Custody risk is the possibility that an owner of securities, cash or digital assets will lose some or all of them, or lose access to them for a time, because of a problem at the institution holding them. The cause may be the custodian's or sub-custodian's insolvency, negligence, misuse of assets, fraud, a legal defect in how the holding is recorded, or an operational failure. Investors, asset managers, central counterparties and payment systems that keep assets with custodians all face it.
Custody risk is a mix of credit, legal and operational elements, and is usually classed under operational risk. It is separate from the market risk of the assets themselves: a bond can keep its value while the investor still cannot reach it because its custodian has failed. A custody service exists to hold assets safely, so custody risk is in effect the risk that this service does not work as promised.
Custody risk in plain terms
Leaving valuables in a hotel safe is usually sensible, but it relies on the hotel. If the hotel goes bankrupt, the safe might be locked by administrators for weeks. If a staff member has a spare key, the valuables could disappear. If the hotel's records mix up two guests' boxes, sorting out who owns what could take time.
Custody risk is the risk of those things happening to a bank or broker that holds your shares or money. The assets may still be yours in law, but getting them back can be slow, costly or, in the worst cases, incomplete.
Sources of custody risk
- Insolvency of the custodian. If assets are not clearly separated, creditors of the failed custodian may claim them, or their return may be delayed by insolvency proceedings.
- Poor record-keeping. Errors in the custodian's book-entry records, or gaps between its records and those of the central securities depository, can leave shortfalls.
- Commingling and misuse. Using client assets for the custodian's own purposes, or failing to keep them apart from its own, exposes clients to the custodian's losses.
- Fraud and theft. Insiders or outside attackers may divert assets or forge instructions.
- Sub-custody chains. Assets held through several layers of intermediaries, often across borders, add risk at each link, including foreign legal risk.
Safeguards
The main protection is segregation. Client assets are recorded separately from the custodian's own assets, in either an omnibus account for many clients or a segregated account for one, so that they fall outside the custodian's estate in insolvency. Other safeguards include frequent account reconciliation of client holdings against the depository's records, strong internal controls, independent audits, insurance, and clear contracts that set out liability and limits on any reuse of assets, such as collateral rehypothecation.
Regulation reinforces these controls. Securities and investment fund rules in most major markets require client assets to be held by qualified custodians and kept separate, and fund rules often require an independent depositary or fund custodian that oversees the manager.
Custody risk for financial market infrastructures
Principle 16 of the Principles for Financial Market Infrastructures addresses custody and investment risks. It says an FMI should hold its own and its participants' assets at supervised and regulated entities with robust accounting practices, safekeeping procedures and internal controls, and should have prompt access to those assets when needed. A central counterparty that holds members' initial margin with custodians must be able to reach that collateral quickly in a default, or its default management plan will fail.
Examples
The failure of the US broker MF Global in 2011 revealed a large shortfall in customer funds that should have been segregated, and customers waited a long time for full recovery. The collapse of the crypto exchange FTX in 2022 showed how severe custody risk becomes when customer assets are commingled with the firm's own and used for other purposes. Both cases prompted closer attention to segregation, reconciliation and independent oversight, including for digital asset custodians.
Managing custody risk as a client
Institutional investors assess custodians through due diligence on financial strength, controls and legal structure, review sub-custodian networks, and obtain legal advice on asset protection in each market. They also monitor service quality and insist on regular, detailed statements. Spreading assets across custodians reduces concentration, though at a cost in complexity and fees.