Buy a licensed company 
VASPs live data and insights 
Learn about crypto safety 
Read the latest research 
Crypto Custody for Institutions: Who Can Legally Hold Client Assets
The institutional adoption of crypto has moved from a speculative experiment to a core component of modern finance. As we navigate the landscape of 2026, the question is no longer whether large-scale entities should hold Bitcoin or Ethereum. Instead, the focus has shifted entirely to the legal and operational framework that governs how they do it. For fiduciaries, fund managers, and corporate treasurers, the most critical decision involves identifying who can legally hold client assets.
Institutional participation in the cryptocurrency market relies on a foundation of trust and regulatory compliance. Unlike retail investors who might use a hardware wallet or a standard exchange account, institutions operate under strict mandates. These mandates require them to protect investor capital through rigorous risk management.
The legal concept of “custody” in the crypto space has matured significantly. In the early days, “not your keys, not your coins” served as the primary mantra. Today, for a registered investment adviser (RIA) or a pension fund, the mantra is “not a qualified custodian, not a legal allocation.” Lawmakers have spent the last few years clarifying exactly what this means.
Defining the Qualified Crypto Custodian
To understand who can legally hold client assets, one must first understand the “Qualified Custodian” (QC) designation. This term represents a specific class of financial institutions that meet high regulatory bars for security, capital reserves, and reporting.
In the United States, the Securities and Exchange Commission (SEC) redefined these standards through the implementation of the Safeguarding Rule (Rule 223-1), which superseded the older Custody Rule. This rule ensures that any RIA with “possession or control” of client assets must maintain those assets with a QC.
The Legal Taxonomy of Custodians
Several types of entities currently qualify as legal custodians for cryptocurrencies:
- National Banks and Federal Savings Associations: These institutions operate under the oversight of the Office of the Comptroller of the Currency (OCC). Banks like BNY Mellon and State Street have integrated digital asset custody into their traditional suites.
- State-Chartered Trust Companies: Many of the most prominent crypto-native firms, such as Coinbase Custody and BitGo, operate as trust companies under New York or South Dakota law. These entities exist specifically to exercise fiduciary powers.
- Federally Chartered Crypto Banks: Anchorage Digital Bank N.A. remains a unique example of a digital asset native firm holding a national bank charter.
- Foreign Financial Institutions (FFIs): For global funds, an FFI may qualify if it maintains assets in a way that provides similar protections to a U.S. bank.
The Historical Context: Crypto Custody for Institutions
The road to the 2026 regulatory environment was not smooth. For years, the industry operated in a gray area where the SEC and other regulators issued warnings without providing a clear path forward.
The Impact of SAB 121
A significant hurdle for traditional banks was the SEC’s Staff Accounting Bulletin No. 121 (SAB 121). This bulletin required banks to list the crypto assets they held for clients as liabilities on their own balance sheets. This requirement forced banks to set aside massive amounts of capital to offset those liabilities, which effectively made crypto custody too expensive for most major banks.
The repeal of SAB 121 in early 2025 changed the game. Once the SEC rescinded this guidance, the gates opened for traditional “mega-custodians.” This allowed the world’s largest banks to apply their 100-plus years of experience in safeguarding trillions of dollars to the crypto space.
The Maturation of the Safeguarding Rule
The 2025 finalization of Rule 223-1 closed several loopholes. It expanded the definition of assets that require a qualified custodian. Previously, some argued that certain cryptocurrencies were not “funds or securities” and thus fell outside custody rules. The new rule explicitly covers all digital assets, including tokens, stablecoins, and even certain tokenized real-world assets (RWAs).
Who Can Legally Hold Assets in 2026?
Determining who can legally hold assets requires a look at three distinct jurisdictional approaches: The United States, the European Union, and the Asia-Pacific region.
The United States: The QC Gold Standard
In the U.S., the SEC remains the primary arbiter of custody rules for investment advisers. The legal framework now demands that a custodian provide “possession or control” of assets.
What does “possession or control” mean for a digital asset? It means the custodian must hold the private keys in a way that prevents the investment adviser from moving the assets without the custodian’s involvement. This “firewall” prevents the commingling of assets and protects against internal fraud at the advisory firm.
The European Union: The MiCA Era
Europe has taken a more prescriptive approach with the Markets in Crypto-Assets (MiCA) regulation. By now, MiCA is fully operational across all 27 EU member states.
Under MiCA, an entity must be a Crypto-Asset Service Provider (CASP) to offer custody services. The requirements for a CASP license are stringent. They include:
- Strict Asset Segregation: The custodian must keep client assets separate from its own proprietary assets at all times.
- Liability for Loss: In the event of a hack or operational failure, the CASP is legally liable for the loss of client assets.
- Prudential Safeguards: CASPs must maintain high levels of insurance or own funds to cover potential risks.
Traditional European banks have aggressively sought CASP licenses. This has created a competitive market where specialized firms like Sygnum Bank compete directly with legacy giants.
Asia-Pacific: The Hub Approach
Singapore and Hong Kong have emerged as leaders in institutional custody. The Monetary Authority of Singapore (MAS) requires custodians to hold a Major Payment Institution license or be a regulated bank. Similarly, Hong Kong’s Securities and Futures Commission (SFC) has implemented a licensing regime for virtual asset trading platforms (VATPs) that includes mandatory third-party custody or strict internal segregation.
The Technical Standards of Legal Custody
Legally holding assets is not just about having a license; it is about the technology that enables that license. Regulators now look at the “how” just as much as the “who.”
Multi-Party Computation (MPC)
MPC has become the industry standard for institutional custody. Instead of a single private key that someone can steal or lose, MPC breaks the key into multiple “shards.” These shards are distributed among different servers and locations. To sign a transaction, a quorum of shards must interact without ever recreating the full key in one place.
From a legal perspective, MPC fulfills the “possession and control” requirement because no single person (neither the client nor a rogue employee at the custodian) can unilaterally move the funds.
Hardware Security Modules (HSMs)
Many custodians combine MPC with HSMs. These are physical devices that store the key shards in a tamper-proof environment. If someone attempts to physically open an HSM, the device erases the data. Regulators favor this approach because it provides a hardware-backed audit trail.
Legal Insight: A custodian’s “Possession or Control” status often hinges on their ability to prove that an unauthorized party cannot access the keys. This is why self-custody solutions, even those using institutional-grade hardware, rarely meet the legal definition of a Qualified Custodian for RIAs.
Bankruptcy Remoteness: The Ultimate Legal Shield
The collapse of various centralized platforms in 2022 taught the industry a painful lesson about “debtor-creditor relationships.” When a user deposits assets on a standard exchange, they often become an unsecured creditor. If the exchange goes bankrupt, the user’s assets might be used to pay off the exchange’s debts.
For institutions, this is unacceptable. A legal custodian must ensure “bankruptcy remoteness.”
Segregated Accounts
A legal custodian holds client assets in segregated accounts. These assets do not appear on the custodian’s balance sheet. If the custodian fails, the client cryptocurrencies remain the property of the client.
In 2026, the New York Department of Financial Services (NYDFS) and the SEC both require explicit “F/B/O” (For the Benefit Of) titling of accounts. This legal structure ensures that the assets are not part of the custodian’s estate in a bankruptcy proceeding.
Independent Audits in Institutional Crypto Custody
So, who can legally hold assets? Only those who can prove they have them. The “Proof of Reserves” (PoR) movement has evolved into a mandatory requirement for many jurisdictions. In 2026, top-tier custodians undergo “Type II SOC 1” and “SOC 2” examinations. These audits verify that the custodian’s internal controls and security protocols actually function as described.
The Rise of Sub-Custody
An interesting development in 2026 is the rise of sub-custody. Many traditional banks do not want to build the underlying blockchain infrastructure themselves. Instead, they obtain the legal license to act as a custodian but use a specialized technology provider (like Fireblocks or Copper) as a sub-custodian.
This creates a two-tier legal structure:
- The Primary Custodian: The bank that holds the regulatory license and the client relationship.
- The Sub-Custodian: The technology provider that manages the actual key shards and blockchain interactions.
Regulators have clarified that the primary custodian remains legally responsible for the assets. This allows institutions to get the “best of both worlds”: the legal protection of a global bank and the technical agility of a crypto-native firm.
Final Thoughts on Crypto Custody for Institutions: The Sector is Branched
The landscape of who can legally hold client assets has settled into two distinct paths. On one side, we have the “Global Mega-Custodians” like BNY Mellon and State Street, who offer a one-stop-shop for traditional assets and cryptocurrencies. On the other side, we have “Pure-Play Digital Custodians” like BitGo and Anchorage, who focus exclusively on the unique nuances of the blockchain space.
For an institution, the choice depends on their specific needs. If they require deep integration with traditional equities and bonds, a legacy bank is the likely choice. If they need to participate in decentralized finance (DeFi), staking, or complex on-chain governance, a crypto-native qualified custodian often provides better functionality.
The “Wild West” era of crypto storage is over. The legal infrastructure of 2026 provides the certainty that institutions need to commit capital for the long term.
Frequently Asked Questions (FAQ)
Can an investment adviser hold their own clients’ crypto keys?
Under the SEC’s Safeguarding Rule, an RIA generally cannot hold their own clients’ private keys. They must use a Qualified Custodian to ensure a separation of duties and prevent the unauthorized movement of funds.
Is a standard crypto exchange a Qualified Custodian?
Most standard exchanges are not Qualified Custodians. While some exchanges have separate, regulated “Custody” subsidiaries (like Coinbase Custody), the main trading platform usually operates under a different legal framework that may not offer the same bankruptcy protections.
Does insurance cover the loss of crypto at a custodian?
Most institutional custodians carry “specie insurance” or “cold storage insurance” that covers physical theft or hacks. However, insurance rarely covers losses due to market volatility or bad investment decisions by the client.
Are stablecoins subject to custody rules?
Yes. In the U.S. and the EU (under MiCA), stablecoins are considered assets that must be safeguarded by a regulated entity. The reserves backing those stablecoins must also be held by a qualified institution.
What happens to my assets if a Qualified Custodian goes bankrupt?
Because of “bankruptcy remoteness” and account segregation, your assets should not be accessible to the custodian’s creditors. You retain legal title, and the assets should be returnable to you through the liquidation process
