An institutional crypto custody provider holds digital assets for a fund, a corporate treasury, an exchange or a fintech, and takes responsibility for safekeeping, segregation and the record of ownership. Twelve providers cover most of that market in 2026. Coinbase Custody and Gemini hold New York trust charters and call themselves qualified custodians. Fireblocks sells key management technology, so the client keeps control of the keys. CEX.IO Prime puts custody in the same account as aggregated liquidity and settlement.
This list groups the twelve by custody model, because a fund appointing a custodian and a fintech building per-user segregation solve different problems. Every regulatory statement below comes from the provider’s own disclosure or from a regulator, and each one carries its source.
What institutional crypto custody means in 2026
Custody covers three things at once. The custodian holds legal title or holds the asset for the client’s account, it controls the private keys, and it keeps the record that says who owns what. A provider can do all three, or only the middle one, and the difference decides what a client can rely on when something goes wrong.
Custody, self-custody and exchange holdings
Self-custody puts the keys in the client’s own hands, so the client carries the whole operational risk. Assets sitting on a trading venue answer to that venue’s terms, and the client holds a claim on the venue. A licensed custodian sits between those two positions, because a licence brings segregation duties, reporting duties and a supervisor who can act.
The four custody operating models
Most comparison lists rank a trust bank, a software vendor and an exchange account side by side. Those three answer different questions, so the model comes first.
Regulated custodian
A regulated custodian holds a charter, a trust licence or a banking licence, and a named supervisor examines it. It holds the assets for the client and produces statements the client’s auditor can use. An SEC-registered investment adviser needs this model, because the SEC custody rule points at a defined set of institutions.
Custody technology provider
A technology provider supplies the key management stack and leaves control with the client. The client gains speed and reach across networks, and the client keeps the operational duty. No charter comes with the software, so a regulated fund pairs it with a licensed custodian.
Exchange and prime affiliated custody
Here custody sits next to execution inside one relationship. Assets move between safekeeping and trading without leaving the platform, which cuts transfer risk and settlement delay. The client accepts a single counterparty across several functions, so the counterparty review carries more weight.
Sub-account custody for platforms serving end-users
A fintech, an exchange or a savings app holds crypto for its own customers. It needs a separate account per end-user, a deposit address per user and a statement per user, because its own books have to attribute every coin to a person. A standalone custody agreement rarely delivers that shape, so platforms build it on sub-accounts.
| Model | Who controls the keys | Regulatory wrapper | Segregation | Best for |
|---|---|---|---|---|
| Regulated custodian | The custodian | Trust charter, banking licence, or national trust bank | Client assets segregated from the provider’s own | Funds, advisers, ETF issuers |
| Technology provider | The client, through distributed key shares | None for custody itself | The client designs it | Teams wanting network reach and control |
| Exchange or prime affiliated | The platform | Varies by entity and jurisdiction | Account and sub-account level | Desks that trade what they hold |
| Sub-account custody | The platform | Follows the platform’s own licences | One sub-account per end-user | Fintechs and apps serving retail customers |
How we assessed these providers
Seven criteria carried the assessment: the licence or charter and the regulator behind it, key management as the provider describes it, insurance and asset protection statements, asset and network coverage, execution and settlement connectivity, integration depth, and how clearly the provider publishes its fee model.
Three things stayed out. Assets under custody figures stayed out, because no provider in this group publishes an audited number. Security claims with no attestation behind them stayed out. Pricing stayed out, because every provider in this group quotes per client. Where a provider publishes nothing on a criterion, the entry says so and the reader gets a question to ask.
Twelve providers at a glance
| Provider | Model | Licence or charter, and regulator | Settlement access |
|---|---|---|---|
| Coinbase Custody | Regulated custodian | Limited purpose trust company, NYDFS. Fiduciary under New York banking law | Coinbase Prime |
| CEX.IO Prime | Prime affiliated, sub-account custody | CEX.IO Group entities, 30+ licences and registrations | Prime Liquidity, REST, WebSocket, FIX 4.4 |
| BitGo | Regulated custodian | South Dakota chartered trust company. OCC conditional approval to convert to a national trust bank, 12 December 2025 | BitGo Prime |
| Anchorage Digital | Regulated custodian | OCC charter, federally chartered digital asset bank | Atlas, real time settlement across counterparties |
| Fidelity Digital Assets | Regulated custodian | National trust bank. UK entity registered with the FCA under the Money Laundering Regulations | Multi-venue execution without moving assets from cold storage |
| BNY | Regulated custodian | G-SIB, entity not named on the digital assets page | Not published |
| Gemini Custody | Regulated custodian | Gemini Trust Company, LLC, NMLS #1518126. Fiduciary and qualified custodian under New York Banking Law | Gemini Exchange and eOTC as separate products |
| Copper | Technology and markets | Copper Markets (US), Inc. broker-dealer, SEC registered, FINRA and SIPC member | ClearLoop |
| Komainu | Regulated custodian | Multiple regulated entities, Komainu MEA FZE named | Komainu CORE, Komainu Connect |
| Zodia Custody | Regulated custodian | Licences page linked, regulators not named on the homepage | Interchange, trade from cold storage and settle off-venue |
| Sygnum | Regulated bank | Sygnum Bank AG, supervised by FINMA. Entities in Singapore and Abu Dhabi | Sygnum Protect, Sygnum Connect |
| Hex Trust | Regulated custodian | Licences and registrations across Dubai, Hong Kong and Singapore, entities not named | OTC execution, fiat ramping |
| Fireblocks | Technology provider | None for custody. SOC 2 Type 2, ISO 27001, C4 CCSS QSP Level 3 | Client configured |
The twelve providers, reviewed
Where CEX.IO Prime fits
CEX.IO Prime is the institutional arm of CEX.IO Group, and CEX.IO describes it as a complete institutional-grade ecosystem from a regulated crypto-fiat services provider. Prime sits apart from the twelve above for one structural reason. Custody, aggregated liquidity and settlement share one account.
Prime Liquidity executes order sizes across leading liquidity platforms, and a best price execution algorithm routes each order to the best available price and splits it among top venues. One account opens that access, and a client works through the web portal or through REST, WebSocket and FIX 4.4. On custody, CEX.IO states that it provides secure, insured storage that a client can customise to its business, and that it holds all digital assets in trust to the benefit of its clients.
Sub-accounts carry the per-user case. The Prime API documentation states that a client creates sub-accounts and uses them to separate orders by that client’s own users, trade strategies, portfolios or projects. The Prime help centre confirms that the system creates a separate sub-account on the first financial transaction into it, and that a client creates one through the API or through the web interface. A Get Deposit Address method issues addresses, and a Statement Transactions method returns a consolidated ledger of the operations that move funds. Transfers between a Prime Liquidity account and a CEX.IO account run free and instant, and external crypto withdrawals go to whitelisted addresses that an account manager adds.
A fintech that owes every end-user an attributable holding, and a treasury that wants execution and reporting on one ledger, get a different answer here from a standalone custodian. Watch-out. The public record shows no separate trust charter held by Prime itself, so an adviser inside the SEC custody rule should ask which CEX.IO entity holds the assets and under which authorisation.
Coinbase Custody
NYDFS chartered Coinbase Custody Trust Company, LLC as a limited purpose trust company. Coinbase describes the entity as a fiduciary under New York state banking law and a Qualified Custodian, and Deloitte & Touche runs its SOC 1 Type II and SOC 2 Type II audits. Key generation and cold storage technology come from twelve years and more of in-house development, and the service brings together physical security, consensus computation and process controls. Coinbase publishes a count of 470 assets and more. Clients stake Avalanche, Cardano, Cosmos, Ether, Polkadot, Solana, Sui, Tezos and other networks without removing assets from vault storage. Watch-out. The custody page publishes no insurance detail, so ask for the policy and its limits in writing.
BitGo
BitGo Trust Company, Inc. is a South Dakota chartered trust company, and the South Dakota Division of Banking regulates it under a trust charter. On 12 December 2025 the OCC granted conditional approval for the conversion of that entity into BitGo Bank & Trust, National Association, of Sioux Falls, South Dakota, an uninsured national trust bank carrying charter number 25366. BitGo lists Qualified Custody and Custody Wallets among its wallet products, and it names BitGo, Inc. and BitGo Prime, LLC as separately operated affiliates. Watch-out. The OCC granted the approval conditionally, and BitGo runs several entities, so confirm which one signs your agreement and under which charter it holds your assets.
Anchorage Digital
Anchorage Digital calls itself the first federally chartered digital asset bank in the United States and holds an OCC charter. The name covers services from wholly owned subsidiaries of Anchor Labs, Inc., a Delaware corporation. Anchorage Hold LLC provides agency trading and A1 Ltd. runs a principal trading business. Atlas delivers real time settlement across counterparties, and the Prime service generates yield on idle assets. Anchorage states that it does not guarantee digital assets held in custody, and that those assets carry no FDIC, SIPC or SDIC protection. Watch-out. That disclosure reads more plainly than most, and every other provider on this list deserves the same question.
Fidelity Digital Assets
Fidelity Digital Assets, National Association, a national trust bank, provides the custody and the trading. Fidelity Digital Assets, Ltd registered with the Financial Conduct Authority under the UK Money Laundering Regulations. Clients reach multi-venue liquidity and execute from one platform without moving assets out of cold storage, which removes a transfer step from every trade. FDA, NA also issues the Fidelity Digital Dollar. Fidelity states that the Federal Deposit Insurance Corporation and other government agencies neither insure nor guarantee digital assets, and it notes that only certain related entities carry regulation. Watch-out. Fidelity says outright that some group entities sit outside regulation, so confirm which entity holds your assets.
BNY
BNY describes itself as the first G-SIB to offer regulated digital asset custody and services. The service helps facilitate asset segregation and compliance across digital tokens and cryptocurrencies, and BNY names bankruptcy stay protection, a legal structure and audit trails as the reasons an institution chooses a bank for this. BNY states that digital assets carry no FDIC insurance, count as no deposit, and may lose value. Watch-out. The public page names neither the subsidiary that provides the service nor the regulator that supervises it, so ask for both before you rely on the G-SIB label.
Gemini Custody
Gemini Trust Company, LLC, NMLS #1518126, operates as a fiduciary and qualified custodian under New York Banking Law, and the State of New York licenses it to custody digital assets. Hardware security modules store the private keys and never connect to the internet, across geographically distributed secured facilities, and role-based governance protocols control access. Gemini’s custody page states, as of 1 March 2024, 125 million dollars of digital asset insurance for certain types of losses, made up of 25 million dollars of commercial crime insurance covering hot wallet assets and 100 million dollars of cold storage cover. A minimum monthly fee of 30 dollars per asset applies. Watch-out. That cover answers to certain loss types only, and the page carries a 2024 date, so ask for the current position.
Copper
Copper Technologies (UK) Limited owns two market entities with different regulatory status. Copper Markets (US), Inc. registered with the SEC as a broker-dealer and belongs to FINRA and to SIPC. Copper Markets (Switzerland) AG holds no SEC or FINRA registration. ClearLoop carries the off-exchange settlement product, and Copper publishes 3 billion dollars of monthly off-exchange settlements routed through it. The site displays SOC 2 and ISO certifications. Watch-out. The two entities answer to different rules, so establish which one faces your desk and what that means for your own reporting.
Komainu
Komainu operates through multiple regulated entities and names Komainu MEA FZE among them. The company puts security, compliance and governance first in its own description of itself. Komainu CORE unlocks digital collateral capability, and Komainu Connect covers trading, borrowing and lending. The company also offers custody, tokenisation and staking, and it directs licensing questions to its contact page. Watch-out. The public site names no regulator and publishes no insurance detail, so request the register entries and the policy documents during diligence.
Zodia Custody
Zodia Custody provides digital asset custody built for institutions, and it holds SOC 1 and ISO 27001 certification. The company describes bank-grade compliance with 24×7 cold storage availability and zero central points of compromise. Interchange lets a client trade from cold storage and settle off-venue, and the site names 24/7 instant settlements alongside custody, staking and tokenisation. Watch-out. The homepage links a licences and authorisations page and a separate insurance disclosure without naming either regulator or policy up front, so read both documents.
Sygnum
Sygnum Bank AG is a regulated bank, and FINMA supervises it from Zurich. The group also runs Sygnum Pte. Ltd. in Singapore and Sygnum Bank Middle East in Abu Dhabi. Sygnum stores a wide range of digital assets under bank-grade multi-level custody and keeps instant access to them. Sygnum Protect holds collateral off-exchange while a client trades on major crypto exchanges, and Sygnum Connect settles fiat, crypto assets and stablecoins around the clock across a multi-asset network. Watch-out. A Swiss banking licence answers a Swiss question, so an EU-domiciled fund should still ask how Sygnum reaches it under MiCA.
Hex Trust
Hex Trust provides regulated institutional digital asset markets services, custody and staking, and it states licences and registrations across Dubai, Hong Kong and Singapore. Institutional Staking and Validator-as-a-Service cover the staking side. Markets services include OTC execution and fiat ramping, and the company works with partners on custody settlement. The footer links an Insurance Coverage Framework. Watch-out. The site names the jurisdictions without naming the licensed entity in each one, so ask which entity holds which licence and which of them holds your assets.
Fireblocks
Fireblocks provides technology, and the client keeps control. Its distributed wallet infrastructure spreads key shares across environments, so no single private key compromise takes down the wallet, and programmable policies decide exactly how assets move. Fireblocks names MPC key management as the core of the security stack, because MPC removes single points of failure in key storage and in transaction signing. The company publishes a SOC 2 Type 2 certification with zero material findings, ISO 27001 and related certifications, and C4 CCSS QSP Level 3 status, and a security operations centre monitors threats around the clock. Watch-out. Technology brings no charter and no fiduciary duty, so an SEC-registered adviser pairs it with a qualified custodian.
Ten questions to send a custodian
Send these as written. A custodian that answers all ten in writing has already told you most of what diligence needs to know.
- Which legal entity holds my assets, and where do I find it on a public register? Ask for the entity name, the licence type and the register reference. Several providers on this list run separately regulated entities under one brand.
- Do I hold legal title, and what happens to my assets if you enter insolvency? Ask for the legal opinion. BNY names bankruptcy stay protection for exactly this reason, and NYDFS updated its insolvency guidance in September 2025.
- How do you segregate my assets from your own and from other clients? An EU provider answers to MiCA Article 70, which requires client crypto-assets to stay unencumbered and segregated at all times. Ask whether segregation runs at omnibus, client or sub-account level.
- Who signs a transaction, and how do you recover a key? Ask for the key ceremony, the number of participants, the recovery procedure and the date you last tested it.
- Which attestations do you hold, and may I read the report? SOC 1 Type II, SOC 2 Type II and ISO 27001 appear across this group. Ask for the auditor name and the report period.
- What does your insurance cover, up to what limit, and which perils sit outside it? Gemini publishes a split between hot wallet and cold storage cover, which shows the shape of the question. Most providers on this list publish nothing.
- Which assets and networks do you support, and how long does a new asset take? Coinbase publishes an asset count. Ask for the onboarding timeline, because a delisting or a new chain moves your operations.
- Can I trade without moving assets out of custody? Fidelity, Zodia, Copper, Sygnum and Anchorage each name a product for this. The answer decides how much transfer risk you carry every day.
- What do your statements and your API deliver? Ask for a sample statement at the level you reconcile, and ask whether an endpoint returns the same ledger your auditor will see.
- How do I leave? Ask about notice, migration support, the cost of a full transfer out, and who signs it off on your side.
What institutional custody costs
Every provider in this group quotes per client, so a published price list does not exist. The shape of the quote stays consistent, and a buyer who knows the components negotiates better.
- A fee on assets under custody, charged in basis points and tiered by volume. This line usually carries the most weight.
- Per transaction or per ticket fees, applied to deposits, withdrawals, internal movements and trades.
- Network fees, passed through on every on-chain withdrawal.
- A minimum, set as a monthly or annual floor, or as a minimum holding. Gemini publishes a minimum monthly fee of 30 dollars per asset, which shows how a per-asset minimum adds up across a wide portfolio.
- Onboarding and integration, charged once, sometimes waived at scale.
- Insurance above the base sub-limit, priced separately when a provider offers extra cover.
Ask for the quote broken into those six lines. A provider that gives one blended number has hidden the line that grows fastest with your volume.
Red flags and common mistakes
- An insurance headline read as per-client cover. A policy limit sits across the whole book. Gemini states its cover applies to certain types of losses, and that qualifier does real work.
- The word regulated with no register entry behind it. Several sites in this group name jurisdictions without naming the licensed entity. Ask for the entity and check the register yourself.
- Treating a trading venue account as custody. Holdings on a venue give you a claim on that venue, which behaves differently in a stress event.
- No tested recovery. A recovery procedure that nobody has run is a document, not a control.
- Buying software and reporting it as custody. A technology provider gives no charter and no fiduciary duty, and an SEC-registered adviser still needs a qualified custodian.
- One provider, no alternative. Onboarding a second custodian takes months, so start before you need it.
Frequently asked questions
What is a qualified custodian in crypto?
The SEC custody rule for registered investment advisers, Advisers Act Rule 206(4)-2, points at a defined set of institutions, and the SEC’s compliance guide names a bank, a broker-dealer or a futures commission merchant. Coinbase Custody and Gemini both describe themselves as qualified custodians under New York Banking Law.
Does my fund need a qualified custodian?
An SEC-registered investment adviser with custody of client assets falls inside Rule 206(4)-2, which brings quarterly statements sent directly to clients, an annual surprise examination by an independent public accountant, and audits of pooled vehicles. Ask your counsel how the rule reaches your structure.
Is MPC more secure than multisig?
MPC splits a key into shares and signs without ever assembling the whole key, which removes single points of failure in storage and in signing, as Fireblocks describes it. Multisig requires several separate keys to approve. Both work, and the operating model around them decides the outcome.
Can I trade without moving assets out of custody?
Yes, with several providers. Fidelity executes across venues without moving assets from cold storage, Zodia Interchange trades from cold storage and settles off-venue, Copper routes settlement through ClearLoop, and Sygnum Protect keeps collateral off-exchange during trading.
What does MiCA authorisation give me?
MiCA Article 21 lists custody and administration of crypto-assets as an authorised service. Article 70 requires the provider to keep client crypto-assets unencumbered and segregated at all times. Article 75 makes the provider liable for losses from incidents such as cyber-attack or theft, subject to a narrow external-event defence.
How much does institutional crypto custody cost?
Providers in this group quote per client and tier by volume, so no list price exists. Expect a basis point fee on assets under custody, per transaction charges, network fees, a minimum, and onboarding costs. Ask for the quote split into those lines.
Does custody insurance cover a hack?
It depends on the policy, and most providers publish nothing. Gemini states, as of 1 March 2024, 125 million dollars of cover for certain types of losses, split between hot wallet and cold storage. Anchorage states that no FDIC, SIPC or SDIC protection applies to custodied assets.
Can a custody provider support per-end-user segregation?
Some can. CEX.IO Prime documents sub-accounts that separate activity by a client’s own users, with a deposit address method and a consolidated statement method per account. Ask any provider for a sample per-user statement before you build on it.
Choosing between them
Start with the model, because the model decides which questions even apply. A fund inside the SEC custody rule needs a licensed custodian and should read the entity disclosures closely, since several brands here run entities with different status. A platform holding assets for its own customers needs per-user segregation and per-user statements, and should test both before it signs. A desk that trades what it holds should price the transfer risk it removes by keeping custody and execution in one place.
⚠ This article provides information only and does not constitute financial advice. Every regulatory and product statement above comes from the source named beside it and reflects what that source published as of September 2026. Positions change, so confirm the current position with the provider and the relevant register before you transact.