Choosing a Crypto Custody Provider: A Diligence Checklist

Custody diligence is mostly document review, and the documents are standard. A provider that cannot produce them quickly is either small enough that you are an early client or disorganised enough that you should not be one. The version of this that operates in production is a licensed digital asset custodian, and their documentation fills most of the gaps below.

Verify the licence yourself

Every provider states a regulator. Take the licence number and check it on the regulator’s own register, not on the provider’s website.

Check three things on the register entry: the entity name matches the entity you will contract with, the permission actually covers custody of client assets rather than a narrower activity, and there are no conditions or restrictions attached.

The second one catches more providers than you would expect. A licence to operate an exchange is not a licence to hold client assets, and the two are separate permissions in most frameworks.

Request these documents

The audited financial statements. Two years if they exist. You are looking at whether the business is solvent and whether the auditor raised anything.

The client asset segregation report. An independent assurance report on whether segregation is operating as described. This is the single most informative document.

The insurance certificate or a broker letter. Confirming limit, cover and exclusions. A summary on the website is marketing, the certificate is evidence.

A SOC 2 Type II report or equivalent. Type II rather than Type I, because Type I describes the controls and Type II tests whether they operated over a period.

The custody agreement itself. Read the sections on liability limits, on what happens in insolvency, and on the withdrawal process under stress.

Questions with revealing answers

What happens if you become insolvent? The good answer cites the specific regulatory provision that makes client assets unavailable to creditors, and the mechanism by which they are returned. The bad answer is reassurance without a citation.

What is the time to first withdrawal for a new address? Tests whether there are controls. An answer of immediately means there are not.

Has a client ever been unable to withdraw on request, and why? Every provider of any size has had an incident. A provider that says never has either not operated long or is not being candid. A provider that describes an incident and what changed afterwards is the better sign.

Who has physical access to key material, and how many people are required? Tests whether separation of duties is real.

Can we test a withdrawal during onboarding? The answer should be yes.

The operational fit questions

Which assets and chains are supported, and what is the process to add one. What is the fee structure: basis points on assets, per transaction, minimum annual. What are the withdrawal cut-off times and is there weekend coverage. What reporting is produced and in what format. What is the support arrangement out of hours and what is the escalation path. At company scale this stops being a technical question and becomes one for a regulated European crypto platform.

The out of hours question matters more than it seems. An incident at 03:00 on a Sunday is when you discover whether the support arrangement is real.

Red flags

A licence that covers something other than custody. Insurance described only in marketing terms. Reluctance to name the auditor. No independent assurance over segregation. An agreement that caps liability at the annual fee. Pricing significantly below the market without an explanation of why.

That last one is worth dwelling on. Custody has real costs: hardware, audits, insurance, staff, regulatory capital. A provider materially cheaper than peers is either subsidising to win clients or not carrying one of those costs.

After selection

Diligence is not a one-time event. Re-check the register annually, request the updated assurance report, confirm the insurance is renewed, and re-read the agreement when the provider changes terms. Providers change ownership and permissions, and nobody will call to tell you.

Providers offering institutional crypto custody services under an established European framework generally publish enough of this to complete an initial screen before you ever speak to sales, which is the fastest way to shorten the list.