Sources

Last reviewed 2 Oct 2026 by Akriti Seth. Originally published 2 Oct 2026.

Key takeaways

  • A crypto custodian is a company that holds the private keys to digital assets on behalf of someone else, such as a fund, an adviser or an individual.
  • Custodians range from banks and specialist trust companies to exchanges; the alternative is self-custody, where you hold your own keys.
  • The main risks are a custodian failing or mixing client coins with its own, and, in self-custody, losing or leaking your keys.

A crypto custodian is a company that safeguards digital assets for clients by controlling the private keys that move them. Because whoever holds the keys can spend the coins, choosing a crypto custodian is really a decision about who you trust with that power, under which rules, and what happens if something goes wrong.

Here’s how crypto custody works, who offers it, how the rules differ in the US and the EU, and what to watch out for.

How does crypto custody work?

Bitcoin, ether and other tokens never leave their blockchain. What you “own” is control over an address on that blockchain, and control comes from a private key, a long secret number that signs transactions. Lose the key and the coins are stuck. Leak it and someone else can move them.

A custodian’s job is to keep those keys safe and to sign only the transactions its client has approved. In practice that involves three layers:

  1. Key storage. Most institutional custodians keep the bulk of assets in “cold” storage, meaning keys are generated and kept on devices that never touch the internet. A smaller “hot” balance sits in internet-connected systems for day-to-day withdrawals.
  2. Signing controls. Many custodians split signing power so no single person or machine can move funds alone. Two common approaches are multisignature wallets, which need several separate keys to approve a transfer, and multi-party computation (MPC), which splits one key into shares held in different places.
  3. Records and segregation. The custodian keeps books showing which client owns what, and ideally holds each client’s assets in separate on-chain addresses or clearly separated accounts, so they can be returned if the custodian goes bust.

Who are crypto custodians?

There is no single type of crypto custodian. The main groups are:

  • Banks and national trust banks. In the US, the Office of the Comptroller of the Currency (OCC) said in Interpretive Letter 1170 in July 2020 that national banks may provide crypto custody, including by holding customers’ keys. It has since granted national trust bank charters, some of them conditional, to several crypto firms; Anchorage Digital was the first, in January 2021.
  • State-chartered trust companies. Many US crypto custodians are limited-purpose trust companies licensed by a state banking regulator, such as New York or South Dakota.
  • Exchanges and brokers. If you buy crypto on an exchange and leave it there, the exchange controls the keys. Some run separate regulated custody arms for institutions.
  • Specialist custody-technology providers. These sell the software and hardware that let other institutions run custody themselves.
  • You. Self-custody means you hold your own keys in a software or hardware wallet, backed up by a seed phrase.

What is a qualified custodian, and what did the SEC just propose?

In the US, registered investment advisers that hold client assets must generally use a “qualified custodian”, a legal category that includes banks, certain trust companies and registered broker-dealers. For years, advisers said it was unclear which firms could legally hold crypto under that rule.

On 1 Oct 2026, the Securities and Exchange Commission (SEC) proposed new custody rules for advisers and regulated funds that address crypto directly. According to the proposal and statements from Chairman Paul Atkins and Commissioners Mark Uyeda and Hester Peirce, it would:

  • allow state-chartered trust companies to act as permitted crypto custodians, provided the adviser or fund has a reasonable basis, before hiring one and annually after that, to believe the trust company is authorised by its state banking regulator to hold crypto and has written policies designed to safeguard it;
  • let advisers hold client crypto themselves, which the proposal calls “self-custody”, but only after determining that no permitted custodian is available for that asset, and re-checking that every quarter. Peirce noted that this is not the same as investors holding their own keys;
  • modernise the wider custody rules, which Atkins described as “crafted for a bygone era”.

The SEC will take comments for 60 days after the proposal is published in the Federal Register. It is a proposal, not a final rule. CryptoWatchDesk covers the details in the SEC’s crypto custody proposal.

How can you tell a custodian really holds the assets?

Because crypto lives on public blockchains, custody can in principle be checked in ways a bank vault cannot. Three tools come up most often:

  • Audits and control reports. Regulated custodians are typically audited, and many publish independent reports on their internal controls. These test processes, not individual coins.
  • Proof of reserves. Some firms publish the blockchain addresses they control, or a cryptographic snapshot of balances, so anyone can check the assets exist. On its own this shows assets, not liabilities, so it can’t prove a firm is solvent.
  • Segregated addresses. When each client’s coins sit in their own on-chain address, the client can see the balance directly on a block explorer.

None of these is a guarantee. Together, they make it much harder to hide a shortfall.

How is custody regulated in the EU?

Under MiCA, the EU’s Markets in Crypto-Assets Regulation, “custody and administration of crypto-assets on behalf of clients” is a licensed crypto-asset service. A firm offering it to EU clients needs authorisation as a crypto-asset service provider (CASP), must keep client assets segregated from its own, and must keep a register of each client’s positions. You can check whether a firm is authorised on the interim MiCA register published by ESMA, the EU markets regulator, or on your national regulator’s list.

Custodian vs exchange vs self-custody: how do they compare?

Regulated custodian Exchange account Self-custody wallet
Who holds the keys The custodian The exchange You
Typical users Funds, advisers, companies Traders, beginners Individuals comfortable managing keys
Main protection Licence, audits, segregation rules Exchange’s licence and terms Your own security habits
Main risk Custodian failure or operational error Exchange insolvency, hacks, frozen withdrawals Lost or stolen keys, phishing
Recovery if you lose a password Usually yes, through identity checks Usually yes No, unless you kept your seed phrase
Cost Custody fees, often a % of assets Often bundled into trading fees Price of a hardware wallet, if used

Risks and criticisms

  • Commingling. If a custodian mixes client coins with its own, clients can end up as unsecured creditors when it fails. Segregation rules exist to stop this, but they only work if they are followed and audited.
  • Concentration. A handful of large custodians hold coins for many of the biggest funds, including spot bitcoin ETFs. An outage or failure at one could affect many products at once (see what a spot bitcoin ETF is).
  • Regulatory arbitrage. Community banks have long argued that national trust charters let crypto firms enter the banking system without the deposit insurance, capital and community-lending duties that apply to ordinary banks. Supporters say trust charters are designed for safekeeping, not lending.
  • Self-custody is unforgiving. There is no help desk for a lost seed phrase.

How to use a custodian or wallet safely

  1. Check the licence. In the EU, search the ESMA interim MiCA register; in the US, check the state or federal charter the firm claims.
  2. Read how assets are held. Look for wording on segregation and on what happens to client assets in insolvency.
  3. Test with a small amount before moving a large balance.
  4. Turn on two-factor authentication and withdrawal address allow-lists.
  5. If you self-custody, write your seed phrase on paper or metal, store it offline, and never type it into a website or share it with anyone.

Common mistakes

  • Assuming an exchange balance is “your wallet”. It is a claim on the exchange.
  • Storing a seed phrase as a photo or in cloud notes.
  • Choosing a custodian on fees alone without checking its licence and audits.
  • Sending a test transaction to an address copied from a chat message rather than from the official app.

Frequently asked questions

What does a crypto custodian actually hold?
The private keys. The coins stay on the blockchain; whoever controls the keys can move them.

Is a crypto exchange a custodian?
If you leave coins there, it is acting as one. Your protection depends on its licence, terms and whether it segregates client assets.

What is a qualified custodian?
A US term for firms such as banks and certain trust companies that registered investment advisers must generally use. The SEC proposed on 1 Oct 2026 how this applies to crypto.

Is self-custody safer?
Not automatically. It removes company-failure risk but puts key-management risk entirely on you.

Related: how in-kind ETF redemptions work.

This article was written by Begoña Iriondo, an AI author persona at CryptoWatchDesk, and was reviewed, fact-checked and edited by Akriti Seth. It is not investment advice. Begoña Iriondo holds no crypto assets.