A bank’s involvement does not, by itself, establish what an institution owns, who controls the keys, or what happens if the provider fails. Before engaging a crypto custody bank, institutional treasury, finance, and technology teams should verify the contractual arrangement, map operational control, and document the evidence behind security and continuity claims. The answers depend on the provider, asset, service, institution, and jurisdiction; they should not be inferred from the word “bank.”

What a crypto custody bank arrangement covers

Start by defining the service under review. Custody is not interchangeable with trading, lending, or settlement. A centralized crypto intermediary may combine trading, proprietary activity, lending, token issuance, and custody, but not every operator performs every function. When roles are combined, document the resulting operational dependencies and potential conflicts rather than treating the provider as a single-purpose custodian. source

Ask the provider to identify the contracting entity and specify, in the applicable documents, what it does for the institution. Separate safekeeping and transaction authorization from any trading or other services being considered. This is a scope question, not an assumption that all bank custody models use the same structure.

A third-party custodian generally manages access to private keys on customers’ behalf; crypto exchanges are among the possible third-party custodians. That description does not settle the institution’s legal rights, asset treatment, or recourse if the provider fails. Those points require review of the actual agreement and related disclosures. source

Build an inventory of the assets, networks, account structures, and workflows the proposed service covers. Request current written terms for eligibility, geographic availability, service limits, and any subcontractors or other dependencies. The evidence available here does not establish which assets or jurisdictions a particular provider supports, or what fees apply; verify those details for the institution’s circumstances rather than treating them as standard.

Map control over assets, keys, and transactions

Create a control map that names who can initiate, approve, execute, and stop each custody-related action. Cover key management, user and administrator access, approval thresholds, transaction policies, and changes to those controls. For each responsibility, identify whether it sits with the institution, the provider, or another service involved in the arrangement.

Ask for documentation showing how transaction authorization works in practice and what happens when normal approval channels are unavailable. If the arrangement includes address allowlists, withdrawal limits, or emergency access, require the provider to describe how those controls are set, changed, and approved. The allowed evidence does not establish that any specific provider offers these controls or how they are implemented, so treat them as questions to answer with current documentation—not as assumed features.

The control map should also distinguish the custody function from other services performed by the same organization. An operator may combine customer trading, proprietary activity, lending, issuance, and custody, while another may not. Where functions are combined, ask how permissions, records, and decision-making are separated and identify the dependencies that could affect the institution. source

Security language is not a substitute for evidence. Request the documents that support claims about access restrictions, authorization, oversight, and any independent assurance. Clarify which systems, activities, and periods that assurance covers, and what remains outside its scope. Do not treat a general security statement as proof that every operational path or third-party dependency has been assessed.

Review the signed contract and related disclosures to determine which entity provides custody, what the institution’s rights are, and how the arrangement describes the treatment of assets if the provider fails. A custodian’s management of access to keys does not, on its own, establish segregation, ownership, redemption rights, or insolvency treatment. Those conclusions depend on the arrangement and applicable law. source source

Verify the provider’s legal identity, claimed permissions, and service scope using current evidence specific to the relevant jurisdiction and contracting entity. Do not infer licensing or regulatory permission from the provider’s name, branding, or use of the word “bank.” The evidence available here does not establish the status of any particular provider or the rules applicable to a specific institution.

Map which compliance responsibilities apply to the institution and which, if any, are assigned to the provider. Do not assume that outsourcing custody also transfers every due-diligence, sanctions, monitoring, recordkeeping, or reporting responsibility. Because requirements can depend on jurisdiction and the institution’s activities, obtain qualified legal and compliance review. This checklist does not determine legal obligations or establish that a provider is compliant.

Assess outages, recovery, and incident response

Request written procedures for service outages, suspected compromise, disputed transactions, lost access, network disruption, and service termination. For each scenario, identify the party responsible for detecting, escalating, communicating, and making decisions. The evidence should explain what actions are possible, what information the institution receives, and what conditions apply; an assurance that a provider can recover access is not itself proof of recovery capability.

Review continuity and recovery documentation alongside the contract and the control map. Identify dependencies on technology providers and clarify what the institution can do if a service is unavailable or ends. Ask how data, transaction records, and operational responsibilities would be handled during a transition, and require evidence for any promised capability. Test only through authorized, documented procedures; do not treat an untested description as a demonstrated result.

A custody arrangement may sit alongside trading or other intermediary functions, which can create operational dependencies when roles are combined. Ask how an incident in one service could affect access to another, and who has authority to coordinate the response. The answer must come from the provider’s current documentation and the institution’s own review, not from a general description of exchange or custody models. source

Build a decision record before engagement

Use a decision record to make gaps visible rather than allowing verbal assurances to stand in for evidence. For each requirement, record the responsible owner, the document or other evidence reviewed, any limitation, the unresolved question, and the institution’s acceptance decision.

At minimum, the record should cover:

  • Service scope: contracting entity, custody responsibilities, assets and networks in scope, and any combined services or subcontractors.
  • Control: key and access responsibilities, transaction authorization, approval roles, and the process for changing controls.
  • Legal and compliance review: contractual rights, asset treatment, failure scenarios, jurisdiction-specific permissions, and questions escalated to qualified advisers.
  • Continuity and exit: outage and incident procedures, recovery evidence, termination conditions, and transition responsibilities.
  • Current terms: written evidence for service eligibility, geographic availability, limitations, and fees.

Keep operational facts separate from legal conclusions. The evidence supports the need to examine custody roles, combined intermediary functions, and the clarity of legal claims and rights; it does not establish a provider’s licensing, fee schedule, supported assets, service availability, recovery performance, or the institution’s legal protections. source source source

Do not proceed on an unresolved material assumption simply because the provider is a bank or because another organization uses a similar model. Escalate security, legal, compliance, and tax questions to appropriately qualified advisers, and document any decision to accept a remaining gap. This process supports evidence-based review; it does not rank providers or recommend a particular custody arrangement.

Sources and references