A crypto custodian annual review checklist is a structured set of items family offices, RIAs, and trustees use once a year to confirm that a digital asset custodian still fits their custody, reporting, control, and risk requirements. It re-tests regulatory status, asset support, transfer controls, audit reports, insurance, and fees, because a custodian that fit at onboarding can drift over time.
What an Annual Custodian Review Covers
The review is the recurring counterpart to your initial crypto custody due diligence checklist. Diligence is not a one-time event at onboarding: a custodian's regulatory registration, asset coverage, audit posture, and ownership can all change between account opening and your next statement. An annual review re-examines those facts on a fixed cadence so the relationship is evaluated on current evidence rather than the version you signed up with.
Where the upfront process answers "should we use this custodian," the annual review answers "should we keep using this custodian, on the same terms, for these entities." Both feed the broader framework in the Digital Asset Custody Hub.
Annual Review Checklist
Work through each item, document what changed since last year, and flag anything that needs follow-up before the file is signed off.
- Legal entity and regulatory status, confirm the operating entity, its charter (for example, a state trust company), and that any registration is still current. Registration alone does not guarantee skill, safety, or favorable outcomes.
- Cryptocurrency qualified custodians have emerged to serve institutional requirements. Qualified custody may be required for register">Qualified custodian analysis, where the SEC custody rule applies, reconfirm whether the custodian still meets the qualified custodian definition for the assets you hold. See what is a qualified crypto custodian.
- Asset support, verify the specific tokens and networks you custody are still supported, and whether any have been delisted or restricted.
- Account types supported, confirm continued support for your trust, LLC, and family office entity structures.
- Transfer approval controls, re-test withdrawal address allowlisting, multi-approver release, and the key model (multi-sig or MPC) against your transfer approval policy.
- SOC reports, obtain the current SOC 1 and SOC 2 reports, read the auditor's opinion, and review any noted exceptions and your responsibility as a user entity.
- Insurance disclosures, review what the custody insurance actually covers, its limits, and exclusions. Crypto custody coverage is not FDIC or SIPC protection.
- Fees, compare current fee schedules against last year and against your engagement terms.
- Statements and tax exports, confirm statements reconcile and that exports support your tax records, including readiness for evolving reporting such as Form 1099-DA.
- Incident history, ask about security incidents, outages, and any change tied to your incident response plan.
- Service quality, assess responsiveness, operational reliability, and support for governance requests.
- Changes in terms, review amendments to the custody agreement, sub-custody arrangements, or ownership.
Family Office Questions
- Does the custodian still support all relevant trusts and LLCs, consistent with your crypto account opening checklist for trusts and LLCs?
- Are reports sufficient for tax and governance, or do gaps need to be raised?
- Are signer changes documented and reflected in current access?
- Is exposure too concentrated with one provider, given the trade-offs covered in should a family office use more than one crypto custodian?
Related Questions
How often should a family office review its crypto custodian?
At least annually is a common cadence, with an additional review triggered by material events such as a change in ownership, a security incident, a regulatory action, or a shift in the assets you hold. The right frequency generally depends on the facts of your structure; confirm it with qualified professionals.
What documents should I request for a custodian annual review?
Typically the current SOC 1 and SOC 2 reports, proof of regulatory or charter status, insurance summaries, the current fee schedule, and any amendments to the custody agreement. What is sufficient depends on your circumstances, so review the package with qualified counsel and compliance.
Does a custodian's registration mean my crypto is safe?
No. Registration or a trust charter speaks to legal status and oversight, not to investment outcomes or freedom from custody, market, or operational risk. No custodian arrangement removes those risks entirely, and registration alone does not guarantee skill or safety.
Sources
- SEC: Custody rule compliance guide
- SEC: Custody rule FAQs
- SEC: Investor Bulletin, Custody of Your Investment Assets
Compliance Note
This article is educational and does not provide legal, tax, fiduciary, investment, compliance, or custody advice. Custodian reviews should be performed with qualified professionals. Registration does not imply a certain level of skill or training.