Custody Policy

Introduction

Shares Financial Assets provides EU clients custody with Coinbase as sub-custodian for client’s crypto-accounts. Shares Financial Assets provides custody and administration of crypto-assets held in these accounts, on behalf of its clients, and is therefore the client’s crypto custodian. The client’s crypto sub-custodian is Coinbase Luxembourg SA, CASP, MICA regulated. 

Shares Financial Asset does not hold client funds and SFA delegates its custody services to Coinbase Luxembourg SA. 

This document applies when Shares Financial Assets is providing custody and administration of crypto assets through reception and transmission of order service automatically. Shares Financial Assets does not hold crypto-assets on behalf of the clients without reception and transmission of order service before. 

Holding and segregation client assets

Shares Financial Assets applies a segregation mechanism to distinguish crypto-assets held on behalf of clients from assets held on behalf of other clients. 

Shares Financial Assets don’t have their own crypto assets. 

Shares Financial Assets don’t use client assets to fund SFA’s.

The Sub-Custodian applies segregation mechanisms to distinguish crypto-assets held on behalf of Clients from:

• the Sub-Custodian's own assets;
• assets held on behalf of other clients; and
• assets used for proprietary trading.

The crypto-assets held in custody remain the property of the Clients and are not the Sub-Custodian's own assets. The Sub-Custodian is not authorized to sell, lend, pledge, reuse, transfer, or encumber the crypto-assets held in custody, except as instructed by the Client through Shares Financial Assets or as required by applicable law or regulation. 

Shares Financial Assets has a CB Lux “client omnibus vault”with all the assets of the clients. All the assets of the clients are segregated by clients in hot and cold wallets. Holdings in the client omnibus vault will be rebalanced in response to transfers and other settlement activity. Rebalancing generally occur at the end of each 12 hours settlement cycle (twice per day) and ad-hoc where required. 

Operations authorized

Custody services enable, in particular: 

• the deposit of crypto-assets into custody wallets;
• the withdrawal of crypto-assets to external blockchain addresses;
• the transfer of crypto-assets in accordance with instructions transmitted by Shares Financial Assets on behalf of the Client.

Crypto-asset deposits and withdrawals are executed in accordance with instructions transmitted by Shares Financial Assets and subject to applicable operational, regulatory, and compliance controls, including those related to anti-money laundering, international sanctions, and fraud prevention. 

Restrictions, Controls, and Suspension of Transactions

The Sub-Custodian and Shares Financial Assets may refuse, suspend, delay, or cancel certain deposit, withdrawal, or transfer transactions in order to:

• comply with a legal, regulatory, or prudential obligation;
• respond to a request from a competent authority;
• implement security, compliance, or risk management controls;
• prevent fraud, illegal activity, or a breach of the security of systems or crypto-assets.

Processing Times

The Client acknowledges that certain withdrawal transactions may require processing time, particularly due to: 

• the security measures applied to custody wallets;
• the use of offline storage mechanisms (“cold storage”);
• the inherent delays of blockchain networks;
• applicable compliance and security controls.

Supported Crypto-Assets

The Sub-Custodian and Shares Financial Assets only support crypto-assets expressly supported by its infrastructure. The Client must not transfer unsupported crypto-assets to the custody wallets. Transferring unsupported crypto-assets may result in their permanent loss or unavailability without the possibility of recovery. 

Record and reconciliations

Books and records : The “client positions” ( the amount of crypto assets in a client’s Shares account with sub custody at Coinbase Lux SA) are reflected in Shares Financial Assets’s books and records. SFA’s books and records enable Shares at any time and without delay to distinguish crypto-assets which it holds for one client, from those which it holds for other clients. 

SFA’s books and records are maintained in a way that ensures that they may be used as an audit trail. 

Reconciliation : Shares perform daily reconciliations between our omnibus wallet at Coinbase Lux SA and our client's positions in Shares’s accounts to ensure that books and records are accurate. When a discrepancy is observed, it is classified as an incident, and will be corrected, for example, by updating records or moving crypto-assets from/to the relevant vault.

Key management and administration of loss‍

The Sub-Custodian and Shares Financial Assets implement technical, organizational, and operational security measures designed to ensure the security, integrity, and confidentiality of the crypto-assets held in custody. This includes the use of offline storage devices (“cold storage”) and maintaining insurance coverage deemed commercially reasonable in relation to the services provided. 

Key management : Our key management process depends on Coinbase Lux’s key management process. 

CB LUX uses a proprietary cryptographic “Key management system” which applies multiparty computation technology to ensure protection of client crypto-assets. 

Pursuant to the Key management system, CB LUX retains controls over client crypto assets and the means of the access to client crypto assets. 

Shares has an omnibus account, “Prime trading Balance”, at Coinbase CBLUX where the crypto-assets are dynamically managed between online and offline wallets. Coinbase keeps the majority of assets in offline storage to maximize security and manages the percentage of assets kept in online wallets to facilitate rapid withdrawals. The percentage of assets maintained in offline vs. online storage is determined by ongoing risk analysis and market dynamics. Factors that impact rebalancing include insurance coverage, client activity, and market activity. We seek to ensure client liquidity needs are balanced with optimizing assets in the most secure storage possible for those needs. 

True cold storage is the most proven, battle-tested storage in cryptocurrency custody. Coinbase LUX SA private keys are always held offline in deep cold storage. The 

printed QR codes of the beta shards are stored in a Coinbase-leased secure processing facility in a vault located in multiple geographic locations. These facilities are 

protected at the perimeter by: video surveillance, 24x7 guards, and badge readers for entry. Coinbase's space is a separate dedicated secure area controlled by Coinbase monitored cameras and Coinbase badge and biometric controls. Physical security and 24/7/365 video surveillance monitoring is provided by Coinbase's Global Security 

Ops Center at all locations. Within the vault, encrypted shards are stored in a secure, auditable, badge-controlled vault. Access to the vault is limited to only the physical 

security team. 

The servers that handle signing and key reconstruction are in an air-gapped configuration and have a tightly controlled AWS account. Logical access to the Production 

Environment, and supporting systems are granted upon management review and approval. Users with access can only connect via encrypted network protocols such as 

Virtual Private Network (VPN), Secure Shell (SSH), and two-factor authentication (2FA). Minimisation of loss : The minimisation of loss depends on the set up in place by Coinbase LUX SA.

CB Lux, applies combinations of core security principles and advanced encryption technologies to secure crypto-assets; applies ongoing security risk assessments, periodic internal and external audits, and other security-related activities, such as penetration testing, to identify, evaluate, and mitigate security risks; has a dedicated ‘Security Team’ which identifies, owns, and manages risks and controls; and has in place appropriate risk management policies and procedures.

The minimisation of loss depends on the set up put in place by Shares Financial Assets to deposit and withdraw from Custody crypto assets. Shares Financial Assets applies core security principles to secure the access to SFA’s Coinbase omnibus account and other security related activities, such as penetration testing to identify, evaluate, and mitigate security risks, has a dedicated “ Security Team” which identifies, owns and manages risks and controls, and has in place appropriate risk management policies and procedures. 

Shares has a secure process for deposits and withdrawals. 

The specific balances of assets maintained in online vs offline omnibus wallets are visible to SFA via the UI and API at no time. SFA has full control over what percentage of their assets are held in trading wallets. 

• Coinbase supports two main pathways for instruction capture:

• User Interface: SFA has an easy to use interface where a Shares employee can enter the required withdrawal details, including destination address, destination memo tag (if applicable), and amount.
• API: Similarly, SFA can provide withdrawal details through our API to initiate a withdrawal.

Once initiated, SFA can view the transaction details and approve the transaction using their Yubikey in order to meet a pre-defined approval threshold. After approval, 

transaction details are confirmed through a live video call. A Yukikey is an authentication device that enables enhanced security protocols for SFA via 2FA. 

The only piece that requires a withdrawal or top up from or to either wallet is to rebalance the allocation of digitals assets in the hot and cold wallets and a transfer outside of a rebalancing cycle to an external wallet when the client wants to liquidate all positions. 

The rebalancing is performed every 12 hours cycles. In case of a request to withdraw crypto-assets outside of a rebalancing cycle, SFA has enough liquidity on the omnibus online wallet to satisfy transfer requests made by clients. 

• Two factor authentication

Coinbase accounts and their associated users are required to use 2 Factor Authentication at sign-in, and during the usage of the online portal. Specifically, 

Coinbase requires that a YubiKey be used at sign-in and during other platform activity, such as initiating a transaction. YubiKey is a hardware device,

manufactured by YubiCo. YubiKey (U2F) serves as the exclusive 2-Factor Authentication (2FA) method on the platform, and users will not be able to access their account without a key registered.

2FA cannot be used in-place of U2F. Providing authentication to the platform at sign-in requires the user to insert their Yubikey into a USB port, and requires physical 

input (pressing a button) on the device itself to authenticate a request. 

• Reporting portal access

SFA can be added as users to the overall account. The roles most appropriate for clients would be Read only. SFA will also have the option to use 

Coinbase comprehensive APis to integrate access directly into its App. This would allow visibility into SFA balances and the ability for SFA to programmatically initiate 

Transactions. 

However, Statements are available for download in either a PDF or a CSV format, the latter allowing for customized reporting. The CSV will provide description, transaction id, transaction type, transaction state, transaction amount, source, destination, currency, fee, wallet, organization, created at date, and updated at date. 

Activity and history reports can be generated from within the application on an ad hoc basis via a self-serve tool that includes filters such as Transaction Type (Withdrawal, Deposit,Invitation, Wallet Change, API Key Change, Settings Change, Billing Preference Change),Asset (any asset held in Portfolio), and Transaction Status (Completed, Expired, Rejected). 

• Control procedures for client instructions

Authentication is required when logging into the account, initiating and approving withdrawals, adding, changing or removing addresses for whitelisting, updating the 

account's roster and user roles, changing the consensus, and resetting the passwords. All instructions necessary to initiate a transaction, must be submitted via the Coinbase platform. 

When a transaction is initiated, the initiating user will be prompted to authenticate their request using their own YubiKey. 

In addition to initiating and authenticating the transactions on the Custody platform using YubiKey, SFA will need to follow the same protocols when changing or adding 

addresses to the address book whitelist and updating the account's consensus. A consensus mechanism on the platform dictates how many approvals are required in order for the consensus to be achieved. Only when the consensus is met, is the underlying transaction considered officially approved by SFA. 

An account's roster and user roles are maintained in a separate document, an Authorised User List ("AUL"). Any changes to the account's roster has to be reflected on an 

updated AUL first, executed by an authorised signatory. 

If SFA needs to reset or change its account password, they will need to contact the Client Service team first and complete a video authorization before a password reset

can be performed.

Information regarding withdrawal transactions will also need to be validated via a video authorization, which is arranged with SFA after they've submitted their request to withdraw funds from their account. When required, a video authorization notification is sent to SFA to set up a video authorization for their pending transaction. If a 

common date/time cannot be reached, Client Services may manually contact SFA to either schedule the call, or perform the authorization immediately. 

• Configurability of user roles

Coinbase Custody supports five unique user roles on the platform: 

• Initiator
• Approver
• Authorised Signatory
• Auditor
• Administrator

Exercising rights attached to crypto-assets (Forks, airdrops and other events affecting crypto-assets protocol)

• the technical, operational, and security capabilities of the Sub-Custodian and third-party service providers involved in the custody or execution of the Transactions;
• applicable regulatory and prudential constraints;
• the availability of compatible technical infrastructure;
• the existence of liquidity or a viable market for the relevant Crypto-asset;
• the ability of Shares Financial Assets and the Sub-Custodian to identify, secure, value, distribute, or return the relevant rights under reasonable conditions of security and compliance.

When SFA decides to accept an event affecting crypto-assets, the rights granted are determined based on the positions recorded at the time chosen by SFA.

• Soft forks are part of regular updates and maintenance of existing blockchain integrations by Coinbase. SFA will notify you if there is any impact as soon as we receive the notification from Coinbase and 3 days after the notification from Coinbase, Coinbase will complete a security analysis and the support will be temporarily downtime before resuming full support for the asset.
• As Hard forks occur, we may notify you if we will support it or not as soon as we receive a notification from Coinbase and maximum 48 hours after receiving the notification. If SFA will support it, we will plan asset support downtime before full support with Coinbase.

When we do not support airdrops, SFA will advise you maximum 3 days after the notification for anticipated airdrops from Coinbase and 48 hours for unforeseen airdrops.

• the payment, distribution or other right is (or relates to) an Advanced Protocol that Coinbase does not support,
• Coinbase lacks the technological capabilities to provide Client with these payments, distributions or other rights
• Coinbase cannot deliver the payments, distributions or other rights for legal or other reasons that Coinbase (in its discretion) considers to make delivery impossible or impracticable.

distributions or other rights for legal or other reasons that Coinbase (in its discretion) considers to make delivery impossible or impracticable. 

Indemnification and Limitation of Liability

SFA shall not be liable for any loss caused directly or indirectly by: 

(A) the Client's failure to comply with Shares Financial Assets' custody policy and all other policy or procedures that have been communicated to it; 

(B) any failure or delay in acting by any service provider to the Client; 

(C) any system failure (other than a system failure caused by SFA's gross negligence, wilful misconduct or fraud that prevents SFA from fulfilling its obligations). 

(D) SFA shall not be liable for delays, suspension of operations, whether temporary or permanent, failure in performance, or interruption of service which result directly or indirectly from any cause or condition beyond the reasonable control of SFA, including any; embargo; natural disaster; act of civil or military authorities; act of terrorists; hacking; government restrictions; market volatility or disruptions in order trading on any CTV, exchange or market; suspension of trading; civil disturbance; war; strike or other labor dispute; fire; severe weather; interruption in telecommunications, Internet services, or network provider services; failure of equipment or software; failure of computer or other electronic or mechanical equipment or communication lines;

unauthorized access; theft; outbreaks of infectious disease or any other public health crises, including quarantine or other employee restrictions; acts or omissions of any CTV; or any other catastrophe or other occurrence which is beyond the reasonable control of SFA.

To the extent that SFA's liability is engaged, notwithstanding the exclusions set out above, SFA's liability shall not exceed: 

1. The total amount of fees paid by the Client to SFA in respect of the crypto-asset service during the 12 months preceding the occurrence of the event giving rise to the liability claim; or 

2. solely with respect to the Client's digital assets lost while in custody at Coinbase Prime CBLUX SA, the value, at the time of the liability event, of the digital assets lost at the time the liability event occurred. Such value shall be determined by reference to the prices of the relevant digital assets, as established by transactions executed on a trading platform registered and regulated by the CCSF. 

Notwithstanding any assets lost in custody at Coinbase Prime CBLUX SA, SFA shall in no event be liable for losses of digital assets where the loss arises as a result of incidents not attributable to SFA, which for the purposes of this agreement includes, without limitation, any event occurring independently of the provision of crypto-asset services to clients or independently of SFA's operations, including (without limitation): 

1. Any issue inherent in the operation of any distributed ledger underlying any digital asset; 

2. Security breaches affecting SFA that occur notwithstanding SFA's compliance with its security obligations under this agreement; 

3. Any choice made by the Client not to use the account security features offered or recommended by SFA, or the Client's choice not to follow SFA's reasonable instructions regarding account security and the mitigation of potential losses; 

4. Losses directly attributable to the Client's fraud or gross negligence, or to any vulnerability affecting the login credentials of the custody account not caused by any fault of SFA; 

5. The failure to follow or act upon any instructions, notices or alerts that SFA may send to the Client regarding the security of digital assets. 

6. Any transfer request submitted through your SFA account that you did not authorize; 7. Any incorrect transfer request that you initiated; 

The general list of SFA’s liability exclusions does not preclude SFA’s primary liability for losses directly attributable to Coinbase. 

For the avoidance of doubt, where losses are directly attributable to SFA and are not excluded above, SFA's liability shall be limited to the portion of the loss that is directly attributable to SFA.

Where losses are directly attributable to Coinbase Prime, SFA's liability is first and foremost with respect to the customer. SFA will exercise its subrogation title recourse against Coinbase under the contract between Shares Financial Asset and Coinbase Prime.

This liability is capped at the market value, at the time the loss occurs, of the lost Crypto-assets. 

Operational process in case of failure of the sub-custodian

This protocol describes the steps to be followed in the event of a failure of Coinbase Prime CBLUX SA as sub-custodian, in order to ensure service continuity and the protection of client assets under the best possible conditions.

Important notice 

This operational protocol is subject to adjustment depending on the nature, criticity and timing of the subdepository's default, prevailing market conditions at the time of the default, response timelines from the guardianship authorities, and the operational availability of the 

replacement PSCA (Coinhouse). Any substantive amendment to the protocol will be subject to prior validation by the Executive Committee and the Oversight Board. The customer will be informed by mail of developments until the final refund at a minimum on a weekly basis. 

To date, no agreement has been concluded with Coinhouse. The implementation of the 

migration therefore remains subject to the prior completion of contractual negotiations with that entity. Accordingly, the 20-day timeframe provided for the switchover should be regarded as an indicative target, conditional upon the conclusion of an agreement with Coinhouse and subject to adjustment depending on the progress of negotiations. 

Important notice 

This operational protocol is subject to adjustment depending on the decisions of the competent jurisdictions, the relevant authorities and, where applicable, any court-appointed administrators or liquidators, in accordance with the specific circumstances of the relevant proceedings. The customer will be informed by mail of developments until the final refund at a minimum on a weekly basis.

‍Custody agreement‍

Shares Financial Assets will enter into agreements with clients in relation to the custody services it provides (any such agreement, General Services Conditions) which will typically disclose details of the basis on which custodial services are provided as follow :