Before using a crypto prime broker, an institution should establish six things, in this order: which legal entities it will actually face; what each entity is authorised to do in each relevant jurisdiction; who controls the private keys and what legal claim the institution holds over its assets; where unsecured exposure to the broker, a venue, a bank or a lender arises; whether controls, finances and insurance are backed by evidence rather than marketing; and how the institution gets out, including in a default or outage. The rest of this article turns those six points into a workable diligence programme.
Requirements differ by jurisdiction, asset and activity, and nothing here replaces advice from counsel who know the institution’s own regulatory position.
As an Amazon Associate I earn from qualifying purchases.
Start with an entity-and-flow map
“Prime broker” is a label for a bundle of services, and the bundle is often split across several legal entities. One party may sign the agreement, another may hold assets, a third may route orders, and others may lend, manage collateral or hold cash. A brand name tells you none of this, so diligence begins with a diagram, not a questionnaire.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The map should name, for each service the institution will use:
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
- The contracting entity.
- The custodian and any wallet operator.
- The execution or order-routing entity and the venues it reaches.
- The settlement party.
- The lender and the collateral manager.
- The bank or other party holding cash.
- Material subcontractors and affiliates on which the service depends.
Provider documentation can show what this looks like in practice. Coinbase’s Prime Custody documentation describes a model where custody, order routing, financing and cash custody involve separately named entities. It also describes wallets that are commingled operationally while being segregated legally. That description is the provider’s own representation and can change. Treat it as an example of the questions to ask, then verify every point against the contract you would sign.
Also define the scope of use before you diligence anything: the assets, products, venues, settlement methods, and whether you will use financing, staking or other activities. A provider can be sound for spot custody and unsuitable for margin lending, and vice versa.
Is a crypto prime broker regulated? Verify authorisations entity by entity
The honest answer is “it depends on the entity, the service, the asset and the place.” So check each entity on your map against the official register of each relevant jurisdiction, for the specific service and asset types you intend to use.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Do not transfer permissions across affiliates. A licence held by one group company does not show that another is authorised.
- Locate the activity. Identify where each entity operates and where client assets, records and keys are held or controlled.
- Get legal analysis on classification-sensitive activity. Whether a given token or service falls under securities, derivatives, payments or crypto-specific regimes is a legal question for your counsel, not a point to accept from sales material.
- Do not assume securities-style protection. SEC staff, in its crypto-asset FAQ, notes that non-security crypto assets may not be protected by SIPA or another specific insolvency regime. The FAQ is staff guidance and does not decide any particular provider’s status. Deposit insurance should not be assumed either.
If the provider is a bank, or uses one, read the applicable banking rules. The Federal Reserve, FDIC and OCC’s joint statement of 14 July 2025 covers risk management for bank crypto-asset safekeeping. It applies existing safe-and-sound principles and says: “The statement does not create any new supervisory expectations.” So it is a reminder of existing expectations, not a new protection for clients.
Regulators also place responsibility on the institution, not just the provider. FINMA’s 12 January 2026 announcement of its custody guidance says: “Responsibility shall remain with the authorised financial institutions in the event that such providers are used.” That is a Swiss statement about authorised institutions, but it captures the general logic: outsourcing the service does not outsource accountability for diligence.
Who actually holds our crypto, and what happens if the custodian fails?
Custody is a legal and operational question as well as a technical one. AIMA’s digital asset custody guide, an industry guide produced with custodians and experts, frames custody as centred on private-key safekeeping and recommends weighing service terms, regulation, insurance and legal basis. Four questions follow.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Who controls the keys?
Establish which entity, and which people within it, can move assets. Find out whether keys are held in shares, where those shares are stored, and whether the institution has any role in approval.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat is the institution’s legal right?
Determine whether you have a property interest, a contractual claim against the provider, or both. Then identify the obligor for each asset and each cash balance. These can differ: crypto may sit with one entity and cash with another.
Is segregation real in law and in operations?
Ask for dedicated or omnibus wallet structures in plain terms. Segregation on the provider’s books, segregation on-chain and segregation in law are three different things. A structure that is commingled operationally may still be defended as legally segregated, but that claim needs support from the contract and from counsel’s analysis, not from a help-page assurance.
What happens in insolvency?
Ask counsel to assess how the assets would be treated in the insolvency of the relevant entity under its governing law. Include cross-border recognition and your access to local records and assets. FINMA’s 2026 announcement specifically highlights cross-border insolvency complexity and the need to keep client assets out of the custodian’s bankruptcy estate. Do this for each entity that touches your assets, not only the one named on the front of the agreement.
For EU providers covered by MiCA, compare the contract with Article 75. It sets requirements on the custody agreement, a record of client positions, a custody policy, client statements, return procedures, segregation, liability and the use of authorised subcontractors. Confirm that the provider and service are actually within scope and that you are reading current law, rather than assuming either.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which contract terms to test
Read the master prime brokerage agreement together with the custody terms, account-control terms, financing and collateral documents, venue terms and every schedule. The documents often interact, and one can undercut another. Test for:
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
- Segregation language versus omnibus structures.
- Liens, set-off and cross-entity netting.
- Rehypothecation and any right to use collateral or client assets.
- Treatment of shortfalls, defaults and permitted transfers.
- Return mechanics: timelines, transfer fees, withdrawal restrictions and suspension triggers.
- Liability, remedies and notice obligations after an incident.
- The process for moving assets or positions to a replacement provider.
- Audit access, reporting duties and subcontractor changes.
What security and operational evidence to request
Ask for control descriptions and evidence, not summaries. The areas that matter most are:
- Keys: generation, ceremony governance, key shares, storage locations, access logging, backup, recovery, rotation and destruction. AIMA identifies key loss, theft and destruction as core risks.
- Wallet design: hot, warm and cold allocation, and the reasoning behind liquidity buffers.
- Access and approvals: separation of duties, privileged access, authentication, transaction policies, multi-person approval, address allowlisting and withdrawal thresholds.
- Change and vulnerability management: software and infrastructure security, incident detection, response and client notification.
- Reconciliation: how internal ledgers, blockchain records, client statements and third-party records are matched, and how often.
- Resilience: business continuity, disaster recovery, recovery objectives, testing frequency and operational dependencies.
- Protocol events: forks, airdrops, upgrades, chain congestion, wrong-network transfers and recovery from erroneous instructions.
Reading a SOC 1, SOC 2 or equivalent report
An audit report is evidence with limits, not a guarantee of safety or restitution. When you receive one, check:
- Which services and entities fall inside its scope, and which are carved out.
- The service period, and how stale it is.
- Exceptions noted and the status of remediation.
- Complementary user controls: the controls the report assumes you operate.
- How subcontractors are treated.
A clean report on a cloud-hosting function says little about the key-management process, and a report on one affiliate says nothing about another.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where does counterparty and credit exposure arise?
Exposure follows the documents and the flow of obligations. Trace a representative transaction from order to execution, clearing or settlement, custody and cash movement, and mark each point at which the institution is exposed to the broker, an exchange, a custodian, a bank or a lender. Then inventory:
- Unsecured balances, including cash awaiting settlement or withdrawal.
- Unsettled trades and intraday exposure.
- Margin posted and collateral lodged, and with whom.
- Lending or financing, and who the borrower and lender are.
For each, document limits, monitoring, escalation and concentration controls. On financing, review collateral eligibility, haircuts, margin-call mechanics, liquidation rights, dispute resolution, close-out netting and any right to reuse assets.
One illustration of why the interposed counterparty matters comes from outside crypto. FinCEN’s guidance on the correspondent account rule describes OTC foreign exchange and derivatives give-up arrangements in which the prime broker becomes the counterparty to accepted trades. It is a defined-scope example, not a rule for crypto products. Use it as a prompt to ask who your counterparty is after a trade is accepted, and read the answer in your own documents.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
How to assess financial strength and insurance
Request audited financial statements where they exist, and information on liquidity, capital, related-party exposures, concentration and material litigation or enforcement matters. Where the entity facing you is a subsidiary, ask what support, if any, the group is obliged to provide, and which entity’s accounts you are reading.
On insurance, ask:
- Who is the insured party, and does cover reach client losses at all?
- What are the aggregate and per-event limits, deductibles and sublimits?
- What exclusions apply, and where are the covered custody locations?
- What is the claims procedure?
Do not treat insurance as a guarantee of recovery unless the contract and the policy together support that reading.
Compliance, governance and reporting
- Financial crime controls: AML, sanctions screening, customer and beneficial-owner due diligence, transaction monitoring, suspicious-activity escalation and blockchain analytics, matched to your institution and activity.
- Records and data: books and records, position statements, transaction data, valuation methods, audit access, regulatory-reporting support and incident notification.
- Asset onboarding: how asset classification and protocol changes are assessed, who approves new assets and venues, and how changes are communicated to clients.
Inside your own institution, decide who owns the relationship, who provides independent risk and compliance review, who signs off legal review, what approval limits apply, how often the provider is reassessed, and which events trigger immediate review.
Comparing providers on a like-for-like basis
When more than one genuine provider model is available, put each through the same grid so differences in structure show up instead of differences in presentation.
| Comparison axis | Questions to ask |
|---|---|
| Custody structure | Dedicated or omnibus wallets? Legal and operational segregation? Who controls keys? |
| Counterparty chain | Which entities face the institution at each step? Are balances or trades unsecured? |
| Execution and settlement | Which venues and assets are supported? How are execution, settlement, reconciliation and outages handled? |
| Financing | Which collateral is accepted? What are haircuts, margin calls, liquidation rights, rates and rehypothecation terms? |
| Legal and regulatory perimeter | Which entity is authorised for each service, asset and jurisdiction? What client protections apply? |
| Controls and assurance | Which reports cover which services and dates? Which exceptions or subcontractors are excluded? |
| Resilience | What are recovery capabilities, incident communications and dependencies? |
| Exit | Can assets and records be transferred promptly? What happens in default, termination or a prolonged outage? |
| Total cost | What are trading, custody, financing, transfer, settlement and ancillary fees? |
Plan the exit before you enter
Exit readiness is the part of diligence most often skipped, because it feels pessimistic at onboarding. Settle these points in writing while you still have negotiating leverage:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- How quickly assets and records can move to a replacement provider, and at what cost.
- What the provider can do during a suspension or prolonged outage, and what you can still do.
- How open positions, margin and financing are unwound or transferred on default or termination.
- Whether you can keep your own independent record of positions, so a transfer can be reconciled without relying on the departing provider.
What the finished diligence file should contain
A file that would satisfy an auditor or regulator holds:
- The entity-and-flow diagram.
- Jurisdiction and permissions analysis, with register extracts and dates.
- Contract and insolvency review from counsel.
- Custody-control assessment and review of independent assurance reports.
- Counterparty, financial and insurance review.
- Evidence of operational testing, such as a small test deposit, withdrawal and reconciliation cycle.
- A documented exit plan and a named internal owner.
Reopen the file whenever the provider, product, asset, jurisdiction, subcontractor or regulatory position changes. Evidence in this area is thin on one point: no independently published figures on institutional crypto prime-broker custody losses or failure rates were found, so any vendor that quotes such a statistic should be asked for its publisher, year, geography and definition.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
