regulationsresearchcrypto custodyguidance documentUnsaid Items & Implicit Requirements

Unsaid Items & Implicit Requirements

June 4, 2026

54 min read

This section addresses the critical gap between what regulations formally require and what markets actually demand. For institutional investors — pension funds, endowments, sovereign wealth funds, and registered investment advisers — the written law is a floor, not a ceiling. The true standard for institutional crypto custody is set by due diligence checklists, RFP requirements, industry associations, and supervisory expectations communicated through speeches, guidance letters, and examination practices rather than through statute.

Understanding these implicit requirements is essential for policymakers designing regulation, for custodians seeking institutional clients, and for compliance officers building programs that will survive both regulatory examination and institutional due diligence.

Part 1: Industry "Table Stakes" Not Codified in Law

The following operational and security standards are effectively mandatory for any custodian seeking institutional capital, even though most jurisdictions do not codify them in statute or regulation. Failure to meet any one of these is typically a disqualifier in institutional RFPs, regardless of whether the custodian holds the appropriate license.

1.1 Cold Storage Ratios: The 90-95% Norm

What regulation requires: Of the 20 jurisdictions surveyed, six mandate a specific numeric cold storage floor; the rest leave it to market practice:

Japan: 95% of customer assets must be held in cold (offline) storage, with the remaining 5% backed 1:1 by the exchange's own reserves ("Redemption Guarantee Crypto Assets"). This requirement was adopted after the Mt. Gox collapse, where 850,000 BTC were lost due to inadequate security controls.
Bahrain (CBB): A minimum of 95% of each client crypto-asset must be held in cold wallets, calculated separately per asset (CRA-8.1.9) — the only Gulf jurisdiction with a hard numeric floor.
Hong Kong (SFC): The original 2023 VATP Guidelines set 98% cold / 2% hot; the ASPIRe roadmap is now shifting toward outcome-based dynamic storage ratios, but 98% remains the operative benchmark (including for banks holding client digital assets).
Singapore (MAS): At least 90% of customer cryptoassets must be held in cold wallets under the PS-G03 Consumer Protection Guidelines, with daily reconciliation required.
South Korea (FSC): Mandates 80% cold storage (per the VAUPA Enforcement Decree, calculated on monthly economic value), with the FSC reviewing a proposal to increase this to near-100%.
Canada (CSA/CIRO): Public crypto funds must keep at least 80% of client crypto with acceptable third-party custodians (typically cold storage); CIRO caps dealer self-custody at 20%.

Notably, none of the five jurisdictions added in this refresh —

Liechtenstein,

Luxembourg, Gibraltar,

Bermuda, and the

Cayman Islands — imposes a numeric percentage. Gibraltar (Guidance Note 5) and the Cayman Islands instead apply a qualitative standard ("online wallets only to the extent needed for immediate liquidity; the remainder in cold storage"), and Bermuda's Custody Code mandates a risk-assessment-based hot/cold split rather than a fixed ratio.

What the market demands: Leading institutional custodians maintain 90-95% of assets in cold storage while keeping only the liquidity necessary for operational needs in more accessible systems. This is a universal expectation in institutional due diligence, verified through on-site assessments and SOC 2 reports. Custodians that cannot demonstrate these ratios are eliminated from consideration regardless of their regulatory status.

The gap: The majority of jurisdictions — including the United States, the European Union (under MiCA), the United Kingdom, Switzerland, and the newly surveyed EU/EEA centres (Liechtenstein, Luxembourg) and offshore centres (Gibraltar, Bermuda, the Cayman Islands) — do not specify a cold storage percentage. Yet every institutional RFP implicitly assumes compliance with the 90-95% industry norm. This creates a situation where custodians in these jurisdictions can be fully compliant with local law while being categorically unacceptable to institutional allocators.

Policy implication: Regulators should consider whether codifying a minimum cold storage ratio (with appropriate flexibility for operational liquidity) would strengthen investor protection without unduly burdening custodians that already adhere to the industry norm.

Sources:

1.2 SOC 2 Type II Certification

What regulation requires: No jurisdiction in the world mandates SOC 2 Type II certification specifically for crypto custodians. MiCA requires certain organizational and security controls but does not reference SOC 2 specifically. The NYDFS BitLicense framework expects robust cybersecurity programs under 23 NYCRR Part 500, but does not mandate SOC 2. The OCC expects sound risk management but does not prescribe SOC 2 as the mechanism.

What the market demands: SOC 2 Type II has become the de facto universal requirement in institutional due diligence for crypto custody. Unlike SOC 2 Type I (a point-in-time assessment), Type II examines the operating effectiveness of security controls over a period of 3-12 months, providing continuous assurance rather than a snapshot.

The SEC's September 2025 no-action letter allowing registered investment advisers to treat state-chartered trust companies (STCs) as "banks" for custody purposes explicitly references the need for STCs to maintain SOC reports covering key custody controls. RIAs must ensure an STC's SOC report meets institutional standards or seek additional assurances before using the STC as a custodian.

Major custodians that have completed SOC 2 Type II certification include:

Crypto.com Custody Trust Company (SOC 1 Type II and SOC 2 Type II)
Kraken (SOC 2 Type 2 for institutional custody)
Custodia Bank (achieved SOC 2 Type II in January 2025)
BitGo (maintains SOC 2 as a core trust commitment)
Coinbase Staking (SOC 2 Type 1, with Type 2 expected)

The gap: SOC 2 is an AICPA standard designed for technology service organizations, not a regulatory requirement. Yet its absence is a deal-breaker for institutional capital. Custodians in jurisdictions with minimal compliance requirements (e.g., certain offshore centers) may hold valid licenses but cannot attract institutional assets without SOC 2 Type II. This creates a two-tier market: custodians with SOC 2 that can serve institutions, and those without that cannot.

Policy implication: Regulators should consider incorporating SOC 2 Type II (or equivalent assurance standards like ISAE 3402 or ISAE 3000) as a licensing condition or ongoing compliance requirement for custodians seeking to serve institutional clients.

Sources:

1.3 Insurance Coverage Minimums

What regulation requires: Most jurisdictions do not mandate specific insurance coverage amounts for crypto custodians, though a growing minority make insurance (or an equivalent financial backstop) a mandatory licensing condition. MiCA requires certain prudential safeguards including minimum capital and treats insurance as a permitted substitute for own funds (Article 67), but does not prescribe dollar amounts. The NYDFS does not mandate a specific coverage floor. Among the 20 jurisdictions surveyed, mandatory insurance/financial-backstop requirements now appear in the European Union (MiCA Art. 75 liability insurance), Bahrain (professional indemnity ≥ BHD 100,000 from a CBB-approved insurer, plus keyman and cybersecurity cover), South Korea (insurance or compensation reserves under the VAUPA), and — added in this refresh — two offshore centres:

Bermuda: DABA s.18(1) is a true statutory mandate — a licensee holding client assets must maintain a surety bond, trust account, or indemnity insurance for the benefit of clients, in a form and amount acceptable to the BMA (no fixed published minimum).
Cayman Islands: Under the February 2026 Market Conduct framework (MC-RSOG), insurance coverage is required — spanning professional liability, theft or loss of client assets, business interruption, and cybersecurity — with alternative risk-mitigation measures permitted only where insurance is unavailable.

The remaining new jurisdictions —

Liechtenstein and

Luxembourg (both EEA/MiCAR, where insurance is one permitted route to the Article 67 prudential floor rather than a standalone mandate) and Gibraltar (professional indemnity expected case-by-case under Principle 3) — prescribe no fixed minimum coverage sum. See Insurance & Liability for the regulatory landscape.

What the market demands: Institutional investors require substantial insurance coverage as a non-negotiable condition of engagement. Leading custodians advertise coverage levels that reflect this expectation:

Coinbase Custody: $320 million coverage policy
BitGo: Up to $250 million in insurance coverage
Gemini: Up to $125 million for certain types of losses

Institutional due diligence requires verification of:

Whether coverage applies to both hot and cold wallet holdings
Specific exclusions and limitations in the policy
Whether the insurance ceiling matches the size and complexity of assets under custody
The reputation and financial strength of the underwriter (Lloyd's, Munich Re, Arch, etc.)
Whether coverage extends to insider theft, social engineering, and operational errors — not just external hacking

Munich Re has developed specialized crypto custody insurance products ("Crypto Cover"), reflecting the market demand for institutional-grade coverage. Relm Insurance offers comprehensive crypto asset insurance covering custody operations.

The gap: Insurance coverage for crypto custody remains expensive, limited in scope, and often insufficient relative to the total assets under custody. A custodian holding $10 billion in client assets with a $250 million insurance policy has coverage for only 2.5% of AUC. This gap between available coverage and total exposure is rarely disclosed and is not addressed by any regulatory framework.

Policy implication: Regulators should consider requiring custodians to disclose the ratio of insurance coverage to total assets under custody, and potentially mandate minimum coverage ratios rather than fixed dollar amounts.

Sources:

1.4 Proof of Reserves / On-Chain Attestation

What regulation requires: Very few jurisdictions mandate proof of reserves (PoR) directly for custodians, though several have introduced or proposed requirements for issuers and exchanges, and two surveyed jurisdictions now provide a statutory or rulebook basis for custodian-level PoR:

The U.S. GENIUS Act (enacted July 2025) requires stablecoin issuers to provide monthly proof of reserves, including redeemable tokens outstanding, redemption assets available, and reconciliation between the two, along with disclosure of reserve composition, custody arrangements, and valuation methods.
Bermuda provides a statutory hook: DABA s.18(3) requires a custodian to maintain "a sufficient amount of each type of digital asset," which functions as a statutory basis for proof of reserves, reinforced by the Digital Asset Custody Code's accounting-records and reconciliation expectations.
UAE (VARA): the Rulebook 2.0 framework mandates periodic proof-of-reserves checks for licensed custodians, with monthly independent audits for asset-referenced virtual assets under the April 2026 Issuance Rulebook.
A proposed PROOF Act (introduced by Representative Ritchie Torres in 2022) would require crypto exchanges to disclose proof of reserves to the SEC, though it has not been enacted.

By contrast, the other newly surveyed jurisdictions —

Liechtenstein,

Luxembourg, Gibraltar, and the

Cayman Islands — impose per-client position-record and reconciliation duties but stop short of an explicit proof-of-reserves mandate.

What the market demands: Post-FTX, proof of reserves has become an expected practice for any entity holding customer assets. The industry has shifted from point-in-time attestations to real-time verification:

Kraken publishes quarterly proof of reserves using third-party attestation (most recently September 2025)
Bitget uses Merkle Tree combined with real-time zero-knowledge proofs and monthly snapshots
Coinbase leverages public SEC filings combined with on-chain data
Crypto Finance went live with Chainlink Proof of Reserve in September 2025, enabling on-chain verification of assets held in custody for physically-backed Bitcoin and Ethereum ETPs

Technologies enabling continuous attestation include Merkle Trees (allowing individual users to verify their balances without exposing others' privacy) and zero-knowledge proofs (providing cryptographic verification without revealing underlying data).

The gap: While exchanges have adopted PoR following FTX, many custodians — particularly bank-affiliated custodians and trust companies — have not implemented on-chain attestation. They rely instead on traditional audit procedures. The gap between exchange-level PoR transparency and custodian opacity is widening, creating information asymmetry for institutional investors.

Policy implication: Regulators should consider requiring periodic or continuous proof of reserves for all entities holding customer crypto assets, with standardized methodologies (e.g., Merkle trees with third-party verification) to ensure comparability.

Sources:

1.5 Disaster Recovery & Business Continuity

What regulation requires: General financial services regulations (e.g., FFIEC guidelines, GLBA, SEC Regulation S-P, MiCA operational resilience requirements) mandate business continuity plans, but none specify crypto-specific parameters such as:

Recovery Point Objective (RPO) — the maximum acceptable data loss measured in time
Recovery Time Objective (RTO) — the maximum acceptable downtime after a disruptive event
Geographic redundancy requirements for key backup storage
Specific testing frequency for recovery procedures

What the market demands: Institutional due diligence checklists consistently require custodians to demonstrate:

Defined RPO and RTO: Leading custodians are expected to have near-zero RPO (no loss of key material) and RTOs measured in hours, not days
Geographic redundancy: Key backups must be stored in geographically separated facilities, ideally across different jurisdictions, to protect against regional disasters (floods, earthquakes, fires, power grid failures)
Redundant key backup procedures: Cryptographic key backups stored in separate, secure locations with independent access controls
Regular recovery testing: Annual or semi-annual disaster recovery tests with documented results
Incident communication protocols: Defined escalation procedures and client notification timelines
Multi-cloud or distributed infrastructure: Avoiding single-cloud-provider dependence

Institutional RFPs specifically ask: "How frequently are key backups verified?" and "What is the defined recovery time objective (RTO)?" These questions go well beyond what any crypto-specific regulation requires.

The gap: The irreversible nature of blockchain transactions creates a unique disaster recovery challenge. Unlike traditional finance where erroneous transactions can be reversed, lost private keys mean permanently lost assets. This makes crypto-specific disaster recovery materially different from traditional BCP, yet no jurisdiction has articulated crypto-specific DR requirements.

Policy implication: Regulators should develop crypto-specific business continuity standards that account for the irreversibility of blockchain transactions and the unique risk of permanent key loss.

Sources:

1.6 Key Ceremony Standards

What regulation requires: Almost no jurisdiction prescribes specific requirements for cryptographic key generation ceremonies — with one notable exception added in this refresh.

Bermuda's Digital Asset Custody Code of Practice (February 2024) is unusually prescriptive: it requires seeds of ≥256-bit entropy, a ≥24-word mnemonic hashed to ≥512 bits, a ≥3-person seed-generation ceremony in which no single person holds the entire seed, M-of-N multi-signature with ≥3 signatories, seed material split into ≥2 parts stored separately so a quorum cannot be assembled from a single location, and HSMs certified to FIPS 140-2. This makes Bermuda the clearest example among the 20 surveyed jurisdictions of a regulator codifying key-ceremony mechanics. By contrast,

Switzerland's FINMA references private-key management risks in its Guidance 01/2026 but does not prescribe ceremony procedures;

Cayman requires robust documented key-management with annually-tested key-compromise protocols but no ceremony script;

Liechtenstein (via the unified VT-Verwahrer custodian role under the TVTG),

Luxembourg (MiCAR Art. 75 custody-of-means-of-access), and Gibraltar (outcome-based Guidance Note 5) all set organisational, outcome-based expectations without prescribing ceremony procedures. The NYDFS expects robust cybersecurity under 23 NYCRR Part 500 but does not address key ceremonies specifically.

What the market demands: According to PwC's audit guidance for crypto custody, the following are established industry practices:

Independent third-party attendance: "Established practice is for the auditor (or another independent third party) to attend the key ceremony" to reduce risks at the point of key generation
Sufficient documentation: There must be "sufficient documentation and evidence to ensure the key ceremony can be verified" after the fact
Dual-control principle: "At a minimum the dual-control principle must be applied" to ensure no single individual can generate, access, or use private keys independently
Multi-signature configuration: Industry standard configurations include 2-of-3, 3-of-5, or 4-of-7 multi-signature arrangements, where multiple designated keyholders must sign before any transaction executes
Separation of key storage: Private keys and their backups must be kept in different physical locations
Video recording: Many institutional custodians record key ceremonies for audit trail purposes
Secure facility requirements: Key generation typically occurs in electromagnetically shielded, access-controlled rooms (Faraday cages)
Hardware Security Modules (HSMs): Keys should be generated within HSMs or MPC environments, never on general-purpose computers

The lifecycle of key management must cover generation, storage, use, rotation, backup, and destruction — yet regulations address almost none of these stages with specificity.

The gap: Key ceremony standards represent one of the most significant regulatory blind spots. Outside Bermuda's prescriptive Custody Code, a custodian could generate keys on a standard laptop in an open office and still be compliant with most jurisdictions' regulations, while being categorically unacceptable to institutional investors. Bermuda's approach demonstrates that codifying ceremony mechanics is feasible without overreach — a useful template for the policy implication below.

Policy implication: Regulators should consider prescribing minimum standards for key generation ceremonies, including independent witness requirements, dual-control mandates, and documentation standards — drawing on Bermuda's Digital Asset Custody Code as a worked example. See Key Management for related guidance.

Sources:

1.7 Penetration Testing Frequency

What regulation requires: Canada's CIRO (Canadian Investment Regulatory Organization) explicitly mandates that "a recognized and qualified independent professional should perform penetration testing at least annually" for digital asset custody operations. Among the surveyed jurisdictions,

Bahrain is the most prescriptive — CRA-5.8.13G(e) requires penetration testing twice per year, performed by external independent third parties whose personnel are certified penetration testers.

Bermuda takes a different but equally concrete tack: a board-approved annual IT audit plan, with key/seed generation and management audited at least every six months, multi-signature arrangements audited annually, and quarterly transaction-sample and access-recertification audits. The

Cayman Islands requires independent third-party security audits of custody/key-management systems plus annual key-compromise-protocol testing. For the EEA newcomers (

Liechtenstein,

Luxembourg) and Gibraltar, testing is governed by DORA's digital-operational-resilience-testing regime (for MiCAR-authorised entities) or outcome-based resilience principles rather than a fixed crypto-specific cadence. The OCC expects penetration testing as part of cybersecurity controls but does not specify frequency.

What the market demands: Institutional investors and their advisors expect:

Annual penetration testing at minimum, conducted by independent, qualified third parties
Quarterly vulnerability assessments for all internet-facing infrastructure
Red team exercises that simulate sophisticated threat actors targeting key management systems
Bug bounty programs providing continuous external security assessment
Published remediation timelines for identified vulnerabilities
Results disclosed to institutional clients upon request, typically under NDA

SOC 2 Type II audits incorporate penetration testing as part of the assessment, creating an indirect requirement for any custodian that maintains SOC 2 certification (which, as noted above, is itself a universal institutional expectation).

The gap: The difference between "annual testing" (the regulatory standard where it exists) and "continuous assessment" (the institutional expectation) is significant. Crypto custody infrastructure faces a more hostile threat environment than traditional financial infrastructure due to the irreversibility of blockchain transactions and the pseudonymous nature of stolen asset movement.

Sources:

Part 2: Institutional Investor Due Diligence Checklists

2.1 What Institutional Allocators Actually Ask

Institutional due diligence for crypto custody has evolved from ad hoc questionnaires to structured frameworks maintained by industry bodies and consulting firms. The following represents the composite of questions that go beyond regulatory compliance, drawn from published frameworks and institutional practice.

AIMA Digital Asset Custody Guide

The Alternative Investment Management Association (AIMA), together with leading digital asset custodians and industry experts, has published an Industry Guide on Digital Asset Custody. This guide provides sound practices and key considerations for institutional investors determining how to custody digital assets, covering:

Custody and key management architecture (MPC vs. multi-sig vs. HSM)
Sub-custody arrangements and delegation chains
Asset segregation mechanics (omnibus vs. segregated wallets)
Insurance coverage relative to AUC
Regulatory status and licensing across operating jurisdictions
Business continuity and disaster recovery procedures
Incident response capabilities and historical track record
Governance structures, including board independence and conflict management

SBAI Operational Due Diligence Toolbox

The Standards Board for Alternative Investments (SBAI) published an Operational Due Diligence of Digital Assets toolbox that establishes a comprehensive framework for institutional allocators. Key areas include:

Custody: Who manages the list of wallet addresses? Are processes properly controlled? ODD of custody arrangements should follow the same rigor as for third-party custodians, with some areas requiring increased scrutiny
Trade processes: How are trades executed, settled, and reconciled with custody records?
Valuation and asset verification: Are valuations independently verified against on-chain data?
Conflicts of interest: Does the custodian also operate as a trading venue or market maker?
Regulatory risk: What happens to client assets under the custodian's local insolvency regime?

CAIA Association Framework

The Chartered Alternative Investment Analyst Association (CAIA) has published research on the institutional custody dilemma, examining the balance between centralization and self-custody in digital asset portfolios. Their framework emphasizes:

The need for hybrid custody models that blend centralized oversight with distributed key management
Risk assessment of MPC implementations vs. traditional multi-signature
Evaluation of custodian financial stability and insurance adequacy
Assessment of regulatory arbitrage risks across jurisdictions

Composite Due Diligence Questions Beyond Regulatory Requirements

Based on published frameworks, institutional RFPs for crypto custody typically include:

Security Architecture:

What percentage of assets are held in cold storage vs. hot/warm wallets?
What multi-signature or MPC configuration is used, and how are key shares distributed?
What HSM vendor and certification level is used for key generation and storage?
Are key ceremonies independently witnessed and documented?
What is the custodian's penetration testing frequency and who performs it?

Operational Resilience: 6. What are the defined RPO and RTO for custody operations? 7. Where are key backups stored, and how frequently are they verified? 8. What geographic redundancy exists in the custody infrastructure? 9. Has the custodian ever experienced a security incident? If so, what was the outcome and remediation?

Governance and Compliance: 10. Does the custodian maintain SOC 2 Type II certification? Who is the auditor? 11. What insurance coverage exists, from which underwriters, and what are the exclusions? 12. Are customer assets legally segregated in the event of custodian insolvency? 13. What sub-custodians are used, and what due diligence has been performed on them? 14. How does the custodian handle forks, airdrops, and staking yields?

Financial Stability: 15. What is the custodian's capitalization relative to assets under custody? 16. Does the custodian have audited financial statements available for review? 17. What are the custodian's revenue sources beyond custody fees?

These questions substantially exceed the requirements of any single jurisdiction's regulatory framework. See Audit & Reporting for related standards.

Sources:

2.2 Pension Fund Approaches: The CalPERS Example

CalPERS, the largest public pension fund in the United States (~$500 billion AUM), illustrates how major institutional allocators approach crypto exposure. Rather than directly custodying crypto assets, CalPERS has maintained indirect exposure through:

A $165.9 million stake in MicroStrategy (MSTR), which holds over 636,000 BTC
Positions in crypto-adjacent equities (e.g., Riot Platforms)
$80 million in Strategy shares for indirect Bitcoin exposure

This approach reflects the reality that most pension funds' investment mandates do not permit exposure to unresolved legal or regulatory risk. Direct crypto custody requires resolving questions about:

Legal enforceability of smart contracts governing custody
Regulatory classification of crypto assets under ERISA or state pension law
Fiduciary duty implications of selecting a crypto custodian
Insurance adequacy relative to the irreversible nature of blockchain transactions

CalPERS' Investment Compliance and Operational Risk (ICOR) division is responsible for operational due diligence, trade controls, and advisory compliance — and these functions apply the same rigor to any crypto-adjacent investment as to traditional assets.

The implication: Until the gap between regulatory clarity and institutional due diligence requirements narrows, the largest pools of institutional capital will likely continue to access crypto through indirect channels rather than direct custody, limiting the growth of the institutional custody market.

Sources:

Part 3: Regulatory Gaps — What Law Misses That Markets Demand

3.1 DeFi Custody: LP Tokens, Governance Tokens, and Protocol Positions

The regulatory void: No jurisdiction has established clear rules for custodying decentralized finance (DeFi) positions. This includes:

Liquidity provider (LP) tokens: When a custodian deposits client assets into a liquidity pool (e.g., Uniswap, Aave), the resulting LP token represents a claim on a pool of assets. Is the custodian now holding the LP token in custody, or the underlying assets, or both? No jurisdiction has answered this question.
Governance tokens: The Howey Test remains central in determining whether governance tokens are securities. Protocols with genuine decentralized governance may argue for functional decentralization through distributed token holdings, active on-chain voting, and automated treasury management. But a custodian holding governance tokens faces the question: must it vote? Can it vote? On whose instruction?
Yield-bearing positions: Staking, lending, and liquidity provision generate yields. These yields may be classified as income, capital gains, or something else entirely, depending on the jurisdiction. The custodian's role in managing these positions is not addressed by any custody regulation.

The institutional reality: Institutional investors are hesitant because the legal enforceability of crypto assets and smart contracts remains unclear, and their mandates do not allow exposure to unresolved legal or regulatory risk. Despite infrastructure progress from regulated custodians like Anchorage, Fireblocks, and Zodia Custody — which provide governance, compliance hooks, insurance, and audit trails for tokenized environments — the legal foundations remain insufficient for fiduciary-grade allocation.

One of the biggest unresolved questions in U.S. market structure legislation is how DeFi, its developers, and non-custodial software should be treated under federal securities and commodities laws.

Sources:

3.2 Cross-Chain Custody: Bridged Assets and Wrapped Tokens

The regulatory void: When assets are moved between blockchains via bridges (e.g., Wrapped Bitcoin on Ethereum), fundamental custody questions arise that no jurisdiction has addressed:

Who holds custody of the underlying asset? If Bitcoin is locked in a bridge contract and a wrapped representation exists on Ethereum, the custodian holding the wrapped token does not hold custody of the underlying Bitcoin. Who is responsible if the bridge is compromised?
Bridge counterparty risk: Over $3.4 billion in cryptocurrency was stolen during 2025, with bridge exploits representing a significant portion. A custodian's obligation to protect bridged assets is not addressed by any regulatory framework.
Chain-hopping for laundering: Cross-chain transactions create compliance challenges, as assets can be moved across multiple blockchains to evade transaction monitoring. Traditional AML rules were not designed for multi-chain environments.

The CFTC's December 2025 tokenized collateral guidance acknowledges that "CFTC regulations do not require any particular technology or operational infrastructure to transfer or hold eligible collateral" and that "assets retain their margin eligibility so long as they satisfy applicable regulatory requirements." But this guidance does not address the unique risks of cross-chain custody.

The market demand: Institutional investors increasingly require multi-chain support (Ethereum, Bitcoin, Solana, Layer 2s). The ability to custody assets across chains — and to track, reconcile, and report on them — has become a competitive differentiator. Yet the regulatory framework provides no guidance on the risks specific to cross-chain operations.

Sources:

3.3 Staking from Custody: Tax, Slashing, and Fiduciary Questions

The regulatory landscape (evolving): This is one area where regulation is beginning to catch up with practice:

The IRS issued Revenue Procedure 2025-31, establishing a safe harbor for trusts (including ETPs) that stake digital assets on proof-of-stake networks. Key requirements include:
- A qualified custodian must hold the digital assets at all times, including while staked
- The trust retains ownership of the digital assets for federal income tax purposes, even while staked
- Assets must be indemnified against slashing (forfeiture due to validator failure) by the staking provider
- Only additional units of the same digital asset may be received as staking rewards
- Rewards must be distributed at least quarterly
The SEC's October 2025 no-action letter permits registered investment advisers to treat STCs as qualified custodians, which implicitly enables institutional staking through custody arrangements.

What remains unresolved:

Slashing risk allocation: Who bears the loss if staked assets are slashed due to validator misbehavior — the custodian, the client, or the staking provider? The IRS safe harbor requires indemnification, but this is a tax provision, not a custody standard.
Fiduciary duty: If a custodian can stake client assets to earn yield, does fiduciary duty require it to stake? Or does the additional risk of staking violate fiduciary duty?
Rehypothecation risks: Does staking constitute a form of rehypothecation of client assets? The NYDFS has taken the position that custodians should only hold customer virtual currency "for custody and safekeeping purposes" and not for the custodian's own use.
Multi-jurisdiction tax treatment: Staking rewards are treated differently across jurisdictions. A custodian serving clients in multiple countries faces irreconcilable tax reporting obligations.

Sources:

3.4 NFT Custody: Technical Divergence Without Regulatory Guidance

The regulatory void: Non-fungible tokens present fundamentally different custody challenges than fungible tokens, yet no jurisdiction has issued NFT-specific custody guidance:

Metadata dependency: Many NFTs reference off-chain metadata (images, documents, attributes). Custodying the token on-chain does not necessarily preserve the associated content. If the metadata server goes down, the NFT may become worthless despite the token being securely held.
Smart contract interaction risks: NFTs frequently require interaction with marketplace smart contracts for listing, bidding, and transferring. Each interaction is a potential attack vector.
Valuation challenges: Unlike fungible tokens with liquid markets, NFT valuation is highly subjective and illiquid, complicating insurance and collateral calculations.
Fractionalized NFTs: When NFTs are split into fractional ownership, custodial obligations multiply and may cross into securities regulation territory.

The Parallel Finance collapse in 2025, which locked $800,000 in NFTs, exposed centralized custody risks for non-fungible assets. NFT lending volumes dropped 97% since 2024 peaks as users abandoned custodial platforms with governance and technical vulnerabilities.

The market demand: Despite these challenges, institutional interest in high-value NFTs (art, real estate-linked tokens, intellectual property) is growing. Custodians that can demonstrate secure handling of NFTs — including metadata preservation, smart contract interaction controls, and valuation frameworks — have a significant competitive advantage.

Sources:

3.5 Tokenized Real-World Assets (RWA): Which Rules Apply?

The regulatory ambiguity: Tokenized real-world assets — including tokenized treasuries, real estate, bonds, and equities — represent claims on underlying regulated assets. This creates a dual-custody problem:

The underlying asset (e.g., a U.S. Treasury bond) requires traditional custody through a qualified custodian or clearing system (DTC, Euroclear)
The token representing ownership requires crypto custody (key management, wallet security)
Neither custody framework alone is sufficient, and no jurisdiction has articulated how the two interact

The market has grown rapidly: on-chain tokenized positions reached between $20 billion and $30 billion in 2025, concentrated in tokenized investment funds, tokenized treasuries, and tokenized real estate instruments. Industry reports anticipated that 2025 would advance tokenization frameworks including clearer custody and segregation rules for tokenized instruments.

Jurisdictional approaches:

United States: Tokenized RWAs are often classified as securities under the Howey Test, requiring compliance with federal securities laws. The SEC's Project Crypto rulemaking program is clarifying when tokens qualify as securities and revising custody rules for on-chain settlement.
European Union: MiCA provides a framework for crypto-assets but tokenized securities fall under MiFID II, creating a regulatory overlap.
Hong Kong: The SFC and HKMA have created staged approaches for tokenized funds and products, including client asset protections and operational expectations.
Singapore: MAS has adopted a hybrid approach through Project Guardian, exploring tokenized investment products under existing securities frameworks.

The gap: Modern digital custodians are building capabilities to combine traditional asset safeguarding with blockchain key management, but the legal and regulatory framework for this hybrid custody model remains fragmented and incomplete.

Sources:

3.6 Multi-Party Computation (MPC) Regulatory Status

The fundamental unanswered question: Is an MPC key shard a "key"? Is each shard holder a "custodian"?

MPC has become the dominant institutional custody technology, with 68% of institutional custodians using MPC across cold, warm, and hot wallets (ChainUp, 2025). Fireblocks' MPC 3.0 (released February 2025) adds quantum-resistant cryptography. Yet the regulatory classification of MPC remains unresolved:

No single private key exists at any point: In an MPC implementation, the private key is mathematically distributed as shares across multiple parties. The key is never assembled — computation occurs on the shares themselves. This is fundamentally different from multi-signature, where each signer holds a complete key.
Custody attribution: If three parties each hold an MPC shard in a 2-of-3 configuration, who is the "custodian"? All three? Any two? The party that initiated the signing? No jurisdiction has provided definitive guidance.
Regulatory compliance advantages: MPC supports regulatory alignment through cryptographically verifiable logs, automated policy engine enforcement, and native audit trail generation. But this compliance infrastructure exists in a regulatory vacuum.
Bankruptcy treatment: If an MPC shard holder becomes insolvent, what happens to the shard? Is it a "asset" of the estate? Can it be claimed by creditors? The legal treatment of MPC shards in insolvency is entirely uncharted.
Audit standards: What audit standards apply to MPC implementations? SOC 2 can assess MPC controls, but there is no MPC-specific audit framework.

The market reality: Institutional clients overwhelmingly prefer MPC over multi-signature because MPC provides better operational efficiency (no on-chain transaction overhead), blockchain-agnostic operation, and flexible governance policies. But they are investing in a technology whose legal status is undefined. See Key Management for technical details.

Sources:

3.7 Smart Contract Wallet Custody: Account Abstraction and the Regulatory Void

The emerging challenge: Account Abstraction (AA), enabled by ERC-4337 and accelerated by EIP-7702, decouples the signer (the key) from the account (the smart contract). This enables institutional-grade features including social recovery, session keys, gas abstraction, spending controls, and automated operations — all within a smart contract wallet.

Smart contract wallets are quickly becoming the default for institutional crypto custody in 2026, yet they present unprecedented regulatory questions:

Who controls custody? In a smart contract wallet with social recovery, multiple guardians can collectively restore access. Does each guardian hold "custody"?
Session keys: Smart contract wallets can issue temporary, limited-authority keys for specific operations. Is a session key a "custodial" key?
Programmable spending controls: Smart contract wallets can enforce transaction limits, whitelists, and time-locks at the protocol level. Do these controls satisfy regulatory "safekeeping" requirements?
Upgradeability: Smart contract wallets can be upgraded, potentially changing custody logic. Who approves upgrades? What governance is required?

Jurisdictional responses: Jurisdictions such as Taiwan (under the VASP Act) and the EU (under MiCA) are beginning to subject hot wallet providers to asset segregation mandates, but none have addressed smart contract wallets specifically.

Hong Kong's Financial Services and Treasury Bureau plans to introduce legislation regulating virtual asset custodian service providers in 2026, which may address some of these questions.

Liechtenstein's TVTG comes closest to naming the relevant actors: its unified custodian category, the VT-Verwahrer (Art. 2(1)(n) TVTG), expressly covers safekeeping of a client's VT keys as well as the tokens themselves (the earlier separate "TT Token Depositary" and "TT Key Depositary" roles were merged into this single category) — a statutory recognition that controlling the means of access is itself a regulated custodial function. But even this token-container model predates account abstraction and does not resolve whether a smart-contract guardian, session key, or MPC shard holder is a "custodian."

Sources:

Part 4: Supervisory Expectations Not Written in Law

Regulators communicate expectations through channels other than statute and formal regulation. These "soft signals" are as important as written law because they guide examination practices, inform enforcement discretion, and shape the practical standard of care.

4.1 SEC Crypto Task Force: "Know Your Custodian" Roundtable (April 2025)

On April 25, 2025, the SEC's Crypto Task Force hosted its third roundtable, titled "Know Your Custodian: Key Considerations for Crypto Custody." The roundtable addressed challenges and potential updates to custody requirements for broker-dealers, investment advisers, and investment companies.

Key supervisory expectations communicated:

Qualified custodian as a "high bar": Commissioner Crenshaw emphasized that the Custody Rule does not intend for just anyone to meet the qualified custodian definition. "It is meant to be a high bar accompanied by robust protections." This signals that the SEC expects custodians to exceed minimum licensing requirements.
Technology provider vs. custodian blur: Panelists highlighted how the line between "technology service provider" and "custodian" is increasingly blurred. Firms that offer wallet management may also perform custodial functions. The SEC signaled that functional analysis — what the firm does, not what it calls itself — will determine regulatory treatment.
Expanding qualified custodian types: Several panelists suggested broadening the scope of qualified custodians to include state-chartered, limited-purpose trust companies. The SEC subsequently issued a no-action letter in September 2025 permitting this treatment under certain conditions.
Due diligence as ongoing obligation: Firms "cannot simply outsource their due diligence to the SEC." They must prove, on paper and in practice, that their chosen custodian meets qualified bank standards.

Sources:

4.2 Commissioner Peirce: Principles-Based Custody (September 2025)

SEC Commissioner Hester Peirce delivered remarks titled "Cultivating Confidence: The Role of Custody in Institutional Confidence" at the Digital Assets Summit in Singapore on September 30, 2025. She:

Criticized past restrictive measures including Staff Accounting Bulletin No. 121 (SAB 121) — since rescinded by SAB 122 (issued January 23, 2025, effective January 30, 2025), which removed the on-balance-sheet liability requirement for custodied crypto and eliminated the associated capital charges — and the Special Purpose Broker-Dealer framework, as having hindered market participation
Urged regulators to adopt principles-based custody frameworks rather than prescriptive technology-specific rules
Called for recognition of blockchain transparency and smart contracts as tools that can satisfy custody requirements
Noted that the Crypto Task Force received public input through a February request for comment and an April roundtable, and is actively developing guidance

The implicit standard: Commissioner Peirce's remarks signal that the SEC is moving toward an outcomes-based approach where custodians are judged on their ability to protect client assets, rather than on specific technology implementations. This creates both opportunity (custodians can innovate) and uncertainty (no prescriptive checklist to follow).

Sources:

4.3 NYDFS Industry Letters: Guidance Beyond the BitLicense

The NYDFS has established itself as a leading source of supervisory expectations that go beyond statute, communicated through Industry Letters:

September 30, 2025 Updated Guidance on Custodial Structures for Customer Protection in the Event of Insolvency — This guidance (updating the January 2023 version) establishes several expectations not found in the BitLicense statute:

Sub-custodian standards: The Department expects sub-custodians to be either chartered/licensed by the Department or subject to "substantially similar" supervisory and regulatory regimes. Prior approval from NYDFS is required, with documentation including risk assessments, service agreements, and relevant policies.
Prohibition on custodian use of customer assets: Custodians should only take possession of customer virtual currency "for custody and safekeeping purposes," treating it as belonging solely to customers and not using it for the custodian's own purposes (e.g., as collateral for a loan). This is a supervisory expectation, not a statutory prohibition.
Customer disclosure standards: Custodians must clearly disclose in writing the general terms and conditions, obtain written acknowledgment before the first transaction, and make all disclosures easily accessible on their website.
Blockchain analytics requirements: The NYDFS extended blockchain tracing guidance to banks in 2025, signaling an expectation that all supervised entities — not just licensed crypto businesses — maintain blockchain analytics capabilities.

The NYDFS approach matters globally because many institutional custodians operate under New York trust charters (Coinbase Custody Trust, Gemini Trust, Paxos Trust), making NYDFS Industry Letters effectively global standards for the institutional custody market.

Sources:

4.4 FINMA Guidance 01/2026: Switzerland's Outcome-Based Approach

On January 12, 2026,

Switzerland's FINMA published Guidance 01/2026 on the custody of crypto-based assets. This represents a quintessential example of supervisory expectations communicated outside of statute:

Key expectations:

Technology-specific risk management: FINMA expects supervised institutions to address DLT-specific risks including operational and cyber risks, private-key management risks, and counterparty risks where custody is delegated to third parties
Bankruptcy-remote custody: The guidance outlines conditions under which crypto-based assets qualify as bankruptcy-remote under Swiss law — a critical determination not explicitly addressed in the DLT Act itself
Sub-custody delegation standards: Foreign custodians may only be used where they are subject to "equivalent prudential supervision" and foreign law provides "comparable protection in case of bankruptcy"
Segregated custody for managed portfolios: Individual portfolio management requires clients' crypto-based assets to be held separately for each client
Full institutional responsibility: FINMA stresses that supervised institutions "remain fully responsible for ensuring compliant custody structures" even when operations are delegated

The FINMA approach is significant because Switzerland is a leading jurisdiction for institutional crypto custody (Sygnum, SEBA, Bitcoin Suisse), and FINMA's outcome-based model — setting expectations without prescribing technology — is being studied by regulators worldwide.

Switzerland's statutory bankruptcy-remoteness (DEBA Art. 242a–242b) is no longer unique. Two jurisdictions added in this refresh now sit alongside it as European/EEA venues offering codified insolvency segregation rather than relying on general trust law:

Liechtenstein, whose TVTG (Art. 25) combined with Insolvenzordnung (IO) Art. 41 lets clients segregate (aussondern) tokens and TT keys from a failed depositary's estate while inside the EEA single market via MiCAR passporting; and

Bermuda, whose DABA s.18(4) declares custodied client digital assets "not subject to the claims of creditors of the licensed undertaking," with the Custody of Client Assets Rules 2025 adding a pari-passu insolvency waterfall. By contrast, the other newly surveyed centres deliver the same outcome through weaker foundations:

Luxembourg relies on MiCAR Art. 75(7) read against national insolvency law (less codified than Switzerland's statutory model), and the

Cayman Islands and Gibraltar have no crypto-specific bankruptcy-remoteness statute at all, depending instead on operational segregation plus common-law trust and property principles. This divergence is precisely the kind of "soft" structural difference that institutional due diligence (Part 2) probes but that headline licensing status conceals.

Sources:

4.5 U.S. Banking Regulators: Joint Statement on Crypto-Asset Safekeeping (July 2025)

On July 14, 2025, U.S. federal banking regulators (OCC, FDIC, Federal Reserve) issued a joint statement on the safekeeping of crypto-assets, highlighting legal, regulatory, and risk management considerations for banking organizations holding customer crypto assets.

Key supervisory expectations:

The OCC's Interpretive Letter 1184 (May 7, 2025) reaffirms and expands the authority of national banks and federal savings associations to provide custody services for crypto assets
Banks must maintain SOC reporting, penetration testing, incident response procedures, and continuity planning that protect against irreversible loss
Institutions need specialized technical knowledge in cryptography, blockchain technology, and security protocols — standard IT capabilities are insufficient
Different crypto assets may require different technical expertise, meaning a custodian qualified for Bitcoin may not be qualified for complex DeFi tokens

Sources:

Part 5: Emerging Norms Likely to Become Regulation

5.1 Real-Time Proof of Reserves

The industry is moving from periodic attestations to continuous, real-time verification of reserves. Since 2025, leading exchanges have shifted from "point-in-time" audits to real-time verification using Merkle Trees and zero-knowledge proofs. Exchanges using real-time verification have reported 40% higher customer retention rates during volatile markets compared to opaque systems (per Financial Stability Board data).

Chainlink Proof of Reserve has been deployed for physically-backed crypto ETPs (September 2025), enabling automated on-chain verification of custody balances. The U.S. GENIUS Act already mandates monthly proof of reserves for stablecoin issuers — extending this to custodians is a logical next step. Bermuda has, in effect, already taken it: DABA s.18(3)'s "sufficient amount of each type of digital asset" requirement supplies a statutory custodian-level PoR hook, and the UAE's VARA mandates periodic proof-of-reserves checks for licensed custodians — early signals of the direction other jurisdictions are likely to follow.

Prediction: Within 2-3 years, at least one major jurisdiction will mandate continuous or near-real-time proof of reserves for institutional custodians.

5.2 Post-Quantum Cryptography Readiness

The threat of quantum computing to blockchain cryptography has moved from theoretical to regulatory concern:

NIST finalized the first PQC standards in August 2024 (FIPS 203, 204, 205), with additional standardization of the HQC algorithm announced in 2025
An Executive Order of January 2025 promotes adoption of PQC technologies and accelerates transition of federal cryptographic systems
The EU published a coordinated PQC implementation roadmap on June 23, 2025, targeting critical infrastructure quantum-resistance by 2030
The SEC has begun signaling PQC expectations in the digital assets space through proposed frameworks referencing NIST PQC algorithms and CNSA 2.0 compatibility
Fireblocks' MPC 3.0 (February 2025) already incorporates quantum-resistant cryptography

Despite this, 91% of businesses do not have a formal roadmap for migrating to quantum-safe algorithms. The transition from standardization to full integration is expected to take a decade or more, with PQC introducing trade-offs including larger keys/signatures and heavier computation.

Prediction: By 2028, PQC readiness will become a licensing condition for crypto custodians in the EU and likely in the U.S. Custodians should begin migration planning immediately.

Sources:

5.3 AI-Driven Transaction Monitoring

AI-powered compliance systems are rapidly becoming the expected standard for institutional crypto custody:

The GENIUS Act (enacted July 2025) mandates comprehensive AML compliance for stablecoin issuers, including transaction monitoring, suspicious activity reporting, and OFAC screening — effectively requiring sophisticated monitoring infrastructure
AI-powered AML solutions reduce false positives by 90-95% and detect sophisticated laundering patterns including chain-hopping across multiple blockchains
A U.S. Treasury report asserts that AI can identify patterns associated with complex laundering techniques that traditional rules-based monitoring systems cannot detect
The industry is moving toward Agentic AI — autonomous systems that adapt, decide, and execute compliance workflows end-to-end, with multi-agent AI workforces expected to gain significant traction in 2026
FATF's June 2025 update highlighted persistent gaps in Travel Rule implementation, increasing pressure on custodians to deploy advanced monitoring

Prediction: Within 2 years, regulators will begin referencing AI-based transaction monitoring as a supervisory expectation, even if not formally mandated. Custodians relying solely on rules-based monitoring will face examination criticism.

Sources:

5.4 Environmental Disclosure for Custody Operations

ESG reporting requirements are extending to crypto operations:

By 2026, crypto companies will face mandatory ESG reporting across multiple jurisdictions, requiring disclosure of environmental, social, and governance metrics as part of licensing
The UAE's federal climate law (implemented 2025) requires entities including crypto firms to report Scope 1 and Scope 2 greenhouse gas emissions, with Scope 3 to be introduced for high-impact sectors
Under Project Guardian, academic and banking consortia have tokenized impact metrics for green instruments, enabling automated disclosure and audit
The EU's Corporate Sustainability Reporting Directive (CSRD) will apply to large crypto service providers operating in Europe

However, a significant number of crypto companies are not positioned to meet sustainability reporting requirements, particularly regarding environmental data collection. This represents an emerging compliance gap that will widen as ESG mandates expand.

Prediction: By 2027, at least one major jurisdiction will require environmental impact disclosures specifically from crypto custodians, including energy consumption of custody infrastructure, not just mining operations.

Sources:

5.5 On-Chain Governance for Custody Wallets

As smart contract wallets mature through Account Abstraction (ERC-4337, EIP-7702), institutional custody increasingly involves on-chain governance mechanisms:

Multi-party approval flows enforced at the smart contract level, not just at the custodian's application layer
Time-locked transactions that create mandatory delay periods for large withdrawals
Whitelisted destination addresses governed by on-chain registries
Transparent upgrade governance for custody wallet smart contracts

These mechanisms provide verifiable, tamper-proof governance that exceeds what traditional custody arrangements can offer. No jurisdiction currently recognizes on-chain governance as satisfying regulatory requirements, but the direction of travel is clear.

Sources:

Part 6: "Soft Law" — Industry Association Standards

6.1 CryptoCurrency Security Standard (CCSS)

The CCSS, maintained by the CryptoCurrency Certification Consortium (C4), is the most widely referenced voluntary security standard for crypto custody operations. Version 9.0 was published December 17, 2024.

Certification levels:

Level I: Foundational security — essential safety requirements and basic security standards
Level II: Enhanced security — controls exceeding Level I, designed specifically for decentralized systems
Level III: Advanced security — the highest level, incorporating stringent controls, advanced risk management, regular security audits, and continuous monitoring

System classification:

Self-Custody: Sole control of private keys for own funds
Qualified Service Provider (QSP): Facilitates a subset of custody services; subject to reduced requirements
Full System: Complete custody operations; subject to all 41 aspect controls

Key requirements:

Multi-signature configuration with at least two signatures required before spending
Strong encryption for cryptographic keys and seeds when not in use
Proof of Reserves audits
Comprehensive audit logging
Advanced cryptographic key management practices
Periodic security audits

Relevance: CCSS certification is not required by any regulator but is increasingly referenced in institutional due diligence. Bitso achieved CCSS Level 2 certification in 2025, described as "the highest global security standard in the crypto industry." Systems are independently evaluated and audited against all 41 aspect controls.

Sources:

6.2 Global Digital Finance (GDF) Global Cryptoasset Standards

GDF's Global Cryptoasset Standards represent one of the most comprehensive industry codes for crypto financial services, including custody. The Standards:

Comprise 63 principles across six domains: Ethics, Governance, Execution, Information Sharing, Risk Management and Compliance, and Confirmation and Settlement Processes
Were inspired by global best-practice industry standards including the FX Global Code (administered by ACI FMA)
Are maintained as a living document that evolves with industry maturity
Have received strong support from the UK's FCA, which sees them as a valuable supplement to future FCA rules on cryptoassets
Replaced GDF's original 10 codes of conduct and AML Due-Diligence Questionnaire for VASPs/CASPs

The FCA's endorsement is significant: it signals that GDF's voluntary standards may inform the substance of formal

United Kingdom regulation. Custodians that already comply with GDF standards will likely find the transition to formal regulation smoother.

Sources:

6.3 ISO 27001/27002 for Crypto Operations

ISO 27001 provides a formal information security management system (ISMS) framework that is directly applicable to crypto custody operations. While not crypto-specific, it has become an expected certification for institutional custodians:

Application to crypto custody:

Defines scope from wallet creation to transaction signing
Risk assessments focused on threats including private key theft and hardware wallet security
Security controls relevant to key management, multi-signature schemes, and physical security of cold storage facilities
Annex A 8.24 specifically addresses the use of cryptography, requiring organizations to create regulations and processes for maintaining confidentiality, integrity, authenticity, and availability

ISO 27001 vs. ISO 27002:

ISO 27001 provides high-level requirements and is certifiable
ISO 27002 expands on implementing security controls but is not independently certifiable
Both are complementary; institutional due diligence typically expects ISO 27001 certification with ISO 27002 implementation guidance followed

Major custodians with ISO 27001 certification:

Cobo (achieved certification following rigorous audit process)
Paribu Custody (ISO 27001 plus SOC 1/SOC 2)
Bitwise (for European investment operations)
Amdax Institutional

Sources:

6.4 AICPA Digital Assets Practice Aid

The AICPA's Accounting for and Auditing of Digital Assets practice aid is the authoritative nonauthoritative guidance for accounting and auditing digital assets under U.S. GAAP and GAAS. Updated in January 2025 following FASB ASU 2023-08 on crypto asset accounting, with a new chapter on auditing lending and borrowing transactions added in September 2025.

Key custody-related guidance:

Existence verification: Auditors should confirm blockchain balances via explorers, inspect hardware wallets, verify custody, and obtain third-party confirmations
Custody service assessment: The practice aid addresses hot/cold wallet providers, qualified custodians, and other custodial services
Valuation: New definitions and amended accounting questions for digital asset fair value measurement
Lending and borrowing: September 2025 chapter provides practical guidance for auditing digital asset lending transactions, including assessment of counterparty risk and collateral adequacy

Relevance: While the practice aid is nonauthoritative (it does not create binding requirements), it establishes the practical standard of care for auditing crypto custody operations. Auditors that deviate from its guidance face professional liability risk. This makes the AICPA practice aid a de facto standard even though it lacks legal force. See Audit & Reporting for related standards.

Sources:

6.5 ISAE 3402 / ISAE 3000 Assurance Standards

In the European context, PwC and other Big Four firms reference ISAE 3402 (for service organizations) and ISAE 3000 (for broader assurance engagements) as the applicable standards for crypto custody control reports. These are the international equivalents of SOC 1 and SOC 2 respectively, and are expected by institutional investors in European jurisdictions alongside or instead of AICPA SOC reports.

Sources:

PwC - Crypto Custody Risks and Controls

Summary: The Institutional Adoption Gap

The central finding of this analysis is that a significant gap exists between what regulation requires and what the market demands for institutional crypto custody. This gap manifests in several dimensions:

Counts below are derived from the 20-jurisdiction fact matrix underlying this domain.

Dimension	Regulatory Requirement	Market Expectation	Gap Severity
Cold Storage Ratio	Numeric floor in 6 of 20 jurisdictions (Japan, Bahrain, Hong Kong, Singapore, South Korea, Canada)	90-95% universally expected	High
SOC 2 Type II	Not required anywhere as a named standard	Universal deal-breaker	Critical
Insurance Coverage	Mandatory backstop in a minority (EU, Bahrain, South Korea, Bermuda, Cayman); fixed minimums rare	$100M+ expected	High
Proof of Reserves	Statutory/rulebook basis only in a few (GENIUS Act issuers, Bermuda s.18(3), UAE VARA)	Expected for all custodians	Medium
Key Ceremony Standards	Prescribed only in Bermuda (Custody Code); unregulated elsewhere	Detailed protocols expected	High
Penetration Testing	Codified cadence in 3 (Bahrain twice-yearly, Canada annual, Bermuda 6-monthly key audit)	Annual minimum; quarterly preferred	Medium
Statutory Bankruptcy-Remoteness	Codified in a minority (Switzerland, Liechtenstein, Bermuda, Japan); outcome-based elsewhere	Insolvency segregation assumed	High
DeFi Position Custody	No guidance	Growing institutional demand	Critical
MPC Legal Status	Undefined	Dominant custody technology	Critical
Cross-chain Custody	No guidance	Multi-chain support expected	High
Post-Quantum Readiness	Signaled, not mandated	Forward-looking institutions asking	Emerging
AI Transaction Monitoring	Not mandated	Becoming expected	Emerging

For policymakers: The items marked "Critical" represent areas where regulatory silence creates systemic risk. Custodians operating in these areas are building infrastructure without legal certainty, and institutional investors are making allocation decisions based on industry norms rather than regulatory assurance.

For institutional investors: Due diligence cannot rely solely on regulatory compliance. The questions in Part 2 of this document should form the baseline for custodian evaluation, regardless of jurisdiction.

For custodians: Meeting regulatory requirements is necessary but insufficient. The table above represents the true standard of care expected by institutional capital.

For compliance officers: Building compliance programs that address only written law leaves the organization exposed to both institutional due diligence failures and supervisory expectations communicated through the channels described in Part 4. See Compliance for enforcement frameworks.

Verification Notes

The original factual claims in this document were researched and verified through web searches conducted on March 18, 2026. This document was refreshed on June 4, 2026 to mirror the canonical 20-jurisdiction crypto-custody fact matrix that underpins this domain — integrating the five jurisdictions added in this cycle (Liechtenstein, Luxembourg, Gibraltar, Bermuda, and the Cayman Islands), correcting facts the matrix now states differently, and re-deriving the "X of N" aggregates for N = 20. No new web searches were performed in this refresh; all newly added jurisdictional facts are sourced from the canonical fact matrix and reflect its "NOT VERIFIED" flags where applicable. The following verification notes apply:

Cold-storage numeric floors (6 of 20 jurisdictions): Per the fact matrix — Japan ≥95% (post-Mt. Gox, hot-wallet exposure backed 100% by operator's own crypto), Bahrain ≥95% per asset (CRA-8.1.9), Hong Kong 98%/2% (2023 VATP Guidelines, shifting to outcome-based under ASPIRe), Singapore ≥90% (PS-G03), South Korea ≥80% (VAUPA Enforcement Decree, FSC reviewing increase to near-100%), Canada ≥80% with third-party custodians / 20% dealer self-custody cap (CSA SN 81-336, CIRO). None of the five newly added jurisdictions imposes a numeric percentage.
Bermuda key-ceremony and audit-cadence standards: Per the fact matrix — Digital Asset Custody Code (Feb 2024): ≥256-bit seed entropy, ≥24-word mnemonic, ≥3-person seed ceremony, M-of-N multi-sig with ≥3 signatories, FIPS 140-2 HSMs; key/seed processes audited at least every six months, multi-sig annually (Custody Rules 2025 r.3; Custody Code §5).
Mandatory insurance / financial backstop: Per the fact matrix — EU (MiCA Art. 75 liability insurance), Bahrain (PI ≥ BHD 100,000 + keyman + cyber), South Korea (insurance or compensation reserves under VAUPA), Bermuda (DABA s.18(1) surety bond / trust account / indemnity insurance), Cayman Islands (Feb 2026 MC-RSOG). Liechtenstein/Luxembourg treat insurance as a permitted MiCAR Art. 67 prudential-floor substitute; Gibraltar expects PI case-by-case under Principle 3.
Statutory bankruptcy-remoteness: Per the fact matrix — codified in Switzerland (DEBA Art. 242a–242b), Liechtenstein (TVTG Art. 25 + Insolvenzordnung (IO) Art. 41), Bermuda (DABA s.18(4) + Custody Rules 2025 pari-passu waterfall), and Japan (statutory preference rights). Luxembourg relies on MiCAR Art. 75(7) read against national insolvency law; Cayman and Gibraltar have no crypto-specific bankruptcy-remoteness statute.
US SAB 121 / SAB 122 correction: Per the fact matrix — SAB 122 (issued January 23, 2025, effective January 30, 2025) rescinded SAB 121, removing the on-balance-sheet liability requirement for custodied crypto and eliminating associated capital charges; banks now apply ASC 450-20. The SEC's September 30, 2025 no-action letter permits state-chartered trust companies to be treated as qualified custodians under specified conditions.
Penetration-testing cadence: Per the fact matrix — Bahrain twice yearly by certified external testers (CRA-5.8.13G(e); interval/reporting CRA-5.8.13I; plain para CRA-5.8.13 was deleted Apr 2023), Canada at least annually (CIRO), Bermuda 6-monthly key/seed audit plus annual multi-sig audit. EEA newcomers governed by DORA resilience testing.
Japan 95% cold storage requirement: Verified (March 2026) through multiple sources including Bitget Academy, FSA documentation summaries, and Global Legal Insights Japan chapter; consistent with the fact matrix.
Singapore MAS 90% cold storage: Verified (March 2026) through Independent Reserve and MAS regulatory summaries. The 90% requirement applies to DPT Service Providers with daily reconciliation mandated.
South Korea 80% cold storage (proposed increase to 100%): Verified (March 2026) through MEXC News and CryptoRank coverage of the FSC announcement dated February 19, 2025.
SOC 2 Type II certifications: Individual custodian certifications verified through their official announcements (Crypto.com, Kraken, Custodia Bank, BitGo).
Insurance coverage amounts: Coinbase $320M, BitGo $250M, Gemini $125M — verified through institutional custody comparison guides (Hashlock, YellowCard, Cobo).
SEC "Know Your Custodian" Roundtable: Verified through SEC.gov official event page and press releases.
Commissioner Peirce September 2025 speech: Verified through SEC.gov speeches and statements page and CharltonsQuantum coverage.
NYDFS September 2025 Industry Letter: Verified through DFS.ny.gov official industry guidance page and Arnold & Porter advisory.
FINMA Guidance 01/2026: Verified through FINMA press release and multiple Swiss law firm analyses (Baer & Karrer, Borel Barbey, CMS Law-Now).
IRS Revenue Procedure 2025-31: Verified through Ropes & Gray legal alert and Chainalysis regulatory round-up.
GENIUS Act (July 2025): Verified through multiple sources including Chainalysis, Grant Thornton, and Atlantic Council.
CCSS Version 9.0: Verified through C4 (CryptoCurrency Certification Consortium) official documentation.
GDF 63 principles: Verified through GDF official standards page and Finance Magnates coverage.
AICPA Practice Aid updates: Verified through AICPA-CIMA official news pages and Deloitte DART coverage.
Post-quantum cryptography NIST standards: Verified through NIST documentation references and Cloudflare PQ Internet report.
CalPERS indirect Bitcoin exposure: Verified through CryptoBriefing and AInvest coverage of CalPERS holdings.
68% MPC adoption statistic: Referenced from ChainUp institutional custody report; specific methodology UNVERIFIED.
40% higher retention for PoR exchanges: Referenced from Bitget guide citing Financial Stability Board data; original FSB source UNVERIFIED.
$3.4 billion stolen in 2025: Referenced from Chainalysis 2025 regulatory round-up; consistent with multiple industry sources.
91% of businesses lack PQC roadmaps: Referenced from TCG/Help Net Security report; specific survey methodology UNVERIFIED.

All source URLs were accessible at the time of research. Readers should verify that URLs remain active, as web content may change over time.

Unsaid Items & Implicit Requirements

Part 1: Industry "Table Stakes" Not Codified in Law

1.1 Cold Storage Ratios: The 90-95% Norm

1.2 SOC 2 Type II Certification

1.3 Insurance Coverage Minimums

1.4 Proof of Reserves / On-Chain Attestation

1.5 Disaster Recovery & Business Continuity

1.6 Key Ceremony Standards

1.7 Penetration Testing Frequency

Part 2: Institutional Investor Due Diligence Checklists

2.1 What Institutional Allocators Actually Ask

AIMA Digital Asset Custody Guide

SBAI Operational Due Diligence Toolbox

CAIA Association Framework

Composite Due Diligence Questions Beyond Regulatory Requirements

2.2 Pension Fund Approaches: The CalPERS Example

Part 3: Regulatory Gaps — What Law Misses That Markets Demand

3.1 DeFi Custody: LP Tokens, Governance Tokens, and Protocol Positions

3.2 Cross-Chain Custody: Bridged Assets and Wrapped Tokens

3.3 Staking from Custody: Tax, Slashing, and Fiduciary Questions

3.4 NFT Custody: Technical Divergence Without Regulatory Guidance

3.5 Tokenized Real-World Assets (RWA): Which Rules Apply?

3.6 Multi-Party Computation (MPC) Regulatory Status

3.7 Smart Contract Wallet Custody: Account Abstraction and the Regulatory Void

Part 4: Supervisory Expectations Not Written in Law

4.1 SEC Crypto Task Force: "Know Your Custodian" Roundtable (April 2025)

4.2 Commissioner Peirce: Principles-Based Custody (September 2025)

4.3 NYDFS Industry Letters: Guidance Beyond the BitLicense

4.4 FINMA Guidance 01/2026: Switzerland's Outcome-Based Approach

4.5 U.S. Banking Regulators: Joint Statement on Crypto-Asset Safekeeping (July 2025)

Part 5: Emerging Norms Likely to Become Regulation

5.1 Real-Time Proof of Reserves

5.2 Post-Quantum Cryptography Readiness

5.3 AI-Driven Transaction Monitoring

5.4 Environmental Disclosure for Custody Operations

5.5 On-Chain Governance for Custody Wallets

Part 6: "Soft Law" — Industry Association Standards

6.1 CryptoCurrency Security Standard (CCSS)

6.2 Global Digital Finance (GDF) Global Cryptoasset Standards

6.3 ISO 27001/27002 for Crypto Operations

6.4 AICPA Digital Assets Practice Aid

6.5 ISAE 3402 / ISAE 3000 Assurance Standards

Summary: The Institutional Adoption Gap

Verification Notes

Graph view