In crypto, ownership is defined by a single piece of information: the private key. Whoever controls the key controls the asset, which is why the old maxim runs, “not your keys, not your coins.” Crypto custody is the business of securing those keys. For institutions moving from experiment to allocation, getting custody right is not optional; it is a legal, operational and reputational prerequisite. This guide explains how custody works, the choices involved, and the 2026 regulatory changes that have reshaped the market.
What is crypto custody?
Crypto custody is the secure generation, storage and use of the private keys that control digital assets, typically performed by a regulated third party on a client’s behalf. Where an individual can keep a seed phrase on a hardware wallet, institutions need redundancy, insurance, audit trails and round-the-clock controls, because a single lost key or insider theft can erase the entire holding.
Self-custody vs a qualified custodian
The first decision is who holds the keys. Self-custody means full control and no counterparty risk, but also total, unrecoverable responsibility and no insurance. For most institutions that is not viable: registered investment advisers, funds and public companies are generally required to hold client assets with a “qualified custodian,” a regulated entity that controls the keys under supervision, with segregation, insurance and audited processes.
| Model | Pros | Cons |
|---|---|---|
| Self-custody | Full control; no counterparty risk; low cost | Total responsibility; no insurance or recourse; not compliant for most institutions |
| Qualified custodian | Regulatory compliance; insurance; segregation; audit | Counterparty risk; fees; less direct control |
Storage types: hot, warm and cold
Custodians manage risk by separating assets across connectivity tiers. Hot storage is online, enabling fast trading and payments but carrying the highest exposure. Cold storage is fully offline and air-gapped, the most secure, but slow to access. Warm storage sits in between. In practice institutions run a hybrid: a small share hot for liquidity, the majority in cold.
The technology: MPC, multi-sig and HSMs
Three technologies dominate institutional key management. Multi-party computation (MPC) splits a private key into encrypted shares that can sign transactions without ever reconstructing the whole key. Multi-signature (multi-sig) requires several independent keys to approve a transaction. Hardware security modules (HSMs) generate and store keys inside tamper-resistant hardware. Serious custodians rarely rely on one alone; they combine them to balance security against operational speed.
| Technology | How it works | Trade-off |
|---|---|---|
| MPC | Key split into encrypted shares that sign without ever reconstructing the full key | Cold-level security at hot-level speed; newer cryptography; vendor-dependent |
| Multi-sig | Several separate keys must approve a transaction | On-chain verifiable and battle-tested; less flexible across chains |
| HSM | Keys generated and stored in tamper-resistant hardware | Strong physical security; best combined with MPC or multi-sig |
The 2026 regulatory shift
Custody has moved from a regulatory grey zone to an actively encouraged business in the space of about eighteen months.
- SAB 121 rescinded: in January 2025 the SEC replaced the rule that forced custodians to record customer crypto as a balance-sheet liability, the single biggest deterrent to banks entering custody. They now assess it under standard contingency accounting.
- OCC national trust charters: from December 2025 the OCC granted conditional approval for a wave of crypto firms, including Circle, Ripple, Paxos, BitGo and Fidelity Digital Assets, to become national trust banks, with more following in early 2026.
- State trust route widened: an October 2025 SEC no-action position allows advisers and registered funds to use state-chartered trust companies as qualified custodians, subject to conditions.
A note of caution for readers: SAB 122 is a staff accounting bulletin and the 16-asset commodity classification is interpretive guidance, both can change more readily than primary law. The charters, by contrast, are durable.
What institutions look for in a custodian
- Regulatory status: a federal or state trust charter, or clear qualified-custodian eligibility.
- Security architecture: MPC, HSM or multi-sig, cold storage and quorum-based signing policies.
- Insurance: meaningful crime and specie coverage.
- Asset segregation: bankruptcy-remote, provably segregated client assets.
- Staking and settlement: the ability to earn yield and settle trades without assets leaving custody.
Spotlight: Anchorage Digital
Anchorage Digital is the reference case for regulated custody. Founded in 2017, it received a national trust bank charter from the OCC in January 2021, the first federally chartered digital-asset bank, and operates as Anchorage Digital Bank, N.A. It offers institutional custody, staking, governance, trading and settlement, alongside Porto, an institutional self-custody wallet built on certified hardware.
Its 2025–2026 trajectory illustrates where the market is heading: a 2022 OCC consent order was formally lifted in August 2025; Tether selected Anchorage to issue its GENIUS Act-compliant US stablecoin and took a $100m equity stake; and the firm has reported a pipeline of major institutions waiting to issue stablecoins through its infrastructure. (As with any fast-moving company, confirm the latest specifics before publication.
The competitive landscape
Anchorage sits among a growing field of institutional custodians. Coinbase Prime is the largest US player by assets; BitGo, an early pioneer, secured its own OCC trust charter in December 2025; Fireblocks is the most widely deployed wallet infrastructure; and Copper, Komainu, Fidelity Digital Assets and others compete on settlement, regional licensing and security models. The common thread in 2026 is regulatory legitimacy as the new baseline for winning institutional mandates.
For an institution selecting a custodian, the practical lesson is to weigh three things together: regulatory standing, the security model, and the breadth of supported assets and services. A trust charter signals oversight, but it does not by itself guarantee the staking, settlement or integration features a given strategy needs. The strongest providers pair a clear regulatory footing with deep operational capability, which is why due diligence should test both the licence and the live product before any assets are moved.
Frequently asked questions
What is crypto custody?
The secure storage and management of the private keys that control digital assets, typically by a regulated third party on behalf of institutional clients.
Is Anchorage Digital a real bank?
Yes, Anchorage Digital Bank, N.A. holds a federal national trust bank charter from the OCC (granted January 2021). It is a trust bank focused on digital-asset custody, not an FDIC-insured deposit-taking bank.
What is the difference between self-custody and custodian?
Self-custody means you hold your own keys, with full control and full risk. A custodian holds keys for you under regulatory oversight, with insurance, segregation and audit, required for most institutions.
Is SAB 121 still in effect?
No. The SEC rescinded SAB 121 via SAB 122 in January 2025, removing the requirement to record customer crypto as a balance-sheet liability.
What makes a custodian “qualified”?
It must fall into an SEC-recognised category, such as a national or state bank, broker-dealer or qualifying institution, and genuinely control the private keys. OCC national trust charters and, since late 2025, state trust companies are the clearest routes.
