Crypto Custody

Crypto custody is the service of holding crypto assets on behalf of someone else, together with the recordkeeping, reporting and transfer functions that go with it. The market calls it crypto custody; the banking regulator calls it crypto-asset custody. Mechanically it means holding the cryptographic keys that authorize transfers, which is a point the crypto wallet page covers, and the custodial-versus-self-custody choice belongs there too.

What this page is about is the layer above the mechanics: which kind of institution is holding the asset, under which body of law, and what that makes the customer. Three arrangements look similar on a screen and are not similar at all. A national bank holding crypto in a custody account is doing something the Office of the Comptroller of the Currency has expressly found permissible, under banking law and, if it holds the asset as a fiduciary, under fiduciary law as well. A registered investment adviser with custody of a client's assets is subject to the Advisers Act custody rule, which requires a qualified custodian and has its own page. A crypto trading platform holding a customer balance is doing so under its own user agreement, and the customer's rights are whatever that agreement and general law give them.

What the banking regulator actually decided. In July 2020 the OCC issued Interpretive Letter 1170, concluding that "a national bank may provide these cryptocurrency custody services on behalf of customers, including by holding the unique cryptographic keys associated with cryptocurrency". Its reasoning is worth knowing because it is deliberately unexciting: safekeeping is among the oldest bank powers, the OCC had already found that a bank may escrow encryption keys because "a key escrow service is a functional equivalent to physical safekeeping", and holding a private key is "an electronic corollary of these traditional safekeeping activities". The letter also records that "in most, if not all, circumstances, providing custody for cryptocurrency will not entail any physical possession of the cryptocurrency"; a bank holding crypto is taking possession of the access keys.

Two distinctions inside that letter matter to a customer. The first is fiduciary against non-fiduciary. A bank may provide custody in either capacity; a bank holding crypto as a fiduciary, "such as a trustee, an executor of a will, an administrator of an estate, a receiver, or as an investment advisor", may manage the asset as it manages other fiduciary assets and is subject to the fiduciary-activities regulations, while non-fiduciary custody "would essentially provide safekeeping for the cryptographic key". The second is the model. The letter describes banks that "offer to store copies of their customers' private keys while permitting the customer to retain their own copy", which it likens to traditional safekeeping and which leaves the customer able to move the asset, and banks that "permit customers to transfer their cryptocurrencies directly to control of the bank, thereby generating new private keys which would be held by the institution on behalf of the customer", which it likens to traditional custody and which does not. Same service name, different answer to who can move the asset tomorrow.

In March 2025 the OCC published Interpretive Letter 1183, which rescinded Interpretive Letter 1179 and with it the supervisory-nonobjection process that had required a bank to clear these activities in advance, while reaffirming that the custody, stablecoin and node-verification activities in the 2020 and 2021 letters remain permissible. The accompanying news release states that the OCC "also withdrew its participation in the joint statement on crypto-asset risks to banking organizations and the joint statement on liquidity risks to banking organizations resulting from crypto-asset market vulnerabilities". The practical effect is procedural rather than substantive: the activity was already permissible, and the step in front of it is gone.

The broker-dealer route, and why it cannot be relied on as it stands. In 2021 the Commission published a statement on the custody of digital asset securities by what it called special purpose broker-dealers, setting out circumstances in which such a firm would not face an enforcement action on the basis that it deemed itself to have possession or control of customer digital asset securities under the customer protection rule. That statement was deliberately temporary. It says, twice, that the Commission's position "will expire after a period of five years from the publication date of this statement", and explains that the five-year window was "designed to provide market participants with an opportunity to develop practices and processes that will enhance their ability to demonstrate possession or control over digital asset securities". Which date starts that clock is genuinely ambiguous: the release is dated December 2020, it was published in the Federal Register in February 2021, and its stated effective date is April 2021. On any of the three the five-year term has run, and no extension or replacement appears in the Federal Register. So the framework should not be treated as available without checking the Commission's current position.

The same statement is useful for a different reason, because it states plainly what the customer of a registered firm gets: customers who use registered broker-dealers to custody their securities "benefit from the protections provided by the federal securities laws, including the Customer Protection Rule and, in most cases, the Securities Investor Protection Act of 1970". A platform that is not a broker-dealer supplies neither of those, and it supplies no federal deposit insurance either. The crypto exchange page sets out what that absence has meant in practice.

The question nobody should pretend is answered. Where a customer's crypto sits with a platform, whether the customer owns identifiable property that a receiver must hand back, or holds a general claim against the estate alongside other creditors, depends on how the arrangement was documented and is decided case by case. It is a real fork with real money on either side of it, and the documents are where the answer starts: a lending agreement that transfers the right to use the asset points one way, and terms stating that the customer retains ownership of assets held in custody point the other. The crypto lending page covers the first case, where the platform borrowed the asset rather than held it. For the second, the honest position is that a reader should know the question exists and read what their own terms of service say about ownership, because that document, and not the word custody, is doing the work.

One regulator statement does address a narrower version of the same problem, and it is worth quoting because it shows the outcome is not hypothetical. Still in the 2021 statement, the Commission observed that "SIPA protection does not extend to all assets that may be held at a broker-dealer", so that "in a SIPA liquidation of a broker-dealer that held non-security assets, including non-security digital assets, investors may be treated as general creditors, to the extent their claims involve assets that are not within SIPA's definition of 'security'". That passage is about a registered broker-dealer, not about a crypto trading platform, so it does not answer the platform question. What it establishes is that being a customer of a regulated firm does not by itself make a crypto holding customer property: the character of the asset matters too, and general-creditor treatment is a documented possibility rather than a worst case somebody invented.

Working out where a holding actually sits takes four questions, in this order. Who is the institution, by legal type: a national bank or federal savings association, a state-chartered trust company, a registered broker-dealer, or a trading platform that is none of those. Under what capacity does it hold the asset, fiduciary or non-fiduciary, because that changes both its duties and what it may do with the asset. Which key model applies, meaning whether the customer retains an ability to move the asset or has handed sole control over. And what do the governing documents say about ownership, use and what happens on insolvency.

A hypothetical shows why the answers, rather than the label, decide things. Amara holds a crypto position and is offered three arrangements that all describe themselves as custody. In the first, a bank stores a copy of a key she also holds; she can still move the asset herself, and the bank's role is safekeeping. In the second, she transfers the asset to the bank, which generates new keys and holds them for her; she can no longer move it directly, and she is relying on the institution's obligations and on its records. In the third, she opens an account with a trading platform and sees a balance; the platform holds the keys, and her rights come from the user agreement she accepted. All three show a balance on a screen. Only the documents distinguish them, which is why the four questions above are worth asking before the money moves rather than afterwards.

One practical note about advisers. If a financial advisor has custody of client assets, the Advisers Act custody rule generally requires those assets to be maintained with a qualified custodian, and whether a given crypto platform qualifies is a question about that rule rather than about crypto. The custody rule page is where that requirement is set out.

Pros

• A regulated custodian brings examination, recordkeeping and reporting obligations that no self-managed arrangement produces, plus statements a fiduciary or an auditor can rely on.
• Bank custody sits inside a body of law with a long history, and the OCC has confirmed the activity is permissible in both fiduciary and non-fiduciary capacity.
• Institutional custody solves the operational problems that make direct holding difficult at scale, including succession, authorization controls and the need for someone other than one individual to be able to act.

Cons

• The word custody carries no fixed legal content on its own. A bank custody account, a broker-dealer's possession or control, and a platform balance are three different positions sharing one label.
• Crypto held with a platform is outside federal deposit insurance and outside standard brokerage customer protection.
• Whether platform-held crypto is the customer's property or part of the estate in an insolvency is unsettled, so the downside case is genuinely uncertain rather than merely unlikely.
• The 2021 broker-dealer framework was written to expire and has, so a route that once existed for digital asset securities cannot simply be assumed to be available.
• Third-party custody adds fees and a dependence on the custodian's own controls and subcustodians.