Institutional crypto custody: charters, keys and bankruptcy protection

What institutional custody is

A digital asset is controlled by a private key, a long secret number that authorizes transfers on a blockchain. Whoever controls the key controls the asset. Custody for institutions means a regulated third party safeguards those keys, keeps records of who owns what, and moves assets only on verified client instructions.

In the US, many investors cannot simply self-custody. The SEC’s custody rule requires registered investment advisers to keep client assets with a qualified custodian, a category that covers banks and savings associations (including trust companies), registered broker-dealers, futures commission merchants and certain foreign institutions. For years it was unclear whether a state-chartered trust company holding crypto counted. On September 30, 2025, SEC staff issued a no-action letter saying they would not object if advisers and regulated funds used state trust companies that are authorized by their state regulator, keep client assets segregated, bar rehypothecation (re-using client assets as collateral) without consent, and pass the adviser’s due diligence on audited financials and internal controls.

How the keys are protected: MPC, HSM and multisig

Custodians combine three main techniques, often layering them.

• Hardware security modules (HSMs). Tamper-resistant hardware devices that generate and store keys so the key never leaves the device in readable form. This is the same technology banks use for payment cards. The weakness is concentration: the device and the people allowed to operate it become the control point.
• Multisignature (multisig). The blockchain itself requires several independent keys to approve a transaction, for example 2 of 3 or 3 of 5. Rules are enforced on-chain and visible, but support and features vary by blockchain, and changing signers can mean moving funds.
• Multi-party computation (MPC). A single key is mathematically split into shares held by different parties or machines. The shares jointly sign a transaction without the full key ever existing in one place. MPC works across most chains and looks like a normal single-signature transaction on-chain, but its security depends on the custodian’s software and is harder for outsiders to inspect.

Assets are also split between cold storage (keys kept offline, slower to move) and warm or hot wallets (online, used for daily flows). Policy engines add approval quorums, withdrawal allow-lists and time delays.

Policy shifts: SAB 122 and bank charters

From 2022, SEC Staff Accounting Bulletin 121 required public companies that safeguarded crypto for clients to record those assets as a liability, with a matching asset, on their own balance sheet. For banks, that inflated capital requirements and made custody uneconomic. SAB 122, issued January 23, 2025 and effective January 30, 2025, rescinded that guidance. Firms now assess whether a loss liability exists under ordinary contingency accounting, while still disclosing their safeguarding obligations.

The second shift is chartering. A national trust bank charter from the Office of the Comptroller of the Currency (OCC) allows a firm to provide custody and fiduciary services nationwide under one federal supervisor. It does not allow taking insured deposits or making loans. Anchorage Digital received the first such charter for a crypto-native firm in January 2021. The OCC’s recent decisions are summarized below.

Conditional approval is not permission to operate: firms must still raise capital, pass pre-opening examinations and meet other conditions. Comptroller Jonathan Gould said in September 2026 that the agency had received 40 charter applications since January 2025, 23 involving some digital-asset activity. Morgan Stanley filed for a digital trust bank in February 2026, and Block filed in September 2026.

The main custodians and prime brokerage

• Coinbase Custody. A New York-chartered trust company and custodian for most US spot bitcoin and ether ETFs. Coinbase’s OCC application stated that its institutional custody business held $245.7 billion as of June 30, 2025.
• BNY. The world’s largest custodian bank began holding bitcoin and ether for some US clients in 2022. On May 7, 2026 it extended crypto custody to Abu Dhabi Global Market. BNY reported $59.4 trillion in assets under custody or administration as of March 31, 2026, across all asset classes.
• Anchorage Digital. The longest-running federally chartered crypto bank, used by asset managers and for staking and governance.
• BitGo. A pioneer of multisig custody, operating state trust companies and holding an OCC conditional approval since December 2025.
• Fidelity Digital Assets. Fidelity’s crypto custody and execution arm, also conditionally approved for a national trust charter in December 2025.

Prime brokerage bundles custody with trading across venues, financing (margin and lending) and settlement. Coinbase Prime is the best-known US example. The appeal is capital efficiency: a fund can trade on several venues without pre-funding each one. The trade-off is that financing often requires the client to let the prime broker use or pledge assets, which reintroduces counterparty risk that pure custody is designed to remove.

Segregation and bankruptcy remoteness

Bankruptcy remoteness means client assets stay outside the custodian’s estate if the custodian fails, so clients get their assets back rather than becoming unsecured creditors. That depends on legal structure more than technology.

FTX showed the cost of commingling: customer deposits were mixed with exchange and affiliate funds, leaving no clean pool to return. Celsius showed the cost of contract terms. On January 4, 2023, the bankruptcy court ruled that about $4.2 billion of assets in Celsius Earn accounts belonged to the estate, because the terms of use transferred title to Celsius. The same company’s custody program was handled separately. Lessons for allocators: assets should sit in segregated accounts titled to the client, held under trust or bailment law, with a contract that forbids rehypothecation without consent and is backed by regular audits and legal opinions on insolvency treatment.

Risks to understand

• Key and operational risk. Insider collusion, compromised signing software or weak approval processes can lead to irreversible loss.
• Legal and insolvency risk. Bankruptcy treatment of digital assets is still being tested, and protections differ between trust charters, broker-dealers and offshore entities.
• Concentration risk. A small number of custodians hold a large share of ETF and institutional assets.
• Rehypothecation and prime risk. Assets pledged for financing are no longer simply in custody.
• Insurance gaps. Custody insurance policies often cover a fraction of assets held and exclude many loss scenarios.
• Regulatory risk. Charters are conditional, federal market-structure law remains unsettled, and policy could change with future administrations.

Sources and further reading

• SEC Staff Accounting Bulletin No. 122 (January 23, 2025)
• Akin: SEC allows state-chartered trust companies to serve as crypto custodians (September 30, 2025 no-action letter)
• Davis Wright Tremaine: OCC charter approvals signal momentum for digital-asset banks (August 2026)
• Forbes: Coinbase wins OCC conditional approval (April 2026)
• The Block: OCC grants conditional approval to World Liberty national trust bank (August 14, 2026)
• Morrison Foerster: Celsius court holds Earn account assets are estate property (January 2023)