Digital Asset Custody for Financial Institutions: What to Evaluate

Key Takeaways

• Digital asset custody means safekeeping the private keys that control an asset. As the OCC puts it, holding digital assets for a customer is “actually taking possession of the cryptographic access keys” (OCC, Interpretive Letter 1170).
• Institutions now judge custodians on compliance and security first. In a 2026 survey of 351 institutional investors, 66% cited regulatory compliance as a key factor in choosing a custodian, up from 25% a year earlier (EY-Parthenon and Coinbase).
• Rules differ across the four major wealth centers. Hong Kong requires licensed trading platforms to keep 98% of client virtual assets in cold storage, Singapore requires segregation and trust accounts, Canada’s crypto trading platforms have undertaken to hold at least 80% of client crypto assets with third-party custodians, and Australia has passed a new digital asset framework.
• The failures of 2022 showed that segregation and contract terms decide who owns client assets when a firm fails.
• Before adding digital assets, institutions should check the custody model, key security, segregation, regulatory status, independent assurance and exit arrangements of every provider in the chain.

Digital asset custody is the safekeeping of digital assets, such as tokenized securities, tokenized gold and cryptocurrencies, on behalf of clients. For banks, wealth managers, trust companies and family offices, it is the question that comes before any other when clients ask for digital asset exposure: who controls the keys, and what happens to client assets if something goes wrong?

Demand is real. Tokenized real-world assets distributed on public blockchains were worth about US$39 billion as of mid-October 2026 (RWA.xyz). Capgemini’s World Wealth Report 2026 found that 50% of high-net-worth individuals consider access to digital assets an important factor when choosing a wealth manager, and that many traditional firms “lack the secure custody infrastructure” to support this (Capgemini). This guide explains how digital asset custody works, how the rules differ across Hong Kong, Singapore, Australia and Canada, and what to evaluate before you choose a custody arrangement.

What Is Digital Asset Custody?

With traditional securities, custody means a bank or depository holds the asset in an account in the client’s name. With digital assets, the asset lives on a blockchain, and whoever holds the private key can move it. Custody therefore means controlling and protecting those keys.

Regulators in several markets frame it the same way:

• United States. The OCC describes crypto custody as providing “safekeeping for the cryptographic key that allows for control and transfer of the customer’s cryptocurrency” (OCC).
• Hong Kong. The HKMA states that “digital assets” should be read to cover “the means of access to a digital asset, which generally refers to private keys, seeds or their backups” (HKMA circular, Provision of Custodial Services for Digital Assets).
• Australia. ASIC says that where a person controls the private keys related to an address on a public blockchain, “they will likely be providing a custodial or depository service”. A self-custody wallet product, by contrast, “is unlikely to amount to providing a custodial or depository service” (ASIC, INFO 225).

The common test is control. Whoever can move the asset is the custodian, whatever the contract calls them.

Custody Models: Self-Custody, Third-Party Custody and Sub-Custody

Financial institutions generally choose between three models, and many combine them.

Model	How it works	Main advantage	Main consideration
Self-custody	The institution holds and manages its own keys	Full control, no custodian fees	The institution carries all key-management risk and, increasingly, a licensing burden
Third-party custody	A specialist regulated custodian holds the keys	Specialist security, insurance and assurance	Counterparty risk shifts to the custodian, so due diligence is essential
Bank or sub-custody	A bank or custodian appoints a specialist sub-custodian to hold the keys	Fits existing banking relationships and oversight	Several parties in the chain, each needing oversight

Regulators recognize all three. In the US, the OCC confirmed in May 2025 that banks may outsource crypto custody to third parties, “subject to appropriate third-party risk management practices”, and that a bank must conduct custody “including via a sub-custodian, in a safe and sound manner” (OCC, News Release 2025-42 (Interpretive Letter 1184)).

Spreading risk across providers is now normal practice. The EY-Parthenon and Coinbase survey found that 61% of institutional investors currently invested in digital assets use more than one custodian, against 36% using a single custodian (EY, Institutional digital assets survey).

How Custodians Protect Private Keys

Key security is where custodians differ most. Three approaches matter:

• Cold storage. Keys are kept offline, often in hardware security modules (HSMs), so they cannot be reached through the internet. Hong Kong’s SFC requires licensed virtual asset trading platforms to store 98% of client virtual assets in cold storage “to minimise exposure to losses arising from a compromise or hacking of the platform” (SFC, Guidelines for Virtual Asset Trading Platform Operators).
• Hot storage. Keys are kept online so assets can move quickly for trading and withdrawals. It is faster but more exposed, which is why regulators limit how much client value sits there.
• Multi-party computation (MPC). The key is never held whole in one place. NIST describes threshold schemes that “apply principles of secure multiparty computation (MPC)” to achieve “a secure distribution of trust” in cryptographic operations (NIST, Multi-Party Threshold Cryptography). No single person or server can move assets alone.

Regulators are not picking a winner. Some respondents to Hong Kong’s custodian licensing consultation suggested the definition should be “technology neutral” across MPC, HSMs and air-gapped solutions (FSTB and SFC, Consultation Conclusions). For an institution, the right question is not which technology a custodian uses, but who can approve a transfer, how that is enforced, and how it is tested.

Custody Rules in the Four Major Wealth Centers

Custody rules for digital assets have changed quickly. The table below summarizes the position as of October 2026.

Market	Key requirements	Status
Hong Kong	Licensed virtual asset trading platforms must segregate client assets and store 98% in cold storage. They also need an SFC-approved compensation arrangement covering 50% of client assets in cold storage and 100% in hot and other storage (SFC). A standalone licence for virtual asset custodians is planned, with the test that a licence or registration would be required, for example, “where a person can unilaterally transfer its clients’ VAs” (FSTB and SFC).	Platform rules in force. Custodian licence: consultation concluded December 2025, with the government targeting a bill in 2026 (FSTB and SFC)
Singapore	Digital payment token service providers must segregate customers’ assets and place them in a trust account for customers’ benefit, keep proper books and records, and maintain effective controls (MAS). Singapore-based firms serving only overseas customers have needed a licence since 30 June 2025, and MAS “will generally not issue a licence” (MAS).	Safeguarding rules in force since October 2024. Digital token service provider regime in force since 30 June 2025
Australia	Custody obligations are principles-based and “apply to custody of any financial product, regardless of its form” (ASIC). The Corporations Amendment (Digital Assets Framework) Bill 2025 creates two new regulated facilities: digital asset platforms and tokenized custody platforms (Senate Economics Legislation Committee).	Received Royal Assent on 8 April 2026 and commences on 9 April 2027 (ASIC), followed by a six-month transition (Gilbert + Tobin)
Canada	Crypto asset trading platforms registering with the Canadian Securities Administrators undertake to hold at least 80% of client crypto assets with third-party custodians. Those custodians must be functionally independent and have obtained a SOC 2 Type 1 or Type 2 report within the last 12 months (CSA Staff Notice 21-332).	In force through pre-registration undertakings since February 2023

Institutions in these markets also watch international standards. The Basel Committee agreed that its members would implement its prudential standard for banks’ cryptoasset exposures by 1 January 2026 (BIS), and in May 2026 said it had expedited a review of targeted elements, with an update due later in the year (BIS). In the US, the SEC rescinded its earlier crypto safeguarding accounting guidance through Staff Accounting Bulletin 122, effective 30 January 2025 (SEC), and the OCC confirmed in March 2025 that crypto custody is permissible for national banks (OCC).

For a wider view of licensing across these markets, see our guide to fintech compliance requirements by jurisdiction.

Why Segregation and Contract Terms Matter

The crypto failures of 2022 turned custody from a technical topic into a board-level one.

• FTX. The SEC alleged that Sam Bankman-Fried “used commingled FTX customers’ funds at Alameda to make undisclosed venture investments, lavish real estate purchases, and large political donations” (SEC).
• Celsius. The US Bankruptcy Court ruled that crypto assets in Celsius’s “Earn” accounts, worth approximately US$4.2 billion as of 10 July 2022, became Celsius’s property under the account terms, and so formed part of the bankruptcy estate rather than belonging to customers (In re Celsius Network LLC, Memorandum Opinion).

The Celsius ruling was about the terms of a yield product, not a regulated custodian. That is exactly the lesson: the contract decides who owns the assets. If client assets are not clearly segregated and held for the client’s benefit, clients may lose their ownership claim when a firm fails.

Regulators responded directly. Canada’s CSA cited the insolvencies of Voyager Digital, Celsius Network, the FTX group, BlockFi and Genesis Global when it introduced its tighter custody undertakings (CSA). Singapore’s trust-account requirement and Hong Kong’s segregation and compensation rules follow the same logic.

Digital Asset Custody Due Diligence: What to Evaluate

Institutional priorities have shifted sharply. In the EY-Parthenon and Coinbase survey, 66% of institutions cited regulatory compliance as a key factor in selecting a custodian (up from 25% in 2025), and 66% cited security and key-signing protocols (up from 8%) (EY-Parthenon and Coinbase). As EY puts it, institutions are not just asking “who can custody?” but “who can custody under scrutiny?” (EY).

Use these questions for every provider that touches client keys, including sub-custodians:

1. Regulatory status. Which licences or registrations does the custodian hold, in which markets, and do they cover the assets and clients you serve?
2. Who controls the keys. Who can approve a transfer? How many approvals are needed, and can any single person or system move assets alone?
3. Storage model. What share of client assets sits in cold storage, and how is the hot-storage balance limited?
4. Segregation. Are client assets held separately from the custodian’s own assets, and are they held on trust or under an equivalent legal structure in each market?
5. Contract terms. Does the agreement state clearly that assets remain the client’s property? Can the custodian lend, stake or rehypothecate them?
6. Insurance and compensation. What loss events are covered, for what amount, and who are the insurers?
7. Independent assurance. Can the custodian provide a recent SOC 2 Type 2 report or equivalent, plus regular security testing results?
8. Proof of holdings. How often are holdings reconciled and attested, and can you verify balances independently?
9. Sub-custody chain. Does the custodian delegate key safekeeping to others? If so, apply the same questions to them.
10. Exit and continuity. How quickly can you move assets to another custodian, and what happens if the custodian fails?

The same discipline applies to tokenized precious metals and securities. Our guides to how wealth platforms add tokenized gold and tokenized securities for insurers and pension funds cover asset-specific custody questions.

How Aerapass Approaches Custody

Aerapass is a platform, not a custodian. It integrates with regulated custodians and infrastructure providers to support both traditional custody and digital asset custody under compliant frameworks. That lets wealth managers, family offices and trust companies offer digital assets to clients without building custody infrastructure themselves, while each asset is held by a specialist provider.

Custody connects to the rest of the client relationship on the same platform. Onboarding and KYC run through customer management, trading in FX, digital assets and precious metals through the multi-asset exchange, and third-party custody and escrow arrangements through our solutions for wealth managers. For firms comparing operating models more broadly, our guide to what wealthtech is and how platforms are changing wealth management sets out the build, assemble and white-label options.

Aerapass is licensed in four major wealth centers - Hong Kong, Singapore, Australia and Canada.

Frequently Asked Questions

What is digital asset custody?

Digital asset custody is the safekeeping of digital assets, such as cryptocurrencies, tokenized securities and tokenized gold, on behalf of clients. Because whoever holds an asset’s private key can move it, custody means controlling and protecting those keys, keeping client assets segregated and making sure they can be returned to clients.

What is the difference between hot and cold storage?

Cold storage keeps private keys offline, often in hardware security modules, so they cannot be reached through the internet. Hot storage keeps keys online so assets can move quickly. Regulators limit hot storage because it is more exposed to hacking. Hong Kong’s SFC, for example, requires licensed virtual asset trading platforms to keep 98% of client virtual assets in cold storage.

Do financial institutions need a licence to custody digital assets?

It depends on the market and the activity. In Hong Kong, a standalone licence for virtual asset custodians is planned, and a licence or registration would be required where a person can unilaterally transfer clients’ virtual assets. Singapore requires digital payment token service providers to segregate customer assets and hold them in trust. Australia’s new digital asset framework commences on 9 April 2027. Institutions should take legal advice for their own situation.

What is MPC custody?

MPC, or multi-party computation, splits control of a private key across several parties or devices so that no single party holds the whole key. Transfers need cooperation between the parties, which reduces the risk of one compromised person or server moving assets. Regulators such as Hong Kong’s are being asked to keep custody rules technology neutral across MPC, hardware security modules and air-gapped solutions.

How do I evaluate a digital asset custodian?

Check its regulatory status in your markets, who can approve transfers, how much is held in cold storage, how client assets are segregated, what the contract says about ownership and lending, its insurance cover, independent assurance such as SOC 2 Type 2 reports, how holdings are reconciled, any sub-custodians, and how you would exit if needed.

Regulatory Disclosure: Aerapass is licensed in four major wealth centers - Hong Kong, Singapore, Australia and Canada. Aerapass is not a custodian; custody is provided through integrations with regulated custodians and infrastructure providers. This article is for educational and informational purposes only and does not constitute investment, financial, legal, or regulatory advice. Digital assets carry risks including custody, counterparty, technology, regulatory and market risk. Regulatory requirements vary by jurisdiction and change over time. Institutions should consult qualified legal and compliance advisors in each market they serve. Regulatory positions are stated as of October 2026.