A custodian is an entity entrusted to hold or safeguard assets for someone else. Custody can include services beyond safekeeping: bank custody typically covers settlement, safekeeping and reporting for customers’ marketable securities and cash.
How Crypto Custody Works
A crypto wallet stores private keys or passcodes, not the crypto assets themselves. A private key enables transaction authorization, so digital asset custody concerns who manages and controls access to those keys. With third-party custody, a service provider holds assets on a customer’s behalf and manages private-key access.
A custodian’s control over key access gives it practical transaction authority; it does not, by itself, establish legal ownership of the customer’s assets. In self-custody, the user has sole control over private-key access and sole responsibility for key security.
For a hypothetical example, suppose a customer holds crypto through a custodian and requests a transfer. The provider controls the private-key access needed to authorize that transaction; the customer’s request is not the same as personally controlling the key. Under self-custody, the customer instead controls that access and bears responsibility for protecting it.
Storage and Recovery
Hot and cold describe internet connectivity, not who controls the keys. Both custody models can use hot or cold wallets, and a third-party provider may use a combination. Hot wallets are internet-connected and convenient for transactions, but expose assets to cyberthreats. Cold wallets are typically offline physical storage. They are generally less convenient for transactions and more protected from cyberthreats than hot wallets, but their physical media can be lost, damaged or stolen.
Loss, theft, damage or hacking may cause permanent loss of access, but recovery can be possible. Many wallets generate a seed phrase, a sequence of words that can restore a wallet after loss of the wallet or private key, or damage to its hardware or software. The phrase itself needs protection, and recovery depends on the wallet’s recovery mechanism.
Looking for liquidity, exploring on-ramp/off-ramp services, or seeking expert guidance?
Get startedService Responsibilities and Residual Risks
Physical and cyber procedures, strong passwords and multi-factor authentication are relevant protections, not guarantees. If the provider is hacked, shuts down or goes bankrupt, customers may lose access to their crypto assets. The table sets out the responsibilities and contractual terms that distinguish the custody arrangement.
| Aspect | What the Arrangement Should Clarify |
|---|---|
| Key access | What the Arrangement Should ClarifyIdentify who can access private keys and authorize transactions. |
| Storage | What the Arrangement Should ClarifyClarify how the provider selects and uses its storage methods. Hot wallets, cold wallets or both may be used; none guarantees safety. |
| Sub-custody | What the Arrangement Should ClarifyCheck whether another provider stores the assets or keys and who has access. |
| Asset use | What the Arrangement Should ClarifySome providers use deposited assets as collateral for their own purposes (rehypothecation) or commingle them rather than hold them individually. Clarify whether either practice occurs and whether customer consent is required. |
| Services and reporting | What the Arrangement Should ClarifyClarify the settlement, safekeeping and reporting services included in the arrangement. |
| Failure and insurance | What the Arrangement Should ClarifyCheck whether loss or theft insurance exists and what its terms and conditions cover. |
| Assets and fees | What the Arrangement Should ClarifyCheck supported assets and whether annual asset-based, transaction, transfer-out, account-opening or account-closing fees apply. |
| Regulation and privacy | What the Arrangement Should ClarifyClarify how the provider and arrangement are regulated and how personal information is used or shared. The custody label alone does not establish regulatory status. |
