- An institutional crypto custody provider safekeeps the private keys that control a client’s digital assets and runs the controls around every movement.
- Custody is a legal question before it is a technical one, because whoever can sign a transaction controls the assets.
- The market holds three different models, and a provider from one model cannot substitute for a provider from another.
- “Qualified custodian” is a specific legal status in the United States, so check the entity name and the regulator before you accept the phrase.
- Insurance cover carries conditions. BitGo publishes cover of up to 250 million dollars and states that it applies where BitGo holds all of the keys.
- CEX.IO publishes this guide, so we list CEX.IO Prime first and describe it in the same terms we apply to everyone else.
What an institutional crypto custody provider is
An institutional crypto custody provider is a company that safekeeps the private keys controlling digital assets for funds, brokers, corporates, payment firms and other regulated clients. On a blockchain, whoever signs a transaction moves the asset. The provider takes responsibility for that signing authority and for the record of every movement.
Retail custody ends at storage. Institutional custody adds the parts an auditor, a regulator and a board ask about. The provider separates client assets from its own, records each credit and each withdrawal against a named account, and puts approval rules between an instruction and a transfer. Clients read that record back in statements, so their own accounting and audit systems reconcile against one source.
The category grew because institutions could not use retail tools for institutional obligations. A fund cannot tell its administrator that a private key sits on one person’s laptop. A payment firm cannot tell its regulator that client crypto and company crypto share a wallet. Custody providers exist to answer those two questions in writing.
What custody covers and what it does not
A custody provider holds keys, segregates client assets and controls movements. Some providers also run execution, settlement, staking or financing next to custody. Others deliberately hold only the keys and connect to a separate venue for everything else. Both approaches work, and the difference decides how many counterparties your operations team reconciles at the end of the month.
Why institutions use a custody provider
Regulatory obligation. Many regulated clients hold a duty to keep client assets with a third party. A fund manager, an RIA or a payment institution answers to a rulebook that names custody directly.
Separation from operational funds. A provider records client assets apart from its own, so a client identifies its holding at any moment and an administrator verifies it independently.
Removal of single points of failure. MPC and multi-signature architectures split signing authority across shares or keys, so one lost device and one compromised person cannot move funds.
Audit evidence. Institutions need SOC reports, statements and an approval log. Building that evidence in house costs more than buying it.
Operational controls. Whitelists, approval quorums and role-based access let a firm apply its own separation of duties to crypto the way it already applies it to cash.
Insurance and capital. Some providers hold trust charters with capital requirements and publish insurance cover, which gives a board something concrete to review.
Three custody models you will meet
Providers in this market run three different models. They look similar on a marketing page and behave differently in a contract, so identify the model first and compare inside it.
A qualified custodian holds a trust charter or a bank charter and takes legal responsibility for client assets. In the United States, the phrase points at a specific status under the Investment Advisers Act of 1940 and at entities chartered by a state regulator or by the Office of the Comptroller of the Currency. Coinbase Custody Trust Company, BitGo Bank and Trust, Fireblocks Trust Company and Anchorage Digital Bank all sit here.
A custody technology provider sells the software and the key management, and the institution keeps control of its own keys. Fireblocks built its platform this way. The institution holds the authority and carries the operational duty that comes with it.
Custody inside a prime account holds client crypto on the same account that carries execution, settlement and reporting. CEX.IO Prime works this way. The client gets segregation per sub-account and one counterparty across custody and trading, and the arrangement does not carry a qualified custodian status.
| Model | Who controls the keys | What you get |
|---|---|---|
| Qualified custodian | The custodian, under a charter and a fiduciary duty | Legal responsibility, a regulator, often insurance and SOC reports |
| Custody technology | Your institution | Control and speed, plus the operational duty that follows |
| Custody in a prime account | The platform, segregated per sub-account | Custody, execution and settlement on one account and one ledger |
A firm that needs a qualified custodian for a regulatory reason cannot solve that need with technology, because software does not carry a charter. A firm that wants to trade from its own holdings all day gains little from a vault that sits away from execution. Decide the model, then read the shortlist.
How we compared the providers
We checked five items for each provider and took every one from an official source. We read the legal entity name and the regulator that supervises it. We read the key management the provider publishes. We read the insurance wording, including the conditions. We read the audit reports the provider names. We read what the provider says about segregating client assets.
We left out anything a provider did not publish. Where a provider publishes no insurance cover, the table says so, because an empty cell tells you more than a hedge.
CEX.IO publishes this guide. We list CEX.IO Prime first and we apply the same five checks to it, including the places where it holds no status that another provider holds.
Best institutional crypto custody providers in 2026
| Provider | Model | Regulated entity | Key management | Insurance published | Best for |
|---|---|---|---|---|---|
| CEX.IO Prime | Custody in a prime account | CEX.IO operates under licences and registrations across several jurisdictions | MPC, hot and cold storage | Not published | Brokers, payment firms, fintechs and funds that hold for their own users and trade from the same account |
| Coinbase Prime Custody | Qualified custodian | Coinbase Custody Trust Company, LLC, a New York state-chartered limited purpose trust company supervised by NYDFS | Cold storage, key generation developed in house | Coinbase publishes insurance on assets in storage without a public figure | United States managers, funds and ETP service providers |
| BitGo | Qualified custodian | BitGo Bank and Trust, National Association, a national trust bank chartered by the OCC | Multi-signature and MPC, offline cold storage, segregated and bankruptcy remote | Up to 250 million dollars where BitGo holds all of the keys, through a Lloyd’s of London syndicate | Institutions that want insurance cover stated as a number |
| Fireblocks | Custody technology, plus a trust company | Fireblocks Trust Company, LLC, a limited purpose trust chartered by NYDFS in August 2024 | MPC key management, cold storage with offline signing on air-gapped devices | Not published as a figure on the trust company page | Trading firms and fintechs that want to run their own keys and connect to a network |
| Anchorage Digital | Qualified custodian | Anchorage Digital Bank, National Association, holder of an OCC national trust charter since January 2021 | Hardware security modules and secure enclaves | Not published as a figure | United States regulated institutions that need a federal charter |
CEX.IO Prime
CEX.IO Prime holds client crypto on institutional custody with multi-party computation across hot and cold storage, and it runs that custody inside the same account that carries liquidity, settlement, payments and financing. CEX.IO has operated a crypto exchange since 2013 and reports more than 1,000 institutional clients, including funds, brokers, exchanges, payment institutions, banks, OTC desks, treasury and trading firms.
The part that separates Prime from the rest of this list is the sub-account. A client creates a sub-account per end user, per mandate or per business line through the API or the interface, and Prime issues each sub-account its own deposit addresses for every asset and network. Incoming crypto reaches the right holding automatically, so a broker attributes an end user deposit without matching it by hand. Holdings stay segregated per sub-account, and internal transfers between sub-accounts settle instantly and cost nothing.
Withdrawals run under a mandatory whitelist and an approval workflow the client configures. Every operation posts to one internal ledger with consistent identifiers, and clients pull account-level and sub-account-level statements through the interface or the API to feed their own accounting systems. Prime covers 500+ assets, including BTC, ETH and stablecoins, with settlement across 60+ networks on Layer 1 and Layer 2. Fiat settles in USD, EUR and GBP over SEPA, SEPA Instant, Faster Payments and SWIFT.
Prime holds no qualified custodian status, so a firm that carries a regulatory duty naming a qualified custodian needs a provider from that group. A firm that holds crypto for its own customers and trades from those holdings gains the most here, because custody and execution share one account, one ledger and one report.
Best for brokers, payment firms, fintechs, asset managers and treasury teams that hold assets for their own users and want custody next to execution.
Coinbase Prime Custody
Coinbase runs custody through Coinbase Custody Trust Company, LLC, a New York state-chartered limited purpose trust company supervised by the New York Department of Financial Services. Coinbase states that the entity acts as a fiduciary under New York state banking law and as a qualified custodian under the Investment Advisers Act of 1940. Deloitte and Touche audits the company against SOC 1 Type II and SOC 2 Type II.
Coinbase built its key generation and cold storage in house and reports more than twelve years of that development. Clients reach 470+ assets today according to the Coinbase Prime custody page. Coinbase sells custody on its own through Coinbase Prime Custody Only, and it sells custody together with trading and financing in the full Prime product.
Best for United States managers, funds and ETP service providers that want a named qualified custodian with long audit history.
BitGo
BitGo has run digital asset custody since 2013 and pioneered multi-signature wallet architecture for institutions. The Office of the Comptroller of the Currency approved BitGo’s conversion to a federally chartered national trust bank, and custody now sits in BitGo Bank and Trust, National Association. BitGo also runs BitGo New York Trust Company, LLC under NYDFS and BitGo Europe ApS registered with the Danish Financial Supervisory Authority.
BitGo publishes the clearest insurance wording in this group. The policy covers up to 250 million dollars on digital assets where BitGo Bank and Trust holds all of the keys, underwritten by a syndicate in the Lloyd’s of London and European marketplace. BitGo states that the cover does not extend to hot wallets or to self-managed custody, because BitGo does not hold sole control of those keys. Read that sentence twice before you compare insurance across providers. BitGo also holds SOC 1 Type 2 and SOC 2 reports and structures custodial wallets as segregated and bankruptcy remote.
Best for institutions that want a charter, a stated insurance figure and the conditions attached to it in writing.
Fireblocks
Fireblocks sells two things, and a buyer needs to separate them at contract stage. The Fireblocks platform provides MPC-based wallet and transaction infrastructure that an institution operates under its own control. Fireblocks Trust Company, LLC is a separate entity that provides regulated custody, and NYDFS lists it with a limited purpose trust charter dated August 2024.
The trust company secures assets with MPC key management and cold storage that signs transactions offline, with key material on air-gapped devices. Fireblocks states that client assets stay fully segregated on an insolvency remote basis. Fireblocks publishes SOC 2 Type II along with ISO 27001 and related certifications. The platform carries integrated KYC, AML, OFAC and Travel Rule screening, and a policy engine drives automated approvals.
Fireblocks earns its place through network connectivity, because the platform links wallets, exchanges, counterparties and liquidity venues. A firm that wants to hold its own keys and move fast across venues finds the fit here. A firm that needs a custodian to carry legal responsibility contracts with the trust company specifically and says so in the agreement.
Best for trading firms, funds and fintechs that run their own keys and need broad venue connectivity.
Anchorage Digital
Anchorage Digital Bank, National Association holds an OCC national trust charter granted in January 2021, which made it the first federally chartered crypto bank in the United States. That charter gives Anchorage the clearest federal regulatory position in this market, and the OCC examines the bank the way it examines other national trust banks.
Anchorage builds custody on hardware security modules and secure enclaves, and it holds SOC 1 and SOC 2 Type II reports. The platform runs policy-driven transaction flows with biometric approvals, and it supports staking and governance from custody. Anchorage also expanded into Asia with licensing from the Monetary Authority of Singapore.
Anchorage onboards selectively and its integration timeline often runs longer than a platform that sells software. Institutions that need federal oversight accept that timeline for the regulatory position it buys.
Best for United States regulated institutions such as funds, advisers and insurers that need a federally chartered custodian.
How to check a provider before you sign
1. Name the entity. Ask which legal entity signs the custody agreement and which regulator supervises it. Brand names cover several entities with different statuses.
2. Check the register. Look the entity up in the regulator’s own register. NYDFS publishes its virtual currency businesses, and the OCC publishes its charters. A licence page on a vendor site proves nothing on its own.
3. Read the key architecture. Ask whether the provider uses MPC, multi-signature or HSM, and ask who holds the shares. Then ask what happens when one share goes offline.
4. Read the insurance conditions. Get the cover, the insurer, the limits and the exclusions in writing. Cover that applies only where the custodian holds every key behaves differently from cover you assumed applied everywhere.
5. Ask for the audit reports. Request SOC 1 and SOC 2 Type II reports under NDA. A provider that names a certification without producing the report has not answered you.
6. Test the controls. Run a sandbox withdrawal against your own whitelist and approval policy before you fund the account. Controls read well on a page and behave differently in a workflow.
What to put in the contract
Three items decide how a custody relationship behaves when something goes wrong, and all three live in the agreement.
Segregation and insolvency. The contract states how the provider segregates your assets and what happens to them if the provider fails. Ask for the words “segregated” and “bankruptcy remote” or their legal equivalents, and ask which jurisdiction governs the outcome.
Movement authority. The contract names who instructs a transfer, who approves it and what the provider does when an instruction arrives outside that policy. Match this to your own separation of duties before you sign.
Reporting and exit. The contract sets what statements you receive and how often, and it sets how you move assets out and how long that takes. Read the exit clause at the start of the relationship, because nobody reads it calmly at the end.
FAQ
What is an institutional crypto custody provider? An institutional crypto custody provider is a company that safekeeps the private keys controlling digital assets for funds, brokers, corporates and other regulated clients, and runs the controls around every movement. The provider separates client assets from its own, records each movement against a named account, and applies approval rules before funds leave.
What is the difference between institutional custody and self-custody? In self-custody your institution holds the keys and carries the whole operational duty, including key generation, backup, signing and recovery. In institutional custody a provider holds the keys under an agreement and takes responsibility defined in that agreement. Some providers sell technology that lets you keep control of your own keys while using their infrastructure, which sits between the two.
What does “qualified custodian” mean? “Qualified custodian” is a legal status in the United States under the Investment Advisers Act of 1940. It points at banks, trust companies and other named entity types, so a provider claims it through a specific chartered entity. Coinbase Custody Trust Company holds a New York trust charter, and BitGo Bank and Trust and Anchorage Digital Bank hold OCC charters. Ask which entity carries the status and read the register before you accept the phrase.
Is MPC more secure than multi-signature? Both remove the single point of failure that one private key creates. MPC splits key material into shares and signs across them without ever assembling the whole key. Multi-signature uses several complete keys and requires a set number of signatures. Providers use both, and some use both together. Compare the operating model and the recovery process, because the label on its own tells you little.
Does insurance cover everything a custodian holds? No. Cover carries conditions, and the conditions decide its value. BitGo publishes cover of up to 250 million dollars and states that it applies to assets where BitGo holds all of the keys, and it states that hot wallets and self-managed custody fall outside. Ask every provider for the insurer, the cover, the limits and the exclusions in writing.
How do I choose a crypto custody provider? Start with the model. Decide whether a regulatory duty requires a qualified custodian, whether your team wants to hold its own keys, or whether you want custody next to execution on one account. Then compare inside that model on entity and regulator, key management, segregation, audit reports, insurance conditions, asset coverage and controls. Finish with a sandbox test of your own withdrawal policy.
Can a custody provider also execute my trades? Some can. Coinbase sells custody alone or together with trading in Coinbase Prime. CEX.IO Prime runs custody on the same account as aggregated liquidity, settlement, payments and financing, so holdings execute and settle without moving to another venue. Providers that sell custody alone connect to a separate execution venue, which adds a second counterparty and a reconciliation between the two.