A crypto custodian is a regulated financial institution that safeguards the private keys controlling digital assets on behalf of clients. The client keeps beneficial ownership of the assets. The custodian takes possession of the keys under a legal duty to protect them, segregate them from its own property, and return the assets on demand. The model mirrors traditional securities custody, where a bank holds client stock on the client's behalf, except the thing being guarded is cryptographic key material rather than book entries at a transfer agent.
​

The category has moved from niche to load-bearing. BitGo reported crossing $100 billion in assets under custody as of June 30, 2025 in its SEC Form S-1, and on December 12, 2025 the Office of the Comptroller of the Currency conditionally approved five national trust bank charters for digital asset custodians in a single announcement. This article covers the legal definition, what qualified custodian status actually means, the day-to-day work, and where a custodian ends and an exchange or wallet provider begins. For a comparison of segregated, omnibus, and MPC setups, see custody models.
​

A crypto custodian is a regulated financial institution that safeguards the private keys controlling a client's digital assets. Most operate under bank, trust company, or state trust charters, owe fiduciary duties to clients, and hold assets in segregated accounts so the assets stay client property rather than joining the custodian's balance sheet.
​

The legal core is the distinction between a custodial relationship and a depository one. When a client deposits dollars at a bank, the money becomes the bank's liability and the bank can lend it. When a client places bitcoin with a custodian, the asset remains the client's property. The custodian holds it in trust, cannot lend or rehypothecate it without explicit authorization, and must return it in kind. In crypto this distinction is enforced through key control: whoever holds the private keys can move the asset onchain, so custody law and key management collapse into the same problem.
​

That property distinction matters most in a failure. The New York Department of Financial Services issued custody guidance on January 23, 2023, after the Celsius and FTX insolvencies, stating that a custodian is expected to segregate customer virtual currency from corporate assets both onchain and on its internal ledger, precisely so customer assets are returned to customers rather than pooled into a bankruptcy estate.
​

Accounting treatment now reflects the same logic. Under Staff Accounting Bulletin 121, public companies safeguarding crypto had to record custodied assets as balance-sheet liabilities at fair value, which made custody prohibitively expensive for banks. The SEC rescinded that guidance with Staff Accounting Bulletin 122 on January 23, 2025. Custodians now assess a liability only for actual loss contingencies, the same way they would for any other safeguarding obligation.
​

A qualified custodian is one of the institution types that SEC Rule 206(4)-2 permits to hold client assets for registered investment advisers: banks, savings associations, registered broker-dealers, futures commission merchants, and certain foreign financial institutions. SEC staff confirmed on September 30, 2025 that state-chartered trust companies can be treated as banks for this purpose.
​

Qualified custodian is a status, not a license. No regulator issues a "qualified custodian certificate." The term comes from the Custody Rule, Rule 206(4)-2 under the Investment Advisers Act of 1940, which requires a registered investment adviser with custody of client funds or securities to maintain them with one of the enumerated institution types. A custodian is qualified because of what kind of institution it is, not because of a crypto-specific approval.
​

For years the open question was whether state-chartered trust companies, the charter most crypto custodians actually hold, counted as "banks" under that rule. Two 2025 developments settled the practical picture. First, on June 12, 2025 the SEC formally withdrew fourteen pending rule proposals, including the 2023 Safeguarding Rule that would have expanded the Custody Rule to cover all client assets, crypto included, under tighter conditions. Second, on September 30, 2025 the SEC's Division of Investment Management issued a no-action letter, discussed in Commissioner Peirce's accompanying statement, confirming that advisers and registered funds may treat state trust companies as banks for crypto custody, conditioned on documented due diligence: the adviser must have a reasonable basis to believe the trust company is authorized by its state banking regulator to custody crypto and maintains written policies covering private key management and cybersecurity.
​

The practical consequence: an RIA holding crypto for clients can now use a NYDFS-chartered trust company or another state trust company without operating in a regulatory gray zone. What has not changed is that most exchanges and wallet software providers still do not meet any qualified custodian category. Criteria for vetting a specific provider are covered in how to evaluate a crypto custodian.
​

A crypto custodian generates and stores private keys, authorizes withdrawals through multi-party approval, segregates client assets from corporate assets, settles trades, supports staking and governance actions, and produces account statements and audit reports. The operational core is key management: keys live in hardware security modules or multi-party computation systems rather than on internet-connected servers.
​

Key management is the product. Custodians generate keys in controlled ceremonies, often inside hardware security modules or air-gapped environments, and store them in some blend of cold storage (fully offline), warm storage (online but restricted), and multi-party computation, where the key exists only as distributed shares so no single machine or employee can sign a transaction alone. Moving a client's assets requires a withdrawal workflow: identity verification, multiple internal approvals, address allowlists, velocity limits, and often a deliberate time delay measured in hours.
​

Segregation and record-keeping run alongside. NYDFS's updated custodial structures guidance of September 30, 2025 expects custodians to account for each customer's assets separately, avoid commingling customer and corporate holdings, and obtain regulatory preapproval before placing customer assets with a sub-custodian. In practice that means per-client wallet structures or rigorously mapped omnibus wallets with an internal ledger reconciled against the chain.
​

Beyond safekeeping, institutional custodians handle the operational surface of holding crypto: settling trades with exchanges and OTC desks, supporting staking so clients can earn protocol rewards without moving keys, executing governance votes on instruction, processing forks and airdrops, and producing the reporting layer that auditors and fund administrators need, typically backed by SOC 1 and SOC 2 Type II examinations and specie insurance on assets in cold storage. The staffing, reconciliation, and incident response behind this are covered in custody operations.
​

Three regulators charter most US crypto custodians: the New York Department of Financial Services through limited purpose trust charters, other state banking authorities through state trust charters, and the Office of the Comptroller of the Currency through national trust bank charters. Each charter carries capital requirements, examinations, and fiduciary obligations.
​

New York moved first. NYDFS approved its first virtual currency limited purpose trust charter for itBit, now Paxos Trust Company, in May 2015, followed by Gemini Trust Company in October 2015. Coinbase Custody Trust Company received its charter in 2018. The current NYDFS roster of limited purpose trust companies includes Fireblocks Trust, NYDIG Trust, Standard Custody, and PayPal Digital. A New York trust charter grants fiduciary powers under Banking Law and subjects the holder to capital requirements, examinations, and the custody guidance described above, which is why it became the default institutional credential.
​

The federal track runs through the OCC. Interpretive Letter 1170, issued in July 2020, concluded that providing crypto custody is a permissible activity for national banks. Interpretive Letter 1183, issued March 7, 2025, reaffirmed that position and removed the requirement that banks obtain supervisory non-objection before starting. On the chartering side, the OCC conditionally approved Anchorage Digital Bank on January 13, 2021, converting a South Dakota trust company into the first national trust bank focused on digital assets. Then on December 12, 2025 the OCC conditionally approved five more national trust charters: new charters for Circle and Ripple, and conversions of the existing state charters of Paxos, BitGo, and Fidelity Digital Assets. A national trust bank may custody assets nationwide under a single federal charter but may not take deposits or make loans.
​

Other states charter crypto custodians through general trust company law, South Dakota being the historical hub. The choice between a state charter and a national one is largely a question of footprint: a state trust company needs state-by-state analysis to serve clients nationally, while a national trust bank passports across all fifty states under OCC supervision.
​

A custodian's sole business is safeguarding assets under a fiduciary charter. An exchange matches buyers and sellers and may hold customer assets as a byproduct of trading. A wallet provider ships software that lets users hold their own keys, taking no possession at all. The legal relationship, not the interface, separates the three.
​

The confusion is understandable because the interfaces look alike: each shows a balance and a withdraw button. The differences sit underneath, in who controls keys and what a court would say the user owns if the company failed.

The insolvency row is the one that carries weight. The FTX and Celsius bankruptcies turned on whether customer crypto was customer property or estate property, and customers at both largely ended up as unsecured creditors. That outcome is what NYDFS's segregation guidance and the SEC's qualified custodian framework are designed to prevent: a chartered custodian holds client assets in trust so there is a legal basis for returning them rather than distributing them to creditors.
​

A working decision rule, by situation:

Institutions use custodians to convert key management risk into a regulated counterparty relationship. A chartered custodian provides fiduciary duty, segregated legal title, audited controls, insurance, and the qualified custodian status that advisers and funds need for compliance. It also removes single-employee key risk that no internal wallet policy fully solves.
​

The compliance driver is the bluntest: an adviser subject to the Custody Rule has no lawful alternative. But the operational drivers apply even where no rule forces the choice. Holding keys internally means an institution must build key ceremonies, approval workflows, disaster recovery, and audit trails itself, then convince its own auditors and board that the setup survives a departing employee or a compromised laptop. A custodian amortizes that engineering across thousands of clients; BitGo's Form S-1 filing reported over 4,600 institutional clients across more than 100 countries as of June 30, 2025. Accounting treatment reinforced the shift: once SAB 122 removed the balance-sheet penalty in January 2025, banks and public companies could offer and use custody without booking custodied assets as liabilities, which is part of why the December 2025 charter approvals drew applicants as varied as Circle, Ripple, and Fidelity Digital Assets.
​

Custodians reduce key-loss and counterparty risk but do not eliminate risk. Custodied crypto carries no federal deposit insurance, withdrawal processes add hours or days of latency versus self-custody, fees run as annual charges on assets held, and the industry concentrates assets with a small number of providers, creating single points of failure.
​

Three limits deserve plain statement. First, custody is not insurance. The FDIC's July 2022 fact sheet is explicit that deposit insurance does not cover crypto assets, and a custodian's specie policy typically covers a fraction of assets held, against specific perils like theft from cold storage. Second, the security model trades speed for control: the same multi-approval workflows that stop attackers also mean a withdrawal can take hours or a business day, which is a real cost for anyone who needs to respond to market moves or move collateral cross-chain quickly. Third, concentration: as charters consolidate custody among a handful of national trust banks, more of the market's assets sit behind a small set of key-management systems, and an operational failure at one would be systemic in a way self-custody failures never are.
​

Eco sits adjacent to this layer rather than inside it. Eco builds stablecoin liquidity and settlement infrastructure that institutions use alongside whichever custodian holds their assets: a treasury or issuer keeps assets with its chartered custodian while Eco's routing handles movement between chains and venues through one integration. In a market holding $310.6 billion in stablecoins as of July 2026, custody and liquidity are separate problems, and Eco deliberately solves only the second.
​

Methodology: regulatory dates and actions cited above come from primary sources, including SEC, OCC, NYDFS, and FDIC publications and the BitGo Form S-1, each linked inline. The stablecoin market figure is from DeFiLlama as of July 7, 2026. Nothing here is legal advice; charter status of any provider should be verified against the relevant regulator's live registry.
​