DAG

Crypto Custody Due Diligence Questions for RIAs

Crypto custody due diligence questions for RIAs are the regulatory and operational questions a firm asks before moving client digital assets to a provider: who the custodian is, whether it can serve as a Cryptocurrency qualified custodians have emerged to serve institutional requirements. Qualified custody may be required for register">qualified custodian under the SEC custody rule, how it controls keys and segregates assets, and whether its statements and control reports support the firm's books-and-records duties.

What "Custody Due Diligence" Means for an RIA

For a registered investment adviser, custody due diligence is the documented review a firm performs before it relies on a provider to hold client digital assets. Under the SEC custody rule (Advisers Act Rule 206(4)-2), client assets an adviser has custody of generally must sit with a "qualified custodian," and the adviser remains responsible for confirming that condition. Crypto raises questions the rule was not drafted around, so the burden generally falls on the firm to document why a given arrangement satisfies its obligations. This review belongs inside your broader crypto compliance checklist for RIAs, and links up to the Crypto Services for RIAs Hub rather than living as a one-off form.

Run this review before client assets move or advisory workflows are built around a provider, not after. The questions below are framed for firm adoption: what to confirm before migrating assets, not a generic vendor questionnaire. They sit alongside the qualified custody requirements for RIAs managing digital assets and the firm's wider crypto due diligence checklist for RIAs.

Provider Status

Confirm what the custodian legally is before anything else, because qualified-custodian status depends on entity type.

  • What legal entity provides custody, and under whose charter or license?
  • Is the provider a bank, broker-dealer, futures commission merchant, foreign financial institution, or another type of entity?
  • Does the provider claim qualified custodian status, and on what statutory basis?
  • What written disclosures, legal opinions, or regulatory correspondence support that claim?

Registration or a charter alone does not guarantee competence, security, or suitability for your clients, it establishes a baseline you still have to verify.

Asset Controls

  • How are private keys generated, stored, and controlled (for example, cold storage, multi-signature, hardware security modules)?
  • Are client assets segregated and identifiable per client, or commingled in omnibus wallets?
  • What approval steps and dual-control checks are required to authorize a transfer?
  • What happens if an authorized signer becomes unavailable or compromised?
  • What insurance, if any, applies, and exactly what does it cover? No insurance, custody model, or balance carries FDIC or SIPC protection for crypto, and segregation does not remove market or counterparty risk.

Reporting and Operations

  • Are independent statements available on a regular cadence?
  • Can the custodian's data feed your reporting and reconciliation systems? See crypto reporting for financial advisors for how this affects client deliverables.
  • How are forks, airdrops, staking rewards, and network fees recorded, relevant for both performance reporting and Form 1099-DA tax records?
  • What audit or control reports are available (for example, SOC 1 or SOC 2 Type II), and how recent are they?
  • How does the provider support trusts, LLCs, and other legal entities your clients hold assets through?

Related Questions

Does an RIA need a qualified custodian for client crypto?

Generally, if the adviser has custody of client digital assets, those assets must be held by a qualified custodian under the custody rule. Whether a specific crypto provider meets that definition depends on the facts and its entity type, so confirm it in writing and consult compliance counsel.

What documents should an RIA collect during crypto custody due diligence?

Typically a firm gathers the provider's legal-entity and licensing details, any qualified-custodian basis, security and key-management descriptions, recent SOC 1 or SOC 2 reports, insurance terms, and sample statements. Retaining these supports the adviser's books-and-records obligations.

Is exchange custody the same as qualified custody?

Not necessarily. Holding assets on a trading venue is generally distinct from custody with a qualified custodian, and the two can carry different protections. Evaluate each arrangement on its facts and document the conclusion; see can RIAs advise on self-custodied crypto for the related self-custody analysis.

Sources

Compliance Note

This article is educational and does not provide legal, compliance, investment, fiduciary, or custody advice. RIAs should consult compliance counsel when evaluating crypto custody. Registration does not imply a certain level of skill or training.

Disclosures

DAG Holdings Co is a holding company that does not provide investment advisory, brokerage, administrative, or insurance services to clients. DAG is not a law firm, does not provide legal or tax advice, and does not provide tax preparation services. Tax matters are handled through referrals to qualified independent tax professionals.

DAG Private Client services involve estate matters that require qualified independent counsel in the applicable jurisdiction. LLC formation, trust drafting, and estate planning services are provided in coordination with or by qualified independent legal counsel licensed in the applicable jurisdiction.

Asset protection structures, including Wyoming LLCs and trusts, do not guarantee protection against all claims, creditors, or losses. Outcomes depend on specific facts, jurisdiction, and applicable law.

Insurance products and services are offered through Xure Insurance or its affiliates.

Investment advisory services are offered exclusively through DAG Wealth, an SEC-Registered Investment Adviser (CRD No. 328627). Registration with the SEC does not imply a particular level of skill or training. Form ADV and Form CRS are available upon request or at www.adviserinfo.sec.gov.

Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them.

Investing in digital assets involves risk, including the possible loss of principal. Digital assets are highly volatile and may not be suitable for all investors. Past performance is not indicative of future results.

Specific fee schedules, scope of engagement, conflicts of interest, and material business practices are disclosed in writing before engagement and in Form ADV Part 2A for the investment-advisory portion.

The information on this site is for general educational purposes and is not legal or tax advice.