Crypto custody compliance is no longer a niche back-office topic. If you hold digital assets for clients, regulators now expect bank-grade security, clear asset segregation, AML/KYC controls, tested governance, and reporting that can stand up in an examination. The custody question has moved from "Can you store private keys safely?" to "Can you prove control, explain legal treatment, monitor transactions, and survive an incident?"

That shift matters for exchanges, investment advisers, funds, banks, trust companies, broker-dealers, payment companies, and corporate treasury teams. A custodian that gets the wallet architecture right but misses suspicious activity reporting, Travel Rule obligations, or sub-custodian oversight still has a compliance problem.

What Crypto Custody Compliance Means

Crypto custody compliance covers the legal, technical, and operational duties of a firm that safeguards digital assets for others. It sits across several rulebooks:

Banking regulation, where custody must be conducted in a safe and sound manner.
Securities law, especially for registered investment advisers and regulated funds using qualified custodians.
Virtual Asset Service Provider rules, including AML/CFT duties under FATF-aligned frameworks.
Accounting and disclosure requirements, which affect balance sheet treatment, risk reporting, and client statements.

For a practical learning path, professionals can pair this topic with Blockchain Council programs such as Certified Cryptocurrency Expert™, Certified Blockchain Expert™, and Certified Blockchain Security Expert™. Custody teams need legal fluency, but they also need people who understand wallets, smart contracts, signing policies, and chain-level risk.

Current Regulatory Direction

United States: SEC custody and qualified custodian issues

In September 2025, the SEC Division of Investment Management issued a no-action letter saying staff would not recommend enforcement if registered investment advisers and regulated funds custody crypto assets, and related cash, with certain state-chartered trust companies. The key condition is that those trust companies operate under frameworks materially similar to banks, with oversight, segregation, and control expectations.

That sounds like clarity, but do not overread it. A no-action letter is staff guidance, not a statute or final rule. Different facts can lead to a different outcome. SEC Commissioner Hester Peirce described the letter as a meaningful step toward reducing ambiguity, and she has pointed toward more principles-based custody modernization. Still, advisers cannot treat every crypto custodian as a qualified custodian just because it has a polished dashboard and a trust charter somewhere in its marketing deck.

The SEC's "Know Your Custodian" discussions also signaled where scrutiny is heading: key management, rehypothecation, sub-custodians, insolvency risk, and transparency to end investors.

OCC guidance for banks

On 7 May 2025, the Office of the Comptroller of the Currency issued Interpretive Letter 1184. It clarified that national banks and federal savings associations may provide crypto asset custody and execution services, buy and sell assets held in custody at a customer's direction, and outsource custody or execution to third parties.

The catch is familiar to anyone in banking: third-party risk management. If a bank uses a sub-custodian, it must conduct due diligence, allocate responsibilities in contracts, monitor performance, and integrate the activity into enterprise risk management. "The vendor has SOC 2" is not enough.

AML/KYC and VASP obligations

Globally, crypto custodians are commonly treated as Virtual Asset Service Providers. FATF standards require customer due diligence, identity verification, ongoing transaction monitoring, suspicious activity reporting, and Travel Rule compliance for covered virtual asset transfers. In the United States, FinCEN applies similar obligations to money services businesses and other covered crypto businesses.

In practice, this means collecting information such as name, address, date of birth, government-issued identification, proof of residence when needed, source of funds for higher-risk clients, sanctions screening results, and transaction monitoring alerts. You also need a record of why a client was approved, not just that they passed onboarding.

Canada and tier-based custody controls

The Canadian Investment Regulatory Organization has introduced a crypto asset custody framework using a tier-based system. Requirements scale with the risk of the activity and may cover third-party custodians, segregation of client assets, capital, insurance, and operational controls. This is a useful model because not every platform has the same risk profile. A dealer platform that trades and holds client assets should face a different review than a firm that only routes to a qualified third-party custodian.

Security Expectations for Crypto Custodians

Security is the most visible part of crypto custody compliance, but it is also the easiest to describe badly. "Cold storage" by itself does not answer who can sign, how approvals work, how keys are backed up, what happens during a chain halt, or whether client assets are legally segregated.

Cold storage, hot wallets, and access controls

Most institutional custodians use a mix of:

Cold storage for long-term holdings and higher-value assets.
Hot wallets for liquidity, withdrawals, and operational needs.
Multi-factor authentication for client and administrator access.
Hardware security modules, hardware wallets, or MPC systems for signing workflows.
Air-gapped systems where key material should never touch internet-connected infrastructure.

Here is the detail beginners miss: operational errors often look mundane. A withdrawal can fail with the Ethereum error insufficient funds for gas * price + value because the wallet policy allowed the full ETH balance to be queued for transfer without reserving gas. Another common one is nonce too low after two operators try to replace or rebroadcast a transaction without a clean nonce management process. These are not just developer annoyances. In a custodian, they become reconciliation breaks, client service tickets, and sometimes reportable operational incidents.

Audits and assurance

Institutional clients increasingly ask for independent assurance. Anchorage Digital, for example, highlights SOC 1 and SOC 2 Type II reports covering areas such as security, confidentiality, and availability. That kind of report matters because custody has to balance control with execution speed. If every withdrawal takes half a day, clients will route activity elsewhere. If approvals are too loose, the risk team should object.

Large custodians such as State Street argue that digital asset adoption depends on bank-grade custody models: governance, business continuity planning, risk controls, and transparent reporting that resemble traditional securities custody.

Reporting Obligations Custodians Cannot Ignore

AML/CFT reporting

Crypto custodians must identify and escalate suspicious activity. This includes unusual movement patterns, rapid layering across wallets, exposure to sanctioned addresses, darknet market links, scam proceeds, ransomware indicators, and transactions inconsistent with a customer's profile.

A mature AML program includes:

Customer risk scoring at onboarding.
Sanctions and politically exposed person screening.
Wallet screening and blockchain analytics.
Ongoing monitoring after onboarding.
Suspicious activity reporting to the relevant financial intelligence unit.
Documented escalation and case management.

Automated tools help, but humans still need to review edge cases. Chain analytics can flag exposure, but it cannot always explain business purpose. That judgment belongs to compliance staff.

Client reporting and disclosures

Clients need accurate account statements showing balances, deposits, withdrawals, fees, and transaction histories by asset. They also need plain disclosure on how assets are held. Are assets in omnibus wallets? Are they individually segregated on-chain? What happens if the custodian fails? Who is the sub-custodian, if there is one?

For advisers and funds, these questions are not optional. SEC staff have made clear that advisers must understand and explain custodial arrangements, including legal protections and operational risks.

Financial reporting and accounting

The SEC's rescission of its prior crypto accounting guidance changed how some entities think about custodial crypto assets on balance sheets. Custodians, money transmitters, and digital asset intermediaries should revisit accounting policies, capital planning, liquidity assumptions, and disclosures. A balance sheet treatment change does not remove operational risk. It changes where and how that risk is explained.

Core Regulatory Obligations

Licensing and registration

Depending on the business model, a custodian may need to operate as a state-chartered trust company, national bank, federal savings association, VASP, money services business, dealer platform, or another regulated entity. The label is not cosmetic. It determines examinations, capital expectations, AML duties, permissible activities, and client asset treatment.

Asset segregation and control

Regulators expect client assets to be separated from the custodian's own assets. They also expect the custodian to demonstrate possession or control, which is harder in crypto than in traditional securities because control often means private key control, signing rights, governance policies, and sub-custodian arrangements.

If you cannot answer "who can move the assets, under what policy, with what logs, and what legal claim the client has," the custody model is not ready for institutional use.

Outsourcing and sub-custodian risk

OCC guidance permits outsourcing, but it does not permit outsourcing accountability. Banks and regulated firms must review the provider's security, compliance program, financial condition, insurance, incident history, and business continuity plans. Contracts should cover liability, service levels, audit rights, data access, confidentiality, regulatory cooperation, and termination procedures.

Where Crypto Custody Is Heading

The direction is clear. Crypto custody is being pulled into mainstream financial regulation. Expect more clarity on qualified custodian status, more bank and trust-company participation, tighter AML/KYC surveillance, broader use of SOC reports, and closer attention to operational resilience.

There is one overhyped idea worth challenging: self-custody is not automatically safer for institutions. It can be the right choice for some crypto-native teams with strong engineering and governance. For a fund, bank, or enterprise treasury without deep wallet operations experience, self-custody can create key-person risk, weak change control, and audit headaches. Regulated third-party custody is often the better route, provided due diligence is real.

What You Should Do Next

If you work in compliance, risk, audit, product, or security, build a custody review checklist around five areas: licensing, asset segregation, key management, AML/KYC reporting, and third-party oversight. Then test it against one actual custodian agreement and one real transaction flow. You will find gaps quickly.

For structured learning, start with Certified Cryptocurrency Expert™ if you need market and regulatory grounding. Choose Certified Blockchain Security Expert™ if your role touches wallet security, key management, or incident response. If you are building custody infrastructure, add Certified Blockchain Developer™ or Certified Blockchain Expert™ to understand the technology behind the compliance controls.

Crypto Custody Compliance: Security, Reporting, and Regulatory Obligations