Crypto Custody: What It Is and How Licensing Works

Crypto custody is a licensed service in which a provider holds private keys, or controls access to them, and so controls digital assets for clients. Holding your own keys is not custody in the regulated sense, and wallet software that never takes key control from the user stays outside the rules.

This guide compares the main custody models, explains what institutions ask of a custodian, and lays out what it takes to offer custody legally in the EU under the Markets in Crypto-Assets Regulation (MiCA), including the Class 2 capital tier.

What crypto custody is

Crypto custody means safekeeping crypto-assets, or the means of access to them, for someone else. MiCA defines it as safekeeping or control, on behalf of clients, of crypto-assets or of the means of access to them, such as private cryptographic keys (Regulation (EU) 2023/1114, Article 3(1)(17)). LegalBison’s wiki entry on crypto custody gives the short form.

The scope line is simple. Holding keys for others as a business triggers regulation, but holding your own does not. A firm that makes wallet software but never holds or controls a user’s keys falls outside the definition, since nothing is held on behalf of clients. The guide to the self-custody wallet covers that side of the boundary.

The market also uses the terms custody crypto and crypto asset custody for the same thing, and a crypto custody service is the commercial offering. If the provider controls the keys, it is custody, whatever the product is called.

Custody models compared

The models differ by who controls the keys, and that decides the regulatory consequence. The table sorts them by control.

With exchange omnibus custody, check segregation. MiCA requires a custodian to keep client holdings apart from its own and to mark clients’ means of access as theirs (Article 75(7)). Pooling clients together is a different question from mixing client assets with the firm’s own. The crypto exchange licensing guide covers the platform side.

No self-custody crypto wallet is best for everyone, and a ranking would mislead. What differs between wallets is who generates and stores the keys, how the recovery phrase is backed up, whether signing happens on a dedicated device, which chains the wallet supports, and whether anyone independent has reviewed the code. Control stays with the owner, and so does the whole risk of losing the keys.

Institutional crypto custody

Institutional crypto custody is custody for funds, corporates, exchanges, and other businesses, and the requirements go well beyond keeping keys safe. Institutions tend to look at four things.

Segregation comes first. Client assets must be legally and operationally separate from the custodian’s own, and on the ledger they must sit apart from the custodian’s holdings. MiCA Article 75(7) sets the duty. It matters most in an insolvency. Article 70 adds that a provider must protect clients’ ownership rights and must not use their assets for its own account.

Next is independent assurance. Institutions ask for audited control reports and security testing, which come from the market and the custodian’s own governance rather than from MiCA. The regulation does require a custody policy and procedures that minimize the risk of loss, and a summary of the policy must be available to clients.

Insurance is a commercial term and no substitute for segregation. Policies differ, and the exclusions decide what the cover is worth, so institutions read the terms before relying on it.

Reporting is the fourth. MiCA requires a register of positions in each client’s name and statements of holdings at least every three months and on request. Institutions usually negotiate more frequent, more detailed reporting by contract.

Banks reach this market by three routes. In the EU, MiCA lets certain already regulated entities, including credit institutions, provide crypto-asset services by notifying their supervisor under Article 60, without applying for a CASP authorization from scratch.

In the US, the Office of the Comptroller of the Currency (OCC) said in Interpretive Letter 1183 (March 2025) that national banks may provide crypto-asset custody, reaffirming Interpretive Letter 1170 of July 22, 2020 (see occ.gov).

State trust charters are the third route, and each state regulator is the place to confirm terms. The guide to the crypto banking license goes further on bank-side routes.

Crypto custody licensing under MiCA

Custody of crypto-assets for clients is a regulated CASP service under MiCA Title V, and it sits in Class 2 for minimum capital. In practice, that means five things.

First, Regulation (EU) 2023/1114, Annex IV sets a minimum own-funds requirement of EUR 125,000 for Class 2 services, which include custody and administration and the exchange of crypto-assets for funds or other crypto-assets. That is a floor. Article 67 also requires own funds equal to one quarter of the fixed overheads of the preceding year, and the higher amount applies.

Second, the custodian must be a legal person established in the EU, with its place of effective management there, so company formation comes first in practice.

Third, one authorization from a national authority lets the firm serve clients across the EU member states, using the notification procedure for cross-border services.

Fourth, Article 75 requires a written agreement with each client, a custody policy, a register of positions, procedures to return assets or the means of access as soon as possible, and segregation. Under Article 75(8), the custodian is liable to clients for loss of crypto-assets or access that is attributable to it. That liability is capped at the market value of the assets when the loss occurred.

Fifth, MiCA transitional cover for legacy providers ended on July 1, 2026 (Article 143(3)). A custodian still running on an old national registration now needs CASP authorization or a valid passport. The ESMA interim MiCA register lists authorized CASPs, as checked September 30, 2026.

The detailed authorization path is on the CASP license page, and the wider framework is on the MiCA license page.

The US has no single custody license. The qualified custodian route runs through bank and trust charters, and the SEC custody rule for registered investment advisers generally requires client assets to be held by a qualified custodian. In January 2025, SEC staff also rescinded Staff Accounting Bulletin (SAB) 121 through SAB 122, which ended the staff view that custodians record a balance sheet liability for client crypto. The current text of both is on sec.gov.

Become a custodian or partner with one

The choice comes down to capital, timeline, liability, and banking. Cost and timeline beyond the regulatory capital tier depend on the project, so none are stated here.

On capital, becoming a custodian means meeting the EUR 125,000 floor and the overhead-based test, plus paying for the technology, governance, and staff that Article 75 implies. On timeline, authorization takes as long as the regulator and the file require, and LegalBison scopes that per project.

Liability needs more thought. A licensed custodian carries the Article 75(8) liability to clients. Partnering moves operational custody to another firm, but a firm that serves clients under its own brand still has to work out whether it is providing the service itself or referring clients to a licensed custodian. The answer depends on the contracts and on who controls the keys. Banking is the last variable. Custodians need accounts for operations and, where they hold client funds, for safeguarding, and newer firms often find access difficult.

Anyone partnering should check five things in a provider of custody services or custody solutions:

1. Its authorization on the ESMA register
2. The terms of the custody agreement
3. How segregation is done on the ledger
4. Whether and how sub-custodians are used
5. What the liability clause says

That is a way to assess crypto custody providers. An initial call with LegalBison is free and helps work out which route fits.

How LegalBison helps

LegalBison is a global boutique legal and business services firm and licensed corporate service provider, with offices across Europe, MENA, Latin America, and Asia and operational reach in 50+ jurisdictions.

For custodians, the firm structures the EU entity, prepares the CASP authorization file, drafts the custody agreement and policy documents, and sets up the compliance program that runs after authorization. Its legal services cover the corporate and regulatory work around a custody business.

Regulators decide outcomes, and LegalBison does not guarantee approvals. To discuss a custody project, contact LegalBison.

FAQ about crypto custody

What is crypto custody?

Crypto custody is the safekeeping or control of crypto-assets, or of the keys that access them, on behalf of clients. In the EU, it is a regulated CASP service. Holding your own keys is not custody in that sense.

What is a crypto custody service?

A crypto custody service is a provider’s offer to hold and control clients’ keys and assets under a written agreement. Under MiCA, the provider must keep a register of each client’s positions, segregate client assets, and answer to clients for losses attributable to it.

Which banks are offering crypto custody services?

The structure matters more than any list. In the EU, credit institutions can offer crypto-asset services after notifying their supervisor under MiCA Article 60. In the US, the OCC has confirmed that national banks may provide crypto-asset custody, and some firms use state trust charters. Which banks offer it changes often, so this guide names none. The ESMA register and each regulator’s public lists are the places to check.

Can I lose my crypto with a custodian?

Yes. A custodian can fail, be hacked, or make operational errors, and regulation does not remove that risk. MiCA responds with segregation, return procedures, and liability for losses attributable to the custodian, capped at market value. The rules cited here do not create a deposit guarantee style scheme for crypto, and this guide makes no claim about the safety of any provider.

Who is the largest crypto custodian?

It depends on the measure: assets under custody, number of clients, or reach in a given jurisdiction. Providers report these figures themselves, on different dates and bases, and no single authoritative ranking exists. Naming one would amount to an endorsement. A better test is whether a provider holds the authorization your use requires.