● BitGo pairs an OCC-chartered national trust bank with $250 million in stated insurance coverage.● Coinbase Custody offers NYDFS-chartered custody with broad asset and staking support.● Fireblocks combines NYDFS-chartered custody, MPC security, and tokenization tooling.● Anchorage Digital suits buyers seeking a federally chartered digital asset bank.● Copper pairs MPC custody with off-exchange settlement through ClearLoop.● Zodia Custody offers bank-backed custody built around cold-wallet security.● Circle and Paxos focus on issuance infrastructure, so buyers should assess their narrower custody scope separately.● Restart Fintech helps institutions integrate their chosen custodian into a custom tokenization build.

What regulated buyers need from custody that retail buyers don't

Regulated institutions must support a custody decision with evidence that examiners, auditors, and boards can review. Consumer wallet buyers may focus on access and convenience. A bank, RIA, asset manager, or trust company must document who legally controls the assets, how client holdings remain segregated, and which party bears responsibility when controls fail.

For RIAs, the SEC Custody Rule generally requires client funds and securities to remain with a qualified custodian. Eligible entities can include banks, registered broker-dealers, and qualifying state-chartered trust companies. A September 2025 SEC no-action letter addressed state-chartered trust companies that custody crypto assets. The stated conditions included specific state authorization for crypto custody, audited GAAP financial statements, a Type II SOC report, written safeguarding policies, and contractual restrictions on rehypothecation. Buyers still need counsel to determine whether a provider qualifies for the assets and account structure under review.

A vendor comparison should apply four lenses. Regulatory licensing establishes whether the legal entity fits your custody obligations. The security review should examine how cold storage, MPC, multi-signature approvals, key recovery, and transaction policies protect assets. Insurance and audit diligence should verify covered events, exclusions, policy limits, and whether independent reports test controls over time.

Integration requirements determine whether custody can operate inside your existing control environment. The custodian should support transaction approvals, record-keeping, balance reconciliation, and audit trails without forcing staff to manage parallel records. A technically secure wallet can still fail institutional review when reporting or governance controls cannot support ongoing supervision.

What to look for in an institutional custodian

Licensing. Verify that the provider’s charter covers the assets and custody services you plan to use. An OCC trust bank operates under federal supervision, while a state trust company relies on its state authorization. A New York BitLicense permits specified virtual currency activities but does not by itself establish qualified custodian status. RIAs should confirm that a provider satisfies the SEC Custody Rule requirements.

Security architecture. Ask how the provider generates, distributes, approves, recovers, and stores keys. MPC divides signing authority among encrypted shares, multi-signature wallets require several keys, and cold storage keeps keys offline. Each model needs documented approval controls and recovery procedures.

Audit and insurance. Review audited financial statements, SOC 2 Type II reports, penetration tests, and insurance policies. Confirm covered events, exclusions, policy limits, and whether coverage applies per client or across the provider. A SOC 2 Type II report tests controls over a period rather than at one point.

Integration and reporting. Test APIs, transaction approval workflows, asset segregation, account statements, and audit trails against your compliance and accounting systems.

Provider scope. Separate dedicated custodians from platforms that bundle custody with trading, settlement, issuance, or tokenization tools. Broader scope can reduce integrations, but it also expands vendor due diligence.

Which provider fits which institution

● Bank trust department. Choose Anchorage Digital when a federal bank charter drives approval. BitGo offers another bank-chartered option when insurance disclosure and institutional custody controls carry more weight.● RIA or asset manager. Start with BitGo, Coinbase Custody, or Anchorage Digital, then confirm that the selected entity qualifies for your assets and account structure. RIAs must keep client assets with a qualified custodian. Coinbase Custody may suit portfolios that need broad asset and staking support.● Credit union. Consider Fireblocks when you need MPC-based wallet controls and connections to external counterparties. Your legal review still must confirm whether its custody entity, reporting, and service model satisfy your regulator. Zodia Custody may fit institutions that prefer a cold-wallet-first model.● Tokenization program lead. Fireblocks combines custody access with tokenization tooling, while Copper fits programs that prioritize off-exchange settlement and collateral movement. No custodian covers every part of issuance, compliance integration, and internal reporting. Pair the chosen provider with an implementation partner such as Restart Fintech when you need fractional CTO support and custom integration.

How to evaluate a custodian as part of a tokenization program

Use a gated review so regulatory approval precedes technical integration.
● Confirm that the contracting entity qualifies as a qualified custodian for the assets and client structure involved. Verify the charter directly with the regulator.● Review the current SOC 2 Type II report, auditor exceptions, and remediation evidence. Request audited financial statements where applicable.● Examine insurance policies rather than relying on the stated coverage limit. Confirm exclusions, deductibles, covered wallet types, and claims procedures.● Document asset segregation, bankruptcy treatment, and any rehypothecation rights in the custody agreement.● Test transaction approvals and key recovery against your internal control framework. Examiners should be able to trace who can initiate, approve, and recover access.● Validate APIs in a sandbox using your compliance and reporting systems. Include reconciliation, transaction monitoring, and audit exports in acceptance testing.
After the custodian passes compliance review, an implementation partner can connect custody to issuance contracts and internal systems. Restart Fintech can provide fractional CTO and engineering support for that work, but it does not replace the custodian or its regulatory obligations.

FAQs