How institutional crypto custody works: MPC vs multisig, qualified custodians, 2026 rules, and six questions to ask before choosing a custodian.
Institutional crypto custody is the safekeeping, by a regulated custodian, of the private keys that control digital assets, under written policies, segregated accounts, multi-person approval rules, and independent audits. Funds, companies, trusts, and family offices use it so no single person or device can move the assets, and so the assets stay theirs if the custodian fails.
Custody can look like a cryptography problem, yet two failures in 2023 and 2025 turned on contracts and approval screens (a lender's terms of service, and a disguised multisig transaction). This guide treats custody as a legal and procedural arrangement first and ends with the six-question custody check for comparing custodians.
Institutional crypto custody is a service in which a regulated third party, usually a bank, trust company, or licensed custodian, holds the private keys to a client's digital assets and moves them only on approved instructions. Under that arrangement, the client keeps ownership, and a written custody agreement sets out each side's duties.
A private key is the secret code that authorizes blockchain transfers (our explainer on what a private key is covers the mechanics), so whoever controls it controls the assets. Where a personal wallet protects one key for one person, an institutional custodian protects keys for many clients under documented, auditable controls.
Digital asset custody comes in four broad models, which differ in who can move the assets and what happens if the provider fails.
| Model | Who controls the keys | If the provider fails |
|---|---|---|
| Platform custody (exchange or app) | The platform, often in pooled wallets | If the terms transfer ownership, clients may rank as unsecured creditors, as Celsius Earn users did |
| Qualified third-party custody | A regulated custodian acting on client instructions | Segregated assets should stay outside its estate |
| Hybrid (shared-control) custody | Client and provider, through MPC or multisig | Access depends on whether the client can sign alone |
| Self-custody | The owner alone | No provider can fail, and no one can recover a lost key |
For individual holders, our comparison of self-custody vs custodial storage sets out the same trade-offs in more detail.
Institutional crypto custody works in three layers that must all allow a transfer: key storage, which keeps signing keys in protected hardware or split across machines; a policy engine, which decides who may approve each transfer; and wallet tiers, which keep most assets offline and only a working balance online.
In most setups, keys are created in a recorded key ceremony, inside tamper-resistant hardware or across independent servers, so no complete key ever sits on a connected computer. Before any withdrawal goes out, a policy engine checks it against the client's rules: an allowlist of addresses, size limits, daily caps, and the quorum (the number of required approvers).
Most custodians keep the bulk of client assets in cold storage, meaning keys held offline, with smaller warm and hot tiers for routine moves and fast withdrawals. Since moving funds out of cold storage can take hours, approvers have time to stop a request that should not go out. For individual holders, our guide to cold storage in crypto explains how offline keys work.
MPC, multisig, and HSMs are the three main ways custodians protect signing keys. Multi-party computation (MPC) splits one key into shares that sign without being combined, multisignature (multisig) wallets require several separate keys, and hardware security modules (HSMs) are tamper-resistant devices that store keys and sign inside sealed hardware.
| MPC | Multisig | HSM | |
|---|---|---|---|
| How it works | One key split into shares that sign together | Several keys, of which a set number (say, 2 of 3) must sign | Keys generated and used inside tamper-resistant hardware |
| Approval rule | Off-chain, in the custodian's software | On-chain, in the wallet's script or contract | In the device's access controls |
| Main weak point | Flaws in the code or policy software | Signers approving a transaction they cannot fully read | Insider collusion and the software sending it requests |
Because custodians often layer the three (keeping one MPC share in an HSM, for example), asking which technology a custodian uses tells you less than asking how many people, devices, and locations must cooperate before anything is signed, and how each signer confirms what a transaction does.
If a crypto custodian goes bankrupt, properly segregated client assets that are legally titled to the client should stay outside the bankruptcy estate, a protection known as bankruptcy remoteness. Under terms that transfer ownership to the provider, assets can instead become company property, and clients then rank as unsecured creditors.
In the clearest example, a US bankruptcy judge ruled on January 4, 2023, that crypto in about 600,000 Earn accounts at lender Celsius Network, valued at $4.2 billion when Celsius filed, belonged to the company because its terms of service transferred ownership, Reuters reported.
A segregated account holds one client's assets at its own addresses, while an omnibus account pools assets and tracks each share in an internal ledger; in that case, the custodian's ledger becomes the main proof of ownership, so its reconciliation and audits carry more weight. Three custody agreement clauses matter most if a provider fails:
Crypto custody regulation changed quickly between 2025 and 2026. In the US, regulators withdrew hurdles to bank custody and proposed custody rules for advisers and funds, while the EU's Markets in Crypto-Assets Regulation (MiCA) requires licensed custodians to segregate client assets and makes them liable, up to a cap, for losses attributable to them.
A qualified custodian is a firm that meets the definition in the US Securities and Exchange Commission's custody rule, which requires registered investment advisers to keep client funds and securities with a bank, registered broker-dealer, or other listed institution. For years, it was unclear which crypto firms qualified, and for state trust companies that question stayed open until SEC staff said in a September 30, 2025 no-action letter that they would not recommend enforcement against advisers and funds using qualifying state trust companies. On December 12, 2025, the Office of the Comptroller of the Currency (OCC) also conditionally approved five national trust bank charters for crypto firms.
Staff Accounting Bulletin 121 (March 2022) had required companies safeguarding crypto for users to record that obligation as a liability, with a matching asset, on their own balance sheets, which bank groups argued would make crypto custody at scale prohibitively costly for regulated banks. SAB 122 rescinded it on January 23, 2025, and six weeks later, OCC Interpretive Letter 1183 dropped the requirement for national banks to obtain supervisory non-objection before offering crypto custody.
On October 1, 2026, the SEC proposed a tailored crypto custody framework for advisers and regulated funds that would let state trust companies act as crypto custodians, with segregation of client assets among the conditions, and let advisers self-custody client crypto under conditions that include an annual review of cybersecurity controls. With the comment period open until December 7, 2026, none of it is final.
Under the Markets in Crypto-Assets Regulation (MiCA), custody is a licensed service. MiCA Article 75 requires a client agreement and a custody policy, and it requires client crypto to be legally segregated from the provider's estate. The custodian is liable for losses attributable to it, capped at the assets' market value at the time of loss. Since the transitional period for existing providers ended on July 1, 2026, crypto-asset service providers in the EU need MiCA authorization.
In Australia, the Corporations Amendment (Digital Assets Framework) Act 2026 brings digital asset and tokenized custody platforms into financial services licensing from April 2027, the Australian Securities and Investments Commission (ASIC) explains in its implementation roadmap.
You verify a crypto custodian through independent evidence: SOC 1 and SOC 2 Type II reports, audited financial statements, regulatory status, and the actual insurance terms. Proof-of-reserves reports and website security badges are weaker evidence, because they show less than they appear to and are often prepared on terms the provider sets.
System and Organization Controls (SOC) reports are examinations by independent CPA firms. A SOC 1 report covers controls relevant to clients' financial reporting, and a SOC 2 report covers security, availability, processing integrity, confidentiality, or privacy. Of the two types, ask for Type II, which tests whether controls operated effectively over a review period; a Type I report assesses only their design at a single date.
Proof of reserves shows that certain wallets held certain assets at one moment. In a March 2023 advisory, the Public Company Accounting Oversight Board's Office of the Investor Advocate warned that proof-of-reserve reports are not audits and likely do not address a firm's liabilities or borrowed assets.
Custody insurance is usually a crime or specie policy (cover for valuables in storage) bought by the custodian, so its limit is often shared across all clients. As a 2021 Aon white paper on crypto insurance capacity explains, cold storage cover is written on an aggregated basis, so once claims use up the limit, no cover is left for later claims. In the US, the Federal Deposit Insurance Corporation (FDIC) states that deposit insurance does not apply to crypto assets.
Institutional crypto custody reduces the risk of a single lost key or rogue employee, but some risks remain. The main ones are attacks on the people and software around the keys, concentration of many clients' assets in one target, failure of the custodian itself, and slower access.
On or about February 21, 2025, attackers took about $1.5 billion from a major crypto exchange, and the FBI later attributed the theft to North Korea. Forensic investigators at Sygnia found that the attackers had planted malicious code in the web interface of the exchange's multisig wallet provider, so signers approving a routine-looking cold-to-warm transfer in fact handed control of the cold wallet to the attackers.
That incident accounted for more than 40% of the over $3.4 billion in crypto stolen from January to early December 2025, Chainalysis data shows. The signers approved the malicious transaction themselves, so the attackers never needed to steal a key, and a sound question for any custodian is how approvers check the raw transaction independently of the screen displaying it.
Pooling many clients' assets makes a custodian a high-value target, and one firm's failure, fraud, or regulatory problem can freeze many clients at once. Approval quorums and cold storage also slow withdrawals by design. For a small personal holding, the extra layers can add cost and paperwork, and a carefully managed hardware wallet may be the simpler choice, as our guide to storing crypto safely explains.
Choosing a crypto custodian comes down to the six-question custody check: who controls the keys, who must approve a transfer, whether your assets stay legally yours if the custodian fails, what independent evidence backs its claims, what the insurance covers, and how quickly you can withdraw, each backed by a document.
| Check | Question to ask | Evidence to request |
|---|---|---|
| Keys | Who controls the keys, and how are they backed up? | A key management description and a tested recovery procedure |
| Approvals | Who approves a transfer, and how do signers verify it? | A written approval policy, quorum rules, and allowlists |
| Title | Are my assets legally mine if the custodian fails? | A custody agreement stating client title and no reuse without consent |
| Evidence | What independent evidence backs its claims? | SOC 1 and SOC 2 Type II reports, audited financials, and regulatory status |
| Insurance | What does the insurance cover, and is the limit shared? | A policy summary with limit, exclusions, and aggregation |
| Exit | How quickly can I withdraw, and to where? | The withdrawal procedure, typical timing, and approved addresses |
Title, evidence, and insurance take longest to confirm because the answers sit in contracts, audit reports, and policy wordings. For a company or trust, the agreement must also match the entity's governance (who may instruct the custodian), as our guide to buying cryptocurrency as a company explains. The exit check is the one a client can test before committing the full amount, since a small first withdrawal to an allowlisted address shows how long approvals actually take and who confirms the request.
In the US, crypto held by a custodian has no government deposit insurance, since the FDIC states its coverage does not apply to crypto assets. Many custodians buy private crime or specie insurance, but the limit is usually shared across clients, so the policy terms matter most.
Yes, in some cases: some custodians serve only funds and companies with high minimums, while some brokers and wealth platforms hold individual clients' assets on institutional custody infrastructure. Either way, ask who controls the keys, whether the assets stay legally yours, and how withdrawals are approved.
A crypto custodian's main job is safekeeping assets under a custody agreement, while an exchange's main job is matching buyers and sellers. Exchanges also hold customer crypto, often in pooled wallets, so the legal protection of those balances depends on their terms of use and jurisdiction.
Neither MPC nor multisig is safer in every case. MPC keeps approval rules off-chain and works on most blockchains, while multisig enforces its rules on-chain, where anyone can inspect them. Both depend on the people and software around them, as a February 2025 exchange theft showed when signers approved a disguised multisig transaction.
A SOC 2 Type II report means an independent CPA firm tested whether a custodian's controls over security, availability, processing integrity, confidentiality, or privacy operated effectively over a review period. It is strong evidence about controls but says nothing about solvency, so read it alongside audited financial statements.
Custody is the part of owning crypto where process carries the most weight, and a broker who confirms each withdrawal with you adds a human check to that process. UpTrade is a dedicated crypto brokerage built around real relationships, not a self-serve app you navigate alone.
See how UpTrade handles institutional custody and security, or read how UpTrade works with companies and trusts.
UpTrade is registered with AUSTRAC (registration DCE100856266-001). You can read more about registered providers at austrac.gov.au.
This article is for general informational purposes only and does not constitute financial, investment, or tax advice. It does not recommend any asset, allocation, or strategy. Cryptocurrency investments carry significant risk, including the possible loss of principal. Past performance is not indicative of future results. UpTrade does not make investment recommendations based on your personal financial circumstances. You should conduct your own research and seek independent financial advice before making any investment decisions.
General information only. This article is for educational purposes and does not constitute financial, investment, legal or tax advice, nor a recommendation to buy, sell or hold any asset. Cryptocurrency is a high-risk asset and you should consider your own circumstances and seek independent advice before making any decision. UpTrade does not make price predictions.
Market updates, new explainers and the occasional Alpha Pro report, sent once a week. Unsubscribe anytime.
