What "Institutional-Grade Custody" Actually Means in Crypto
In This Article
Introduction
"Institutional-grade custody" appears on nearly every crypto platform's website, and it has no legal definition. No regulator certifies it and no law defines it, so any company can print it. What it's supposed to describe is real, though: a specific set of legal, technical and operational protections that decide whether your crypto survives if the company holding it gets hacked, goes bankrupt, or has one bad employee.
The topic is suddenly practical. On September 16, 2026, Deutsche Bank said it plans to launch crypto custody for European institutional and corporate clients later this year, pending approval from Germany's regulator, BaFin. In the US, the SEC sent a new crypto custody rule for investment advisers and broker-dealers to the White House for review on August 25, and expects to publish the proposal by October. And on September 24, Bitget lost $387.5 million from its hot and warm wallets in the year's largest hack.
Here's what the phrase should mean, how to check whether it does, and what it still doesn't protect you from.
The Five Things That Actually Make Custody "Institutional-Grade"
1. Your assets are legally yours, not the custodian's
This is the most important one, and it has nothing to do with technology. Real custody keeps client assets segregated: held off the custodian's own balance sheet, often in trust, in accounts that are identifiable as belonging to each client. If the custodian goes bankrupt, segregated assets aren't part of what its creditors can claim.
This is exactly where retail crypto has failed before. When Celsius collapsed, a US bankruptcy court ruled in January 2023 that assets in its Earn accounts belonged to Celsius, because its terms of use said so. Customers became unsecured creditors of their own coins. FTX went further and mixed customer money with its own trading firm's. Neither company had a hacker problem first. They had a whose-assets-are-these problem.
2. No single key and no single person can move funds
A crypto asset is controlled by whoever holds its private key. Serious custody makes sure that is never one key or one person:
- Most assets stay in cold storage, with keys generated and kept offline, often inside hardware security modules (HSMs), tamper-resistant devices built so a key can be used but never extracted.
- Moving funds needs a quorum. Either multisig (several separate keys must sign, such as 3 of 5) or MPC (multi-party computation, where one key is split into shares held by different parties and never exists whole in one place). Either way, one stolen laptop or one rogue employee isn't enough.
- A small hot wallet covers day-to-day withdrawals, deliberately sized so its loss is survivable.
Deutsche Bank's announced design has all three: hardware-based key protection, multi-person approvals, and separate warm and cold environments.
3. Controls around the keys, not just the keys
The Bitget hack is the clearest lesson here. Attackers never stole a key. They broke into a backend system and fed Bitget's own approval process spoofed transaction data, so it signed withdrawals that looked routine. Keys only protect you if the process deciding what gets signed is also locked down. Look for:
- withdrawal address allow-lists, so funds can only go to pre-approved destinations
- time delays on large or unusual transfers, giving humans a window to stop them
- separation of duties, so the person who requests a transfer can't also approve it
- independent monitoring that can halt activity
4. Someone independent checks, repeatedly
A company saying it's secure is marketing. An independent check is evidence. The two most useful kinds:
- A SOC 2 Type II report. An audit firm tests whether the custodian's controls actually worked over a period of months, not just whether they exist on paper.
- Audited financial statements that show liabilities as well as assets. "Proof of reserves" is useful but narrower: it shows assets held at one moment, and unless it's paired with a check of liabilities, it doesn't prove those assets cover what's owed.
5. A regulator can hold it accountable
This is where "institutional-grade" becomes a legal term. US investment advisers who hold client assets must use a qualified custodian under the SEC's custody rule (Rule 206(4)-2). That means a bank, a registered broker-dealer, certain futures firms, or a qualifying foreign institution, many of them state- or nationally-chartered trust companies. A charter brings capital requirements, examinations, and a supervisor who can step in. The SEC's upcoming proposal is expected to clarify exactly how that applies to crypto.
Why Banks Are Arriving Now
For years, US banks had a strong reason to stay out. An SEC accounting rule, SAB 121, made them record client crypto as a liability on their own balance sheets and hold capital against it, which made custody uneconomic. The SEC rescinded it in January 2025. Two months later, the US bank regulator (the OCC) confirmed that national banks can offer crypto custody without asking permission first.
Since then, BNY, the world's largest custodian, has expanded the crypto it holds for ETF issuers, and State Street has launched a digital asset platform. Deutsche Bank is the first major European bank to commit to holding clients' keys at this scale. The pattern is clear: the firms that already hold trillions in stocks and bonds are building the same thing for crypto.
What It Still Doesn't Protect You From
- Price risk. Custody protects possession, not value. Perfectly custodied bitcoin can still fall 50%.
- Insurance gaps. Custodian insurance typically covers specific events, such as theft from certain storage, up to limits often far below total assets held. Read what's actually covered before relying on the word "insured."
- Exchange balances. Most people don't hold crypto with a custodian at all. They hold it on an exchange, which is a trading venue with custody attached, and standards vary widely. Bitget's customers were made whole because it had a $464 million protection fund. That was a choice Bitget made, not a legal requirement. (See our Bitget hack breakdown.)
- Your own mistakes. If you self-custody, all five layers above become your job. The Coldcard firmware flaw showed even good tools can fail, and a lost seed phrase has no support line.
How an Individual Actually Gets Institutional-Grade Custody
You don't need to be an institution. The most common route is a spot ETF: the fund's coins sit with a qualified custodian, and you hold shares in a regular brokerage account, protected by the same rules as your stocks. The trade-off is that you own shares in a fund, not the coins themselves, and you can't move them on-chain.
If you use an exchange, ask it these five questions. A good one will answer publicly:
1. Are customer assets segregated and held in trust, or are they part of your balance sheet?
2. What share of customer assets is in cold storage?
3. How many people or keys does it take to move funds from cold storage?
4. Do you publish a SOC 2 Type II report and audited financial statements?
5. Which regulator supervises your custody, and under what charter or license?
For the basics of wallet types, see understanding crypto wallets.
Frequently Asked Questions
Q: What does institutional-grade custody mean in crypto?
A: It describes custody with five protections: client assets legally segregated from the custodian's own, keys held mostly in cold storage with multi-person or multi-key approval, strict controls over what gets signed, independent audits such as SOC 2 Type II, and oversight by a regulator. "Institutional-grade" itself is a marketing term with no legal definition.
Q: What is a qualified custodian?
A: Under the SEC's custody rule (Rule 206(4)-2), it's the type of firm US investment advisers must use to hold client assets: a bank or savings association, a registered broker-dealer, certain futures commission merchants, or a qualifying foreign financial institution. The SEC is preparing a proposal, expected by October 2026, to clarify how this applies to crypto.
Q: What's the difference between multisig and MPC?
A: Both stop one person or one key from moving funds. Multisig requires several separate keys to sign a transaction, such as 3 of 5. MPC splits a single key into shares held by different parties so the full key never exists in one place.
Q: Is crypto held by a custodian insured?
A: Sometimes, and partially. Custodian insurance usually covers specific events, such as theft from certain storage, up to limits often well below total assets held. It doesn't cover price drops, and crypto isn't covered by FDIC or SIPC protection the way bank deposits or brokerage cash can be.
Q: Is keeping crypto on an exchange the same as institutional custody?
A: Not necessarily. An exchange is a trading venue that also holds assets, and its practices vary. Some use qualified custodians and segregated accounts. Others hold customer assets on their own balance sheet, which is how Celsius customers became unsecured creditors in 2023.
Q: Why are banks like Deutsche Bank and BNY entering crypto custody now?
A: The biggest US obstacle, the SEC accounting rule SAB 121, was rescinded in January 2025, and the OCC confirmed in March 2025 that national banks can offer crypto custody without prior approval. Deutsche Bank announced its European custody plans on September 16, 2026, pending approval from BaFin.
Q: How can an individual get institutional-grade custody?
A: The simplest route is a spot crypto ETF held in a brokerage account, where the underlying coins are held by a qualified custodian. The trade-off is that you own fund shares, not the coins, and can't move them on-chain.
The Bottom Line
"Institutional-grade custody" is a claim you can check. Strip away the phrase and ask five things: are the assets legally yours, can any single person move them, what controls decide what gets signed, who independently checks, and which regulator can step in. The biggest crypto losses of recent years, Celsius, FTX and now Bitget, each failed at least one of those. Celsius and FTX failed the first, and Bitget the third. As the SEC finalizes its custody rule and banks like Deutsche Bank and BNY build this out, the answers are getting easier to find. Make sure whoever holds your crypto can give them.
This content was created with AI assistance and may contain errors, always verify before acting. Not financial advice. Always do your own research before making any investment decisions.
Frequently Asked Questions
What does institutional-grade custody mean in crypto?
It describes custody with five protections: client assets legally segregated from the custodian's own, keys held mostly in cold storage with multi-person or multi-key approval, strict controls over what gets signed, independent audits such as SOC 2 Type II, and oversight by a regulator. "Institutional-grade" itself is a marketing term with no legal definition.
What is a qualified custodian?
Under the SEC's custody rule (Rule 206(4)-2), it's the type of firm US investment advisers must use to hold client assets: a bank or savings association, a registered broker-dealer, certain futures commission merchants, or a qualifying foreign financial institution. The SEC is preparing a proposal, expected by October 2026, to clarify how this applies to crypto.
What's the difference between multisig and MPC?
Both stop one person or one key from moving funds. Multisig requires several separate keys to sign a transaction, such as 3 of 5. MPC splits a single key into shares held by different parties so the full key never exists in one place.
Is crypto held by a custodian insured?
Sometimes, and partially. Custodian insurance usually covers specific events, such as theft from certain storage, up to limits often well below total assets held. It doesn't cover price drops, and crypto isn't covered by FDIC or SIPC protection the way bank deposits or brokerage cash can be.
Is keeping crypto on an exchange the same as institutional custody?
Not necessarily. An exchange is a trading venue that also holds assets, and its practices vary. Some use qualified custodians and segregated accounts. Others hold customer assets on their own balance sheet, which is how Celsius customers became unsecured creditors in 2023.
Why are banks like Deutsche Bank and BNY entering crypto custody now?
The biggest US obstacle, the SEC accounting rule SAB 121, was rescinded in January 2025, and the OCC confirmed in March 2025 that national banks can offer crypto custody without prior approval. Deutsche Bank announced its European custody plans on September 16, 2026, pending approval from BaFin.
How can an individual get institutional-grade custody?
The simplest route is a spot crypto ETF held in a brokerage account, where the underlying coins are held by a qualified custodian. The trade-off is that you own fund shares, not the coins, and can't move them on-chain.
Get daily intelligence on the coins you track
Personalized AI briefings built from the sources you choose. Starting at $5.99/month.
Start with Crypto Flo