Institutions should treat custody as a governance and risk decision, not just an execution choice. The core questions are whether client assets are clearly segregated, whether the custody model supports bankruptcy protection, and whether operational controls reduce commingling risk. Teams should also verify oversight, contractual protections, and how assets are ring-fenced if the provider fails.
What makes custody and protection controls a governance decision?
Institutional custody is not just about where assets sit, it is about who can move them, under what conditions, and what happens if the provider fails. The evaluation should start with control design, not product branding: segregation, legal ring-fencing, operational oversight, and how commingling risk is prevented in normal operations and in distress.
That means the due diligence question is whether the custody model preserves client ownership under stress, supports clear asset segregation, and limits operational paths that could blur client and firm assets. Institutions should treat the custody provider as a critical control environment, not a passive storage venue.
Where the custody decision is tied to broader market-entry controls, MiCA and DORA for Crypto-Asset Service Providers Guide is useful for understanding how custody duties, ICT resilience, and failure handling fit together in practice.
Which custody controls deserve the closest review?
The highest-value checks are the ones that reveal whether the institution can actually isolate client assets and prove that it can operate safely under failure conditions. That includes segregation of accounts and wallets, authority boundaries for transfers, approvals for exception handling, reconciliation discipline, and whether operational procedures match the legal promises in the contract.
Providers should be able to show how assets are ring-fenced, how keys or signing authority are controlled, and how access is limited to the smallest practical set of roles and systems. If the model depends on informal process discipline, it is weaker than it looks on paper.
For operational assurance around storage, key handling, and wallet design, the CryptoCurrency Security Standard Guide and MPC Wallet and Threshold Signing Security Guide give practical coverage of custody controls that affect segregation, authorisation, and recovery.
How should institutions test failure, exit, and recovery assumptions?
A custody model is only as strong as its failure handling. Institutions should examine what happens if the provider becomes insolvent, loses operational capability, or cannot complete transfers during a market event. The key test is whether client assets remain recoverable, whether records are sufficient to prove entitlement, and whether alternate control paths exist without creating hidden commingling or administrative confusion.
It is also important to assess transition and exit realism, because a contract that sounds protective may still leave the institution dependent on fragile operational handovers, unclear sign-off rules, or slow legal processes. The best custody arrangements make separation and recovery understandable before a crisis, not after one.
Control design should also be checked against key compromise and wallet-operation risk, which is why Crypto Exchange Identity and Key Security Guide and Crypto Wallet Security Guide are relevant when evaluating how signing authority, recovery, and custody boundaries behave in stress conditions.
Risk and Threat Considerations
Custody risk is concentrated where legal ownership, operational control, and transaction authority do not line up cleanly. The main exposure is that client assets can become hard to distinguish from firm assets, especially if reconciliation is weak or if the provider’s operating model allows broad internal access to wallets, records, or transfer processes.
Failure mechanism: Commingling, weak segregation, or poorly designed signing and transfer controls can leave client assets exposed during provider distress, internal error, or insolvency proceedings.
Impact: Institutions may face loss of recoverability, delayed asset return, disputed entitlement, or reduced ability to demonstrate that client property was protected as intended.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CSA Cloud Controls Matrix and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Custody controls depend on tightly limiting transfer and admin authority. |
| IA-5 — Authenticator Management | Custody operations rely on protecting and rotating keys, tokens, and other authenticators. | |
| Recommendation — Restrict wallet, reconciliation, and exception access to the minimum necessary roles. Manage custody credentials with defined issuance, rotation, revocation, and storage rules. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Custody governance hinges on controlled access to assets, records, and signing processes. |
| Recommendation — Define and enforce who can access and move client assets and custody records. | ||
| CSA Cloud Controls Matrix | IAM — Identity & Access Management | Cloud custody models need disciplined identity and privilege control around signing and operations. |
| Recommendation — Map custody roles, approvals, and privileged paths to controlled identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | Custody risk rises when operational accounts and signing access are not governed tightly. |
| Recommendation — Inventory and review all accounts that can affect custody operations or transfers. | ||
Practitioner Guidance
What to verify: Confirm that legal terms, operational procedures, and technical controls all describe the same custody model. If any one of them is vague on segregation, transfer authority, or failure handling, treat that as a material control gap rather than a documentation issue.
Decision rule: If the provider cannot explain how client assets are ring-fenced under insolvency or operational failure, do not treat the custody model as ready for institutional use, even if day-to-day operations appear stable.
Practitioner takeaway: The right custody question is not whether assets can be held, but whether they can be proven to remain client assets when the provider, the market, or the control environment stops behaving normally.
Related resources from NHI Mgmt Group
- How should institutional investors evaluate custody and compliance controls before entering DeFi?
- How should financial institutions evaluate custody models when moving from physical assets to digital assets in crypto markets?
- How should financial institutions evaluate identity verification controls for e-KYC onboarding in regulated markets?
- How should institutions evaluate self-custody before moving more assets out of centralized exchanges?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org