • Procedures are established to ensure clients can exercise their rights attached to the crypto-assets.
   • Mechanisms are in place to facilitate the timely return of client crypto-assets or means of access upon request or during insolvency scenarios.
5. Monitor and Detect Risks:
   • Real-time monitoring tools are used to identify operational disruptions, unauthorised access, and ICT vulnerabilities.
   • Incident response systems enable swift escalation and resolution of identified risks.
6. Ensure Resilience:
   • High-availability infrastructure is deployed to minimise downtime and ensure uninterrupted service delivery.
   • Backup and disaster recovery systems are regularly tested to ensure operational continuity.
7. Protect Client Assets:
   • Systems are designed to safeguard client crypto-assets from operational failures, cybersecurity threats, and external risks.
   • Stringent access control mechanisms are enforced to prevent unauthorised access to custody systems.

7. Exercising Client Rights Attached to Crypto-Assets

CoinJar Europe has systems designed to ensure clients can exercise rights attached to their crypto assets effectively. However, CoinJar Europe acknowledges certain practical limitations regarding participation in blockchain governance activities, the terms of which are detailed in its terms and conditions.

1. Limited Participation in Governance Protocols:
   • CoinJar Europe does not facilitate client participation in blockchain governance activities, such as voting, staking, or actively managing hard forks and token migrations.
   • This stance reflects practical considerations, including blockchain protocol risks, technological uncertainties, potential security vulnerabilities of new or emerging protocols, and possible technical constraints in supporting new networks at the same standard and rigour required by this Custody and Administration Disclosure.
   • Clients who wish to participate in governance decisions or specific blockchain events (e.g., token migrations, forks) that are not Business-as-usual have two choices: i. Withdraw their crypto assets to self-hosted wallets to maintain full autonomy over their assets. ii. Complete an exception form for the given event that will be reviewed and executed on a case by case basis by CoinJar Europe. The execution of certain events may require additional costs incurred to be on-charged to the customer.
2. Exceptional Circumstances:
   • CoinJar Europe reserves the right, at its discretion, to intervene proactively in certain major or mandatory blockchain events that materially impact client assets. Examples of such scenarios include significant hard forks or compulsory token migrations involving widely supported digital assets.
   • In these exceptional cases, CoinJar Europe will clearly communicate the nature of the event, actions required, and any involvement it intends to undertake to support clients.
3. Distribution of Financial Benefits:
   • In cases where CoinJar Europe derives a direct financial benefit from blockchain governance events (e.g., token distributions resulting from forks or protocol upgrades), and where such distributions can be readily liquidated but not practically distributed to clients in-kind, CoinJar Europe will distribute the resulting financial proceeds proportionately to clients based on their recorded asset holdings at the time of the relevant event.
4. Rights Notification:
   • CoinJar Europe will promptly notify clients of relevant blockchain events, such as protocol upgrades or significant network changes. These notifications are provided for informational purposes only and do not constitute active management or facilitation by CoinJar Europe unless explicitly stated otherwise.
5. Blockchain Integration:
   • Direct integration with blockchain networks ensures accurate processing of client requests related to validly accepted asset management functions.

8. Ensuring the Return of Crypto-Assets or Means of Access to Clients

CoinJar Europe has systems to ensure the timely return of crypto-assets or means of access to clients upon request or during insolvency scenarios:

1. Asset Return Protocols:
   • Procedures are in place to verify client identity and authorise the return of crypto assets securely.
   • Dedicated wallet addresses are used to facilitate the return process, ensuring unambiguous identification of funds.
2. Reconciliation and Reporting:
   • Ledger-level segregation ensures accurate tracking of client holdings, enabling seamless reconciliation during asset returns.
   • Reporting provides transparency to clients regarding their holdings and return status.
3. Insolvency and Wind Down Planning:
   • Wind Down Plan in place for execution if required.
   • Systems are designed to enable efficient distribution of client assets in the event of insolvency, including:
     • Access to books and records detailing client holdings
     • Reconciliation and rebalancing tools to ensure accurate asset distribution

9. Delegation and Outsourcing

CoinJar Europe does not delegate or outsource custody and administration services to third parties. All client crypto assets remain under the direct custody and administration of CoinJar Europe, ensuring full control and accountability. Fireblocks is utilised solely as a technology provider, supplying infrastructure and tools to enhance the security and operational efficiency of custody systems.

10. Location of Books and Records

CoinJar Europe maintains comprehensive books and records related to client assets and transactions. These records are stored securely and are accessible for audit and regulatory purposes.

11. Regular Reviews and Updates to the Disclosure

CoinJar Europe conducts reviews and updates to the custody and administration Disclosure to ensure its continued relevance and effectiveness. The Disclosure is reviewed at least annually or in response to significant changes in regulatory requirements, market conditions, or operational risks.