Custodying crypto-assets means managing the keys that move them: whoever controls the key controls the asset. That is why custody on behalf of third parties is a regulated service in the EU — under MiCA it requires CASP authorization — and why the first decision for any company touching crypto-assets is where and how its keys live.
Self-custody or delegated custody
In self-custody, the holder keeps their own keys: total control, total responsibility, no recourse if they are lost. In delegated custody, a professional third party manages them with legal obligations towards the client. Between the two sits a nuance that is often missed: delegating the interface does not remove custody, it relocates it — if your product holds your clients keys, the custodian is you, with everything that implies.
What MiCA requires from a custodian
Custody and administration of crypto-assets on behalf of clients is one of the ten services defined by MiCA, so a professional custodian needs CASP authorization. The core obligations: segregation of clients crypto-assets from the firms own estate, a register of positions per client, a written custody policy, and liability towards the client for the loss of crypto-assets or of the means of access where the incident is attributable to the custodian. Without authorization or a regulated-entity notification, there is no service.
Cold, hot, multisig and MPC
Technology distributes the risk. Cold wallets keep keys offline (maximum security, less agility); hot wallets stay connected for daily operations. Serious custodians combine both with multisig (several keys to authorize a movement) or MPC (the key never exists whole in one place), per-operation limits and separation of duties. No technology replaces operations: most losses come from processes, not from cryptography.
Custody in regulated tokenization is a different animal
If the token is a transferable security, we are no longer in MiCA: custody belongs to entities authorized to hold financial instruments — credit institutions and investment firms — and ownership is fixed by the register administered by the ERIR. That is the terrain of our security tokens service: the wallet is just the window; the source of truth is the register.
Choosing a custodian: the short list
Verifiable authorization (CASP or authorized financial entity, in the supervisors register); real, audited segregation rather than promised; documented technology (cold/hot split, multisig or MPC, key management); insurance or capital that answers for losses; contingency and key-succession plans; and transparency about sub-custodians. If a provider cannot show these six things in writing, the answer is no. More on this in our ranking of the best crypto custody companies.
Where we fit
We design and integrate the custody layer of asset tokenization platforms and digital-asset products: key architecture, segregation, limits and recovery, working with regulated custodians where the case demands it. If you are deciding how to custody your products assets, book a call.