Institutional teams assessing a Nasdaq-related crypto custody service should verify the service’s current status, contracting entity, custody structure, and allocation of control from current primary documents. The evidence available here does not establish that a specific Nasdaq custody service exists, who provides it, its status, supported assets, or its terms. Treat those points as open questions—not settled facts—and distinguish the provider’s documented duties from the institution’s own responsibilities.

What the custody claim does—and does not—establish

In the 2025 interagency statement concerning U.S. banking organizations, crypto-asset safekeeping is defined as holding an asset on a customer’s behalf. That is a bounded definition for the statement, not a universal definition of institutional treasury management or a description of any Nasdaq-related service.

A reference to custody does not, by itself, establish which legal entity performs the work, whether the service is available, what assets it covers, or how customer rights are structured. Third-party crypto custody can involve a provider managing access to private keys on customers’ behalf, but custody structure, customer rights, segregation, regulation, insurance, and insolvency treatment vary by provider and jurisdiction. source

Start with current primary documents that identify the named service, contracting entity, custody provider, intended customers, and operational status. Establish whether the documents describe custody itself or an adjacent function such as trading or settlement. Do not infer a live service, customer eligibility, or supported assets from a headline, brand reference, or announcement alone; the evidence available here establishes none of those Nasdaq-specific facts.

The distinction matters when one organization performs multiple roles. A centralized exchange operator may combine trading, proprietary activity, lending, token issuance, and custody, but not every operator performs every function. Combining roles can create operational dependencies and conflicts. This general observation is not evidence that a specific Nasdaq-related service combines any of them. source

Likewise, a token or digital record should not be treated as sufficient evidence of legal ownership. In issuer-sponsored tokenized-security models, the network may form part of the master ownership record, or an onchain transfer may trigger an update to an authoritative offchain record. Governing documents, applicable law, and transfer mechanics determine which record is legally effective. This is an example of why institutions should examine the actual legal and operational arrangement, not an assertion that a Nasdaq-related custody service holds tokenized securities. source

Nasdaq crypto custody: map control ownership

Build a responsibility map from contracts, procedures, and current service documentation. Identify which entity holds or administers key access, who can initiate or authorize transactions, which approvals apply, and what actions the institution must take. Record the source document for each assignment. A product label or the identity of a corporate affiliate is not a substitute for a clear account of permissions and obligations.

Ask the provider to explain the custody arrangement in terms that can be compared with the contract: who holds assets on the customer’s behalf, what access the institution retains, and how instructions become authorized transactions. If a third party manages access to private keys, determine what rights the institution has under the governing documents and what recourse is described if the service relationship ends or access is disputed. These are questions for the specific arrangement; the general custody model does not answer them. source

Trace operational dependencies where the documents disclose them. Ask whether another provider or infrastructure service performs a critical task, who oversees that dependency, and which party must respond if it is unavailable. The allowed evidence does not identify any Nasdaq-related provider, subcontractor, wallet design, or technical architecture. Mark those details as unverified unless current service documents substantiate them.

A role map should distinguish documented provider responsibilities from institutional actions and unresolved ownership. For example, do not assume that the institution controls a transaction approval simply because it submits an instruction, or that the provider assumes every reconciliation or access-management duty because it is described as a custodian. Require the relevant contract or procedure to support each conclusion.

Test operational controls and failure handling

Request current, service-specific material describing authorization, monitoring, segregation, reconciliation, and change-control processes. For each claimed control, record whether the evidence is a contractual commitment, a procedure, a provider statement, or independently substantiated material. Avoid turning a general policy description into an assurance about how a particular service operates.

Clarify who is responsible when access is interrupted, a transaction is disputed, or an incident occurs. Review the terms for notification, escalation, continuity, recovery, and institutional cooperation. Ask what actions are required from the institution and what the provider agrees to do. The evidence available here does not establish the security performance, incident-response capability, continuity arrangements, or recovery capability of any Nasdaq-related service. Those points require current and directly relevant evidence.

Also examine whether roles are combined. Where the same operator provides custody alongside trading or other functions, identify the resulting operational handoffs and potential conflicts rather than treating the functions as interchangeable. The general possibility that an exchange may combine roles does not show that a particular service does so; confirm the arrangement from its own documentation. source

Use a simple evidence register: record the claim, the document and date supporting it, the entity responsible, and any qualification or gap. Separate documented commitments from provider assertions and from findings independently substantiated by evidence. If materials describe a control differently, preserve the discrepancy and seek clarification rather than choosing the more favorable interpretation.

Verify the contracting entity, applicable service jurisdiction, and regulatory status against authoritative, current records. The supplied evidence does not establish the jurisdiction or regulatory status of a Nasdaq-related custody provider. Do not infer approval, registration, or compliance from a brand affiliation, corporate name, or use of the word “custody.”

Custody arrangements can differ in customer rights, segregation, regulation, insurance, and insolvency treatment depending on provider and jurisdiction. A general description cannot settle those terms for a particular institution. source Have qualified reviewers assess the relevant agreements and applicable requirements for the institution’s circumstances. This analysis does not provide legal, regulatory, or tax conclusions.

Document which compliance responsibilities the provider expressly accepts and which remain with the institution. Do not assume that outsourcing a custody function transfers every institutional duty. If service terms, internal policies, and compliance requirements do not align clearly, flag the issue for qualified review instead of resolving it by inference.

Turn evidence gaps into a decision record

Before relying on a service, verify current availability, supported assets, customer eligibility, fees, and service terms directly from primary documentation. The evidence available here establishes none of those details for a Nasdaq-related service. Treat each as a verification prerequisite, not a fact implied by a name, announcement, or general description of custody.

For every material conclusion, preserve the evidence reviewed, its date and scope, the party responsible, and any remaining uncertainty. Categorize items as confirmed by current documentation, stated by a provider but not independently substantiated, or unanswered. Then record residual risks, internal approvals required, and conditions that should trigger reassessment, such as changed terms or a revised allocation of control.

The resulting decision record should answer a narrow question: what does the current evidence establish about custody, control, and operational responsibility, and what remains unresolved? If the documentation does not establish a service’s status, provider, terms, or key responsibilities, the appropriate conclusion is that those matters need verification—not that they can be inferred from the Nasdaq name or from general custody practices.

Sources and references