Custodian due diligence questionnaire

Last checked 31 October 2026. Regulation is changing in both countries. Check each provider against the regulator's own register on the day you decide. If anything here conflicts with the linked source, the source wins.

A company that uses a custodian, rather than holding its own keys in a 2 of 3 multisig, relies on that firm for the whole holding. These are the questions worth asking before signing, grouped by topic. The answers are only useful if you can check them against documents: the custody agreement, the regulator's register, an independent controls report and the insurance wording.

Regulation and legal status

1. Which legal entity would hold our bitcoin, and where is it incorporated?
2. Which regulators register or authorise that entity, under which reference numbers? Check them yourself on the regulator's own register.
3. Is the entity permitted to provide custody, not just exchange or broking?
4. Has it, or its group, been subject to enforcement action or restrictions?

In the UK, check the FCA register and the FCA Warning List. Today most cryptoasset firms are only registered for anti money laundering purposes, which does not bring FSCS or Financial Ombudsman cover. A new authorisation regime starts on 25 October 2027. In New York, the Department of Financial Services licenses virtual currency businesses under its BitLicense rules. Other states have their own regimes.

Source: FCA: Financial Services Register, FCA: ScamSmart: check a firm and the FCA Warning List, FCA: Cryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover), FCA: Framework for cryptoasset regulation in the UK: what you need to know, New York DFS: Virtual currency businesses and the BitLicense (23 NYCRR Part 200).

Segregation and legal ownership

1. Are our assets held for us on a segregated basis, separate from the custodian's own assets?
2. Does the agreement say the assets remain ours and are not the custodian's property, so they would not be available to its creditors in an insolvency?
3. Are assets held in an omnibus wallet or in addresses dedicated to us? How is our share recorded?
4. Does the custodian lend, pledge, stake or otherwise use client assets? Can we opt out in writing?
5. Does it use sub-custodians? Which ones, and do we have to approve them?

New York's regulator expects custodians it supervises to segregate customer assets, keep internal records showing each customer's interest, create only a custodial relationship (not a debtor and creditor one), get approval before using a sub-custodian, and disclose all of this to customers.

Source: New York DFS: Industry letter, 30 September 2025: updated guidance on custodial structures for customer protection.

Proof of reserves and independent reports

1. Does the custodian publish proof of reserves? Who prepared it, as at what date, and does it also cover liabilities?
2. Will it give us a SOC 1 Type 2 or SOC 2 Type 2 report (or an ISAE 3402 report) covering the custody service? What period does it cover, and are there exceptions?
3. Are the custodian's financial statements audited? Who by?

The PCAOB warns that proof of reserve reports are not audits, describe a single point in time, and may not show whether the firm also has matching liabilities. SOC 1 reports cover controls relevant to clients' financial reporting; SOC 2 reports cover security, availability, processing integrity, confidentiality or privacy.

Source: PCAOB: Investor advisory: exercise caution with third party verification and proof of reserve reports, AICPA and CIMA: System and Organization Controls: the SOC suite of services, ICAEW: Considerations for auditing cryptocurrencies.

Insurance

1. Who is the insurer, and what is the limit? Is the limit shared across all clients?
2. What is covered: theft from online (hot) systems, offline (cold) storage, insider theft, loss of keys?
3. What is excluded? Can we see the certificate or a summary from the broker?

Crypto held with a custodian is not covered by the FSCS in the UK, by FDIC deposit insurance in the US, or by SIPC unless it is a security. Any protection comes from the custodian's own private insurance, so the wording matters.

Source: FSCS: Cryptoassets: are they covered, and what is the risk?, FDIC: Fact sheet: what the public needs to know about FDIC deposit insurance and crypto companies, SIPC: What SIPC protects (not digital assets that are not securities), Lockton (insurance broker): Cryptocurrency insurance: best practices for custodians.

Key management and withdrawals

1. How are keys generated, stored and backed up? Are signing keys split across several people and locations?
2. How many approvals does a withdrawal need at the custodian? Who can override them?
3. Can we require more than one approver on our side, with an allow list of withdrawal addresses and a delay before a new address can be used?
4. How often are key recovery and business continuity tested?

NIST's key management guidance covers how keys should be generated, protected, backed up and recovered. Ask the custodian which framework it follows and how that is tested.

Source: NIST: SP 800-57 Part 1 Rev. 5: Recommendation for key management.

Exit and data portability

1. How quickly can we withdraw everything to our own multisig wallet? What fees or limits apply?
2. Can we export full transaction history (date, amount, transaction ID, value in pounds or dollars) as a file, and will we keep access after closing the account?
3. What happens to our assets, and how long would it take to get them back, if the custodian fails or is acquired?

An exit plan is easiest to write before you need it. A dry run, withdrawing a small amount to your own wallet and exporting the history, shows how it works in practice.

A regulated fund or note that tracks bitcoin is another way to get exposure without holding keys. The custody questions then apply to the fund's custodian, and the fund's documents will describe them. Our custody guide compares the options.

Read next

• Custody options for companies, multisig, collaborative custody, custodians and funds.
• Rules and insurance, UK and US.
• Custody cost calculator, compare yearly costs.

Sources

Primary sources only. Each link was checked on 31 October 2026. Rules change, so confirm the current version with your adviser.

1. FCAFinancial Services Register
2. FCAScamSmart: check a firm and the FCA Warning List
3. FCACryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover)
4. FCAFramework for cryptoasset regulation in the UK: what you need to know
5. New York DFSVirtual currency businesses and the BitLicense (23 NYCRR Part 200)
6. New York DFSIndustry letter, 30 September 2025: updated guidance on custodial structures for customer protection
7. PCAOBInvestor advisory: exercise caution with third party verification and proof of reserve reports
8. AICPA and CIMASystem and Organization Controls: the SOC suite of services
9. ICAEWConsiderations for auditing cryptocurrencies
10. FSCSCryptoassets: are they covered, and what is the risk?
11. FDICFact sheet: what the public needs to know about FDIC deposit insurance and crypto companies
12. SIPCWhat SIPC protects (not digital assets that are not securities)
13. Lockton (insurance broker)Cryptocurrency insurance: best practices for custodians
14. NISTSP 800-57 Part 1 Rev. 5: Recommendation for key management