For institutional treasury, risk, and operations teams, bank-provided digital-asset custody is an arrangement for holding an asset on a customer’s behalf, but that basic description does not settle who controls access, what other services are included, or what rights apply if the provider fails. Before relying on a service, map its scope and control responsibilities, request evidence for security and recovery claims, and verify legal and operational terms against current, applicable documentation. The available evidence does not establish the terms or protections of any particular bank’s custody service.

What bank-provided digital-asset custody covers

In a 2025 U.S. interagency statement concerning covered banking organizations, crypto-asset safekeeping is defined as holding an asset on a customer’s behalf. That definition helps identify the basic activity, but it is not a universal definition of institutional treasury management and does not specify the full scope of a particular service. 1

A treasury team should establish which assets and activities an agreement covers. Separate safekeeping and transaction authorization from trading, lending, staking, or broader treasury management. Those activities may be offered or structured separately; the evidence available here does not establish that any particular bank provides them or under what terms.

Request the service description and governing agreement, then compare them. Record the contracting entity, the covered assets and transaction types, stated exclusions, and dependencies. Confirm whether the arrangement covers holding and transfer authorization alone or additional activities. Do not infer service scope, asset support, custody rights, or protections merely from a provider’s use of the word “bank.” The available evidence does not show that bank status by itself determines those matters.

Map the custody model and control responsibilities

Map responsibilities across the institution, the bank, and any other service participants. A useful contrast is self-custody: in that model, the user controls the private keys and recovery material needed to access the user’s crypto assets. This does not establish how a bank’s service is structured or who controls its keys. 2

For the proposed service, request a documented path from an institutional instruction to the resulting asset movement. Identify who can initiate an instruction, who approves it, who executes it, and who can pause or reject it. Ask how the institution’s authorization process connects to the provider’s key-management process, and whether another entity participates. The available evidence does not establish these details for a particular provider, so treat them as questions to resolve rather than assumptions.

Extend the map to operational exceptions. Request procedures for access changes, staff departures, disputed instructions, outages, and reconciliation between institutional and provider records. For each step, record the accountable party and the evidence the institution receives. If another service provider or subcontractor participates, seek documentation of its role and how the institution will learn of relevant changes. These are diligence questions, not claims that every service uses subcontractors or follows the same workflow.

Assess security, recovery, and operational resilience

Broad statements about secure storage or institutional-grade controls do not, by themselves, establish how a service operates. Ask for attributable, current documentation on key-management design, access controls, monitoring, incident response, recovery, business continuity, and asset reconciliation. For each control, clarify which entity operates it, what activity it covers, and what evidence the institution can review. The available evidence does not verify any particular bank’s security design, independent assurance, incident record, testing, or recovery capability.

Treat recovery as a distinct control area. Ask how the institution would seek access after a key, credential, or service disruption; who may authorize recovery; and what conditions or dependencies apply. Request the procedure and evidence relevant to the service. A general assurance should not be treated as proof that recovery will be available in every scenario. Also ask how incidents are communicated, who coordinates response, and what information the institution receives for investigation and reconciliation.

Record what each control does and does not address. A control description is not evidence that risk has been eliminated. If the provider cannot supply current, service-specific support for a material security or recovery claim, preserve that absence as an open diligence item rather than converting the claim into a verified fact.

Identify the precise contracting entity and governing documents before drawing conclusions about institutional rights. Ask what the agreement says about asset ownership, the provider’s role, and the treatment of assets if the provider becomes insolvent. The evidence available here does not establish ownership, segregation, insolvency treatment, licensing, or regulatory protection for any particular bank or custody arrangement.

Check claims about licensing, regulation, or protections against current primary sources that apply to the relevant entity and jurisdiction. Do not infer a legal outcome from a provider’s name or general service description. The available evidence does not support jurisdiction-specific legal, regulatory, or tax conclusions; leave those questions unresolved until the relevant agreement and current jurisdiction-specific sources have been reviewed.

Assess compliance responsibilities separately from custody. FATF standards state that virtual asset service providers under those standards are expected to implement preventive measures that include customer due diligence, record keeping, suspicious-transaction reporting, and originator and beneficiary information handling for applicable transfers. Exact duties, thresholds, licensing, data handling, and permitted services depend on implementation in each jurisdiction. This evidence does not establish whether a particular bank or arrangement falls within that scope, or whether custody affects the institution’s own responsibilities. 3

Build a due-diligence decision record

For each material topic, record the evidence reviewed, its date and scope, the accountable internal owner, assumptions, open questions, and required approvals. Distinguish provider representations from contractual terms and independently checked requirements. This helps the team track which points are documented and which still need verification, without treating an incomplete record as proof of safety or approval.

Before stating current asset availability, supported assets, fees, or service conditions, verify them in authoritative, current provider documentation and the applicable agreement. The evidence available here does not establish those details for any provider. Do not substitute market-wide assumptions or documentation about a different entity or product.

Set review triggers for changes to the agreement, contracting entity, service scope, control documentation, applicable rules, or the institution’s operating requirements. The record should identify what must be reassessed and who owns that review. The goal is a clear account of the decision’s evidence and remaining questions—not a conclusion that a custody arrangement is risk-free or legally approved.

Sources and references

  1. claim_b17451b01b8b1cec824c. ↩︎

  2. claim_sec_self_custody_responsibility. ↩︎

  3. claim_vasp_preventive_measures. ↩︎