Digital Asset Custodian: Storage, Insurance, and Costs

A digital asset custodian is a regulated financial institution that holds cryptocurrency, tokens, and other blockchain-based assets on behalf of clients by controlling the private keys that authorize their movement. Under federal securities law, investment advisers who control client funds must place those funds with a qualified custodian, and that requirement has built an entire industry around protecting cryptographic keys.¹ Opening a custodial account involves identity verification, compliance screening, and technical onboarding that can take several weeks.

What a Custodian Actually Holds and Does

The core job is protecting private keys. Anyone who obtains a private key can transfer the associated assets irreversibly; there is no bank to call for a reversal. A custodian generates, stores, and uses those keys under controlled conditions so the asset owner never has to manage that risk directly.

The custodian also keeps the books. Every transaction, current balance, and cost basis figure for each account is recorded, and those records feed the tax documents clients need for IRS compliance, a function that took on new weight when mandatory broker reporting on Form 1099-DA began.² A custodial arrangement also separates duties: whoever makes investment decisions is not the same entity holding the keys, which reduces the risk of theft or self-dealing.

How Assets Are Stored

Custodians use several key management models, usually in combination. The mix determines how fast you can move funds and how exposed those funds are to attack.

Hot Storage

Hot storage keeps private keys on internet-connected systems, so withdrawal requests can be signed by automated software almost immediately. The tradeoff is constant exposure to remote attack. Custodians running hot wallets rely on firewalls, intrusion detection, and monitoring, and most cap the share of total assets held this way.

Cold Storage

Cold storage keeps keys on air-gapped hardware, sometimes in bank-grade vaults, with no network connection. Signing a transaction requires physically bridging the gap: the unsigned transaction is carried to the offline device, signed there, and broadcast from a separate connected system. That process introduces delay, often up to 24 hours on business days, but rules out remote digital theft.³

Multi-Party Computation

Multi-Party Computation (MPC) splits a private key into mathematical fragments distributed across separate servers or locations. No single fragment is a usable key. When a signature is needed, a preset number of fragments interact through a secure protocol to produce a valid signature without ever reassembling the full key. Compromising one server yields a meaningless shard. MPC has become the dominant institutional model because it combines hot-storage speed with much of cold storage’s security.

Hardware Security Modules

Whatever the storage model, cryptographic operations usually happen inside Hardware Security Modules (HSMs), tamper-resistant physical devices. Institutional-grade HSMs are certified to the FIPS 140-2 Level 3 standard set by NIST. At that level, the device must have a tamper-evident casing that destroys internal components on physical attack and automatically erases keys when tampering is detected.⁴ FIPS 140-2 Level 3 is the minimum certification worth accepting when evaluating a custodian.

The Legal Framework

Federal securities law sets the baseline. Under the SEC’s custody rule at 17 CFR 275.206(4)-2, a registered investment adviser with custody of client funds or securities must keep those assets with a “qualified custodian.” The rule recognizes four categories:

Banks and savings associations with FDIC-insured deposits
Registered broker-dealers holding assets in customer accounts
Futures commission merchants for commodity-related assets
Foreign financial institutions that customarily hold client assets and segregate them from their own

Most digital asset custodians enter the market through state-chartered trust company structures that qualify as banks under the Advisers Act definition.¹ Several states have created specialized charter programs for digital asset businesses, with strict capitalization, reserve, and examination requirements. Some require full reserves: 100% of customer fiat deposits backed by unencumbered liquid assets, with no lending against customer funds.

Willful violation of the federal custody rule carries criminal penalties of up to five years in prison and a fine of up to $10,000.⁵ State regulators can impose their own sanctions, and revocation of a charter would end the firm’s ability to operate.

One rule is worth flagging because clients often assume it exists: the SEC’s 2023 proposed Safeguarding Rule, which would have expanded the custody rule to explicitly cover digital assets, was formally withdrawn in June 2025, and the SEC stated it does not intend to finalize it.⁶ The existing custody rule remains in effect.

Qualified custodians are expected to undergo independent audits. The industry standard is a SOC 2 Type II examination, covering security, availability, processing integrity, confidentiality, and privacy.⁷ “Type II” means the auditor tested whether controls actually worked over a sustained period, not just whether they existed on paper. Ask for the most recent report; a custodian that can’t produce one is a warning sign.

What Insurance Actually Covers

This is where assumptions most often break down. A regulated custodian is not an FDIC-insured bank account.

Digital assets held in custody are not covered by FDIC deposit insurance. The GENIUS Act, which established the federal framework for payment stablecoins, explicitly states that these instruments are not subject to FDIC insurance.⁸ If the custodian holds fiat currency in a bank on your behalf, that cash may be insured up to $250,000 as a corporate deposit of the custodian, but the protection does not extend to your crypto.

SIPC coverage has the same problem. SIPC protects securities at failed brokerage firms, but unregistered digital asset securities, which is what most cryptocurrencies are, don’t qualify as “securities” under the SIPC statute and receive no protection, even when held by a SIPC member.⁹

To fill the gap, most institutional custodians carry private “specie” insurance covering loss, damage, or theft of private key data stored in designated secure locations. Coverage limits in the London market can exceed $500 million for a single insured entity. Some policies cover all customer assets; others only named customers. Ask what the policy covers, what the limits are, and whether coverage applies to assets in both hot and cold storage.

Documentation You’ll Need

Opening a custodial account triggers the same Anti-Money Laundering and Know Your Customer rules that apply to banks. Federal law requires identity verification before account access.¹⁰

Individuals need an unexpired government-issued photo ID (passport or driver’s license) and documentation of a residential address, typically a recent utility bill. Some custodians accept alternatives that meet the “reasonable belief” standard, but a passport or license is the cleanest path.

Business accounts need documentation of the entity’s legal existence: certified articles of incorporation, a partnership agreement, or a trust instrument, along with a taxpayer identification number (typically an EIN). The custodian must also identify everyone with authority or control over the account, and board resolutions naming authorized signatories are standard. Any name mismatch between entity documents and identification will trigger a manual review that adds days.

Travel rule requirements apply to transfers of $3,000 or more. The custodian must collect and pass along identifying information about the sender and recipient through the transfer chain, including names, addresses, and account numbers.¹¹ Moving assets between custodians is not anonymous, and moving them in from a self-hosted wallet will bring detailed questions about the source of funds.

Onboarding Timeline and Withdrawal Speeds

After you upload documents, the custodian runs your identity against sanctions lists including OFAC.¹⁰ Many custodians add a live verification step, either a video call with a compliance officer or a biometric facial scan. Review commonly takes five to ten business days for individuals and longer for complex corporate structures. Most custodians then require a small test transaction before allowing significant transfers.

Once the account is live, withdrawal speed depends on where your assets sit. Hot-storage withdrawals may process within hours. Cold-storage withdrawals can take up to 24 hours on business days, and unusually large or flagged transfers can take longer.³

Tax Reporting Through a Custodian

Using a custodian shifts much of the recordkeeping burden off you. It also creates reporting that self-custody does not.

For transactions occurring in 2025, custodians acting as brokers must report gross proceeds from digital asset sales to the IRS on Form 1099-DA. Cost basis reporting for “covered securities,” digital assets acquired after 2025 in a custodial account, becomes mandatory for transactions in 2026 and later.¹² Assets acquired before 2026 or transferred in from outside wallets are “noncovered securities,” and the custodian is not required to report basis for those, though some do so voluntarily.²

A few de minimis thresholds apply. Stablecoin transactions below $10,000 in aggregate annual gross proceeds may qualify for simplified reporting. For specified NFTs, the threshold is $600 in aggregate annual proceeds. For payment processing, the custodian need not report if a customer’s total proceeds stay at or below $600 for the year.²

If you use an offshore custodian, FBAR may apply. Any U.S. person with foreign financial accounts whose aggregate value exceeds $10,000 at any point during the year must file FinCEN Form 114 by April 15, with an automatic extension to October 15.¹³ Application of FBAR to digital asset accounts at foreign custodians is still evolving; a foreign digital asset custodian likely qualifies. Err on the side of filing.

What It Costs

Custodial fees vary widely and rarely appear as flat published schedules. Most use tiered pricing based on assets under management. A typical arrangement includes:

Setup and filing fees. Entities applying for a specialized digital asset trust charter generally face initial filing fees of $12,500 to $20,000. Individual account holders don’t pay charter fees, though some custodians charge an onboarding fee.
Annual custody fee, usually a percentage of assets under management, covering secure storage, insurance, compliance, and account administration.
Transaction fees on deposits, withdrawals, and trades, typically lower than retail exchange fees but variable by custodian and size.
Additional services such as active management, rebalancing, yield strategies, and detailed reporting, priced separately.

Get the full fee schedule in writing before signing. Look closely at withdrawal fees and any minimum holding periods; some custodians charge premium rates for expedited cold-storage withdrawals, and a few penalize early withdrawals.

Planning for Heirs

Digital assets pose a distinct estate risk: if heirs don’t know an account exists or can’t reach it, the assets can be lost. A regulated custodian reduces that risk compared to self-custody, since the firm keeps records and responds to legal process, but planning still matters.

Most states have adopted the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which sets a hierarchy for post-death access. An online tool designation, such as an account beneficiary setting, overrides contrary directions in a will. A written direction in a will or trust overrides the custodian’s terms of service. Absent either, the terms of service control. Use your custodian’s beneficiary designation if it offers one, and back it up with written instructions in your estate plan.

Keep a letter of instruction with your estate documents describing which custodians hold your assets, account numbers, and contact information. Do not include private keys or passwords in estate documents; those records often become public in probate. An executor can generally gain access through a court order and the custodian’s death-of-account-holder procedures.

1
U.S. Securities and Exchange Commission. Final Rule: Custody of Funds or Securities of Clients by Investment Advisers
2
Internal Revenue Service. 2026 Instructions for Form 1099-DA
3
U.S. Securities and Exchange Commission. Form of Custodial Services Agreement Between INX Digital Inc. and BitGo Trust Company
4
NIST CSRC. FIPS 140-2 Security Policy: NITROXIII CNN35XX-NFBE HSM Family
5
Office of the Law Revision Counsel. 15 U.S. Code 80b-17 – Penalties
6
U.S. Securities and Exchange Commission. Safeguarding Advisory Client Assets
7
AICPA & CIMA. System and Organization Controls (SOC) Suite of Services
8
Federal Deposit Insurance Corporation. GENIUS Act Requirements and Standards for FDIC-Supervised Permitted Payment Stablecoin Issuers and Insured Depository Institutions
9
Securities Investor Protection Corporation. For Investors – What SIPC Protects
10
FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Customer Identification Program
11
Federal Register. Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements
12
U.S. Department of the Treasury. U.S. Department of the Treasury, IRS Release Final Regulations Implementing Bipartisan Tax Reporting Requirements for Sales and Exchanges of Digital Assets
13
Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)