Institutional Crypto Custody

Institutional crypto custody is the holding and safeguarding of crypto-assets on behalf of professional clients, such as asset managers, exchange-traded funds, hedge funds, banks, corporations and pension funds, by a specialised and usually regulated provider. Because ownership of a crypto-asset is exercised through a private key, custody means generating, storing and using keys in a way that prevents theft, loss and unauthorised transfer, while keeping client assets legally separate from the custodian's own.

It is the professional end of digital asset custody. Retail users often leave coins with an exchange or hold their own keys; institutions are generally required by regulation, fund rules or their own governance to use an independent digital asset custodian with audited controls, insurance and a clear legal structure. The collapse of several exchanges that mixed client and house assets, most prominently FTX in November 2022, increased demand for this separation.

A transaction on a blockchain cannot be reversed, and whoever holds the key controls the asset. Custodians therefore combine several techniques.

• Cold storage. Keys are generated and kept on devices that are never connected to the internet, often in geographically separate vaults, as described under cold storage of keys. Most client assets are held this way.
• Hardware security modules. Keys are stored inside a tamper-resistant hardware security module that signs transactions without revealing the key.
• Multi-signature. A transfer requires signatures from several independent keys, a method described under multi-signature.
• Multi-party computation. The key is never assembled in one place; several parties each hold a share and jointly produce a signature. This is covered under multi-party computation custody.

A smaller share of assets is kept in a hot wallet connected to the network, so that withdrawals and trades can be met quickly. The balance between security and speed of access is a central design choice.

Technology is only part of the service. Institutional custodians apply the same disciplines as securities custodians: separation of duties, approval by several authorised people for each withdrawal, address whitelists so that assets can be sent only to pre-approved destinations, limits by amount and time, and time delays for large transfers. These rules are set out under wallet governance. Client assets are held in segregated wallets or recorded in segregated accounts, and holdings on the blockchain are reconciled to internal records through digital asset reconciliation.

Custodians obtain independent assurance reports on their controls, carry insurance against theft, though usually for a fraction of assets held, and maintain procedures for key backup and disaster recovery. They screen deposits and withdrawals for links to sanctioned or illicit addresses. Network events need policies of their own: a custodian must decide how it handles a chain split, covered under digital asset fork management, and whether clients may earn rewards through staking from custody.

Three groups compete. Crypto-native firms, some holding trust company charters, built the first services and often act as custodian for exchange-traded products. Traditional custodian banks have entered the market, offering digital assets beside securities so that clients have one provider. Technology vendors supply wallet infrastructure to banks and brokers that prefer to run custody themselves. Prime brokers and exchanges also offer custody, though institutional clients often prefer a custodian that is independent of the trading venue. Some clients hold assets with a third-party custodian and mirror balances to an exchange for trading, so that assets leave custody only to settle.

Rules have developed quickly. In the European Union, the Markets in Crypto-Assets Regulation, which has applied to service providers since the end of 2024, makes custody and administration of crypto-assets a licensed service. Providers must segregate client holdings, keep a register of positions, have a custody policy, and are liable for losses of assets or keys resulting from incidents attributable to them. In the United States, custodians operate under state trust charters, the New York virtual currency regime or national bank powers, and investment advisers must consider whether a provider meets the definition of a qualified custodian. Accounting guidance issued by the staff of the Securities and Exchange Commission in 2022, which had required custodians to record client crypto-assets on their own balance sheets, was withdrawn in January 2025, removing an obstacle for banks. The approval of spot bitcoin exchange-traded funds in the United States in January 2024 made custody arrangements a matter of public disclosure for mainstream products.

Other centres, including Switzerland, Singapore, Hong Kong and Dubai, license custody under their own digital asset regimes. Common themes are segregation, capital, technology risk management and clarity on what happens to client assets if the custodian fails.

Custody risk in crypto has features that securities custody lacks. Theft is final. Loss of key material means permanent loss of the asset. Insider collusion and attacks on the signing process have caused large losses even at well-resourced firms. Legal uncertainty remains in some jurisdictions over whether client assets are protected from the custodian's creditors, a question tested in recent insolvencies. Concentration is a further concern, since a small number of custodians hold the assets backing many funds. A proof of reserves attestation can show that assets exist on-chain but does not by itself establish the custodian's liabilities or the quality of its controls.