A crypto custody due diligence checklist is a structured set of questions investors, family offices, and advisers use to evaluate a digital asset custodian: where assets are held, who can move them, what controls and reporting exist, and what happens during death, incapacity, a cyber incident, or provider failure. It documents evidence, not brand names.
What a Crypto Custody Due Diligence Checklist Is
Custody is the control point for digital assets. The custodian you choose, and the way the account is titled and approved, determines who can move coins and under what authority. A due diligence checklist turns that into a repeatable review so the answers are written down and testable rather than assumed. A brand name is not a custody policy. This page sits within Digital Asset Custody and pairs with What Is a Qualified Crypto Custodian? for the regulatory baseline.
Why This Matters
The wrong custody decision can create theft risk, access risk, compliance gaps, reporting failures, or succession problems. A Cryptocurrency qualified custodians have emerged to serve institutional requirements. Qualified custody may be required for register">qualified custodian under the SEC custody rule, a SOC 1 or SOC 2 report, and clear account titling are not interchangeable safeguards; each answers a different question. No custodian and no checklist removes market, custody, or tax risk. Diligence reduces the chance of an avoidable failure; it does not guarantee an outcome.
The Diligence Checklist
Work through each item and record the evidence, not just the answer. For the common errors this is meant to catch, see Common Crypto Custody Mistakes for Family Offices.
| # | Question | Evidence to request |
|---|---|---|
| 1 | What legal entity provides custody, and where is it chartered or regulated? | Charter, registration, Form ADV references where relevant |
| 2 | Is the provider a qualified custodian for the relevant use case? | Regulatory status, custody-rule applicability |
| 3 | How are accounts titled (individual, LLC, trust)? | Account agreement, titling confirmation |
| 4 | Are client assets segregated from the provider's own assets? | Segregation policy, account structure |
| 5 | What transfer approvals are required (multi-sig, multi-approver, whitelisting)? | Written transfer-approval policy |
| 6 | Does the platform support trust or LLC ownership? | Onboarding requirements for entities |
| 7 | What statements and reports are provided, and how often? | Sample statements, reporting cadence |
| 8 | Is staking supported, and under what terms and risks? | Staking terms, slashing and lock-up disclosures |
| 9 | What insurance or crime coverage exists, and what does it exclude? | Policy summary, coverage limits and carve-outs |
| 10 | What happens if an authorized signer dies or becomes incapacitated? | Signer succession and key-person procedures |
| 11 | What incident response process exists for a breach or outage? | Written incident response plan |
| 12 | How are fees charged (custody, transfer, staking)? | Fee schedule |
Several items map to standalone policies worth requesting in writing: a crypto transfer approval policy, an incident response plan, and the custodian's SOC 1 and SOC 2 reports.
Evidence Standard
This article is a diligence checklist and does not endorse any custodian. The questions apply equally to every provider; the goal is documented evidence, not a ranking.
When It May Help
- You are moving from exchange or self-custody to institutional custody.
- An RIA is evaluating crypto custody for client accounts.
- A family office needs documented account controls.
- A trust or LLC will own the account.
- A large transfer or liquidity event is expected.
When It May Not Be Enough
A checklist surfaces questions; it does not replace legal and technical review. Written controls should be tested, not just requested, and a SOC report or insurance summary should be read by someone who can assess scope and exclusions. Diligence is ongoing, not a one-time event.
Related Questions
Is qualified custody the same as safe custody?
Generally, no. Qualified custody is a regulatory concept under the SEC custody rule. Safety also depends on operational controls, provider quality, insurance, written procedures, and user behavior. A custodian can be "qualified" and still carry operational risk.
Should custody accounts be held in an LLC or trust?
It depends on the wealth structure, governing legal documents, tax treatment, and custodian onboarding requirements. The account opening checklist for trusts and LLCs covers the documents most custodians request. Consult a qualified legal and tax professional before titling an account.
Should families use more than one custodian?
Some do, to diversify provider-failure risk; others prefer the simplicity of one. There is no single correct answer, and the decision and its rationale should be documented either way.
Does registration alone mean a custodian is skilled or safe?
No. Registration or qualified-custodian status indicates a legal framework applies; it does not guarantee skill, performance, or that assets cannot be lost. It is one input to diligence, not a substitute for it.
Bottom Line
Crypto custody diligence should answer a plain question: if the assets need to move, who can move them, under what authority, with what controls, and what evidence exists? Write the answers down, test them, and revisit them on a schedule.
Sources
Compliance Note
This article is for general educational purposes and is not legal, compliance, custody, cybersecurity, or investment advice.