Crypto custody explained: qualified custodians, MPC, the 2026 SEC proposal and what to ask

Who this is for: Registered investment advisers, fund operations teams, treasurers and founders who need to choose or review a crypto custodian, and who want to understand what the October 2026 SEC proposal and the new wave of OCC-chartered custodians change for that decision.

Every crypto asset is controlled by a private key: a string of data that authorizes transactions from an address. Custody is the discipline of protecting those keys so that the asset cannot be stolen, lost or moved without proper authorization, while still being able to use it when needed. It is the single most important operational decision an institution makes before touching digital assets, because a mistake is irreversible in a way that has no equivalent in traditional finance. There is no chargeback, no transfer agent to reissue shares, and no central bank to freeze a wire.

The subject has moved quickly. In 2022 the main obstacle to institutional custody in the United States was an accounting bulletin that kept banks out. By late 2025 the Office of the Comptroller of the Currency was approving crypto-native trust companies to become national banks, and on October 1 2026 the SEC voted to propose the first custody rules written with crypto assets in mind, including a conditional path for advisers to hold client keys themselves. At the same time the largest theft in the industry’s history, the $1.5 billion Bybit compromise of February 2025, rewrote the threat model for every custodian and every client that signs transactions through a web interface.

This guide explains the three custody models, what changed in US regulation between January 2025 and October 2026, what Bybit teaches, who the qualified custodians now are, how crime insurance actually works, and the due diligence that matters. It closes with a worked example: a registered investment adviser pricing a $50 million mandate across two custodians.

Crypto custody by the numbers

The three custody models

Third-party custody

A regulated custodian holds the keys on the client’s behalf. Coinbase Custody Trust Company, BitGo, Anchorage Digital, Fidelity Digital Assets and Paxos are the largest specialist providers, and since 2025 traditional custodians such as BNY, State Street and Standard Chartered have launched or expanded their own offerings. The client gets a familiar relationship: a custody agreement, an account, reporting, insurance and a regulator to complain to. Under the SEC’s custody rule for investment advisers, client assets must generally be held with a qualified custodian, which today means a bank or savings association, a registered broker-dealer, a registered futures commission merchant or certain foreign financial institutions. That definition is why the early growth of crypto custody ran through state-chartered trust companies in New York, South Dakota and Wyoming, which could argue they were banks for the purpose of the rule, and why so many of those trust companies spent 2025 and 2026 converting to federal charters.

The custodian charges an annual fee as a percentage of assets under custody, often with a minimum, plus per-withdrawal charges and a share of rewards if it stakes on the client’s behalf. Its own costs are security engineering, insurance premiums, audits and compliance staff, which is why scale matters and why the market has consolidated around a handful of names.

Self-custody

The institution holds its own keys, usually with technology that avoids a single point of failure. Multi-party computation (MPC) splits a key into shares held by different people or systems so that no single party can sign alone and the full key never exists in one place. Hardware security modules keep key material inside tamper-resistant devices. Multi-signature wallets require several independent approvals on-chain. Fireblocks, Copper and similar platforms package this into wallet infrastructure with policy engines that enforce who can move what, to where, above what amount. Self-custody removes counterparty risk to a custodian and replaces it with operational risk that the institution now owns. For a primer on the wallet side, including seed phrases, hardware wallets and the difference between custodial and non-custodial apps, see crypto wallets and self-custody explained.

For a registered adviser, self-custody of client assets has until now been close to impossible to square with the custody rule, which is why the October 2026 SEC proposal matters. It would allow an adviser to maintain client crypto itself, but only after determining in writing, and re-checking every quarter, that no permitted custodian is available for that asset, and only if it meets a list of conditions discussed below. Commissioner Hester Peirce, in her October 1 2026 statement, pointed out that this is really adviser custody rather than investor self-custody, and added that “Regulators should zealously protect investors’ right to self-custody.”

Hybrid and delegated models

Most institutional setups land in between. A common structure has the client holding some MPC shares and the custodian holding others, so neither can act alone; another separates cold storage for long-term holdings, where keys are kept fully offline and withdrawals take hours by design, from hot or warm wallets for trading. Exchange custody, where assets sit on a trading venue, is the model that failed catastrophically at FTX in November 2022 and is now generally avoided for anything beyond working balances. The industry response was off-exchange settlement, where assets stay with a custodian and are mirrored to the exchange for trading, and the related growth of prime brokerage, which is covered in crypto prime brokerage explained.

What changed in US regulation, 2025 to 2026

SAB 121 and its rescission

For three years the largest obstacle to bank custody in the US was an accounting bulletin. SEC Staff Accounting Bulletin 121, issued in March 2022, required firms that custodied crypto to record the assets as liabilities on their own balance sheet, which for a bank meant capital charges that made the business uneconomic. The SEC rescinded it with SAB 122, published on January 23 2025 and effective January 30 2025. SAB 122 tells custodians to treat the risk of loss under a safeguarding obligation as a contingency under FASB ASC 450-20, which is how banks already account for other obligations, and to keep disclosing the obligation in risk factors. The balance sheet gross-up disappeared.

The bank regulators step back

On March 7 2025 the OCC issued Interpretive Letter 1183, confirming that national banks and federal savings associations may provide crypto-asset custody, hold stablecoin reserves and participate in node verification networks, and removing the earlier requirement to obtain supervisory non-objection before starting. The Federal Reserve withdrew its own crypto-asset and dollar-token guidance for banks on April 24 2025, and on August 15 2025 announced it would sunset the novel activities supervision program it had created for crypto and fintech, returning those activities to normal supervision. The effect was to take custody from a specialist business to a line item at every large trust bank.

Federal charters for the crypto natives

The second-order effect was that crypto-native trust companies, which had been chartered by New York, South Dakota or Wyoming, applied to become national trust banks regulated by the OCC. Anchorage Digital Bank had been the first and only one since January 2021. On December 12 2025 the OCC approved BitGo Trust Company’s conversion to BitGo Bank & Trust, National Association, and the same day approved Paxos Trust Company’s conversion from its 2015 New York limited purpose trust charter to a national trust charter. Fidelity Digital Assets now operates custody through Fidelity Digital Assets, N.A., a national trust bank. On April 2 2026 Coinbase announced conditional OCC approval to charter Coinbase National Trust Company, which it said would provide custody and market infrastructure services but would not take retail deposits or engage in fractional reserve banking; Coinbase’s existing New York trust company and BitLicense remain in place alongside it.

A national trust charter does three things for a custodian. It gives a single federal regulator in place of a patchwork of state licences, it removes the argument about whether a state trust company counts as a bank under the SEC custody rule, and it opens the possibility of direct access to Federal Reserve payment rails. On that last point, the Federal Reserve requested comment on December 19 2025 on a new payment account that eligible institutions could use solely for clearing and settling payments, with no interest, no access to Fed credit and balance caps; the comment period ran 45 days from Federal Register publication on December 23 2025.

The SEC’s September 2025 no-action letter and the October 2026 proposal

While the bank side opened up, advisers were still working under a 2009 custody rule written for securities. The SEC’s 2023 safeguarding proposal, which would have expanded that rule to all client assets, was widely read as making compliant crypto custody impossible. The staff of the Division of Investment Management issued a no-action letter on September 30 2025 saying it would not recommend enforcement against advisers or funds that treated a state trust company as a bank for custody of crypto assets and related cash, under certain conditions. That gave comfort but, as the SEC itself notes in the 2026 proposing release, a staff letter has no legal force and does not change the law.

On October 1 2026 the Commission proposed amendments to the adviser custody rule (Rule 206(4)-2) and the Investment Company Act custody rules, published as Release IA-7023 with a 60-day comment period from Federal Register publication. The proposal would do four things for crypto. First, it would permit state trust companies to act as custodians for client and regulated fund crypto assets if the adviser has a reasonable basis, checked initially and annually, to believe the trust company is authorised by its state banking regulator for crypto custody and maintains written safeguarding policies, and if the adviser receives and reviews the trust company’s audited financial statements and internal control report each year, with client assets segregated from the trust company’s own. Second, it would allow adviser self-custody of crypto assets when a permitted custodian is not available, subject to the conditions in the next section. Third, it would modernise the broader custody rule, including changes to audit requirements and exceptions for inadvertent custody and standing letters of authorization. Fourth, it would let regulated funds self-custody crypto through their adviser with board oversight, or use state trust companies under comparable conditions. Chairman Paul Atkins framed the gap plainly in the release: “our rules and regulations have not kept pace.” For the broader map of which agency regulates what, see SEC vs CFTC crypto regulation.

What the self-custody conditions actually require

The proposal’s adviser self-custody path is narrow and is worth reading as a checklist of what the SEC thinks good custody looks like, because it is also a reasonable standard to hold third-party custodians to. Under the proposal an adviser holding client crypto itself would need to:

1. Determine in writing, and re-determine at least quarterly, that no permitted custodian is available to maintain the specific crypto asset.
2. Have and document expertise in safeguarding each asset, and maintain systems that protect it against loss, theft, misuse and misappropriation.
3. Operate private key management with joint authorization of every transaction by at least two people, and hold each client’s assets in one or more addresses segregated from other clients and from the adviser.
4. Mitigate cybersecurity risk and review cybersecurity controls and their effectiveness at least annually.
5. Obtain an internal control report within six months of first holding client crypto and annually thereafter.
6. Send account statements at least quarterly that identify the addresses, amounts and transactions, and encourage clients to compare them against on-chain balances.
7. Agree with the client in writing to treat each self-custodied crypto asset as a financial asset under state law, which brings the commercial law of Article 8 of the Uniform Commercial Code into play on ownership and priority.

The proposal also clarifies that receiving an airdropped token into a self-custodied address would not itself breach the custody rules. Two-person authorization, segregated addresses, annual control reports and client-visible statements are the same four things a diligent client should demand from any third-party custodian, and Bybit shows why the first is not sufficient on its own.

Lessons from Bybit: when the multisig signs the wrong thing

On February 21 2025 Bybit, a Dubai-based exchange, lost roughly 401,000 ETH, about $1.5 billion at the time, during what should have been a routine transfer from its Ethereum cold wallet to a warm wallet. The FBI attributed the theft on February 26 2025 to North Korean actors it tracks as TraderTraitor and asked exchanges, node operators and analytics firms to block more than 50 identified addresses. Chainalysis later estimated North Korean groups stole $2.02 billion across 2025, a 51% increase on 2024, bringing their cumulative haul to $6.75 billion.

The mechanics are the lesson. Bybit’s cold wallet was a Safe multisig contract, which is sound technology. The attackers did not break the contract or steal the signers’ keys. According to Chainalysis, they compromised a Safe developer’s machine and injected malicious JavaScript into the Safe web interface served specifically to Bybit, so that the signers saw a legitimate transfer on screen while approving a transaction that handed control of the wallet to the attacker. Three things followed from that: the signers were doing their jobs, the hardware wallets did exactly what they were asked, and the funds left anyway. Bybit offered a bounty of up to 10% of recovered funds; Chainalysis reported more than $40 million frozen. The remainder was laundered through intermediary wallets, swaps into bitcoin and DAI, cross-chain bridges and no-KYC swap services, with a portion left deliberately dormant to outlast the scrutiny.

For custody buyers the implications are concrete. First, signing has to be verifiable independently of the interface that proposes the transaction: the signer should be able to decode what is being signed on a device the web page cannot influence, and policies that forbid implementation changes or arbitrary contract calls should be enforced at the signing layer, not only in a dashboard. Second, supply chain risk is custody risk. A custodian that depends on a third-party front end, browser extension or build pipeline inherits that vendor’s security posture, and a due diligence questionnaire should ask who can push code to the interfaces the signers use. Third, large cold-to-warm movements deserve friction: time locks, out-of-band confirmation, simulation of the transaction’s effect, and address whitelists that would have rejected an unknown destination. Finally, the incident shifted theft toward services and away from individuals; Chainalysis found personal wallet compromises fell to 20% of value stolen in 2025 from 44% in 2024, which is another way of saying attackers followed the money into institutional infrastructure.

The qualified custodian landscape

The US market is now organised around a small group of national trust banks and New York trust companies, with the large traditional custodians building alongside them. The table summarises the main specialist providers and the regulatory facts that matter for a qualified custodian analysis as of October 2026.

Three patterns stand out. The specialist custodians are converging on the same federal charter, which makes them easier to compare and harder to differentiate on regulatory status alone. Public listing adds disclosure: BitGo’s January 2026 IPO means quarterly financial statements and risk factors that private competitors do not publish, a theme explored in crypto IPOs and SEC filings explained. And custodians are expanding into stablecoin issuance, staking, settlement and tokenized deposits, so a custody client is increasingly also a counterparty on other products with the same firm. In Europe the equivalent framework is MiCA, under which BitGo obtained a BaFin licence in May 2025; see what is MiCA.

Insurance: what a $250 million policy does and does not mean

Insurance is the most misunderstood line in a custody pitch. A headline figure such as BitGo’s “up to $250 million” is almost always an aggregate crime or specie policy that covers the custodian’s whole book, not a per-client guarantee. If the custodian holds $50 billion of client assets, a $250 million aggregate limit is half of one percent of the assets at risk, and a single large loss would exhaust it for every client at once. That is not a criticism of the custodian; it is the structure of the specialist insurance market, where capacity is limited and priced to the quality of the custodian’s controls. The point is to read the certificate rather than the headline.

Policies are split by storage temperature. Cold storage is usually covered under a specie policy against physical loss, theft and destruction of key material, including by insiders in collusion. Hot and warm wallets are covered, if at all, under a crime policy with a much smaller limit and specific exclusions, often for losses caused by the client’s own compromised credentials or by a vulnerability in a protocol the custodian does not control. The Bybit pattern, where a signing interface was manipulated, sits in a grey area that a client should ask about directly. Many custodians also offer clients the option to buy a dedicated excess layer that names the client as loss payee; that is the only structure in which a per-client figure means what it appears to mean.

Insurance also does not cover the risks that caused the largest institutional losses of 2022: the custodian’s own insolvency or the commingling of client assets with its estate. Those are legal questions, answered by the custody agreement and by the custodian’s charter, and the next section is where they belong. And no custodian’s assets are covered by FDIC deposit insurance or SIPC, which Anchorage, BitGo and Fidelity each state on their own sites.

Due diligence that actually matters

The custody agreement is where the important terms live. Segregation: are client assets held in separate on-chain addresses, or pooled in omnibus wallets with only the custodian’s ledger distinguishing them? The 2026 SEC proposal would require segregation from the trust company’s proprietary assets as a condition of using a state trust company, and on-chain segregation is the stronger form. Bankruptcy remoteness: are client assets legally the client’s property, held in trust, so that they are not part of the custodian’s estate if it fails? The Celsius and FTX bankruptcies of 2022 turned on exactly this question, and a national trust bank charter helps because trust assets are not bank assets, but the agreement should still say so. Insurance: what is covered, for how much, whether the limit is aggregate or per client, and whether it includes theft from cold storage, hot wallet compromise and insider theft. Key ceremony and recovery: how were keys generated, who witnessed it, how are shares distributed geographically, and how are they recovered if a device or a person is lost? Transaction policy: who can initiate, who must approve, what whitelists apply, is there a time delay on large withdrawals, and can the signer verify the transaction independently of the interface, the Bybit question. Regulatory status: which regulator examines the custodian, when was the last examination, and are its SOC 1 Type II and SOC 2 Type II reports current, with a bridge letter covering the gap since the report date?

Two practical points round it out. Staking, governance voting and airdrop handling all require the custodian to do something with the asset beyond holding it, and the agreement should say who bears the risk when a validator is slashed or a fork produces a new token; the mechanics are covered in what is crypto staking. And the ability to move quickly matters: a custodian that takes 48 hours to release funds is safe until the day a position needs to be closed in 48 minutes. For a view of how banks have been quietly building this infrastructure, see the CCS interview on why banks are building for Web3 in silence.

How we got here: a timeline

Worked example: an RIA pricing a $50 million mandate

How to evaluate a crypto custodian: a checklist

• Is it a qualified custodian today, and under the proposal? A bank, broker-dealer or FCM qualifies now; a state trust company relies on the September 2025 staff letter until the October 2026 proposal is finalised. Know which category you are in and what paperwork it creates for you.
• Are client assets segregated on-chain and legally? Separate addresses per client plus agreement language that assets are held in trust and are not part of the custodian’s estate. Omnibus wallets with ledger-only segregation are a weaker answer.
• What exactly does the insurance cover? Ask for the certificate: aggregate or per client, cold versus hot limits, insider collusion, exclusions, and the ratio of the limit to total assets under custody.
• Can signers verify what they sign independently of the interface? After Bybit this is the central technical question. Look for device-level transaction decoding, policy enforcement at the signing layer, and controls on who can change the front end.
• Who can approve a transfer, and how fast? At least two approvers, address whitelists, time delays on large or new-destination withdrawals, and a documented emergency path that is faster than 48 hours when it has to be.
• Are the SOC 1 and SOC 2 Type II reports current and clean? Twelve-month periods, few exceptions, a bridge letter, and an auditor you recognise. Read the exceptions, not just the opinion.
• How were keys generated and how are they recovered? A witnessed key ceremony, geographically distributed shares, and a tested recovery procedure for a lost device or an unavailable person.
• What happens with staking, forks and airdrops? Who bears slashing risk, who decides on forks, and how new tokens are credited. Check the fee on rewards as part of total cost.
• What else does the custodian do with your assets or your business? Stablecoin issuance, lending, trading and settlement services add counterparty exposure to the same firm. Make sure custody assets cannot be rehypothecated.

Risks and open questions

The first risk is concentration. The qualified custodian market has consolidated around a handful of federally chartered firms, and a single one holds the keys for most US spot crypto ETFs. That makes those firms systemically important in a way their insurance limits, measured in the hundreds of millions against assets measured in the tens or hundreds of billions, do not reflect. A compromise at that scale would be an industry event, not a client event.

The second is that the regulatory framework is proposed, not final. The October 2026 SEC proposal has a 60-day comment period and will be revised before adoption, and its treatment of state trust companies and adviser self-custody could narrow or widen. Advisers relying on the September 2025 staff letter in the meantime are relying on a document the SEC itself describes as having no legal force. The OCC conditional approvals granted to Coinbase and others also carry conditions that must be met before a charter is final.

The third is technical. MPC and multisig remove single points of failure in key storage, but the Bybit incident demonstrated that the signing interface, the build pipeline and the people who can change them are now the softest targets. North Korean groups stole over $2 billion in 2025 by Chainalysis’s count, and their operational patience, including leaving stolen funds dormant for months, suggests they will keep probing institutional infrastructure. Finally, there is an open legal question about how far UCC Article 8 financial asset treatment, which the SEC proposal would require for adviser self-custody, protects a client in the insolvency of an intermediary that is not a bank, a question the courts have not fully tested for crypto assets.

What to watch next

Glossary

Private key

The secret data that authorises transactions from a blockchain address. Whoever controls the key controls the asset.

Qualified custodian

Under the SEC adviser custody rule, a bank or savings association, registered broker-dealer, registered futures commission merchant or certain foreign financial institutions that may hold client assets.

State trust company

A limited purpose trust company chartered by a state banking regulator such as NYDFS or South Dakota. The October 2026 SEC proposal would admit them as crypto custodians under conditions.

National trust bank

A trust company chartered and supervised by the OCC that may hold assets in trust but does not take deposits or make loans. BitGo, Paxos, Anchorage and Fidelity Digital Assets hold or have been approved for this charter.

Multi-party computation (MPC)

Cryptography that splits a key into shares held by different parties, who sign cooperatively so the full key never exists in one place.

Hardware security module (HSM)

A tamper-resistant device that stores key material and performs signing so the key never leaves the hardware.

Multisig

A wallet, usually a smart contract such as Safe, that requires a set number of independent signatures to execute a transaction.

Cold, warm and hot wallets

Keys kept fully offline, keys kept online with strict policies, and keys used for frequent trading, in descending order of security and ascending order of speed.

Blind signing

Approving a transaction without being able to verify its decoded contents on a trusted device; the vulnerability exploited at Bybit in February 2025.

Omnibus versus segregated

Omnibus custody pools many clients’ assets in shared addresses tracked on the custodian’s ledger; segregated custody gives each client distinct on-chain addresses.

Bankruptcy remoteness

The legal position that client assets are held in trust and are not part of the custodian’s estate if it becomes insolvent.

SOC 1 and SOC 2 Type II

Independent auditor reports on a service provider’s controls over financial reporting (SOC 1) and over security and availability (SOC 2), tested over a period rather than at a point in time.

Specie and crime insurance

Specie policies cover physical loss or theft of key material in cold storage; crime policies cover theft from online systems, usually with lower limits and more exclusions.

Off-exchange settlement

An arrangement where assets stay with a custodian and are mirrored to an exchange for trading, so the exchange never holds the keys.

Internal control report

An auditor’s report on a custodian’s safeguarding controls, which the October 2026 SEC proposal would require advisers to obtain and review annually.

Why it matters

Every other institutional product depends on custody being solved. Spot ETFs exist because a regulated custodian holds the coins. Tokenized funds, covered in what is tokenization of real-world assets, rely on a transfer agent controlling a whitelist of custodied wallets. Prime brokerage, lending and derivatives clearing all start with an answer to the question of where the assets sit and who can move them. In 2025 and 2026 the United States finally gave that question a regulatory answer: banks may do this, crypto natives may become banks, and advisers will have a written rule rather than a staff letter. What has not changed is that the answer is only as good as the agreement, the insurance certificate and the signing procedure behind it, and Bybit showed that even a well-designed vault can be emptied through its front door. Getting those details right, and reviewing them as the custodian and the regulation change, is the unglamorous work that separates institutions that had a bad year in 2022 from those that did not.

Sources

1. SEC: Proposal Would Address How Investment Advisers and Funds Can Custody Crypto Assets Under the Federal Securities Laws, October 1, 2026
2. SEC: Fact Sheet, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules (IA-7023), October 1, 2026
3. SEC: Proposing Release IA-7023, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, October 1, 2026
4. SEC: Commissioner Peirce, Roller Coaster Ride: Statement on Proposed Adviser and Regulated Fund Custody Rules, October 1, 2026
5. SEC: Chairman Atkins, Statement on Proposal to Address the Custody of Crypto Assets, October 1, 2026
6. SEC: Staff Accounting Bulletin No. 122, January 23, 2025
7. OCC: OCC Clarifies Bank Authority to Engage in Certain Cryptocurrency Activities (Interpretive Letter 1183), March 7, 2025
8. Federal Reserve: Board announces the withdrawal of guidance for banks related to their crypto-asset and dollar token activities, April 24, 2025
9. Federal Reserve: Board announces it will sunset its novel activities supervision program, August 15, 2025
10. Federal Reserve: Board requests public input on “payment account”, December 19, 2025
11. FBI: North Korea Responsible for $1.5 Billion Bybit Hack, February 26, 2025
12. Chainalysis: Bybit Hack Analysis, February 2025
13. Chainalysis: 2025 Crypto Theft Totals (Crypto Crime Report preview), December 18, 2025
14. BitGo (Business Wire): BitGo Secures OCC Approval to Convert to Federally Chartered National Trust Bank, December 12, 2025
15. BitGo (Business Wire): BitGo Holdings Announces Launch of Initial Public Offering, January 12, 2026
16. Paxos: OCC Approves Paxos Application to Convert to OCC Trust, December 12, 2025
17. Coinbase: Coinbase Receives Conditional OCC Approval, April 2, 2026
18. Coinbase: Coinbase Prime Custody (regulatory status and SOC reports), accessed October 6, 2026
19. Anchorage Digital: $100 Million Strategic Investment from Tether at $4.2 Billion Valuation, February 5, 2026
20. Fidelity Digital Assets: Institutional custody and trading (Fidelity Digital Assets, N.A.), accessed October 6, 2026

Disclosure: This guide is for education only and is not investment, legal or tax advice.