Crypto custody is about who controls the private keys that can move a crypto asset. If a third party holds those keys for you, the arrangement is custodial, and you depend on that firm to keep the assets safe and send them back when you ask. If you hold the keys yourself, it is self-custody: no one else can move or freeze the funds, and no one else can recover them if you lose the keys. The newest development came on 1 October 2026. The US Securities and Exchange Commission (SEC) proposed a dedicated crypto custody framework for investment advisers and regulated funds. Under certain conditions it would let advisers self-custody, and it would let state trust companies act as custodians.
What "custody" means for a crypto asset
With traditional securities, custody means a firm holds the asset in an account in your name. Crypto works differently because control comes from a key. Anyone who has the private key, or the material it is derived from, can sign transactions. The EU's Markets in Crypto-Assets Regulation (MiCA) captures this. It defines custody as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets," and the means of access is the keys.
So the practical question is always the same: who can sign?
Custodial vs self-custody
| Custodial | Self-custody | |
|---|---|---|
| Who holds the keys | A third party (a custodian, trust company or bank) | You |
| If you lose your password | The provider can usually restore access | There is no reset. A lost seed phrase means lost funds |
| Main risk | The provider's solvency, security, conduct and legal status | Your own key management: loss, theft, phishing, user error |
| Can funds be frozen? | Yes, by the provider or by legal order served on it | Not by an intermediary, because there isn't one |
Self-custody removes risk from the intermediary, but other risks remain. Your device, your backups and any software or smart contract you sign with still carry their own.
How self-custody works in practice
Most self-custody wallets use the BIP-39 standard. It turns random data into a mnemonic, or "seed phrase", of 12, 15, 18, 21 or 24 words taken from a 2,048-word list. The wallet derives a 512-bit seed from those words, and every key in the wallet comes from that seed. BIP-39 also supports an optional passphrase. Any passphrase produces a valid but different seed, so forgetting a passphrase is the same as losing the wallet.
Two further techniques split control so that no single key can move the funds:
- Multisignature (multisig). Bitcoin's BIP-11 set out "M-of-N" transactions, where M of N listed keys must sign before funds can move. Its own examples are a 2-of-2 wallet-security setup and a 2-of-3 escrow with a dispute agent.
- Shared-key schemes. Some providers split key material among several parties. Regulators now say how such splits count: under the SEC's 2026 proposal, an adviser holding any part of the private key material, even a non-controlling part, is treated as having self-custody (details below).
Who can move your crypto, and what should you check?
Answer up to three questions about who holds your keys to see which checks from this article apply to you.
Who holds the private keys (or the seed phrase) that can move your crypto?
- A third party: a custodian, trust company or bank → next question
- I hold them myself → next question
Which rules cover the custody arrangement?
- A crypto-asset service provider in the EU → Check the MiCA Article 75 protections
- US: I am an investment adviser or a regulated fund → Follow the SEC proposal of 1 October 2026
- Somewhere else, or I am not sure → Run the custodian checklist
Could one compromised device or one key move your funds on its own?
- Yes, or I am not sure → One device or key is a single point of failure
- No, several keys must sign (M-of-N multisig) → Control is split, but other risks remain
MiCA custody rules have applied since 30 December 2024, subject to national transitional periods. Look for a written client agreement and custody policy, a register of positions in your name, and client assets kept separate from the provider's own, both legally and on the ledger. Liability for lost assets is capped at the market value of what was lost. Sub-custody is allowed only with other MiCA-authorised providers, and you must be told when it is used.
This is a proposal, not a final rule. As summarised by Sullivan & Cromwell, state trust companies could act as custodians if state banking authorities supervise them and they may exercise fiduciary powers. Adviser self-custody would be allowed only when no qualified custodian is available for that asset, and at least two people would have to authorise each transaction. The comment period runs 60 days from Federal Register publication; Sullivan & Cromwell gives the deadline as 7 December 2026.
Your risk sits with the provider: its solvency, security, conduct and legal status. The provider or a legal order served on it can freeze funds. Ask which regulator supervises it for custody specifically, whether client assets are segregated legally and on-chain, whether the agreement allows lending or rehypothecation, whether it uses sub-custody and tells you, what happens if keys are lost or stolen and whether liability is capped, and whether internal-control reports or audits are available.
No intermediary can freeze your funds, and no one can recover them. A lost seed phrase means lost funds, and a forgotten BIP-39 passphrase is the same as losing the wallet. Check where your seed phrase is backed up and where any passphrase is recorded. Multisig, where M of N listed keys must sign (for example 2-of-3), is one way to split control.
M of N keys must sign before funds move, so one stolen key is not enough. Each key still needs a safe backup, and any passphrase must be recorded somewhere. Your devices, your backups and any software or smart contract you sign with still carry their own risks.
This only sorts which of the article's checks apply to you: it covers US and EU rules only, does not rate any custodian or wallet, treats the SEC framework as a proposal that may change, and is not legal or investment advice.
The newest rules
United States: SEC custody proposal (1 October 2026)
On 1 October 2026 the SEC proposed amendments under the Investment Advisers Act of 1940 and the Investment Company Act of 1940 (Release No. IA-7023; press release 2026-100). The comment period runs 60 days from publication in the Federal Register. Sullivan & Cromwell's summary gives the deadline as 7 December 2026. The SEC's own page does not state a date. As summarised by Sullivan & Cromwell:
Time left until 7 December 2026 · end of day UTC
- State trust companies could custody crypto for advisers and regulated funds if they are supervised by state banking authorities and authorised to exercise fiduciary powers. Advisers would have to check in writing, before engaging one and every year after, that it has written policies covering at least private key management and cybersecurity. Client crypto would sit in accounts separate from the company's own assets.
- Adviser self-custody would be allowed only if no qualified custodian is available for that particular asset, and cost is not an acceptable reason. Advisers would recheck availability every quarter and move the asset to a custodian "as soon as reasonably practicable" once one exists.
- Key controls for self-custody would include:
- key access limited to designated people - at least two people authorising each transaction, one of them a management person - addresses that hold only one client's assets - an independent accountant's internal control report within six months, then once a year
- This replaces earlier relief. The framework would supersede the SEC staff's 30 September 2025 no-action letter, which let advisers and funds use state trust companies as crypto custodians under conditions.
This is a proposal, not a final rule.
United States: banks and accounting
- SAB 122 (23 January 2025). The SEC withdrew Staff Accounting Bulletin 121, which had required firms safeguarding crypto for users to record it as a liability on their balance sheet. Under SAB 122, firms instead decide whether to record a liability for the risk of loss under the normal loss-contingency rules (ASC 450-20 under US GAAP, or IAS 37 under IFRS).
- OCC Interpretive Letter 1184 (7 May 2025). The US bank regulator for national banks and federal savings associations confirmed that these banks may offer crypto custody. They may also buy and sell custodied assets at the customer's direction and outsource custody and execution, provided they manage third-party risk properly.
European Union: MiCA Article 75
MiCA's custody rules for crypto-asset service providers have applied since 30 December 2024, subject to national transitional periods. Article 75 requires:
- a written client agreement and a custody policy designed to "minimise the risk of a loss of clients' crypto-assets"
- a register of positions in each client's name
- client assets kept separate from the provider's own, both legally and on the distributed ledger. ESMA's Q&A says client wallet addresses should differ from the provider's own addresses
- liability to clients for lost crypto-assets or means of access, capped at the market value of what was lost. The provider is not liable for incidents it can show happened independently of its service, such as a fault in the distributed ledger it does not control
- sub-custody only with other providers authorised under MiCA, and clients must be told when it is used
What to check before using a custodian
These questions follow from the rules above:
- Licence. Which regulator authorises and supervises the custodian for custody specifically?
- Segregation. Are client assets held separately from the firm's own, both legally and on-chain?
- Use of assets. Does the agreement allow lending or rehypothecation, meaning the firm reusing your assets as collateral for its own borrowing? The SEC's 2025 no-action letter required custody agreements that bar this without client consent.
- Sub-custody. Does the custodian pass your assets on to someone else, and does it tell you?
- Liability. What happens if keys are lost or stolen, and is there a cap?
- Independent assurance. Are internal-control reports or audits available?
If you self-custody, the equivalent checks are:
- where your seed phrase is backed up
- whether you use a passphrase, and where it is recorded
- whether one compromised device could move your funds
Limitations
This article covers US and EU rules only. The SEC framework is a proposal that may change. Nothing here is legal or investment advice.
