Institutional crypto custody is the regulated safekeeping and administration of digital assets for a client. It includes controlled wallet and key operations, but also account governance, customer-authorized trading or transfers, settlement, books and records, valuation, tax information and reporting. A bank may perform those functions itself, appoint a sub-custodian, or combine both models under a documented third-party risk program.
Banks are entering because the operating model resembles established securities services and because institutions want auditable governance, fiat connectivity and a regulated counterparty. The permissions, asset coverage and customer protections are not universal: they depend on the bank’s charter, jurisdiction, fiduciary status, licenses, contracts and the networks it supports.
As an Amazon Associate I earn from qualifying purchases.
What institutional crypto custody actually covers
In a retail wallet, “custody” can mean controlling a private key. Institutional custody is a broader service relationship. The custodian is accountable for an agreed set of legal, operational and reporting duties around assets held for a client, with controls that can be examined by the client, auditors and supervisors.
Safekeeping is only one layer
The Office of the Comptroller of the Currency (OCC) describes a custody proposition that can include customer-directed exchange and trade execution, transaction settlement, recordkeeping, valuation, tax services and reporting. The client agreement should state exactly which of these functions are included, which are performed by another provider and where responsibility changes hands.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Custody function | What the institution should expect | Questions to document |
|---|---|---|
| Asset safekeeping | Controlled wallet, key and transfer operations designed to protect client assets. | Who can authorize a movement, how are approvals separated, and how are keys or signing credentials recovered? |
| Execution and exchange | Customer-directed purchases, sales or exchanges where the bank is permitted to provide them. | Which venues, assets and jurisdictions are covered, and what conflicts or best-execution controls apply? |
| Settlement | Completion of crypto and fiat legs of a transaction in accordance with the client mandate. | What settlement cycle, cut-off times, reconciliation and exception procedures apply? |
| Books and records | Records of positions, movements, instructions, approvals and counterparties. | Can the client obtain a complete, time-stamped audit trail in a usable format? |
| Valuation and reporting | Position values, tax information and periodic reports needed by the client and regulators. | Which pricing sources, valuation times, tax jurisdictions and report controls are used? |
Fiduciary and non-fiduciary capacity
OCC Interpretive Letter 1184 distinguishes fiduciary from non-fiduciary custody. If a bank acts in a fiduciary capacity, applicable fiduciary rules govern the relationship, including the scope of authority and duties accepted. A non-fiduciary arrangement still requires a clear custody contract, authorization matrix and safe-and-sound controls, but the bank is not taking on the same fiduciary role. An institution should have counsel identify the capacity before onboarding rather than infer it from the word “custody” in a product name.
How the custody workflow operates
A robust arrangement connects legal authority to every technical action. The following sequence shows where decisions, controls and records are created.
-
1. Establish the client and account governance
The bank identifies the legal customer, verifies authorized persons and opens the custody account. The agreement records whether the service is fiduciary or non-fiduciary, the permitted assets and networks, instruction channels, approval thresholds, settlement terms, reporting duties and treatment of corporate or protocol events. Institutions should require dual approval for high-risk actions and maintain a current list of signers and delegates.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
2. Place assets into controlled safekeeping
Assets are assigned to wallets or accounts controlled under the bank’s operating procedures. Controls should cover creation, address whitelisting, signing, transaction limits, emergency suspension, backup and recovery, reconciliation and access review. US regulators require safe and sound operation and effective internal controls; they do not prescribe one wallet architecture, hardware standard or multi-party-computation design. The control objective matters more than a particular product label.
-
3. Receive and authenticate an instruction
A client request is checked against the mandate, the authorized channel and the account’s available balance. The bank validates destination addresses, sanctions and other legal checks that apply to the transaction, then routes the instruction through the required approvals. Every rejection, override and exception should be recorded so the client can distinguish an unauthorized request from a technical failure.
-
4. Execute and settle crypto and fiat legs
Where permitted, the bank may exchange assets or execute a trade at the customer’s direction. It then coordinates delivery of the crypto leg and payment or receipt of fiat, applying the settlement terms in the agreement. Timing, network fees, confirmations, failed transactions and chain reorganizations need defined treatment. A bank can outsource execution or settlement, but outsourcing does not remove its responsibility to oversee the provider.
Rank #2
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet | 100% offline; Bitcoin, Ethereum, NFTs & altcoins; No seed phrase; NFC, Self custody wallet- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
-
5. Reconcile, value and report
On a schedule agreed with the client, the custodian reconciles on-chain balances, internal books, pending transactions and cash accounts. It supplies valuations, transaction histories, tax data and regulatory reports using documented pricing and cut-off rules. Breaks should generate an exception, an owner and a resolution deadline rather than remain as unexplained differences.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
6. Monitor providers and incidents
If a sub-custodian, wallet operator, exchange or technology provider is involved, the bank performs due diligence, sets service and security requirements, monitors performance and maintains exit or contingency plans. Incident response should cover a compromised credential, incorrect address, unavailable network, provider outage and suspected fraud, with escalation contacts known before an event occurs.
Is the crypto held by the bank or a third-party custodian?
Both structures are possible. A bank can operate the custody wallets and signing process directly, appoint a sub-custodian, or use a hybrid in which it controls the client relationship and records while a specialist performs some wallet or network functions. The legal answer is found in the custody agreement and account records, not in the bank’s marketing description.
| Model | How it works | Trade-offs to examine |
|---|---|---|
| Direct bank custody | The bank operates the relevant wallets, approvals, reconciliations and reporting. | Potentially clearer control, but the bank must maintain deep technical capability, 24-hour operations and network-specific expertise. |
| Sub-custody | A specialist holds or administers assets under a contract with the bank; the bank remains responsible for oversight appropriate to the arrangement. | May add expertise and resilience, while introducing dependency, concentration and exit risks. |
| Hybrid | The bank keeps governance, client records and selected assets in-house while assigning particular networks or functions to providers. | Can fit different asset types, but interfaces, reconciliations and responsibility boundaries must be tested. |
OCC guidance allows a bank to use a sub-custodian for permissible activities, subject to appropriate controls and third-party risk management. Institutions should verify segregation, title, insolvency treatment, audit rights, subcontracting, data access and the process for moving assets if a provider fails. “Held at a bank” does not automatically mean every technical action is performed by bank employees.
Why banks are entering the crypto-custody market
Existing securities-services capabilities transfer
Safekeeping, settlement, books and records, valuation and reporting are familiar banking activities. Crypto adds new wallet, network and key-control requirements, but the surrounding service disciplines are recognizable. Customer-directed exchange and trade execution extend that platform for clients that want one relationship spanning digital assets and fiat cash.
Free tools Windows power users keep installed
One-click scans. No signup required.
Institutional clients want governed operations
Funds, corporates, asset managers and other professional investors commonly need documented authority, segregation, reconciliations, audit trails, tax reporting and integration with treasury or fund-administration systems. A regulated banking counterparty can address those needs, although the exact protection depends on the contract and local law. These are service-model incentives, not evidence that every bank has adopted crypto custody.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
The addressable activity is growing
The European Central Bank reported €4.7 billion of crypto-asset and crypto-related investment-product custody services in 2024, up from about €400 million in 2023. Those figures describe the activity measured by the ECB and do not represent a universal global market total, but they illustrate why established financial institutions see a larger client opportunity than in the market’s earlier stages.
US permissions are clearer than they once were
OCC Interpretive Letter 1184, issued May 7, 2025, states that national banks and federal savings associations may provide custody and execution services, buy and sell assets at a customer’s direction, and outsource permissible activities subject to risk management. The letter says, “The cryptocurrency and fiat currency exchange and trade execution services described above encompass these activities.”
A joint statement from the Federal Reserve Board, Federal Deposit Insurance Corporation and OCC on July 14, 2025 emphasized safe-and-sound operation and compliance with applicable law. It also said, “The statement does not create any new supervisory expectations.” That is clarification of existing principles, not a blanket approval for every bank, asset or business model.
Regulatory map: permission is jurisdiction- and service-specific
| Region | What the cited authorities establish | What remains to be checked |
|---|---|---|
| United States | OCC authority covers custody, customer-directed execution and outsourcing for national banks and federal savings associations, with applicable-law and third-party-risk conditions. The July 2025 interagency statement reinforces safe-and-sound risk management. | The bank’s charter, state or federal permissions, fiduciary status, supported assets, money-transmission or securities requirements and client-protection terms. |
| European Union | ESMA’s MiCA Q&A says credit institutions can provide crypto-asset services through the notification procedure. | Banking authorization, the specific service notification, national implementation details, asset scope and any additional permissions. |
| Global | The Financial Stability Board’s 2025 peer review found 11 jurisdictions, or 39%, with finalized financial-stability frameworks and eight, or 29%, consulting or finalizing frameworks. It identifies two broad approaches: applying existing financial regulation to crypto-assets or creating bespoke regimes. | Whether the provider is licensed where the client and assets are located, how cross-border activity is treated and which insolvency, safeguarding and disclosure rules apply. |
A license in one country is not a universal global license. Availability, customer protections, asset coverage and the ability to serve a particular fund or corporate entity must be confirmed for the actual transaction and client location.
What protections and risks should an institution analyze?
OCC Bulletin 2025-17, dated July 14, 2025, states: “Banks that are providing safekeeping for crypto-assets must do so in a safe and sound manner and in compliance with applicable laws and regulations.” In practice, that principle turns into a control framework rather than a mandated technology stack.
- Authority risk: an employee or compromised credential could initiate a transfer outside the client mandate. Use role separation, multi-person approval, address controls and independent review.
- Key and wallet risk: loss, theft or corruption of signing material can make assets inaccessible. Require tested recovery, controlled backups, documented ceremonies and periodic access recertification.
- Network and asset risk: a token may change contracts, pause transfers or operate on several networks with different finality rules. Define supported versions, confirmation standards and handling of forks or chain reorganizations.
- Counterparty and sub-custodian risk: a provider outage, insolvency or control failure can interrupt access. Review financial condition, concentration, audit reports, subcontractors, exit plans and contractual liability.
- Record and valuation risk: incomplete transaction histories or inconsistent pricing can distort financial statements and tax reports. Reconcile on-chain data to internal books and disclose valuation methodology.
- Legal and protection risk: crypto-assets are not automatically bank deposits and should not be presented as covered by deposit insurance. Determine segregation, insolvency treatment, insurance terms and contractual allocation of losses for the specific service.
Regulatory sources do not establish one universal insurance level or wallet design. A provider’s stated insurance limit is meaningful only when the institution understands covered events, exclusions, deductibles, claims procedures and whether the policy protects the client directly or the custodian.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
How to compare institutional custodians
Use a written requirements matrix before accepting a proposal. The following dimensions reflect the legal and operational issues that determine whether a provider fits a particular mandate.
| Comparison area | Evidence to request |
|---|---|
| Authorization and geography | Charter or license, regulator, permitted services, client-entity eligibility and countries served. |
| Fiduciary capacity | Whether the account is fiduciary or non-fiduciary, governing law and duties accepted in the agreement. |
| Asset and network coverage | Exact tokens, chains, standards, confirmation policy, staking or protocol-event treatment and unsupported-asset procedure. |
| Safekeeping controls | Wallet architecture, signing quorum, approval roles, address allowlists, recovery tests, key ceremonies and access reviews. |
| Execution and settlement | Instruction channels, trade venues, settlement timing, fiat rails, reconciliation and exception handling. |
| Books, valuation and tax | Position and transaction reports, pricing sources, valuation time, tax forms, data exports and audit support. |
| Segregation and insolvency | Client-asset segregation, title records, omnibus versus individually identified accounts and treatment if a provider fails. |
| Third-party oversight | Sub-custodian list, due diligence, audit rights, service-level metrics, concentration limits and termination assistance. |
| Resilience and incidents | Business-continuity objectives, recovery testing, cyber response, communications tree and post-incident reporting. |
| Loss allocation | Insurance, exclusions, contractual liability, indemnities, caps, claims process and responsibilities for client instructions. |
| Integration | APIs or files for trading, fund administration, treasury, accounting and compliance systems. |
Questions procurement should ask
- Which entity signs the custody agreement, and which entity actually controls each wallet?
- Can the bank refuse an asset, network or transaction after onboarding, and how much notice will it provide?
- What happens to assets and records if the bank or a sub-custodian becomes insolvent?
- How are emergency transfers authorized during an outage, suspected compromise or lost signer event?
- Which reports are produced daily, monthly and annually, and can the client independently reconcile them?
- What evidence demonstrates that recovery, access revocation and incident procedures have been tested?
Common mistakes and how to avoid them
Assuming a banking name means universal permission
Confirm the specific legal entity, charter, service permission and geography. A bank may be authorized to safeguard one class of assets but not to execute trades, serve a particular client type or support every network.
Treating custody like a deposit account
Custody records ownership and administration of client assets; it is not automatically a deposit, and deposit insurance should not be assumed. The contract should explain segregation and loss allocation in plain language.
Leaving fiduciary status ambiguous
State the capacity in the agreement and map the resulting duties to approvals, conflicts management, investment discretion and reporting. Do not rely on a product brochure to answer a legal question.
Outsourcing without accountability
OCC guidance permits sub-custody but expects appropriate controls. Maintain a provider inventory, monitor concentration and service performance, test exit plans and keep enough records to reconstruct every client asset and instruction.
Buying a technology label instead of a control system
No cited regulator mandates a particular multi-party-computation, hardware or wallet model. Compare authorization, recovery, segregation, monitoring and resilience outcomes, then choose technology that satisfies those controls.
A practical implementation sequence for an institution
- Define the mandate: list entities, jurisdictions, assets, networks, transaction volumes, fiduciary expectations and reporting outputs.
- Map the legal perimeter: obtain advice on licensing, custody, execution, settlement, sanctions, tax and insolvency treatment in every relevant location.
- Design authority and segregation: approve roles, limits, signer changes, address controls, reconciliations and escalation paths before production access.
- Evaluate direct and sub-custody options: compare control evidence, provider dependencies, supported networks, integration and exit capability rather than price alone.
- Test before funding: run small-value transfers, failed-transaction scenarios, recovery exercises, report reconciliations and incident communications.
- Review continuously: reassess licenses, providers, networks, contracts, concentration, control testing and client reporting as the service changes.
Bottom line
Institutional crypto custody is a regulated operating chain: establish authority, safeguard assets, execute only approved instructions, settle crypto and fiat, reconcile records, report accurately and control every third party. Banks are entering because those functions extend familiar securities-services capabilities and because institutional clients value governed operations and fiat integration. The right custodian is therefore not simply the one with a secure wallet; it is the provider whose legal permissions, fiduciary posture, controls, records, resilience and contractual protections match the institution’s exact assets and jurisdictions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
