Crypto custody explained: qualified custodians, MPC and what to ask
The three custody models institutions use, how the 2025 withdrawal of SAB 121 and the OCC letter opened the door to banks, and the due diligence questions that decide whether assets are safe.
Key takeaways
- Crypto custody is the safekeeping of the private keys that control assets on a blockchain. Whoever holds the keys holds the asset; there is no central registry to appeal to if they are lost or stolen.
- Institutions choose between qualified third-party custodians, self-custody using multi-party computation or hardware security modules, and hybrid models where the client and custodian each hold part of the key.
- US policy shifted decisively in 2025: the SEC withdrew SAB 121, which had kept banks out of custody, and the OCC confirmed national banks can custody crypto, so the largest traditional custodians are now entering the market.
- The questions that matter are segregation of client assets, bankruptcy remoteness, insurance, key management and the operational controls around who can approve a transfer.
Every crypto asset is controlled by a private key: a string of data that authorizes transactions from an address. Custody is the discipline of protecting those keys so that the asset cannot be stolen, lost or moved without proper authorization, while still being able to use it when needed. It is the single most important operational decision an institution makes before touching digital assets, because a mistake is irreversible in a way that has no equivalent in traditional finance. There is no chargeback, no transfer agent to reissue shares, and no central bank to freeze a wire.
The three models
Third-party custody
A regulated custodian holds the keys on the client’s behalf. Coinbase Custody, BitGo, Anchorage Digital (a federally chartered bank), Fidelity Digital Assets and Gemini are the largest specialist providers, and since 2025 traditional custodians such as BNY, State Street and Standard Chartered have launched or expanded their own offerings. The client gets a familiar relationship: a custody agreement, an account, reporting, insurance and a regulator to complain to. Under the SEC’s custody rule for investment advisers, client assets must generally be held with a qualified custodian, which in practice means a bank, a trust company or a registered broker-dealer, and that requirement is what drove the early growth of state-chartered trust companies in New York, South Dakota and Wyoming.
Self-custody
The institution holds its own keys, usually with technology that avoids a single point of failure. Multi-party computation (MPC) splits a key into shares held by different people or systems so that no single party can sign alone and the full key never exists in one place. Hardware security modules keep key material inside tamper-resistant devices. Multi-signature wallets require several independent approvals on-chain. Fireblocks, Copper and similar platforms package this into wallet infrastructure with policy engines that enforce who can move what, to where, above what amount. Self-custody removes counterparty risk to a custodian and replaces it with operational risk that the institution now owns.
Hybrid and delegated models
Most institutional setups land in between. A common structure has the client holding some MPC shares and the custodian holding others, so neither can act alone; another separates cold storage for long-term holdings, where keys are kept fully offline and withdrawals take hours by design, from hot or warm wallets for trading. Exchange custody, where assets sit on a trading venue, is the model that failed catastrophically at FTX in 2022 and is now generally avoided for anything beyond working balances; the industry response was the growth of off-exchange settlement, where assets stay with a custodian and are mirrored to the exchange for trading.
What changed in 2025
For three years the largest obstacle to bank custody in the US was an accounting bulletin. SEC Staff Accounting Bulletin 121, issued in 2022, required firms that custodied crypto to record the assets as liabilities on their own balance sheet, which for a bank meant capital charges that made the business uneconomic. The SEC rescinded it in January 2025 with SAB 122. Two months later the Office of the Comptroller of the Currency issued Interpretive Letter 1183 confirming that national banks may provide crypto custody and related services without seeking prior approval, and the FDIC and Federal Reserve withdrew their own guidance that had required advance notice. The effect was to take custody from a specialist business to a line item at every large trust bank, and the entrants have been arriving since.
Due diligence that actually matters
The custody agreement is where the important terms live. Segregation: are client assets held in separate on-chain addresses, or pooled in omnibus wallets with only the custodian’s ledger distinguishing them? Bankruptcy remoteness: are client assets legally the client’s property, held in trust, so that they are not part of the custodian’s estate if it fails? The Celsius and FTX bankruptcies turned on exactly this question. Insurance: what is covered, for how much, and does it include theft from cold storage, hot wallet compromise, and insider theft, or only some of those? Key ceremony and recovery: how were keys generated, who witnessed it, and how are they recovered if a device or a person is lost? Transaction policy: who can initiate, who must approve, what whitelists apply, and is there a time delay on large withdrawals? Regulatory status: which regulator examines the custodian, and are its SOC 1 and SOC 2 reports current?
Two practical points round it out. Staking, governance voting and airdrop handling all require the custodian to do something with the asset beyond holding it, and the agreement should say who bears the risk when a validator is slashed or a fork produces a new token. And the ability to move quickly matters: a custodian that takes 48 hours to release funds is safe until the day a position needs to be closed in 48 minutes.
Why this is the foundation
Every other institutional product depends on custody being solved. Spot ETFs exist because a regulated custodian holds the coins. Tokenized funds rely on a transfer agent controlling a whitelist of custodied wallets. Prime brokerage, lending and derivatives clearing all start with an answer to the question of where the assets sit and who can move them. Getting that answer right, and reviewing it as the custodian and the regulation change, is the unglamorous work that separates institutions that had a bad year in 2022 from those that did not.
Frequently asked questions
What is a qualified custodian for crypto?
Under the SEC custody rule for investment advisers, a qualified custodian is a bank, a registered broker-dealer, a futures commission merchant or certain foreign institutions. In crypto that has meant state-chartered trust companies such as Coinbase Custody Trust and BitGo Trust, federally chartered banks such as Anchorage Digital, and since 2025 the large traditional custodian banks.
What is MPC custody?
Multi-party computation splits a private key into shares held by different parties or systems, so that transactions are signed cooperatively and the complete key never exists in one place. It removes the single point of failure of a traditional key without requiring on-chain multisig.
What was SAB 121 and why did it matter?
SEC Staff Accounting Bulletin 121, issued in 2022, required firms custodying crypto to record the assets as liabilities on their own balance sheet, which imposed capital costs that kept banks out of the business. It was rescinded in January 2025.
Are custodied assets protected if the custodian goes bankrupt?
Only if the custody agreement and applicable law make the assets client property held in trust, segregated from the custodian estate. The Celsius and FTX bankruptcies showed that assets held under terms treating them as the platform own were not protected. This is the first term to check in any agreement.
This explainer is reviewed and updated as the rules and the market change. Last reviewed September 29, 2026. It is educational content and not financial, legal or tax advice.