Custody Selection: The Documents That Decide It

Custody diligence is document review, and the documents are standard. A provider slow to produce them is either small enough that you are an early client or disorganised enough that you should not be one. The sector-level shift described here is observable in the published terms of a business wallet with institutional controls.

The register entry

Verify it yourself on the regulator’s own site.

Three checks: the entity name matches the entity you will contract with, the permission covers custody of client assets specifically rather than a narrower activity, and there are no conditions attached.

The middle check fails more often than expected. An exchange permission is not a custody permission.

The segregation assurance report

An independent report on whether client asset segregation operates as described.

This is the single most informative document. Its absence means the control exists as an assertion rather than as something anyone has tested.

The insurance certificate

Naming the insurer, the limit, and whether cover is per incident or aggregate annually.

Ask also for total assets under custody. The ratio is the meaningful figure and it is rarely volunteered.

Read the exclusions. Compromise of your own credentials is typically excluded, and that is the most likely way you personally lose assets. Merchants encounter this on the acceptance side, where a provider serving funds and family offices carries the obligation.

The audited accounts

Two years if they exist. You are looking at solvency and at whether the auditor raised anything.

The custody agreement

Three sections matter: liability limits, what happens on insolvency, and whether the provider may use client assets.

The third should be an explicit and unqualified no. Rehypothecation is how several failures became insolvencies.

A liability cap at the annual fee means a total loss caused by the provider entitles you to a refund of fees.

The controls report

An assessment covering a period of operation rather than a point in time, so the controls were tested as operating rather than described as existing.

Questions with revealing answers

What happens if you become insolvent. A good answer cites the specific provision keeping client assets from creditors.

How long before a newly added withdrawal address can be used. Immediately means no controls.

Has a client ever been unable to withdraw on request, and why. Any provider of scale has had an incident. A claim of a perfect record indicates either a short history or reluctance to discuss problems.

Ongoing

Recheck the register annually, request updated reports, confirm insurance renewal, and reread the agreement when terms change. On the trading side, the list of countries covered publishes its fee schedule and corporate onboarding terms in full.

Providers change ownership and permissions and nobody will tell you.