Guides / Glossary / Custodian
Glossary

Custodian: when someone else holds the keys

A third party that holds bitcoin and its keys for a client. The client relies on the custodian's controls and legal terms.

Education onlyUnited Kingdom and United States

Definition. A third party that holds bitcoin and its keys on a client's behalf. The client relies on the custodian's controls and legal terms.

How it works

A custodian generates and stores the private keys for the client's bitcoin, usually in pooled or segregated wallets protected by its own multisig, hardware security modules and internal approvals. The client sees a balance in an account and instructs the custodian to send or receive. The client does not hold any key, so the custodian's systems, staff and legal position stand between the client and its coins.

Why it matters for a company

A regulated custodian can suit a company that does not want to manage keys or that needs institutional reporting. The trade is counterparty risk. The 2022 failures of several crypto lenders and an exchange showed that customer assets can be frozen or lost in an insolvency. The main questions are whether the company's bitcoin is segregated and held on trust or similar terms, what happens in insolvency, which audits and control reports exist, and how fast withdrawals are processed.

Regulation differs by country.

United KingdomGo to United States

Firms carrying on cryptoasset business in the UK must currently be registered with the FCA under the money laundering regime. That registration covers anti money laundering controls; it is not a prudential licence, and the FCA says customers do not get FSCS or Financial Ombudsman cover through it. The FSCS also says cryptoassets are not generally protected. Under the new regime, safeguarding cryptoassets becomes an authorised activity, with the FCA saying the regime starts on 25 October 2027 and the application window closes on 28 February 2027. Check the FCA register for the provider's actual status at the time.

US custody providers include state chartered trust companies, such as those supervised by the New York Department of Financial Services, and nationally chartered banks. NYDFS issued updated guidance on custodial structures and customer protection on 30 September 2025. The SEC's custody rule for investment advisers defines a qualified custodian; it applies to advisers, but its terms are often used as a benchmark. FDIC deposit insurance does not cover crypto assets, and SIPC protection does not cover digital assets that are not securities.

Both countries
Example only, fictional. A company shortlists two custodians and asks each for its latest SOC 1 or SOC 2 report, its customer agreement wording on segregation and insolvency, its withdrawal times and its regulatory status, then records the answers in a due diligence questionnaire for the board.

Common mistakes

Sources

Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.

  1. FCACryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover)
  2. FCAFCA opens gateway for regulated crypto (apply by 28 February 2027; regime from 25 October 2027)
  3. FSCSCryptoassets: are they covered, and what is the risk?
  4. US CFR17 CFR 275.206(4)-2, custody rule for investment advisers (definition of qualified custodian)
  5. New York DFSIndustry letter, 30 September 2025: updated guidance on custodial structures for customer protection
  6. FDICFact sheet: what the public needs to know about FDIC deposit insurance and crypto companies
  7. SIPCWhat SIPC protects (not digital assets that are not securities)
  8. AICPA and CIMASystem and Organization Controls: the SOC suite of services
Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.