To evaluate a crypto custodian, look past labels such as “institutional-grade,” “regulated” or “insured.” Verify who controls the keys and authorizes transactions, how your ownership and balances are recorded, which legal entity provides the service, and what the actual insurance policy and contract let you recover. A regulator’s permission to offer custody is not proof that a provider’s controls work, and private insurance is not government deposit insurance.
Start with the exact legal entity and service
Find the legal name of the company named in your custody agreement, not just the brand on the website. Then identify its jurisdiction, regulator or charter, and the activity it is authorized to conduct. Check whether the entity that holds or controls the assets is the same entity you contract with. If it is not, map each intermediary and sub-custodian, including where each operates.
As an Amazon Associate I earn from qualifying purchases.
Ask the provider to identify the exact product, customer type, assets and wallets covered by its regulatory claims. A license or bank charter may apply to one affiliate or activity but not another. The Office of the Comptroller of the Currency says national banks and federal savings associations may offer crypto-asset custody and execution services, and may outsource bank-permissible crypto activities subject to applicable law and third-party risk management. That describes bank authority; it is not an endorsement of a named provider or its subcontractors.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The federal baseline does not settle every case. State trust-company and licensing rules, non-US regimes, how an asset is classified, and the particular product and customer agreement may change the analysis. For a specific provider, the service entity, its regulator records, the custody contract and any sub-custody arrangements all matter.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Trace key control and transaction authorization
Ask the provider to explain its custody model in operational terms. Find out which entity or people can access key material or key shares, where they are stored, and how a transfer moves from request to approval and signing. A provider saying that it “does not hold the private key” is not enough if it can control a key share or otherwise cause a transaction.
- Access: Who can initiate, approve and execute a withdrawal? Are those duties separated, and how many independent approvals are required?
- Transaction rules: What policies limit destinations, amounts or unusual activity? Who can change those rules, and how are changes approved?
- Recovery: What happens if a device, key share or authorized employee becomes unavailable? Who can trigger recovery, and what prevents an attacker from using the recovery process?
- Revocation: How quickly can access be removed when an employee, customer credential or third-party connection is compromised?
Request a clear explanation of key generation, storage, signing thresholds, recovery and withdrawal controls. A diagram or written procedure is more useful than a general security claim because it lets you see where independent approvals exist and where control is concentrated.
Confirm ownership, segregation and balance records
Your contract should say who owns the assets, whether the provider may lend, pledge, rehypothecate or otherwise use them, and what happens to them if the provider becomes insolvent. Do not infer these rights from a dashboard balance or from the word “custody.” Ask whether assets are held in individually identified accounts or addresses, or in omnibus wallets, and how the provider maps your beneficial ownership to its records.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Find out how the custodian reconciles its books with wallet activity and the relevant blockchain network. Ask what your statements show, how often they are issued, and how you can check that addresses and transactions correspond to your account. A balance statement is useful only if the provider can explain how it is tied to assets under custody and how discrepancies are investigated.
Inspect independent assurance and incident readiness
Ask for the control report, audit or examination evidence that applies to the exact service you will use. Check who performed it, the period and systems covered, whether the report includes the relevant crypto controls and locations, what exceptions were found, and whether those issues have been remediated. Determine whether material subcontractors are covered or assessed separately; a certification or audit label does not automatically cover every affiliate, asset, wallet or service.
Security evidence should be paired with operational plans. Ask how the provider responds to key compromise, unauthorized transfers, service outages and loss of a critical vendor. Review its incident-notification terms, business-continuity and disaster-recovery arrangements, withdrawal availability and recovery procedures. The provider should be able to explain who makes decisions during an incident, how customer assets and records are protected, and how customers can escalate a complaint or recovery request.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Separate current requirements from proposed rules
For SEC-registered investment advisers with custody, the current Advisers Act custody framework generally requires use of a qualified custodian, required notices, a reasonable basis for quarterly account statements, and independent verification, subject to exceptions. Whether those requirements apply depends on the adviser, asset and arrangement. The SEC’s investor bulletin, Custody of Your Investment Assets, describes the general safeguards and advises investors to remain proactive.
Free tools Windows power users keep installed
One-click scans. No signup required.
On October 1, 2026, the SEC issued a proposal addressing custody of crypto securities and similar investments by regulated investment companies and custody of client crypto funds and securities by registered investment advisers. As of October 7, 2026, it is a proposal, not an effective rule. The proposal describes controls for adviser self-custody that include an annual cybersecurity review, internal-control reports initially within six months and annually thereafter, and quarterly client statements identifying crypto addresses, with segregation and comparison of statement activity against on-chain activity also discussed. Do not treat these proposed terms as obligations already in force.
The SEC proposal treats possession of any portion of a client crypto asset’s key materials as self-custody for its proposed adviser rule. That is a proposed-rule treatment, not a general statement of current law. Separately, a July 14, 2025 interagency statement from federal banking agencies says existing laws, regulations and risk-management principles apply to bank crypto-asset safekeeping and that the statement creates no new supervisory expectations.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Read insurance terms rather than relying on a headline
FDIC insurance covers eligible deposits held at an insured bank if that bank fails. It does not insure crypto assets, assets issued by non-bank crypto companies, or losses from theft or fraud, and it does not protect customers from a non-bank custodian’s insolvency. If a service holds both cash and crypto, ask which legal entity holds each and whether the cash is an eligible deposit at an insured bank.
Private commercial insurance is different: the policy wording and custody contract determine what protection, if any, reaches a customer. A provider’s aggregate policy limit does not establish that your assets, wallet, loss event or claim are covered. Request the policy or a sufficiently detailed certificate and check these terms:
- Who is covered: Identify the named insureds, any beneficiaries, and whether customers have a direct claim or must rely on the custodian to pursue one.
- What is covered: Confirm the customer assets, wallets, locations and services within scope.
- Which events qualify: Check the covered triggers and exclusions, including treatment of employee misconduct, compromised credentials, social engineering, smart-contract exploits, chain events, insolvency and third-party services.
- What can be recovered: Review aggregate and per-loss limits, sublimits, deductibles, claims control and how any proceeds are allocated among customers.
Official federal sources do not establish a universal private crypto-custody insurance amount or standard policy wording. If a provider will not supply enough detail to verify coverage, treat the insurance claim as unverified rather than assuming your assets are insured.
Compare providers against the same evidence
Use the same questions for each provider, and compare the documents for the product you would actually use—not marketing summaries or assurances for a different affiliate or service.
Quick Recap
| Area | Evidence to compare | What an unclear answer leaves unresolved |
|---|---|---|
| Key control | Custody model, key generation and storage, signing threshold, separation of duties, transaction rules and recovery procedures. | Who can cause a transfer, whether approval is independent, and how access is restored or revoked. |
| Asset rights and records | Contract terms on ownership and use; account or address structure; statements; reconciliation method; insolvency treatment. | Whether assets are segregated, how your beneficial interest is evidenced, and what happens if the provider fails. |
| Independent assurance | Report or examination type, auditor independence, coverage period and systems, exceptions, remediation and subcontractor scope. | Whether the evidence covers the controls and service relevant to your assets. |
| Regulatory fit | Service entity, regulator or charter, jurisdiction, permitted activity, agreement entity and sub-custody chain. | Which entity is accountable and whether the cited authority applies to this service. |
| Insurance and recourse | Policyholder, customer rights, asset and wallet scope, covered events, exclusions, limits, sublimits, deductibles and claims process. | Whether a covered loss would produce a customer recovery and how much might be available. |
| Operational resilience | Incident disclosure, continuity and recovery plans, withdrawal controls, network support and third-party dependencies. | How the service handles outages, compromise or a failure at a critical provider. |
Use a document-first decision process
- Get the entity map. Request the legal name and jurisdiction of the service entity and every sub-custodian. Match the map to the agreement and the provider’s regulatory claims.
- Get the custody and control description. Obtain written details on key access, transaction approvals, recovery, segregation and reconciliation. Ask the provider to identify any lending, use or withdrawal restrictions in the contract.
- Review assurance evidence. Obtain applicable audit or control reports, note their scope and period, and ask for exceptions and remediation status.
- Review policy and customer recourse. Ask for policy evidence and exclusions, then read the contract for ownership, insolvency, liability, claims and recovery terms.
- Get incident and continuity answers in writing. Confirm how the provider will notify customers, maintain or restore service, and handle complaints or recovery requests.
- Match every assurance to your use case. Confirm each document covers the exact product, customer type, assets, wallets, legal entity and locations you are evaluating. If a material point cannot be verified, record it as unresolved rather than filling the gap with a marketing claim.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
