What is crypto-asset custody?
Crypto-asset custody is the safekeeping of crypto-assets — in practice, of the private keys that control them — for the account of a client. It differs from holding cash at a bank in one decisive respect: whoever controls the keys controls the asset itself. Custody law therefore answers a narrow but expensive question: who bears the loss when keys are stolen, lost or the custodian fails?
Custody models and key management
- Self-custody: the user holds the keys; there is no service provider, and the entire loss risk stays with the user.
- Custodial safekeeping: a platform or custodian holds keys on the client’s behalf; the legal relationship is shaped by contract.
- Qualified custodian: an institution authorised for this business, meeting capital, organisational and audit conditions.
On the technical side, hot-cold segregation (see Cold Wallet), multi-signature schemes and multi-party computation (MPC) are the standard key-management techniques a diligent client should ask about.
The legal dimension
Three principles carry most of the weight: client assets must be segregated from the custodian’s own estate; client assets may not be used — lent, pledged, staked — without consent; and insolvency turns on whether clients hold a proprietary claim to identified assets or rank as unsecured creditors. Under MiCA, CASPs providing custody owe defined safeguarding duties and are liable, within limits, for the loss of clients’ crypto-assets. Contracts should allocate key-loss risk, cap or define liability, and disclose any sub-custody arrangements explicitly.
Turkish context
Law No. 7518 placed custody at the centre of the Turkish regime. SPK secondary regulations require client crypto-assets to be tracked separately from the platform’s own assets, with safekeeping concentrated at banks and authorised custody institutions rather than left freely with the trading platform. Protection of clients in a platform failure is built on that segregation. The licensing and custody conditions are set out in our article on Turkey’s crypto licence requirements.
Do: demand written disclosure of segregation, key management and sub-custody arrangements from any custodian before transferring assets. Don’t: read “your funds are safe” marketing as a proprietary claim in insolvency — only the contract and the regulatory regime decide that.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call