Crypto custody: wallets and responsibility
In the crypto world one brutal principle applies: whoever controls the private keys controls the assets. It does not matter who appears as owner in a contract: what matters is who can sign the transactions. That is why custody — the management of the keys — is the most sensitive technical and legal topic in the entire sector. Whoever holds crypto in custody on behalf of third parties takes on precise responsibilities and, often, enters a regulated perimeter. Here is what sets the models apart and where the responsibilities lie.
Custodial and non-custodial: the distinction that changes everything
The first question is always the same: who holds the private keys?
- Non-custodial wallet: the keys are in the user’s hands. The provider offers only the software, has no access to the assets and cannot dispose of them. In principle this model does not constitute custody on behalf of third parties: the provider holds nothing.
- Custodial wallet: the keys are held by the provider, who effectively controls the clients’ assets. This is where real custody arises — and with it the responsibilities and, often, being subject to regulation.
Many real-world solutions sit in between (multi-signature, shared custody, MPC): the decisive criterion is not the commercial label, but who can actually dispose of the assets.
Why custody enters the regulated perimeter
Holding crypto in custody on behalf of third parties touches several areas.
Anti-money laundering (AMLA)
Holding and transferring assets on behalf of clients is typically financial intermediation and triggers the AMLA (the Anti-Money Laundering Act): identification of the client, clarification of the beneficial owner, transaction monitoring, reporting obligations. This entails affiliation with a self-regulatory organisation (SRO) or placement under an entity that is already subject to supervision.
Deposit-taking and licences
The way in which the assets are held matters. If the crypto-assets are kept available to the client and individually attributable, the situation differs from the case where the custodian pools them or uses them. Pooling assets can bring the model closer to deposit-taking, with implications for a banking licence or a fintech licence. The custody structure must be designed knowing where this line runs.
Protection in the event of bankruptcy
The DLT Act clarified that crypto-assets held in custody on behalf of clients can be segregated from the custodian’s bankruptcy estate, provided they are kept available to the client and individually attributable. This is a decisive protection, but a conditional one: if the custody does not meet the requirements, the clients’ assets risk ending up in the estate. Setting up segregation correctly is an integral part of the custodian’s responsibility.
Operational responsibilities
Beyond the regulatory perimeter, custody entails concrete and ongoing responsibilities:
- Key security: generation, storage, backup, signing procedures. A lost key is a lost asset; a compromised key is a stolen asset.
- Continuity and governance: what happens if a key person is unavailable? Procedures must hold up without depending on a single individual.
- Traceability: recording of operations, reconciliation, attribution of assets to individual clients.
- Incident management: response plans for compromises, errors, disputes.
These responsibilities cannot be delegated with a clause: they must be designed into the infrastructure and the organisation.
The correct approach
The sequence is always the same: first you define which custody model you want to offer (custodial, non-custodial, shared); then you classify the activity from a regulatory standpoint; then you build the technical and organisational infrastructure — segregation of assets, key security, anti-money laundering safeguards, governance — consistent with the perimeter. Starting from the technology without having classified the activity is the fastest way to find yourself holding others’ assets in custody without the necessary authorisation or affiliation.
How SIH ONE approaches the topic
SIH ONE handles structuring and advice: classification of the custody model, identification of the authorisation perimeter, design of the segregation structure and of the anti-money laundering safeguards, setup of the governance. Where custody on behalf of third parties requires an authorisation or an affiliation, the regulated activities go through authorised partners who provide the actual custody. The aim is for the responsibilities to be clear and the structure solid before a single asset is taken into custody.
This content is informational and does not constitute legal or regulatory advice. Every model must be verified in the specific case.
Do you want to hold crypto in custody in a compliant way, with clear responsibilities? Let’s talk: we define the model and build the structure, with the right partners where authorisation is needed.