Crypto Custody Requirements: Safeguarding Digital Assets

[cryptolaw_takeaway]Cryptocurrency custody requirements vary based on the entity type and regulatory framework. Investment advisers must use qualified custodians for client assets, while exchanges face custody standards under state and federal money transmission rules. Institutional adoption increasingly depends on robust custody solutions that satisfy regulatory requirements while maintaining security.[/cryptolaw_takeaway]

Investment Adviser Custody Requirements

Investment advisers registered with the SEC must comply with the Custody Rule (Rule 206(4)-2 under the Investment Advisers Act). This rule requires advisers with custody of client funds or securities to maintain those assets with a qualified custodian. Qualified custodians include banks, registered broker-dealers, futures commission merchants, and certain foreign financial institutions.

For digital assets, the custody question becomes complex. Traditional qualified custodians may not accept cryptocurrency, while crypto-native custodians may not satisfy qualified custodian requirements. Some state-chartered trust companies have emerged as qualified custodians for digital assets, though the SEC has not formally blessed specific entities.

State Trust Company Framework

Several states have established frameworks for digital asset custody through trust company charters:

• Wyoming: Special Purpose Depository Institutions (SPDIs) designed specifically for digital asset custody
• New York: Limited purpose trust companies operating under NYDFS supervision with BitLicense-equivalent requirements
• South Dakota: Trust companies with digital asset custody authority
• Nebraska: Digital asset depository institutions

These state-chartered entities may qualify as custodians for investment adviser purposes, though advisers should confirm qualification with legal counsel and document their analysis.

Exchange Custody Obligations

Cryptocurrency exchanges holding customer assets face custody requirements under state money transmitter licenses and, in New York, the BitLicense. Common requirements include:

• Segregation of customer funds from operating capital
• Restrictions on commingling customer assets
• Reserve requirements ensuring customer assets remain available
• Insurance or bonding covering custodied assets
• Cybersecurity standards protecting against unauthorized access

Security Standards for Digital Asset Custody

Institutional custody solutions typically implement:

• Cold Storage: Keeping the majority of assets in offline wallets disconnected from internet-accessible systems
• Multi-Signature Controls: Requiring multiple key holders to authorize transactions
• Hardware Security Modules: Dedicated cryptographic hardware for key storage and signing
• Geographic Distribution: Distributing key material across multiple secure locations
• Insurance Coverage: Crime, specie, and errors and omissions policies covering digital asset losses

Self-Custody vs Third-Party Custody

Organizations face fundamental choices between self-custody and third-party solutions:

Self-Custody Advantages:

• Direct control over private keys
• No counterparty risk from custodian failure
• Potential cost savings for sophisticated organizations

Third-Party Custody Advantages:

• Regulatory compliance path for investment advisers
• Professional security infrastructure
• Insurance coverage
• Operational support including staking and governance

SEC Proposed Custody Rule Changes

The SEC has proposed amendments to the custody rule that would expand the definition of assets requiring custody to include cryptocurrency. If adopted, these changes would require investment advisers to custody all client crypto assets with qualified custodians meeting enhanced requirements. The proposal has generated significant industry comment regarding the availability of qualified custodians for digital assets.

Due Diligence for Custody Selection

Organizations selecting custody solutions should evaluate regulatory status, insurance coverage, security architecture, operational controls, financial stability, and audit reports. SOC 2 Type II reports and penetration testing results provide insight into custodian security practices.

This article provides general information about cryptocurrency custody requirements. Custody arrangements involve complex regulatory, security, and operational considerations. Consult qualified legal and compliance professionals for guidance specific to your situation. Seth Goettelman is licensed in Wisconsin and Florida.