What is crypto custody?

Custody in banking is the "safekeeping and administration of financial instruments for the account of clients", an ancillary service under MiFID II (Annex I, Section B(1)). The service includes custodianship and related services such as cash and collateral management. Crypto custody is the same job for crypto-assets. MiCA defines it as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys" (Article 3(1)(17)).

The difference is what the custodian holds. In its order on spot bitcoin ETFs, the US Securities and Exchange Commission noted that "bitcoin custodians only hold keys to such bitcoin and not the bitcoin itself" (SEC, January 10, 2024). Whoever controls the private key can move the asset.

Crypto custody under MiCA works through duties that Article 75 sets for every custodian:

• an agreement with each client that names the custody policy, the security systems and the fees;
• a register of positions for each client and a statement of position at least every three months;
• a custody policy that minimizes the risk of loss through fraud, cyber threats or negligence;
• client assets held separately from the custodian's own assets on the blockchain, and legally separated so that the custodian's creditors have no recourse to them, in particular in insolvency;
• liability for losses the custodian causes, capped at the market value of the lost crypto-asset at the time of loss.

A custodian that uses another custodian may only use one authorized under MiCA and has to tell its clients (Article 75(9)).

In a custodial wallet a provider holds the private keys; in a non-custodial wallet, also called self custody, the holder keeps them. MiCA's custody rules cover safekeeping "on behalf of clients", so they apply to the provider of a custodial wallet. A person who keeps the keys personally is nobody's client, and no custodian bears the loss if the keys are lost. How keys and seed phrases work is covered on What is a crypto wallet?

Institutional crypto custody is custody offered by banks, securities depositories and licensed crypto firms to funds, banks and companies. MiCA lets a credit institution offer crypto-asset services after it notifies its supervisor at least 40 working days before it starts (Article 60(1)). For a central securities depository, crypto custody counts as equivalent to maintaining securities accounts (Article 60(2)).

BaFin sees a concentration in crypto custody services. It writes that providers of physically backed crypto ETNs need a custodian, and that the few specialized custodians work with an even smaller number of service providers for key safeguarding. A failure of one of them, for example through a cyber attack, could hit many ETNs at once (BaFin, Risiken im Fokus 2026).

Crypto custody risk is the risk of losing assets held by a custodian. The CPMI defines custody risk as loss "in the event of a custodian's insolvency, negligence, fraud, poor administration or inadequate record-keeping" (BIS CPMI, October 21, 2024). For crypto-assets, the theft of keys adds to this. BaFin reports that hackers stole 400,000 ether worth about USD 1.4 billion from the Dubai-based exchange Bybit in February 2025, the largest known theft of its kind to date. MiCA answers with segregation in insolvency and with the liability rule in Article 75(8).

In Germany, BaFin supervises crypto custody under MiCA as competent authority (section 3 KMAG). The KWG keeps its own license for the qualified crypto custody business: custody and administration of cryptographic instruments for others, or safeguarding private keys for cryptographic instruments, crypto securities, crypto fund units and DLT securities (section 1(1a) sentence 2 no. 6). Firms with a German license from before MiCA could continue under the old rules until December 31, 2025 at the latest (section 50 KMAG).

In Austria, the FMA is the competent authority under section 1 MiCA-VVG. The Austrian transition for registered virtual currency providers also ended on December 31, 2025 (section 23).

Switzerland is outside the EU. FINMA writes that the DLT Act of 2021 introduced "comprehensive bankruptcy protection" for crypto-based assets held by third parties (Article 37d Banking Act, Article 242a Debt Enforcement and Bankruptcy Act). A Swiss bank that holds such assets as segregable custody assets generally needs no capital for them, and portfolio managers must use custodians under prudential supervision (FINMA Guidance 01/2026, January 12, 2026). This page gives no legal advice.

• What is a bitcoin ETF?
• What is a crypto wallet?
• What is MiCA regulation?
• All questions on investment and digital assets

• European Union: Regulation (EU) 2023/1114 on markets in crypto-assets, May 31, 2023
• European Union: Directive 2014/65/EU on markets in financial instruments, May 15, 2014
• Securities and Exchange Commission: Release No. 34-99306, order approving spot bitcoin ETPs, January 10, 2024
• BIS Committee on Payments and Market Infrastructures: Tokenisation in the context of money and other assets, October 21, 2024
• BaFin: Risiken im Fokus 2026: Digitalisierung, read on September 29, 2026
• BaFin: Risiken im Fokus 2026: Investitionen in Kryptowerte, read on September 29, 2026
• Germany: Kreditwesengesetz, section 1, version of May 12, 2026
• Germany: Kryptomärkteaufsichtsgesetz, December 27, 2024
• Austria: MiCA-Verordnung-Vollzugsgesetz, BGBl. I Nr. 111/2024
• FINMA: Guidance 01/2026, Custody of cryptobased assets, January 12, 2026