Custody Providers: Who Holds What

Institutional crypto sits with a handful of custodians. That fact shapes several features of this market and is rarely covered directly.

The categories of custodian

Qualified custodians. Firms holding a licence that satisfies the regulatory definition applicable to the client. Required for many institutional mandates.

Exchange custody arms. Several large exchanges operate a separate custody entity, legally distinct from the trading business.

Bank custody. A growing number of established banks now offer digital asset custody, generally to their existing institutional clients.

Self-custody with institutional tooling. Multi-party computation platforms that let an institution hold its own keys with the governance controls its auditors require.

Why concentration happened

The requirements are demanding and the fixed costs are high. Segregated client assets, an insurance programme a compliance officer will accept, an audit trail, and controls ensuring no individual can move assets alone.

Few firms can meet all of that, and those that do enjoy substantial economies of scale. The result is a small number of large providers.

What it means in practice

Correlated infrastructure risk. A failure or compromise at a large custodian would affect a large share of institutional holdings simultaneously.

Predictable behaviour. Assets in deep cold storage move slowly and on schedules, which dampens some volatility.

Visible flows. Custody addresses are large and identifiable, which is why on-chain analysts can observe institutional movement even when they cannot identify beneficial owners.

The questions that matter about any custodian

Is it a qualified custodian for the client’s regulatory position? This determines whether an institution may use it at all.

Are client assets bankruptcy-remote? If the custodian fails, are client assets separate from the estate? The answer depends on the legal structure and jurisdiction, not on marketing language.

What does the insurance cover? Typically theft from cold storage, frequently excluding losses involving an employee with legitimate access, with per-incident limits well below assets held.

Who can authorise a movement, and how many of them are required? The governance model is the actual security property.

The read-across for individuals

None of this applies directly to someone holding a modest amount. Two principles do transfer.

Separate what must move from what must not, and require more than one thing to go right before assets can leave.

For an individual that means a small working balance at a venue where withdrawals work reliably, such as retail venues covering the pair, and long-term holdings in self-custody with a tested backup. The institutional version is the same structure with more paperwork.