A neutral comparison, checked 9 November 2026. It names no products or providers and makes no forecasts. Neither option is right for every company; the board decides, with its own advisers.
The difference in one line
In collaborative custody, the company holds two of three keys and a provider holds one, so the provider can help but cannot move funds alone. With a custodian, the provider holds all the keys and the company holds a claim against it.
Side by side
| Question | Collaborative multisig (company holds 2 of 3) | Regulated custodian (provider holds all keys) |
|---|---|---|
| Who can move the bitcoin? | The company with its own two keys, or one company key plus the provider's key | The custodian, on the company's instructions |
| If the provider fails | The company can still sign with its two keys, if it has the descriptor and tested recovery | Depends on segregation, trust terms and insolvency law; withdrawals may be frozen |
| If the company loses a key | Remaining company key plus the provider's key, after the provider's checks | Not applicable: the company holds no keys; account recovery follows the custodian's identity process |
| Day to day work for the company | Keep two devices, backups, a key register and a drill | Manage user access, approvals and the account |
| Audit evidence | On chain records, signed messages from the company's keys, the key register | Custodian statements and controls reports such as SOC 1 or SOC 2 |
| Main risk | Operational: lost backups, poor process, a single person holding both company keys | Counterparty: the custodian's solvency, controls and legal terms |
| Withdrawal speed | As fast as the company can gather two signers | Set by the custodian's process and cut off times |
Regulation
UK cryptoasset businesses must currently be registered with the FCA for anti money laundering purposes, which the FCA says gives no FSCS or Financial Ombudsman cover. The new regime makes safeguarding cryptoassets an authorised activity, starting on 25 October 2027 according to the FCA. The FCA's perimeter guidance (PERG 18.6, in PS26/18, September 2026) says a firm safeguards cryptoassets only if it can, through any means, bring about a transfer of them. Being able only to block a transfer, which the FCA calls negative control, is not enough; its example is a firm holding a single shard of a key below the signing threshold. A firm that can reach the threshold by other means, for example by requiring other key holders to act, does have control, and the FCA says the threshold is a case specific matter. The guidance does not name collaborative multisig, so ask each provider how its service is built, how it expects to be treated from 25 October 2027, and check the FCA register.
US custodians include state chartered trust companies, such as those supervised by NYDFS, and banks. The SEC adviser custody rule's definition of a qualified custodian is often used as a benchmark, though it applies to investment advisers. FDIC deposit insurance does not cover crypto assets, and SIPC does not protect digital assets that are not securities. Collaborative providers that never hold enough keys to move funds are generally structured as technology and support services; check how each describes its status.
Questions that decide it
- Does the board want the company to be able to move its bitcoin without any third party?
- Can the company reliably keep two keys in two places, with backups and a yearly drill?
- Does the company need institutional statements and controls reports for its auditor or investors?
- How quickly might it need to sell or move funds?
See custody options and custodian due diligence.
Common questions
Can a collaborative provider move our bitcoin?
Not on its own. In a 2 of 3 set up it holds one key and needs one of the company's keys to sign.
Is bitcoin at a custodian protected like a bank deposit?
No. The FSCS and FDIC say crypto assets are not covered by deposit protection, and SIPC does not cover digital assets that are not securities.
Will a collaborative provider be regulated in the UK from 2027?
It depends on control. FCA guidance says merely being able to block a transfer is not safeguarding, but a firm that can bring about a transfer by any means is. Ask each provider how its service is built and check the FCA register.
Sources
Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.
- FCACryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover)
- FCAPS26/18: Cryptoasset perimeter guidance
- FCAFCA opens gateway for regulated crypto (apply by 28 February 2027; regime from 25 October 2027)
- FSCSCryptoassets: are they covered, and what is the risk?
- New York DFSIndustry letter, 30 September 2025: updated guidance on custodial structures for customer protection
- US CFR17 CFR 275.206(4)-2, custody rule for investment advisers (definition of qualified custodian)
- FDICFact sheet: what the public needs to know about FDIC deposit insurance and crypto companies
- SIPCWhat SIPC protects (not digital assets that are not securities)
- AICPA and CIMASystem and Organization Controls: the SOC suite of services
- PCAOBInvestor advisory: exercise caution with third party verification and proof of reserve reports
- Bitcoin BIPsBIP 380: Output script descriptors, general operation (wallet backups and exports)
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.