Crypto custody providers: institutional solutions and how to choose one

"Custody provider" hides four different products: a regulated custodian that holds your keys, an MPC infrastructure that lets you hold them yourself, a multisig that splits control, and a wallet-as-a-service that embeds all of it in your product. Choosing well starts with knowing which of the four you need; the brand comes later.

The four institutional custody solutions

Qualified custodian. An authorized entity (in the EU, with a CASP license) safekeeps the crypto-assets on the client's behalf: it is the party that answers, that is supervised, and that funds, managers and issuers are required to use. It is the default when the assets belong to third parties or are regulated — see what a digital asset custodian actually does.

MPC infrastructure. The key never exists in one piece: it is split into shares across devices or parties that sign together (multi-party computation). It is what custodians run internally and what a company can deploy to self-custody with approval policies, limits and audit trails. Full control, full responsibility — the trade-off of self-custody.

Multisig. Several independent keys must sign every movement. Simpler than MPC, on-chain and verifiable, ideal for treasuries and DAOs; less flexible across chains.

Wallet-as-a-service. The provider gives you wallets through an API to embed in your application — every user gets one without ever seeing a seed phrase — and you decide the custody model behind it. It is the route for platforms, fintechs and games.

Custody providers with a public register entry

In the European Union, only an entity authorized as a crypto-asset service provider (CASP), or a financial entity allowed to provide those services, may hold crypto-assets in custody on behalf of clients (Article 59(1) of MiCA), and ESMA publishes a register of those providers (Article 109). The table lists a selection of entities whose authorization we checked on October 13, 2026, in ESMA's interim register (provider file updated on October 7, 2026) and in the register of each national supervisor: the CNMV, BaFin, the AMF and the CSSF. All of them are registered for custody and administration of crypto-assets on behalf of clients (Article 3(1)(16)(a)). It is neither a complete list nor a ranking: rows are ordered by country, and in the ESMA file 227 of the 365 registered entities have that service, 11 of them in Spain.

In Germany, the BaFin entry for all three entities also shows, since December 30, 2024, the national qualified custody license (qualifiziertes Kryptoverwahrgeschäft, Section 1(1a), second sentence, no. 6 of the German Banking Act, KWG), which covers the custody and administration of cryptographic instruments for others and safeguarding, for others, the private keys used to store or dispose of cryptographic instruments, crypto securities, crypto fund units and other securities recorded with distributed ledger technology. Being listed in these registers means an entity may provide the service; it says nothing about its fees, its insurance or its solvency. Before signing up, look the entity up in the current ESMA file: if its authorization end date is filled in, it is no longer authorized.

How to choose a provider: the criteria that matter

Legal regime. Who is the custodian in law: them or you? If it is them, under which authorization and in which jurisdiction? A technology provider is not a custodian, however good its technology. Segregation and insolvency. Your assets must be separated from the provider's and from other clients', and you need to know what happens to them if the provider fails. Proof of reserves and audit: what they publish, how often and who verifies it. Insurance: what the policy really covers — many exclude exactly the case you worry about. Asset and chain coverage: the ones you use today and the ones you will need. Operations: approval policies, limits, roles, withdrawal times, API and logs. Cost: fixed fee, percentage of assets and per-movement charges add up very differently depending on your volume.

A checklist to compare institutional custodians side by side:

What the regulator requires

In the EU, custody of crypto-assets on behalf of third parties is a MiCA service that requires authorization, a custody policy, segregation and liability for loss. In regulated tokenization, custody is a different figure — that of the transferable security, with registrars and depositaries — which we explain in crypto-asset custody.

Qualified custody in the US

In the US, "qualified custodian" is not just a market label but a defined term in the SEC custody rule for investment advisers: Rule 206(4)-2 under the Investment Advisers Act (17 CFR 275.206(4)-2). An adviser registered or required to be registered with the SEC that has custody of client funds or securities must keep them with a qualified custodian, in a separate account for each client under the client's name or in accounts that hold only clients' assets under the adviser's name as agent or trustee (paragraph (a)(1)).

• Who qualifies (paragraph (d)(6)). A bank as defined in section 202(a)(2) of the Advisers Act or an FDIC-insured savings association; a registered broker-dealer holding the assets in customer accounts; a registered futures commission merchant, only for certain futures-related assets; and a foreign financial institution that customarily holds financial assets for its customers and keeps advisory clients' assets segregated from its own.
• What custody means. Holding client funds or securities, directly or indirectly, or having any authority to obtain possession of them, including through a related person (paragraph (d)(2)).
• Other conditions. The adviser must have a reasonable basis to believe the qualified custodian sends account statements to clients at least quarterly (paragraph (a)(3)), and client assets must be verified by an independent public accountant in a surprise examination at least once each calendar year, with exceptions (paragraph (a)(4)).

The 2026 proposal, not yet in force. On October 6, 2026, the SEC published in the Federal Register a proposal on custody rules for advisers and regulated funds, including crypto assets (Release Nos. IA-7023 and IC-36353, File No. S7-2026-35, 91 FR 63870), with comments due by December 7, 2026. Its crypto provisions would apply only to crypto assets that are funds or securities, and the proposal also modernizes the custody rules more broadly. Among other changes, it would:

• allow advisers to self-custody clients' crypto assets when they determine in writing, initially and every quarter, that no permitted custodian is available, subject to safeguarding expertise and systems (including private key management and joint authorization of transactions by at least two people), cybersecurity controls, internal control reports and quarterly account statements;
• add State trust companies authorized by their State banking authority to provide crypto asset custody as an express category of permitted custodian for crypto assets, subject to written safeguarding policies, audited financial statements, internal control reports and segregation from the trust company's own assets (today a State trust company qualifies only if it meets the definition of "bank" in section 202(a)(2) of the Advisers Act, a fact-specific test that a staff no-action letter of September 30, 2025 addresses);
• redesignate Rule 206(4)-2 as Rule 223-1 and add Form ADV questions on tokenized private funds.

Until the SEC adopts a final rule, the current Rule 206(4)-2 is the one that applies; an earlier proposal, the 2023 Safeguarding Proposal, was formally withdrawn on June 12, 2025. For tokenized securities, custody also has to fit the token's design: if the token is permissioned under ERC-3643, the custodian's wallet must be registered and verified in the token's Identity Registry, or transfers to it will fail. For the EU perspective, see our qualified custodian entry and, for how tokenized securities are issued in the US, our guide to asset tokenization in the United States.

Reference providers and our role

The reference custodians and technology providers — and why some are custodians and others are not — are in our guide to crypto custody companies. We do not custody: we integrate. We design the model (qualified, MPC, multisig or embedded), connect it to the custodian or deploy the infrastructure, and build the wallet and policy layer on top — our wallet and custody development service. If you have to decide where your company's keys live, talk to us.