Wyoming Stable Token Commission

Token

Chapter 2: Cryptographic Asset Management

Effective Date: 01/14/2026 to Current

Rule Type: Current Rules & Regulations

Reference Number: 091.0004.2.01142026

Chapter 2

Cryptographic Asset Management

Section 1. Authority. These rules are adopted to implement the Commission's authority granted by W.S. 40-31-105(b)-(c).

Section 2. Cryptographic Key and Seed Generation and Storage.

(a) The Director or Commission Staff shall:

(i) Generate all cryptographic keys and seeds using cryptographically secure industry standards;

(ii) Generate Multi-Signature or Multi-Party-Computation wallets requiring multiple signers for authorizing transactions, for which the Director or Commission Staff shall establish a key signing ceremony process for generating and distributing multiple keys;

(iii) Maintain a redundant key for recovery purposes in case of primary key loss or compromise;

(iv) Maintain a secure facility or facilities or engage third-party vendors to securely store recovery keys, seeds, storage media, and hardware devices;

(v) Develop procedures pertaining to the custody, transfer, and management of cryptographic keys; and

(vi) Perform periodic key rotation to ensure access is appropriately provisioned amongst signers and removed as necessary and appropriate.

Section 3. Cryptographic Key Usage.

(a) The Director or Commission Staff shall:

(i) Create an internal training program for Key Holders;

(ii) Create an agreement for Key Holders specifying the terms and conditions of managing keys exerting control over WYST, including the engagement of third-party custodians;

(iii) Procure devices and physical media necessary for storing cryptographic keys; and

(iv) Define key signing ceremony procedures and determine key signing thresholds for authorizing minting, burning, token transfers, compliance actions, and smart contract updates or changes.

Section 4. Incident Response Authority.

(a) The Director or Commission Staff shall: (i) Create an incident response plan and a disaster recovery plan; (ii) Be authorized to suspend all smart contract operations during an incident response or disaster, as defined in said policy or plan; and (iii) Be authorized to engage vendors for the purposes of incident response.