Quick answer
Digital asset custody follows two regimes depending on the nature of the asset. If it is a crypto-asset that is not a financial instrument, custody is a crypto-asset service provider (CASP) service under MiCA. If it is a tokenised security, that is, a financial instrument represented on a network, safekeeping corresponds to authorised entities under MiFID II and the LMVSI, with an ERIR (the entity responsible for registration and recording) administering the register.
Two assets, two regimes
The word custody conceals two legally distinct services. The boundary is not set by the technology, which in both cases may be a blockchain, but by the nature of the asset held. That classification determines the applicable rules, the authorised entity and the guarantees the holder receives.
The crypto-asset regulation governs the provision of services on crypto-assets that are not financial instruments, and includes among them the custody and administration of crypto-assets on behalf of clients. But it expressly excludes from its scope crypto-assets that qualify as financial instruments within the meaning of MiFID II (MiCA, Regulation (EU) 2023/1114, Art. 2(4)). Consequently, a token representing a share, a bond or a fund unit does not fall under MiCA: it is governed by securities markets rules.
Crypto-asset custody: the CASP service under MiCA
When the asset is a crypto-asset that is not a financial instrument, for example a utility token or a cryptocurrency, holding it on behalf of third parties is a service reserved to an authorised crypto-asset service provider. MiCA subjects these providers to an authorisation and supervision regime, with capital, governance and conduct requirements, and specific obligations for the custody service (MiCA, Regulation (EU) 2023/1114).
The CASP custodian must keep a record of positions per client, separate clients' crypto-assets from its own, and be accountable for their availability. Holding the cryptographic keys that control access to the crypto-assets is the operational core of the service: whoever controls the keys controls the asset. Hence the importance of key-custody policies, backup procedures and the provider's liability in the event of incidents.
Custody of tokenised securities: authorised entities and the ERIR
The second regime applies when the digital asset is a financial instrument represented through distributed ledger technology. Ley 6/2023 (Spain's Securities Markets Law, LMVSI) recognises DLT systems as a valid way to represent transferable securities, alongside book entries and certificates (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053). Being financial instruments, their safekeeping and administration on behalf of clients is an ancillary investment service subject to MiFID II and the LMVSI (MiFID II, Directive 2014/65/EU).
This service may be provided by entities authorised to safekeep financial instruments: credit institutions and investment services companies and brokerage firms with the relevant authorisation. Operating a technological infrastructure is not enough; authorisation for the investment service of safekeeping is required. Where the credit institution is at the same time the depositary of a collective investment scheme, it also performs the depositary and oversight functions imposed by the collective investment regime (Ley 35/2003 on collective investment schemes).
The role of the ERIR
For securities represented through DLT, a figure appears that has no equivalent in crypto-asset custody: the entity responsible for registration and recording. The ERIR administers the register of the securities on the network, identifies the holders, determines the nature and number of securities and guarantees the integrity and immutability of the entries, and must also have a contingency plan for the continuity of the register (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053). The CNMV authorised Ursus-3 Capital, a brokerage firm, as the first ERIR in Spain on 22 November 2024.
It is important not to confuse recording and custody. The ERIR administers who is listed as holder on the network; custody as an investment service refers to the safekeeping of the instruments on behalf of the client. A single authorised entity may take on both functions, but they are distinct responsibilities with their own legal bases.
Asset segregation
Separating the client's assets from the entity's own is a principle common to both regimes, though with different anchors. In the custody of financial instruments, the client-asset protection rules derived from MiFID II require identifying and separating each client's securities and avoiding their use for the entity's own account without consent (MiFID II, Directive 2014/65/EU). In crypto-asset custody, MiCA requires the provider to keep clients' positions segregated from its own and to maintain a faithful record of positions (MiCA, Regulation (EU) 2023/1114).
Segregation serves a protective function: in the event of the custodian's insolvency, the client's assets must not be confused with the custodian's estate. In the digital environment, segregation also projects onto the management of keys and addresses, so that each client's positions are identifiable and can be reconstructed.
DORA: the operational resilience layer
Over both regimes operates the digital operational resilience regulation, applicable to financial entities and their technology providers. DORA requires technology risk governance, incident management and reporting, periodic resilience testing and control of the risk of critical third-party providers, and is fully applicable since 17 January 2025 (DORA, Regulation (EU) 2022/2554).
For a digital asset custodian this translates into concrete obligations: continuity plans, cybersecurity incident management, infrastructure testing and oversight of the providers that underpin the recording and custody operation. The strength of the keys or the smart contracts does not exempt it from the resilience framework; it complements it.
Self-custody versus regulated custody
Self-custody means the holder keeps, by themselves, the keys that control their crypto-assets, without an intermediary. It is legitimate for crypto-assets and grants direct control, but it shifts all the operational risk to the holder: losing the keys means losing the asset, with no third party to answer for it. There are none of the segregation, supervision or resilience guarantees proper to a regulated custodian.
In the field of tokenised financial instruments, self-custody does not fit in the same way. The recording of ownership rests on an ERIR and custody as an investment service is reserved to authorised entities, so the model is built on supervised intermediaries, not on individual holding of keys outside the system. The choice between direct control and regulated protection depends on the type of asset and the holder's profile.
Frequently asked questions
Is a tokenised security held in custody under MiCA?
No. A tokenised security is a financial instrument, so its safekeeping is governed by MiFID II and the LMVSI, and it is provided by an authorised entity. MiCA excludes from its scope crypto-assets that are financial instruments (MiCA, Regulation (EU) 2023/1114, Art. 2(4)).
What is the difference between an ERIR and a custodian?
The ERIR administers the register of the securities on the network and identifies the holders; the custodian safekeeps the instruments on behalf of the client as an investment service. A single authorised entity may take on both, but they are distinct functions (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053).
Can a technology company safekeep tokenised securities without a licence?
No. The safekeeping of financial instruments is a service reserved to authorised entities under MiFID II and the LMVSI. Operating the technological infrastructure is not the same as being authorised to provide safekeeping (MiFID II, Directive 2014/65/EU).
Does DORA apply to crypto-asset custodians?
Yes. DORA reaches financial entities, including crypto-asset service providers, and their critical technology providers, with full application since 17 January 2025 (DORA, Regulation (EU) 2022/2554).
What this means for you
Before entrusting a digital asset to a custodian, first identify what the asset is. If it is a crypto-asset, verify that the provider is authorised as a CASP under MiCA. If it is a tokenised security, check that custody is provided by an entity authorised for financial instruments and who acts as the ERIR. In both cases, the segregation of your assets and DORA compliance are indicators of how robust the service is. Self-custody offers control, but without the protections of a regulated custodian.
This content is for general information and educational purposes only. It is not legal, tax or investment advice and does not replace consultation with a qualified professional. Regulation on tokenisation and crypto-assets evolves; always check the version in force of the rules cited in the BOE (boe.es) and EUR-Lex (eur-lex.europa.eu).
.webp)
.webp)
.png)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
%20(1).webp)
.webp)
.webp)
.webp)
.png)
.png)
.png)
