When a pension fund or hedge fund wants to hold crypto, the custody question is the first one they need to answer. Regulators require that client assets be held by a qualified custodian, separate from the firm own assets. This is a non-negotiable requirement in most jurisdictions, and it means self-custody is not an option for most institutional investors even if they wanted it.
Qualified custodians in crypto include regulated entities like Coinbase Custody (a New York trust company), BitGo Trust, Fidelity Digital Assets, and Anchorage Digital Bank. These firms have obtained the necessary licenses and undergone the regulatory audits required to hold assets on behalf of institutional clients. The licensing process is expensive and time-consuming, which is why there are relatively few qualified crypto custodians compared to traditional finance.
The technology stack for institutional custody differs significantly from retail solutions. MPC (multi-party computation) is the dominant key management approach. Instead of a single private key, MPC splits the key material into multiple shares distributed across different parties and geographies. No single party ever possesses the complete key. Transactions require a threshold of these shares to cooperate in generating a signature, without ever reconstructing the full key.
Policy engines are a critical layer in institutional custody. These systems enforce rules about who can initiate transactions, who must approve them, what amounts require additional approvals, and during what hours transactions can be processed. A typical setup might allow a trader to initiate transactions up to $100,000 with one approval, while anything over $1 million requires three approvals including a compliance officer.
Insurance coverage is a key differentiator among custodians. Specialty insurers offer crime and specie policies that cover losses from theft, hacking, and internal collusion. Coverage limits vary widely. Some custodians carry $100 million or more in coverage, while others have significantly less. The amount and quality of insurance is one of the first things institutional investors evaluate.
Segregated accounts ensure that each client assets are separately identifiable and not commingled with other clients assets or the custodian own assets. This is a fundamental requirement that protects clients in the event of the custodian bankruptcy. The FTX collapse illustrated what happens when client assets are not properly segregated. Regulated custodians are required to maintain strict segregation with regular audits.
Integration with trading infrastructure is another institutional requirement. Custodians need to connect with exchanges, OTC desks, and DeFi protocols without exposing the underlying keys. Solutions like Fireblocks provide a network that connects custodied assets to trading venues, allowing institutions to trade across multiple platforms while maintaining custody with a single provider. Settlement can happen off-chain within the custodian network, reducing on-chain risk.
Reporting and audit trails are essential for regulatory compliance and investor relations. Institutional custodians provide detailed transaction histories, position reports, tax documentation, and audit-ready records. They need to track cost basis across thousands of transactions, handle forks and airdrops, and provide mark-to-market valuations using approved pricing sources. This reporting infrastructure is expensive to build and maintain.
The custody landscape is evolving rapidly. Self-custody with institutional-grade controls is becoming more feasible through smart contract wallets and account abstraction. Ethereum ERC-4337 enables on-chain policy enforcement that approaches what centralized custodians provide. For now, most institutions still use traditional custodians, but the line between custodial and self-custodial solutions is blurring as the technology matures.