Digital asset custody is the secure storage and control of the private keys that authorize ownership and transactions for cryptocurrency and other blockchain-based assets. The custody model you choose, whether self-custody, cold storage, or institutional qualified custody, determines who controls those keys and what protections exist if something goes wrong.
Definition: Digital Asset Custody
Private keys are cryptographic credentials that prove ownership of on-chain assets. Whoever controls the private key controls the asset. Digital asset custody is, at its core, the discipline of managing those keys: generating them securely, storing them so they are not lost or stolen, and authorizing transactions only as intended.
Custody models differ primarily by who holds the keys and how signing authority is structured:
| Model | Who Holds Keys | Common Use |
|---|---|---|
| Self-custody | Owner directly (hardware or software wallet) | Individuals comfortable managing key security |
| Exchange custody | Exchange on owner's behalf | Active traders; lower suitability for long-term HNW holdings |
| Cold storage | Custodian or owner; keys offline or air-gapped | Reduces online theft exposure |
| Qualified custody | Regulated institutional custodian (bank, trust company, or broker-dealer) | Advisers, family offices, and entities subject to regulatory requirements |
| MPC / multi-sig | Signing authority split across multiple parties or devices | Institutional-grade controls; reduces single-point-of-failure risk |
No model eliminates all risk. Each carries some combination of key-loss, counterparty, operational, and market risk. The right structure depends on entity type, asset size, regulatory exposure, and succession needs.
What Makes a Custodian "Qualified"?
A qualified custodian is a specific regulatory category, not a general quality designation. For registered investment advisers subject to the SEC custody rule, client assets may need to be held by a qualifying entity, typically a bank, trust company, or broker-dealer that meets defined standards under applicable law.
Whether a given provider is a qualified custodian depends on the legal entity, jurisdiction, and the specific regulatory framework that applies to the account relationship. A "qualified" label from a provider does not guarantee solvency, segregation, or protection in all scenarios. Confirm status with a qualified professional before relying on any arrangement.
For more on the regulatory framework, see what a qualified crypto custodian is and qualified custody for RIAs managing digital assets.
Cold Storage vs. Qualified Custody
Cold storage and qualified custody address different problems and should be evaluated separately.
Cold storage is a key-storage method that keeps signing keys offline or air-gapped to reduce online theft exposure. A custodian can use cold storage without being a qualified custodian. Qualified custody is a regulatory category about the type of entity, not the technical method used to store keys. The full comparison is in cold storage vs. qualified custody.
What to Ask When Evaluating a Custodian
Use a structured due-diligence framework rather than general impressions. Key dimensions to evaluate:
- Legal entity and charter. Is the provider a bank, trust company, or broker-dealer? In which jurisdiction, under what charter?
- Qualified custodian status. Does the entity meet the applicable regulatory standard for your account type?
- Asset segregation. Are your assets held separately from the custodian's proprietary assets and from other clients?
- Account structures supported. Can the custodian hold assets in a trust, LLC, or other entity? Confirm this fits your structure (e.g., a crypto custody arrangement for a family office or crypto custody for trusts).
- Transfer controls. Withdrawal allowlists, approval thresholds, multi-sig or MPC signing requirements.
- Audit and reporting. Availability of SOC 1 and SOC 2 reports, statement cadence, and independent attestations.
- Insurance. What the policy covers, the limits, and any exclusions.
- Fees and asset support. Fee structure and which specific assets are supported.
- Signer and key management. How authorized signers are added or removed; key-recovery procedures.
A structured version of these factors is in the crypto custody due diligence checklist.
What Happens If a Custodian Fails?
Outcomes depend on the legal entity, account terms, how assets are legally characterized, whether they are segregated, and applicable law. Assets held in a properly structured custodial account that are legally segregated from the custodian's balance sheet may be treated differently in an insolvency than assets held as a general liability, but this is fact-specific and not guaranteed.
Crypto custody accounts do not carry FDIC or SIPC deposit insurance. Do not assume government coverage applies. Review the specific terms and bankruptcy treatment with a qualified professional, and consider the risk profile in what happens if a crypto custodian fails.
Related Questions
Does using a qualified custodian eliminate custody risk?
No. A qualified custodian can reduce certain operational and regulatory risks, but no arrangement removes all key-loss, counterparty, or market risk. Diligence on the entity, terms, segregation, and insurance still matters. Outcomes depend on the specific facts.
Is self-custody allowed for crypto accounts managed by an adviser?
It depends on the adviser's regulatory situation and the specific assets involved. For registered investment advisers, certain client assets may need to sit with a qualified custodian under applicable custody rules. Whether self-custody is permissible for a given arrangement is fact-specific; consult a qualified professional.
How does custody connect to estate and succession planning?
Custody determines who can access keys, which directly determines whether heirs can reach assets after death. Coordinating custody structure with succession planning, including private key succession planning, helps avoid permanent loss. A trustee holding custody should ensure the arrangement is supported by the trust instrument and by the custodian's account terms.
What is the difference between MPC and multi-signature custody?
Both approaches distribute signing authority to reduce single-point-of-failure risk. Multi-signature (multi-sig) requires a defined threshold of separate private keys to authorize a transaction, for example, 2 of 3 keys. MPC (multi-party computation) achieves a similar result cryptographically without generating discrete key shards that individually represent partial ownership. The practical differences involve key generation, recovery, counterparty coordination, and blockchain-level compatibility. See MPC vs multi-sig custody for a full comparison.
Does crypto custody insurance cover all losses?
Not typically. Custodian insurance policies vary widely in what they cover (e.g., external theft vs. insider theft vs. operational error), coverage limits, and exclusions. Confirm the specific policy terms rather than relying on a general "insured" representation. Crypto custody insurance and its limits are covered in crypto insurance and custody.
Sources
- SEC: Custody Rule Compliance Guide
- SEC: Custody Rule Staff FAQs
- SEC: Investor Bulletin. Custody of Your Investment Assets
Compliance Note
This page is educational and does not provide legal, tax, investment, fiduciary, compliance, or custody advice. Custody structures, qualified-custodian status, and related regulatory obligations depend on the specific entity, account terms, applicable law, and individual circumstances. Consult qualified legal, tax, and financial professionals before making custody decisions. Registration does not imply a certain level of skill or training.