- Custody means control over the ability to move assets, not only storing them.
- There are three routes. Most institutions combine them, and start with a partner.
- Ask every provider the same questions in writing, and compare the answers side by side.
What custody means
In traditional markets, custody means safekeeping assets and servicing them: settlement, corporate actions and reporting. For digital assets, the core of the job is controlling the cryptographic keys that authorize movement, together with the legal and operational structure around them. A custodian that holds the keys can move the assets, so the quality of its controls, its legal structure and its resilience decide whether client assets are safe.
Three routes
Building means operating the key management and custody infrastructure yourself. Partnering means appointing a specialist custodian, or a provider of custody technology that you integrate into your own operations. Buying, in this context, means acquiring a custody business or capability outright. In practice, institutions often partner first and then decide which parts to bring in-house.
| Consideration | Build | Partner | Buy |
|---|---|---|---|
| Control | Highest. You design everything. | Shared. Depends on the contract and the provider. | High, once integrated. |
| Time to market | Longest. | Shortest. | Long, with integration risk. |
| Regulatory responsibility | Rests with you for the full stack. | Depends on the structure. Some responsibility stays with you. | Rests with you. |
| Cost profile | High fixed cost. Economies of scale come later. | Variable, driven by assets and activity. | High up front, then largely fixed. |
| Concentration and exit | Low dependence on a provider. | Dependence on one provider. Exit has to be planned. | Low dependence on a provider. |
The table is a starting point. The right answer depends on the volumes you expect, the assets you support and the regulatory position you take, which is why we recommend writing down the criteria and their weights before speaking to providers.
Questions to put to every custodian
Ask each provider the same questions in writing, and compare the answers side by side.
- Where are the keys held, who can use them, and how is access controlled and approved?
- How are client assets segregated from the provider's own, and how is that evidenced?
- What does insurance cover, and what does it exclude?
- What independent assurance is available, such as audit or control reports?
- How are client assets treated if the provider becomes insolvent, and under which jurisdiction's law?
- Which sub-custodians or technology providers does it rely on?
- How does it handle recovery, incident response and disclosure to clients?
- What are the terms for leaving, and how are assets transferred out?
Weak or evasive answers are information. So is a provider that answers every question the same way, whatever your use case.
Decide on the integration, not only the vendor
Custody sits inside your operations. Reconciliation, client reporting, transaction approval and incident handling all touch it. Before signing, map how the provider's processes connect to yours, who reconciles what, and what happens on a bad day. Many problems come from the integration rather than from the custodian.
A sensible path
For most banks, credit unions and wealth managers the practical path is to set the criteria, shortlist a small number of providers, run structured due diligence, pilot with limits, and review. Keep the option of bringing parts in-house once volumes and experience justify it.
This article is general information and reflects our own approach. It is not legal, regulatory or investment advice.