Crypto Custody Explained: Self, Third-Party and Qualified Custody

Crypto custody means holding and controlling the private keys that move a crypto-asset, either yourself (self-custody) or through a third party such as an exchange, bank or specialist custodian. Whoever controls the keys controls the asset, so the custody choice decides who can lose it, who can freeze it and what happens to it if a company fails.

For institutions, the question is narrower: is the custodian "qualified" under the rules that apply to them? This guide explains the three main custody models, what a qualified custodian is in the US, what MiCA requires of custodians in the EU, how custodied crypto has been treated in bankruptcies, how custodians secure keys, and how to evaluate one.

The three custody models

Ownership of a crypto-asset is recorded on a blockchain, and access to it is controlled by a private key that lets the holder transfer the asset or use rights such as staking and governance. Keys can also be split into pieces, or shards, so control is spread across more than one party, as the SEC's October 2026 custody proposal describes.

Self-custody removes counterparty risk but makes you responsible for everything. Our self-custody guide covers how to do it safely. Third-party custody is what most people use without thinking about it: crypto on an exchange account is held by the exchange. Qualified custody is a legal category, mainly relevant to investment advisers, funds and other regulated institutions.

What is a qualified custodian in the US?

In the US, the term comes from the Investment Advisers Act custody rule, Rule 206(4)-2. A registered adviser with custody of client funds or securities generally has to keep them with a "qualified custodian", defined as:

• a bank or an FDIC-insured savings association;
• a registered broker-dealer holding client assets in customer accounts;
• a registered futures commission merchant, for certain futures-related assets; or
• a foreign financial institution that customarily holds financial assets for customers and keeps client assets segregated from its own.

Crypto did not fit neatly. Many crypto custodians are state-chartered limited purpose trust companies, which are not a listed category, so advisers had to work out whether each one counted as a "bank". The SEC's 2026 proposal says that uncertainty made advisers and funds reluctant to use them.

How the US rules have moved since 2025

• SAB 121 rescinded. Staff Accounting Bulletin 121 (31 March 2022) said firms obliged to safeguard crypto for customers should record a safeguarding liability, and a matching asset, on their balance sheet at fair value. SAB 122 rescinded it on 23 January 2025, as cited in the SEC's proposing release, which notes commenters saw SAB 121 as an impediment to bank crypto custody.
• Bank custody reaffirmed. The OCC first said national banks may provide crypto custody in Interpretive Letter 1170 (July 2020). In 2025 it rescinded the more restrictive Letter 1179 through Letter 1183 (7 March 2025), and Letter 1184 (7 May 2025) confirmed banks may buy and sell custodied crypto at the customer's direction (as summarised in the SEC's 2026 release).
• 2023 Safeguarding Proposal withdrawn. The SEC formally withdrew its 2023 proposal to replace the custody rule on 12 June 2025.
• State trust company no-action letter. On 30 September 2025, SEC staff said they would not recommend enforcement against advisers or funds that treat a state trust company as a bank for crypto custody, subject to conditions. Like all staff statements, it has no legal force.
• New proposal, October 2026. The SEC has proposed "Adviser and Regulated Fund Custody Rules; Crypto Custody Rules". It was published in the Federal Register on 6 October 2026, with comments due by 7 December 2026 (Release IA-7023). It would allow state trust companies as permitted custodians if the adviser checks their state authorisation, policies, audited financial statements and internal control reports each year, with client crypto segregated from the custodian's own assets. It would also let advisers self-custody client crypto under conditions, including a written finding each quarter that no permitted custodian is available, joint authorisation of transactions by at least two people, and quarterly statements showing each client's on-chain address.

As of 17 October 2026, that proposal is at the comment stage and is not final.

Crypto custody rules under MiCA

In the EU, "providing custody and administration of crypto-assets on behalf of clients" is a licensed crypto-asset service under MiCA. Article 75 sets out what a custodian must do:

• sign an agreement with each client covering the service, custody policy, security systems, fees and applicable law;
• keep a register of positions in each client's name;
• keep a custody policy designed to minimise loss from fraud, cyber threats or negligence, and give clients a summary on request;
• send a statement of positions at least every three months, and on request;
• return clients' crypto-assets, or the means of access, as soon as possible;
• segregate client holdings from its own, including on the blockchain, and legally segregate them from its estate "so that creditors of the crypto-asset service provider have no recourse" to them, in particular in insolvency;
• be liable for losses from incidents attributable to it, capped at the market value of the lost asset when the loss occurred.

MiCA's grandfathering for firms already operating under national rules ran until 1 July 2026 at the latest (Article 143), so custodians serving EU clients now need a MiCA authorisation. Our CASP licence guide covers the process.

What happens to custodied crypto in a bankruptcy?

This is where custody terms stop being fine print. Three cases show why.

• Celsius. In January 2023 the US Bankruptcy Court ruled that crypto in Celsius's Earn accounts belonged to the bankruptcy estate, because the terms of use transferred title to Celsius, leaving Earn customers as unsecured creditors (Decrypt). The ruling covered Earn only, and left open whether assets in the separately structured Custody and Withhold programmes would be treated differently (Weil).
• Coinbase's 2022 disclosure. In May 2022 Coinbase told investors that "custodially held crypto assets may be considered to be the property of a bankruptcy estate" and that customers "could be treated as our general unsecured creditors". Its chief executive said institutional custody clients already had protections and that retail terms would be updated (The Register).
• FTX. The SEC alleged that Sam Bankman-Fried diverted FTX customer funds to his trading firm Alameda Research from at least 2019 until November 2022 (SEC press release 2022-219). Segregation on paper means little if it is not enforced in practice.

The lesson is to check whether your terms keep title with you, whether assets are segregated, and whether the custodian publishes evidence. Our guides to proof of reserves and to what happens when an exchange shuts down go further.

How custodians secure private keys

Professional custody is mostly key management. The common building blocks are:

• Cold storage: keys generated and kept on devices that never connect to the internet, with a smaller "hot" balance for withdrawals.
• Hardware security modules (HSMs): tamper-resistant devices that generate and use keys without exposing them. Buyers often look for validation under NIST's Cryptographic Module Validation Program, which now accepts FIPS 140-3 submissions.
• Multi-party computation (MPC): the key is never assembled in one place; several parties hold shares and sign together. See our MPC wallet guide.
• Multisig and policy controls: transactions need approval from several people or devices, with allow-lists, limits and time delays. The SEC's 2026 proposal would require joint authorisation by at least two people where advisers self-custody client crypto.

No setup removes risk. Each moves it: from a single stolen key to collusion, faulty software, or a weak approval process.

How to evaluate a crypto custodian

Whether you are an individual choosing an exchange or a fund choosing a custodian, ask these questions:

1. Licence and supervisor. Who regulates it, under which regime (a MiCA authorisation, a US state trust charter, a bank charter), and can you confirm that on the regulator's register?
2. Title and segregation. Do the terms say you keep ownership? Are your assets segregated on-chain, or pooled in an omnibus wallet?
3. Audits and controls. Does it publish audited financial statements and an independent internal control report? The SEC staff's state trust company letter and the 2026 proposal both centre on these.
4. Proof of reserves and liabilities. Can you check your balance is included, and are liabilities covered too?
5. Insurance. What does any policy actually cover, and what is the limit relative to assets held?
6. Asset support and exits. Does it support the chains and tokens you need, and how fast can you withdraw?
7. Rehypothecation and staking. Does it lend or stake your assets, and on whose behalf?

Expect onboarding checks in return. A regulated custodian has to run KYC, and KYB for companies, before opening an account; many use specialist identity verification providers such as iDenfy for this step.

If you choose self-custody instead, the trade-off is different but not zero. Using DeFi, such as liquid staking for JWLSUI, JWLEGLD or JWLXRD on JewelSwap, keeps the tokens in your own wallet, but the underlying assets sit in smart contracts, so you take on smart contract and admin-key risk instead of custodian risk.

Frequently asked questions

What is crypto custody?

Crypto custody is the holding and control of the private keys that move a crypto-asset. You can hold the keys yourself (self-custody) or let a third party, such as an exchange, bank or specialist custodian, hold them for you.

What is a qualified custodian for crypto?

In the US, a qualified custodian under the Advisers Act custody rule is a bank or insured savings association, a registered broker-dealer, a registered futures commission merchant for certain assets, or a qualifying foreign financial institution. Since September 2025, SEC staff have also allowed advisers to treat state trust companies as banks for crypto custody under conditions, and an October 2026 proposal would write that into the rules.

Is crypto on an exchange safe if the exchange goes bankrupt?

It depends on the terms and how the assets are held. In the Celsius case, Earn account crypto became estate property and customers became unsecured creditors. Under MiCA, custodians must legally segregate client crypto from their estate so creditors have no recourse to it.

What did SAB 122 change?

SAB 122, dated 23 January 2025, rescinded SAB 121, the SEC staff guidance that firms safeguarding crypto for customers should record a safeguarding liability and matching asset on their balance sheet. Commenters had described SAB 121 as an impediment to bank crypto custody.

What does MiCA require of crypto custodians?

Article 75 of MiCA requires a client agreement, a register of positions, a custody policy, statements at least every three months, prompt return of assets, on-chain and legal segregation of client crypto, and liability for losses attributable to the custodian, capped at the market value of the lost asset.

Is self-custody better than a custodian?

Neither is better for everyone. Self-custody removes counterparty risk but puts key security entirely on you. A regulated custodian adds legal protections and professional key management, but you depend on its solvency, controls and withdrawal process.

Keep reading

• Self-custody crypto guide
• What is an MPC wallet?
• Proof of reserves explained
• What happens when an exchange shuts down
• CRS 2.0 explained

Disclaimer: this article is educational and is not financial or legal advice. Rules and proposals are described as of 17 October 2026; the SEC's 2026 custody proposal is not final. Sources are linked throughout.