Institutional treasury, risk, and operations teams evaluating a bank-associated crypto custody arrangement should verify the precise service, the entity responsible for each function, and the evidence supporting claims about control and protections. A bank’s name or location does not establish that a service is available, what assets it supports, or what legal protections apply. Those details require current documents and, where appropriate, qualified review.

Define what the proposed custody service actually covers

Begin by identifying the contracting entity and the service described in current provider materials and agreements. In this context, custody means managing access to private keys on a customer’s behalf. A crypto exchange may be one type of third-party custodian, but that general description is not evidence that a particular institution offers custody or that a proposed customer can use it. (Claim: claim_sec_third_party_custody)

Separate custody from trading, settlement, administration, and other services. A centralized crypto exchange operator may combine custody with trading, lending, token issuance, or proprietary activity, but not every operator performs every function. Where functions are combined, that can create operational dependencies or conflicts; it does not establish that a particular provider has a specific conflict. Ask which entity performs each function, and determine whether the proposed relationship includes anything beyond custody. (Claim: claim_bis_exchange_combined_functions)

For each asset and service under consideration, request current provider materials and contractual terms that establish the scope. Verify the supported asset and network, account structure, transaction responsibilities, and operational boundaries from those documents. Do not infer support for a token on one network from the same token’s presence on another, or assume that a general service description resolves these points. The available evidence here does not establish the present availability or asset coverage of any named bank-associated service; leave those items open until current documentation answers them.

A useful initial scope map separates custody from any associated trading or settlement activity. If the proposed arrangement includes exchange trading, obtain the terms for that activity separately and identify how it interacts with custody. In the general centralized-exchange model, a customer typically transfers assets into the exchange’s custody before trading on its internal system, although some venues and products use different custody or settlement arrangements. This is a model to check against the actual documents, not a universal operating rule. (Claim: claim_bis_exchange_deposit_custody)

Bank of New York Crypto Custody: verify control and responsibility

Review the agreement’s description of who manages key access and what the customer can authorize. Third-party custody describes a provider managing access to private keys on a customer’s behalf. By itself, that label does not establish the customer’s legal rights, whether assets are segregated, or how assets would be treated if the provider failed. Those matters depend on the arrangement and applicable jurisdiction. (Claim: claim_sec_third_party_custody)

Translate contractual and operational descriptions into a responsibility map. For each action relevant to the service, identify who may request it, who authorizes it, who executes it, and who documents or communicates its status. The relevant actions will depend on the proposed service, so do not assume that all custody arrangements use the same process. If the documents do not say who can pause an action, what happens after an instruction is submitted, or how an exception is handled, record that as an unresolved question rather than supplying an assumed answer.

Ask the provider to identify the records it maintains for the service and the process by which the institution can review those records. The evidence available for this article does not establish any particular provider’s reconciliation practices, reporting cadence, incident records, or ability to reverse an operational step. Treat each of those as a question for the contract and current operating documentation. Distinguish what the provider promises from what the institution itself must do, such as assigning authorized reviewers or escalating an unexplained discrepancy.

If trading is included, keep trading authority and custody authority distinct in the review. The general exchange model can involve a transfer into exchange custody followed by trading through an internal account system, but the actual arrangement may differ. Identify whether the contract describes an internal trading account, a separate custody account, or another structure; do not conclude that a particular structure exists without seeing its terms. (Claim: claim_bis_exchange_deposit_custody)

Test security and operational resilience claims

Ask technical and risk reviewers to connect each security statement to applicable, current evidence. Request documentation of the stated key-management and access-control arrangements, determine which entity operates them, and note any stated exclusions or conditions. A general definition of third-party custody does not substantiate a provider’s particular security controls, independent assurance, monitoring, continuity arrangements, incident response, or recovery process. Treat those claims as unverified until evidence and contractual terms support them. (Claim: claim_sec_third_party_custody)

Examine operational dependencies when one provider or related entity performs several functions. If custody is combined with trading, lending, token issuance, or proprietary activity, ask which functions depend on shared processes or decisions and who is accountable for each. The fact that an operator may combine functions is a reason to examine dependencies, not proof that a particular arrangement has a control weakness. Keep the assessment specific to the documented service and avoid turning a general risk possibility into a finding about a named provider. (Claim: claim_bis_exchange_combined_functions)

Treat recovery, insurance, segregation, and asset-protection statements as unverified until applicable documents support them. The evidence available here does not establish any of these features for a particular arrangement. Request the relevant contractual language and supporting material, identify the entity making the commitment, and refer unclear or incomplete terms to the appropriate legal and risk reviewers. Avoid substituting a marketing description or a general custody definition for evidence of an actual contractual protection.

Operational resilience questions should likewise be tied to the service under review. Ask what the provider’s documents say about incidents, service interruptions, dependencies, and the responsibilities of each party. If the materials do not specify a process or allocation of responsibility, note the gap and seek clarification. Do not report that continuity, recovery, or incident handling is assured unless the applicable evidence supports that precise claim.

Use current documents to identify the contracting entities, relevant service locations, governing law, and jurisdictions connected to the proposed arrangement. Then require current, jurisdiction-specific evidence before recording conclusions about regulatory status, availability, customer protections, or compliance obligations. The phrase “bank of New York crypto custody” does not establish where a service is offered, which entity provides it, or what legal regime applies.

Where a provider is subject to virtual-asset-service-provider standards, FATF standards describe preventive measures that include customer due diligence, recordkeeping, suspicious-transaction reporting, and handling originator and beneficiary information for applicable transfers. These are international standards; exact legal duties, thresholds, licensing, data handling, and permitted services depend on how each jurisdiction implements them. This general description does not determine whether a particular provider or activity is subject to a specific duty or satisfies it. Have qualified compliance and legal reviewers assess the entities, activities, and jurisdictions involved. (Claim: claim_vasp_preventive_measures)

Keep tax treatment separate from operational assumptions. Obtain qualified, jurisdiction-specific review before documenting a tax conclusion. The evidence available here does not establish the tax treatment of any particular custody arrangement, and a service description cannot fill that gap.

Build a decision record with open risks and evidence gaps

Maintain a review record that ties each material statement to supporting evidence and an accountable reviewer. For every item, record the claim being assessed, the document that supports it, the date reviewed, the entity and service it concerns, and any stated scope or jurisdiction limits. If a claim lacks current support, mark it as unresolved rather than as a confirmed capability.

A practical record can classify findings as verified from current documents, supported only under stated conditions, requiring legal, compliance, security, or tax review, or not established by available evidence. Add the responsible reviewer and the specific document or clarification needed to move an open item forward. For arrangements that combine custody and trading or other functions, record each function separately so that one documented feature is not mistakenly treated as evidence for another. (Claims: claim_sec_third_party_custody, claim_bis_exchange_combined_functions)

Before approval, revisit time-sensitive matters against current provider materials and the executed terms. This includes service availability, supported assets and networks, fees, yields if any are separately proposed, security assurances, recovery terms, and compliance details. Do not state fees, yields, availability, recovery, or regulatory conclusions without evidence applicable to the proposed arrangement. Escalate unresolved dependencies and contract gaps to the appropriate decision-makers. A completed checklist documents what was verified and what remains open; it does not endorse a provider or guarantee an outcome.

Sources and references