What is institutional crypto custody?

It is the safekeeping of private keys, and the assets they control, for funds, companies, banks and exchanges. Chartered custodians such as Coinbase Custody Trust Company and Anchorage Digital Bank hold the keys themselves, while vendors such as Fireblocks and DFNS sell MPC and HSM software that institutions run on their own.

What is a qualified custodian?

Under SEC Rule 206(4)-2, a qualified custodian is a bank or savings association, a registered broker-dealer, a registered futures commission merchant or a qualifying foreign financial institution. OCC national trust banks such as Anchorage Digital Bank fill the role for crypto, and on September 30, 2025 SEC staff said they would not recommend enforcement against advisers that treat state trust companies as qualified custodians for crypto, subject to conditions.

Which custodians hold spot bitcoin and ether ETF assets?

Coinbase Custody Trust Company is the main custodian for IBIT, GBTC, ETHA and the Grayscale Ethereum Staking ETF, and it shares custody of ARKB and MSBT. Fidelity Digital Assets holds FBTC's bitcoin and Gemini Trust Company is HODL's primary custodian. BNY co-custodies MSBT, while Anchorage and BitGo hold ether for the Fidelity Ethereum Fund alongside Fidelity Digital Assets.

How does MPC differ from qualified custody?

MPC is a signing method that splits a key into encrypted shares, so no single party ever holds the full key. Qualified custody is a legal status held by entities such as national trust banks and state trust companies. Gemini and BitGo use MPC inside qualified custody, while Utila and Safeheron sell MPC software in which the client keeps its own key share.

Is crypto held by an institutional custodian insured?

Coverage depends on the custodian and has limits. Coinbase Global's crime policy of up to $320 million is shared by all customers, and BitGo carries up to $250 million for assets where BitGo Bank & Trust holds all keys. The Morgan Stanley Bitcoin Trust's filing warns that custodian insurance is shared among customers and unlikely to cover the full amount of a loss.

What does a SOC 2 report mean for a crypto custodian?

A SOC 2 report is an independent auditor's examination of a service provider's controls against the Trust Services Criteria, such as security and availability. A Type 2 report tests whether those controls operated over a period, usually six to twelve months, and SEC staff expect advisers using state trust companies to review the custodian's SOC 1 or SOC 2 report each year.

How do institutional crypto custody fees work?

Published schedules charge a percentage of assets under custody with monthly minimums. Gemini Custody charges 0.40% a year or $30 per month per asset, whichever is higher, and BitGo's Singapore custody agreement includes the first $100,000 of holdings and charges 5 basis points a month above that, based on average USD balances.

Can assets in institutional custody be staked?

Yes. Coinbase Prime, Anchorage Digital, BitGo and Komainu offer staking, and the Fidelity Ethereum Fund's August 2026 prospectus stakes its ether through its custodians and node operators for a fee of 15% of rewards. SEC staff said on May 29, 2025 that protocol staking, including custodial staking in which the custodian acts as an agent, does not involve securities transactions.

What does MiCA require from crypto custodians?

MiCA's transitional period ended on July 1, 2026, so firms serving EU clients need permission under the regulation. Article 75 requires a custody policy, client statements at least every three months, legal segregation of client assets from the custodian's estate and liability for losses the custodian causes, capped at market value.

How is institutional crypto custody regulated in the UK?

Custodians register with the FCA under the Money Laundering Regulations, and Fidelity Digital Assets, Komainu, Zodia Custody and Bitpanda Custody hold such registrations. Safeguarding cryptoassets becomes a regulated activity when the FCA's new regime starts on October 25, 2027, and the FCA is accepting applications from September 30, 2026 to February 28, 2027.

Institutional Crypto Custody: 30 Providers Compared

Institutional crypto custody is the safekeeping of private keys, and the digital assets they control, for funds, asset managers, companies and exchanges. A custodian controls those keys under a written agreement, and rules in New York and the EU require it to keep client assets apart from its own.

Providers fall into four groups. Banks such as BNY and Sygnum Bank hold crypto under banking licenses. Trust companies and trust banks such as Coinbase Custody Trust Company, which serves Coinbase Prime clients, and Anchorage Digital act as US qualified custodians. Specialist custodians such as Komainu are regulated outside the US, in Komainu's case in Jersey and Dubai. Software vendors such as Fireblocks sell MPC wallet systems that clients run themselves.

Institutional crypto custodians compared

The table lists 30 custodians and custody software vendors alphabetically, with the main charters and registrations held across each group.

Provider	Custody model	Licenses and charters	SOC report	Insurance	Staking	HQ
AMINA Bank	Bank custody; MPC, multi-sig, HSM	FINMA bank; MiCA (FMA Austria); SFC licenses (Hong Kong); ADGM branch	Not published	PI and cyber cover; specie for cold wallets	Yes, 7 assets	Zug, Switzerland
Anchorage Digital	Qualified custodian; HSM; Porto self-custody wallet	OCC national trust bank; NYDFS BitLicense; MAS MPI	SOC 2	Not published	Yes	San Francisco, US
BitGo	Qualified custodian; multi-sig, MPC, HSM; self-custody wallets	OCC national trust bank; NYDFS trust; MiCA (BaFin); VARA; MAS MPI	SOC 2	Up to $250M where BitGo holds all keys	Yes	Sioux Falls, US
Bitpanda Custody	Custodian; HSM; on-premises option	VARA; MiCA (FMA, BaFin, MFSA); FCA MLR registration	SOC 2	Not published	Yes	London, UK
BNY Digital Asset Custody	Qualified custodian; MPC, cold storage	New York state bank; MiCA notification (Belgium)	Not published	Shared policy covering fraud and theft	Announced with Galaxy (Aug 2026)	New York, US
Cactus Custody	Custody and MPC self-custody; multi-sig, HSM	Hong Kong TCSP; GFSO (Bhutan); VQF SRO (Switzerland)	SOC 2	OneDegree policy (Hong Kong, Bhutan entities)	Yes	Singapore
Ceffu	Custodian; MPC cold storage	VARA custody (Dubai); GFSO (Bhutan)	SOC 2	Not published	Yes	Not published
Cobo	Custodial and MPC wallets; HSM	Hong Kong TCSP	SOC 2 Type 2	Not published	Yes	Singapore
Coinbase Prime	Qualified custodian; cold storage	NYDFS trust charter; BitLicense; MiCA (CSSF); OCC conditional approval	SOC 1, SOC 2 Type 2	Up to $320M crime policy, shared	Yes	New York, US
Copper	Custodian; MPC; ClearLoop settlement	SEC broker-dealer, FINRA (US); VQF SRO (Switzerland)	SOC 2	$500M specie (Lloyd's via Aon) plus crime policy	Yes	London, UK
Crypto Finance	Custodian; HSMs in Switzerland	FINMA securities firm; BaFin custody; MiCA (BaFin)	SOC 2	Custody cover (company statement)	Yes	Zurich, Switzerland
DFNS	Software only; MPC, HSM	None; holds no client assets	SOC 2 Type II (KPMG)	$15M corporate cyber, E&O and crime cover	Yes	Paris, France
Fideum	Software only; MPC, HSM	None; not a custodian of record	Not published	Not published	Yes	London, UK
Fidelity Digital Assets	Qualified custodian; 98%+ cold storage target	OCC national trust bank; FCA MLR registration	SOC 2	Not published	Not published	Boston, US
Fireblocks	MPC software; qualified custody via trust company	NYDFS trust charter; MTLs in 37 states and DC	SOC 2	Not published	Yes	New York, US
First Digital Trust	Trust company custody	Hong Kong trust company; TCSP	SOC 2	Not published	Not published	Hong Kong
Gemini Custody	Qualified custodian; MPC, multi-sig, HSM	NYDFS trust charter; Nevada trust license; MAS MPI	SOC 2	$125M (Mar 2024): $100M cold, $25M hot	Yes (Solana)	New York, US
Hex Trust	Custodian; HSM-based Hex Safe	MAS MPI; VARA; Hong Kong trust company and TCSP	SOC 2	Up to $25M across all clients	Yes	Hong Kong
Komainu	Custodian; MPC, HSM	JFSC (Jersey); VARA (Dubai); FCA MLR registration	SOC 1, SOC 2 Type II	Up to $820M specie capacity for client cover	Yes	St Helier, Jersey
Kraken Custody	Bank custody; MPC with HSMs	Wyoming SPDI bank; MiCA (Central Bank of Ireland)	SOC 2	Not published	Yes	US
Ledger Enterprise	Self-custody platform; HSM, multi-sig	None; says it is not a custodian	SOC 2	Add-on specie via Arch, up to $750M for some clients	Yes	Paris, France
Liminal Custody	MPC and multi-sig wallets; HSM	FIU-IND (India); FINTRAC MSB (Canada); PSA exemption (Singapore)	SOC 2	$50M Lloyd's policy (2022), shared	Yes	Singapore
Prometheum Capital	Special purpose broker-dealer custody	SEC broker-dealer, FINRA member; SEC transfer agent	Not published	Not published	Not published	New York, US
Ripple Custody	Software only; HSM, MPC	Group: NYDFS trust, OCC trust bank approval, MiCA (CSSF)	SOC 2	Not published	Yes	San Francisco, US
Safeheron	Software only; MPC, TEE	None	SOC 2 Type II; ISO 27001	Custodial risk cover via Lockton	Not published	Singapore
Sygnum Bank	Bank custody; Protect off-exchange service	FINMA bank; MAS CMS and MPI; ADGM FSRA; MiCA (Liechtenstein)	Not published	Not published	Yes	Zurich, Switzerland
Tangany	White-label custody; MPC, HSM	BaFin MiCA CASP; KWG custody license; PSD2	Not published	Wallet theft cover (Great Lakes SE, Munich Re)	Yes	Munich, Germany
Taurus	Software (Taurus-PROTECT); HSM, MPC	FINMA securities firm; CySEC MiFID (Cyprus)	Not published	Not published	Yes	Geneva, Switzerland
Utila	MPC self-custody software	None; uses licensed partners	SOC 2 Type II	Coverage cited in 2025 funding news	Yes	Tel Aviv, Israel
Zodia Custody	Custodian; HSM cold storage	MiCA and payment institution (CSSF); FCA MLR registration; ADGM FSRA; Hong Kong TCSP	SOC 2	$100M custody policy plus crime, PI and cyber	Yes	London, UK

What a qualified custodian is

The term comes from Rule 206(4)-2, the SEC custody rule under the Investment Advisers Act. A registered adviser with custody of client assets must keep them at a qualified custodian, in a separate account for each client or in accounts holding only client assets. The rule recognizes four types: banks and savings associations, registered broker-dealers, registered futures commission merchants and certain foreign financial institutions.

The bank definition covers trust companies that exercise fiduciary powers under state or federal supervision. OCC-chartered national trust banks fall under it, and New York limited purpose trust companies such as Gemini Trust Company describe themselves as qualified custodians under New York law. On September 30, 2025, SEC staff said they would not recommend enforcement against advisers and registered funds that treat state trust companies as qualified custodians for crypto. The conditions include annual due diligence, a review of the custodian's SOC 1 or SOC 2 report, segregation of client assets and a ban on lending them without written consent.

The SEC went further on October 1, 2026, proposing rules that would make state trust companies qualified custodians for crypto and allow adviser self-custody only when no qualified custodian will take an asset. National banks have had OCC confirmation that they may custody crypto since July 2020.

Custody models

Offers differ on who holds the keys and how signing power is protected. A custodian such as Coinbase Custody Trust Company or Zodia Custody holds the keys and the legal duty of safekeeping. A software vendor such as DFNS or Safeheron sells key management that the client operates, and Ledger states that Ledger Enterprise is not a custodian. BitGo, Cobo, Cactus Custody and Anchorage Digital offer both models, and Fireblocks pairs its MPC software with an NYDFS-chartered trust company.

How keys are protected

A multi-signature wallet needs several independent keys to approve a transfer, such as 2 of 3, and each signature is recorded on chain. MPC, or threshold signing, gives each party an encrypted key share. The shares combine during signing without anyone holding the whole key, so one signature reaches the chain, as BitGo's developer documentation explains. Hardware security modules keep keys inside dedicated hardware: Ledger Enterprise uses FIPS 140-2 Level 3 HSMs, and Taurus keeps keys in HSMs owned by client banks such as KBC and State Street.

Cold storage

Cold storage keeps keys offline. Fidelity Digital Assets targets more than 98% of assets in cold storage, and BlackRock's agreement with Anchorage requires every key for IBIT bitcoin held there to stay cold. Grayscale's 2025 annual report says GBTC's key shards are kept in cold storage in vaults around the world and that transfers require additional security procedures.

Segregated and omnibus accounts

NYDFS guidance updated on September 30, 2025 allows omnibus on-chain wallets that hold only customer coins, provided records identify each customer's share and corporate assets stay separate. Dubai's VARA requires a separate wallet for each client and bans rehypothecation even with consent. MiCA requires client crypto to be legally segregated from the provider's estate and makes the custodian liable for losses it causes, up to market value.

Custody for exchanges and trading firms

Off-exchange settlement lets a trading firm keep collateral with a custodian while an exchange credits it for trading. Kraken added support for Copper's ClearLoop in June 2024, and Copper extended ClearLoop to Deribit for FalconX clients in December 2025. Ceffu links custody to Binance and KuCoin Institutional, Komainu Connect holds off-exchange collateral, Sygnum's Protect service passed $1 billion in assets in March 2026, and Ledger's Tradelink settles through partner custodians. Fireblocks and Safeheron sell MPC wallet software to exchanges.

Regulation by region

United States

NYDFS has chartered Coinbase Custody Trust Company, Gemini Trust Company, Fireblocks Trust Company and BitGo New York Trust Company as limited purpose trust companies. The OCC supervises Anchorage Digital Bank as well as BitGo Bank & Trust and Fidelity Digital Assets, N.A., which converted from state charters after approvals announced on December 12, 2025. Ripple National Trust Bank received final OCC approval on October 26, 2026 but has not opened, and Coinbase National Trust Company holds preliminary conditional approval. Kraken Financial is a Wyoming special purpose depository institution with a Federal Reserve master account since March 2026. BNY custodies crypto at its New York state-chartered bank, and Copper Markets (US) and Prometheum Capital are SEC-registered broker-dealers.

European Union

MiCA's transitional period ended on July 1, 2026, and only firms permitted under the regulation may now serve EU clients. Coinbase and Zodia Custody hold authorizations from Luxembourg's CSSF. BaFin has authorized Tangany, BitGo Europe, Crypto Finance (Deutschland) and a Bitpanda entity. Kraken's Payward Europe Solutions is authorized in Ireland and AMINA's EU unit in Austria, while Sygnum Europe gained authorization in Liechtenstein in June 2026. BNY's Belgian bank filed a MiCA notification with the National Bank of Belgium.

United Kingdom

UK custodians register with the FCA under the Money Laundering Regulations. Zodia Custody, which holds such a registration, states that it is not authorized by a financial services authority and that FOS and FSCS protection does not apply. Fidelity Digital Assets, Komainu, Bitpanda Custody and Ripple are also registered. Safeguarding cryptoassets becomes a regulated activity when the FCA's new regime starts on October 25, 2027. The FCA published final rules on June 30, 2026, and registered firms that apply between September 30, 2026 and February 28, 2027 can keep operating while their applications are decided.

Switzerland

FINMA licensed Sygnum Bank and AMINA Bank as banks and securities dealers in August 2019, and Taurus and Crypto Finance hold FINMA securities firm licenses. Copper's Zug entity and BitGo GmbH belong to VQF, a FINMA-recognized self-regulatory organization. Since August 1, 2021, the DLT Act has allowed clients to separate crypto from a bankrupt custodian's estate when the custodian holds the keys for them and can allocate the assets to each client.

Hong Kong

Hong Kong does not yet license standalone crypto custodians. Hex Trust, First Digital Trust, Cobo and Zodia's local unit hold trust or company service provider licenses. The government concluded consultations on a custodian licensing regime in December 2025 and planned a bill for 2026. SFC rules already require licensed trading platforms to keep 98% of client crypto in cold storage.

Singapore

Custody of digital payment tokens became a regulated service under the Payment Services Act on April 4, 2024, and rules requiring customer assets to be held in trust accounts followed six months later. Hex Trust, Gemini, Anchorage Digital, BitGo and Sygnum hold MAS Major Payment Institution licenses.

United Arab Emirates

Dubai's VARA licenses custody and broker-dealer activity separately, and Hex Trust and BitGo hold both through different entities. Komainu and Ceffu hold VARA custody licenses, as does Bitpanda Custody's Dubai company. In Abu Dhabi, the ADGM's Financial Services Regulatory Authority has granted permissions to Zodia, through Tungsten Custody Solutions, and to Sygnum Bank Middle East.

Insurance, SOC reports and proof of reserves

Coinbase Global's crime policy of up to $320 million covers theft from hot and cold storage and is shared by all customers. BitGo carries up to $250 million for assets where BitGo Bank & Trust holds every key, and Copper cites $500 million of specie insurance placed in the Lloyd's market through Aon. Komainu offers up to $820 million of specie capacity for clients to buy their own ring-fenced cover. The Morgan Stanley Bitcoin Trust's registration statement warns that each custodian's insurance is shared among its customers and is unlikely to cover the full amount of a loss.

A SOC 1 report covers controls relevant to clients' financial reporting, while a SOC 2 report tests controls against the Trust Services Criteria, such as security and availability. Type 1 reports assess design at a single date, and Type 2 reports test operation over a period, usually six to twelve months. Coinbase holds SOC 1 and SOC 2 Type 2 reports for Custody and Prime, as does Komainu for its business, and KPMG audits the SOC 2 Type II report of DFNS.

Third-party proof-of-reserve reports are a different product. In a March 8, 2023 advisory, the PCAOB said such engagements are not audits and give investors no meaningful assurance.

Fees and pricing structure

Gemini Custody's fee schedule, dated October 7, 2026, charges 0.40% a year or $30 per month per asset, whichever is higher. Gemini waives the setup fee and passes network fees through on administrative withdrawals. BitGo bills custody in basis points on each asset's average monthly USD balance, sampled hourly, and applies any monthly minimum. The fee schedule in its published Singapore custody agreement includes the first $100,000 of holdings and charges 5 basis points a month above that.

In the iShares and Fidelity bitcoin trusts, the sponsor pays the custodian out of its sponsor fee. Staking adds a separate charge: the Fidelity Ethereum Fund pays 15% of staking rewards as a staking fee, and the Grayscale Ethereum Staking ETF pays fees totaling 23% of gross staking rewards.

Who holds spot bitcoin and ether ETF assets

US spot ETFs name their custodians in SEC filings. The iShares Bitcoin Trust (IBIT) uses Coinbase Custody Trust Company and lists Anchorage Digital Bank as an additional custodian; its June 30, 2026 quarterly report says the sponsor has no plans to move bitcoin there. Grayscale Bitcoin Trust (GBTC) also uses Coinbase Custody, with Anchorage as an alternative. The ARK 21Shares Bitcoin ETF (ARKB) names four custodians: Coinbase Custody, BitGo Bank & Trust, BitGo New York Trust Company and Anchorage. VanEck's HODL holds bitcoin at Gemini Trust Company with Coinbase Custody as additional custodian, and the Morgan Stanley Bitcoin Trust (MSBT), launched in April 2026, names BNY and Coinbase Custody. Fidelity keeps FBTC's bitcoin at Fidelity Digital Assets, N.A., which held 174,383 BTC for the fund on June 30, 2026.

The iShares Ethereum Trust (ETHA) uses Coinbase Custody with Anchorage on standby, and the Grayscale Ethereum Staking ETF uses Coinbase Custody with Anchorage as an alternative. Bitwise's ETHW and Invesco Galaxy's QETH also use Coinbase Custody. The Fidelity Ethereum Fund differs: its August 21, 2026 prospectus names Anchorage, BitGo Bank & Trust and Fidelity Digital Assets as the custodians holding all of its ether.

How to choose an institutional custodian

A due diligence review can cover these points.

The legal entity holding the assets and its charter or license for the client's jurisdiction.
Qualified custodian status for US advisers and funds, and the charter behind it.
Segregated or omnibus wallets, and the insolvency treatment written into the custody agreement.
Who holds key shares or signing devices, and how quorum changes and recovery work.
A current SOC 1 or SOC 2 Type 2 report on the custody entity itself, including any exceptions.
Insurance limits and whether clients share them, plus the wallets or events each policy excludes.
Staking terms, including who runs validators and the share of rewards the custodian keeps.
The fee basis and monthly minimums, with withdrawal and network charges itemized.
Pending ownership changes, such as Standard Chartered's agreed purchase of Zodia Custody UK and Copper's sale process.