An institutional crypto custodian is a third party that manages access to private keys on an organization’s behalf. The role centers on safeguarding and administering access to crypto assets; it does not, by itself, determine what the organization owns, how it invests, or which services are included. An organization should define the responsibilities in scope, verify them against written terms, and keep custody distinct from treasury decisions and any bundled trading or financing services.

What an institutional crypto custodian does

A crypto wallet is used to generate, manage, store, or use the asymmetric keys and blockchain addresses associated with crypto assets. In a third-party custody model, a custodian manages access to private keys for customers. By contrast, a self-custody user controls the private keys and recovery material needed to access the user’s assets. These descriptions distinguish who manages key access; they do not establish the legal ownership or rights associated with a particular arrangement. source

A useful way to understand the operational scope is to map custody against the key-management lifecycle. That lifecycle includes protecting keying material through generation, storage, distribution, use, recovery, revocation, and destruction. These are categories to investigate—not a list of tasks that every custodian necessarily performs. The arrangement’s actual procedures and division of responsibility need to be documented. source

For example, an organization might ask whether a proposed service covers key generation and storage, or whether the organization retains part of that process. It might also ask what happens when access must be changed, recovered, revoked, or discontinued. The general lifecycle offers a structure for these questions, but it does not show how any specific service implements them.

Custody should also be separated from ownership and decision-making. A custodian’s management of key access does not, on its own, establish who has a claim to an asset, what rights apply, or who decides whether to hold or transfer it. A signature from a key can support attribution of control of that key for a transaction, but it does not by itself identify the person, organization, device, or service controlling the key. source

The practical task is to make the boundary explicit: which actions can the custodian perform, which require organizational approval, and which responsibilities stay with the organization? Avoid treating a service label as a complete description of the control arrangement.

How custody differs from treasury management and prime brokerage

Treasury management concerns the organization’s broader decisions and oversight about its assets. Custody addresses a narrower operational responsibility: managing access to keys and performing the duties agreed for the custody arrangement. Using a custodian does not itself set the organization’s objectives, asset allocation, risk appetite, or treasury policy. Those decisions remain outside what the custody role alone establishes.

Trading is another function that may be separate or bundled. In a common centralized-exchange model, a customer typically transfers funds and custody to the exchange before trading on its internal order book. That example describes a particular trading-venue model; it does not mean every custodian is an exchange or that every custody arrangement requires an exchange deposit. source

Some centralized exchange operators may combine custody with third-party trading, proprietary trading, margin lending, token issuance, or other services. Not every operator performs every function, and combining roles can create operational dependencies and conflicts. An organization should therefore identify each service included in the arrangement rather than assume that “custody” describes the entire relationship. source

Prime brokerage is a separate adjacent topic and is not assessed here. For this explainer, the central distinction is that key management, trading, and the organization’s treasury decisions are different functions, even if an arrangement combines some of them. The written service description should make clear which functions are included and which are not.

Key custody controls to understand

Begin by mapping the key-management lifecycle to the proposed service. Ask who is responsible for generation, storage, distribution, use, recovery, revocation, and destruction. For each task, record whether the custodian, the organization, or another party performs it, and what documented procedure governs it. The lifecycle categories organize diligence but do not establish the effectiveness of a control or guarantee a recovery outcome. source

Next, clarify authorization. Identify who may request an action, who is expected to approve it, and how exceptions are handled. Ask what records document requests and approvals, how those records are made available to the organization, and which party is responsible for maintaining them. The evidence available here does not establish a universal approval design or recordkeeping practice, so those details need to come from the particular service’s documentation.

Keep key signing distinct from human or organizational authorization. A transaction signature can support attribution to the key that signed, but it is not conclusive evidence of which person or organization directed the action. Procedures should explain how the organization connects its internal approvals to actions submitted through the custody arrangement. source

Also ask how responsibilities are divided for monitoring, incident response, continuity, and recovery. The general definition of key management includes recovery as a lifecycle function, but it does not establish that a specific custodian offers recovery, continuity, monitoring, or incident-response services. Request current written descriptions and clarify any stated limitations rather than infer these capabilities from the custody label.

Security, insurance, and guarantee statements need particular care. The allowed evidence does not establish the security measures, insurance terms, recovery conditions, or guarantees of any provider. Treat such statements as arrangement-specific claims that require current documentation and clear limits. This explainer does not determine whether any stated protection is adequate for an organization’s circumstances.

Questions to resolve before assessing a custody arrangement

A focused review can start by documenting the organization’s own scope. Identify the assets and networks under consideration, the users and teams involved, and the workflows the arrangement would support. Then ask the provider to specify which assets and networks its documented service covers and which are outside the stated scope. The evidence used here does not establish support or availability for any particular asset or network.

For each workflow, establish who can request an action, who must authorize it, how exceptions are handled, and what records the organization will receive. Connect those answers to the key lifecycle: who manages each stage, who can access relevant materials, and how a responsibility changes when access is revoked or a relationship ends. The lifecycle is a checklist for inquiry, not proof that a particular service supports each process. source

Then compare the operational description with the written agreement. Check how the parties’ responsibilities and limitations are described, and request documentation for service availability, fees, security measures, recovery, insurance, incident handling, and any compliance statements. No general claim in this explainer establishes the terms of a particular service. These details should be verified in current, service-specific documents.

The review should also identify whether trading, lending, or other functions are bundled with custody. If they are, clarify which party performs each activity and how responsibilities are separated. A centralized exchange may combine custody with other functions, but this does not establish that a particular arrangement does so. source

Finally, route questions that depend on the organization’s circumstances to qualified legal, compliance, tax, and security advisers. This article does not determine jurisdiction-specific legal status, regulatory permission, tax treatment, or compliance obligations. It provides a way to organize questions, not a provider ranking or recommendation.

What custody arrangements do not settle

Custody alone does not determine an organization’s asset allocation, risk appetite, investment decisions, or treasury strategy. Nor does the word “custodian” establish a uniform legal status or level of protection. In the third-party model described here, the custodian manages access to private keys on behalf of customers; that description does not establish the customer’s legal rights or the arrangement’s treatment of assets. source

The custody label also does not prove that every key-management lifecycle task is included, that stated controls are effective, or that recovery is available under all conditions. Those points require service-specific evidence. Likewise, claims about supported assets, networks, availability, fees, yields, security, insurance, recovery, and compliance cannot be inferred from a general definition of custody. They require current documentation, careful attention to its limits, and, where relevant, jurisdiction-specific advice.

The most reliable way to understand the role is to keep three questions separate: who manages key access, what other services—if any—are included, and which decisions and obligations remain with the organization. Written terms and operating procedures should answer the first two; the organization and its advisers must address the broader responsibilities that custody does not settle.

Sources and references