Institutions entering the digital asset market face a question that goes far beyond simply deciding whether to buy Bitcoin or another cryptocurrency. They also need to determine who will control the private keys, who is authorised to approve transfers and what happens if the people, systems or service providers responsible for custody suddenly become unavailable.
These questions become even more important when an institution decides to use a third-party digital asset custodian rather than managing the assets itself. At the Luno Institutional Digital Asset Conference in Kuala Lumpur, industry panellists discussed the practical checks institutions should make before deciding where and how their crypto holdings are stored.
Who Actually Controls The Private Keys?
The first major distinction between self-custody and third-party custody comes down to control of the private keys. These keys are what ultimately allow digital assets to be transferred, so whoever controls them effectively controls access to the crypto.
Under a regulated custody arrangement, the custodian may hold the keys on behalf of the client and keep assets inside cold-storage wallets that are disconnected from the internet. This reduces exposure to online attacks and removes some of the operational burden from the institution.
With self-custody, however, the institution remains fully responsible for protecting the keys. Even if it uses wallet technology supplied by another company, the responsibility for access and recovery still sits with the institution itself.
Self-Custody Means Taking Full Responsibility
The risks of self-custody are easy to understand when compared with an individual crypto wallet. Someone using a software wallet needs to protect the recovery phrase, while a hardware wallet still requires a backup plan in case the device is lost, damaged or inaccessible.
For an institution, that responsibility becomes much more complicated because several people may need authority to approve transactions. Policies must determine who can act, how many approvals are required and how emergency access works if key personnel are unavailable.
This means self-custody is not simply about buying secure hardware. It requires governance, documented procedures, recovery plans and enough internal expertise to manage the system safely.
Custody Is More Like Choosing Between A Safe And A Bank Account
One useful way to think about the decision is to compare self-custody with owning a safe box, while third-party custody resembles using a bank account. In the first scenario, the institution controls the security arrangements itself. In the second, a specialist provider manages many of those controls on its behalf.
That convenience comes with another question: what happens if the custodian itself fails? Institutions need to know whether their digital assets remain legally theirs if the provider becomes insolvent or experiences serious operational problems.
The answer depends heavily on how the custody arrangement is structured.
Asset Segregation Becomes Critical If The Custodian Fails
One of the most important things institutions should verify is whether customer assets are legally and operationally separated from the custodian's own assets. If the company enters insolvency, clients need confidence that their crypto will not simply become part of the custodian's estate.
Segregation can be implemented in different ways. Some custody providers may hold each client's assets in separate wallets, while others may group customer assets together but keep them entirely separate from the firm's treasury holdings.
The important point is that the institution should understand the structure before transferring any assets. Regulatory status, contractual protections and insolvency arrangements all need to be reviewed alongside the technical custody model.
On-Chain Segregation Can Improve Transparency
Some digital asset custodians segregate client holdings directly through individual blockchain wallets. This can make it easier to demonstrate which assets belong to which client and allow wallet balances to be independently verified on-chain.
That transparency can be useful during audits or when an institution needs to prove ownership. However, simply seeing a wallet on the blockchain does not automatically answer every legal question surrounding custody.
Institutions still need clear contractual documentation confirming that the wallet and its assets are held for them rather than for the custodian.
Insurance Can Add Another Layer Of Protection
Insurance is another factor institutions may consider when evaluating a custodian. Some providers offer substantial insurance coverage for assets where they maintain full control over the relevant keys.
However, the headline insurance figure alone does not tell the entire story. Institutions need to examine exactly what the policy covers, which types of loss qualify and what exclusions apply.
A large policy is useful only if the specific incident affecting the institution is actually covered. Preventive controls remain just as important as insurance because avoiding a loss in the first place is always preferable to making a claim afterwards.
Cold Storage Reduces Online Exposure
Cold storage is commonly used by institutional custodians because it keeps private keys disconnected from internet-accessible systems. This reduces exposure to remote attackers and makes certain classes of cyberattack significantly harder.
However, cold storage does not eliminate operational risk. Institutions still need to understand how the custodian authorises withdrawals, how keys are protected and what happens if critical hardware or personnel become unavailable.
A secure custody arrangement therefore needs both strong technology and strong procedures.
Hardware Security Modules And MPC Can Work Together
Modern custody systems may combine several security technologies rather than relying on one mechanism. A hardware security module, or HSM, can protect sensitive cryptographic material, while multiparty computation can divide control across several key shares.
This means no single person or system necessarily possesses the complete secret required to authorise a transfer. Combining these controls can reduce the risk that one compromised device or employee can move assets independently.
Institutions should still understand how each layer works rather than assuming that technical complexity automatically means stronger security.
Business Continuity Is Just As Important As Cybersecurity
A custody provider also needs a credible answer to a simple question: if something fails, how does the institution regain access to its assets? The failure could involve technology, staff, infrastructure or even the custodian itself.
This is fundamentally a business continuity issue. Recovery procedures should be documented, tested and capable of working even when the usual systems or employees are unavailable.
An institution should not discover during a crisis that only one person knows how to restore access to the assets.
Tokenised Assets Introduce Another Layer Of Complexity
Custody becomes even more complicated when the digital token represents something that exists outside the blockchain. A tokenised bond or tokenised bank deposit may be secured cryptographically, but ownership of the token is only one part of the picture.
Crypto-native assets such as Bitcoin rely primarily on the blockchain as the authoritative record. Tokenised financial products may also depend on another record, such as a bond register, company ledger or bank deposit system.
Both records need to remain aligned.
Controlling The Token May Not Mean Owning The Underlying Asset
If the blockchain record and the underlying legal record diverge, controlling the token may not necessarily prove ownership of the real-world asset behind it. That creates a risk that does not exist in exactly the same way with crypto-native assets.
For example, protecting a tokenised bond perfectly is not particularly useful if the corresponding bond register does not recognise the holder. The same problem applies to tokenised deposits if the banking record no longer matches the blockchain representation.
Institutions therefore need to understand not only how the token is secured but also how ownership of the underlying asset is recorded and enforced.
Regulatory Rules Differ Between Crypto And Tokenised Products
Digital asset custody permissions do not automatically cover every type of tokenised financial product. A provider may be authorised to safeguard cryptocurrencies but lack the appropriate regulatory permission to hold tokenised securities or other regulated instruments.
This becomes particularly important as financial markets increasingly experiment with tokenised bonds, funds and deposits. Institutions need to confirm that the custodian can legally hold the exact asset they intend to purchase.
The fact that something exists on a blockchain does not automatically make it equivalent to ordinary crypto.
Auditors Need To Understand The Holding Too
Accounting and audit requirements add another practical consideration. When an institution prepares its financial statements, its auditor must be able to verify what the organisation owns and how those assets are controlled.
If the custody arrangement is so complicated that the auditor cannot understand or independently confirm the holding, that creates an operational problem regardless of how advanced the technology may be.
A good custodian should therefore be able to provide clear records, supporting documentation and evidence that helps auditors confirm ownership and balances.
Institutions Need More Than Technical Security
Choosing a digital asset custodian should not be based only on whether the provider uses cold storage or sophisticated cryptography. Institutions also need to evaluate legal ownership, regulatory status, operational procedures, insurance, recovery plans and auditability.
A technically secure wallet is not enough if the institution cannot recover access during a crisis. Likewise, strong legal agreements are of limited value if the underlying private keys are poorly protected.
Institutional custody therefore requires several layers of assurance working together.
What Should Institutions Check Before Choosing A Custodian?
Before transferring significant digital assets to a custody provider, an institution should understand who controls the keys, how transactions are approved and what legal protections apply if the provider fails. It should also confirm whether client assets are properly segregated and whether there are clear recovery procedures.
Insurance terms, security architecture and business continuity plans deserve close examination as well. For tokenised assets, institutions must additionally determine how the blockchain record connects to ownership of the underlying asset.
The objective is not simply finding the custodian with the most impressive technology. It is finding one whose entire operating model can survive technical failures, cyber incidents and financial distress without putting client ownership at risk.
Final Thoughts
The question of what happens to crypto when a digital asset custodian fails cannot be answered by looking at the blockchain alone. Institutions need to understand the legal, technical and operational structure surrounding the assets before anything goes wrong.
Private-key control is only the beginning. Asset segregation, cold storage, HSMs, multiparty computation, insurance, recovery procedures and insolvency protections all contribute to whether an institution can still access and prove ownership of its holdings during a crisis.
Tokenised assets make the picture even more complicated because the blockchain may not be the only authoritative record. Institutions must ensure the digital token and the underlying legal asset remain properly connected.
Ultimately, trusting a custodian means trusting much more than a wallet. It means trusting the systems, contracts, governance and recovery processes surrounding that wallet. Before handing over significant digital assets, institutions need to know exactly what happens if any one of those layers fails.
Comments 0