Machine-readable research:Provider dataset·JSON·CSV

Primary-source research

Institutional Custody Provider Evidence Index

140 custody and infrastructure records reviewed against regulator, company-register and provider primary sources. Evidence completeness is shown separately from provider quality.

Open Provider Matcher Open Regulatory Matrix Research methodology Entity Database

Evidence, not ratings

Current primary-source snapshots

“4/4 evidence dimensions” means useful primary-source evidence was found in all four research dimensions. It does not mean the provider is safer or better.

Search evidence

Fireblocks

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Fireblocks Trust Company, LLC is listed by NYDFS as a limited purpose trust company; Fireblocks Trust markets qualified custody.
Security: Fireblocks publishes SOC 2 Type II and ISO 27001/27017/27018/22301 coverage plus CCSS QSP Level 3 and external penetration testing.
Asset protection: Fireblocks Trust states client assets are segregated and held in a bankruptcy-remote structure.
Procurement caveat: Differentiate the Fireblocks technology platform from the regulated Fireblocks Trust custody entity when contracting.

Provider profile NYDFS virtual currency businesses ↗Fireblocks security ↗Fireblocks Trust ↗

BitGo

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: BitGo New York Trust Company is listed by NYDFS as a limited purpose trust company; BitGo also operates regulated custody entities in other jurisdictions.
Security: BitGo states SOC 1 Type II and SOC 2 Type II controls and has published CCSS Level 3 certification.
Asset protection: BitGo markets qualified custody with offline cold storage and insurance; exact policy scope and exclusions are entity- and contract-specific.
Procurement caveat: Confirm the contracting custody entity, jurisdiction and current insurance schedule before procurement.

Provider profile NYDFS BitGo charter release ↗BitGo qualified custody ↗BitGo institutional custody controls ↗BitGo CCSS ↗

Anchorage Digital

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Anchorage Digital Bank, National Association received an OCC national trust bank charter and appears in the OCC institution directory.
Security: Anchorage states its custody environment is examined under SOC 1 Type II and SOC 2 Type II reporting.
Asset protection: Digital assets held in custody are subject to bank-grade custody controls; Anchorage disclosures note crypto assets are not FDIC- or SIPC-insured.
Procurement caveat: A federal bank charter does not make digital assets FDIC-insured; confirm account structure and asset treatment contractually.

Provider profile OCC charter announcement ↗OCC institution search ↗Anchorage custody ↗

Copper

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Copper publishes regulatory registrations for specific entities, including Switzerland; permissions must be checked against the entity used for the mandate.
Security: Copper has published SOC 2 Type II assurance for its digital-asset custody environment.
Asset protection: Copper provides institutional custody and collateral-management architecture; legal segregation and insolvency treatment should be confirmed for the selected entity.
Procurement caveat: Regulatory permissions and asset-protection mechanics vary by Copper entity and jurisdiction.

Provider profile Copper homepage ↗Copper SOC 2 Type II announcement ↗

Zodia Custody

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Zodia Custody Europe S.A. appears on the AMF MiCA whitelist following authorization by Luxembourg CSSF.
Security: Zodia publishes SOC 1 Type II, SOC 2 Type I and ISO 27001:2022 assurance/certification.
Asset protection: Zodia describes institutional insurance protection; exact legal segregation and policy terms should be verified for the contracting entity.
Procurement caveat: Standard Chartered announced acquisition of Zodia Custody’s custody business in May 2026; confirm the current contracting entity and integration status.

Provider profile AMF MiCA whitelist ↗Zodia custody ↗Standard Chartered acquisition announcement ↗

Komainu

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Komainu publishes regulated custody permissions/registrations across Jersey, the UAE, the UK and Italy.
Security: Komainu publishes SOC 1 Type II, SOC 2 Type II and ISO 27001 assurance/certification.
Asset protection: Komainu states assets are held in segregated on-chain wallets, off balance sheet and in a bankruptcy-remote custody structure.
Procurement caveat: Confirm which Komainu legal entity and regulatory perimeter applies to the mandate.

Provider profile Komainu regulation ↗Komainu security ↗Komainu custody ↗

Hex Trust

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Hex Trust publishes multiple regulated-entity permissions, including a Singapore capital-markets-services licence with custodial permissions.
Security: Hex Trust publishes SOC 1/SOC 2 assurance history and CSA STAR Level 2; its trust center documents current control assurance.
Asset protection: Hex Trust states client assets are segregated; legal treatment remains entity- and jurisdiction-specific.
Procurement caveat: Check the exact Hex Trust entity and licence scope for the client jurisdiction.

Provider profile Hex Trust trust center ↗Hex Trust about/licensing ↗Hex Trust 2026 assurance update ↗

Taurus

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Taurus provides institutional custody/tokenization infrastructure; this review does not independently certify the regulatory status of every Taurus entity or customer deployment.
Security: Taurus publishes ISO/IEC 27001:2022 certification for its information-security management system.
Asset protection: Taurus provides institutional custody technology; legal segregation and insolvency treatment depend on the regulated service/entity used.
Procurement caveat: Treat technology-provider capability and regulated-custodian status as separate procurement questions.

Provider profile Taurus platform ↗Taurus ISO 27001:2022 ↗

Cobo

Digital Asset Custodians · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Cobo publicly offers custodial wallets, but the reviewed public materials do not establish one globally applicable qualified-custodian or bank/trust status. Regulatory perimeter should be confirmed for the contracting entity.
Security: Cobo describes institutional wallet infrastructure spanning custodial, MPC and smart-contract wallet architectures; exact assurance-report scope should be requested during due diligence.
Asset protection: Custodial-wallet documentation describes institutional safekeeping, but public evidence reviewed here is insufficient to generalize segregation, bankruptcy remoteness or insurance across all entities and products.
Procurement caveat: Treat Cobo as a mixed custody-and-wallet platform. Verify the legal custody entity, licence, segregation structure and insurance applicable to the intended jurisdiction.

Provider profile Cobo official site ↗Cobo Custodial Wallet ↗

GK8

Wallet Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: GK8 was acquired by Galaxy after the transaction announced in 2022 and completed in February 2023. Galaxy now refers to its Custody Infrastructure platform as formerly known as GK8.
Security: Galaxy/GK8 documents Cold Vault technology that enables transaction signing without internet connectivity and MPC controls for operational flexibility.
Asset protection: The technology can support institutional custody or self-custody architectures, but the legal custodian and asset-segregation framework depend on the deploying institution.
Procurement caveat: Treat GK8 as a legacy/product brand within Galaxy custody infrastructure, not as an independent regulated custodian.

Provider profile Galaxy — completes acquisition of GK8 ↗Galaxy — GK8 Tokenization Wizard / custody stack ↗Galaxy — Bank Leumi / platform formerly known as GK8 ↗

Ledger Enterprise

Wallet Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Ledger Enterprise explicitly positions its platform as infrastructure for institutions and custodians, including self-custody deployment models.
Security: Ledger Enterprise documents hardware-enforced security and, in 2026, an HSM On-Premise architecture that keeps the signer HSM and master seed inside the client data center with no Ledger access to the signing keys.
Asset protection: The model is designed to let institutions retain control of signing keys and governance. Legal asset segregation and insolvency treatment belong to the institution/custodian operating the technology.
Procurement caveat: Ledger Enterprise technology can support a custodian, but the platform itself should not be treated as the regulated legal custodian.

Provider profile Ledger Enterprise platform ↗Ledger Enterprise — For Custodians ↗Ledger Enterprise — HSM On-Premise ↗

Fordefi

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Fordefi explicitly positions its core platform as institutional MPC wallet infrastructure that lets customers self-custody private keys.
Security: Fordefi documents MPC, hardware isolation and SOC 2 Type II assurance; customers can retain backup/signing control in self-custody deployments.
Asset protection: Key and asset control depends on deployment. Fordefi’s core institutional product states the customer remains in control of private keys.
Procurement caveat: A Fordefi deployment can support custodial businesses, but Fordefi technology itself should not be treated as the regulated legal custodian.

Provider profile Fordefi — institutional MPC wallet ↗Fordefi — developers/self-custody and security ↗Fordefi — Wallet as a Service ↗

Safeheron

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Safeheron explicitly markets institutional-grade MPC self-custody rather than delegated third-party custody.
Security: Safeheron documents SOC 2 Type II and ISO/IEC 27001:2022 certifications and security reviews for its self-custody platform.
Asset protection: The self-custody architecture is designed to leave asset/key control with the deploying organization rather than Safeheron as custodian.
Procurement caveat: Do not classify Safeheron as the legal custodian solely because its technology is used for safeguarding digital assets.

Provider profile Safeheron — MPC self-custody ↗Safeheron — SOC 2 Type II ↗Safeheron — security ↗

Finoa

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Finoa states that its German crypto-custody licence was surrendered and formally revoked effective 31 December 2025 and that it no longer enters new regulated business relationships.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Technology or successor services must not be confused with the former regulated Finoa GmbH custody business.
Procurement caveat: Technology or successor services must not be confused with the former regulated Finoa GmbH custody business.

Provider profile Finoa — regulatory and operational status ↗

Propine

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Propine held a Singapore capital-markets-services licence for institutional custody and became subject to Komainu's announced acquisition plan.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Confirm completion, current brand, contracting entity and MAS permission before treating Propine as a standalone active provider.
Procurement caveat: Confirm completion, current brand, contracting entity and MAS permission before treating Propine as a standalone active provider.

Provider profile Komainu — agreement to acquire Propine ↗

Standard Custody

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: New York DFS approved Standard Custody & Trust Company as a limited purpose trust company; Ripple completed its acquisition in 2024.
Security: Current independent security-assurance details were not verified in this review.
Asset protection: Trust-company custody is regulated in New York; current insurance, segregation and insolvency mechanics should be confirmed with Ripple/Standard Custody.
Procurement caveat: The business is now part of Ripple; verify whether the mandate contracts with Standard Custody, another Ripple entity, or a partner.

Provider profile NYDFS Standard Custody charter ↗Ripple acquisition close ↗Standard Custody site ↗

Coincover

Compliance & Security · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Coincover provides recovery, resilience, governance and secure key-management infrastructure for custodians, exchanges, wallets and financial institutions.
Security: Its products focus on recovery workflows, encrypted backups, governance and operational continuity rather than delegated legal custody.
Asset protection: Coincover Recover for Institutions is described as recovery infrastructure for non-custodial wallets and institutional holdings; custody remains with the relevant wallet/custodian arrangement.
Procurement caveat: Coincover explicitly serves custodians; that does not make Coincover the legal custodian of the underlying customer assets.

Provider profile Coincover — digital asset protection ↗Coincover — institutional recovery ↗

Tangany

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Tangany GmbH appears on the AMF MiCA whitelist following authorization by BaFin and markets itself as a MiCA-licensed German custodian.
Security: Tangany publishes ISO 27001 certification and HSM/MPC custody security controls.
Asset protection: Custody architecture is documented by Tangany; insolvency treatment and insurance scope should be verified in current contractual documentation.
Procurement caveat: Confirm the specific MiCA services and asset scope applicable to the mandate.

Provider profile AMF MiCA whitelist ↗Tangany homepage ↗Tangany security FAQ ↗

Upvest

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Upvest states it holds BaFin licences covering securities and crypto brokerage and custody and can provide custody within B2B operating models.
Security: Public material establishes licensing and operating-model controls but this review did not establish a public custody-specific security certification set.
Asset protection: Asset custody can be provided under Upvest’s regulated model; exact segregation and contractual treatment should be verified in the client agreement.
Procurement caveat: Whether Upvest or the B2B client performs a specific regulated role depends on the selected operating model and product.

Provider profile Upvest — BaFin custody licences ↗Upvest — operating models ↗

Qredo

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: UK Companies House records Qredo Ltd as dissolved on 16 September 2025 after an administration that began in February 2024.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not present the former Qredo company as an active custody provider. Product or protocol successors require separate entity review.
Procurement caveat: Do not present the former Qredo company as an active custody provider. Product or protocol successors require separate entity review.

Provider profile UK Companies House — Qredo overview ↗UK Companies House — Qredo insolvency ↗

Onchain Custodian

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Onchain Custodian historically marketed institutional digital-asset safekeeping, but this review did not establish a sufficiently current operating and regulatory statement.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Require current company, licence and onboarding evidence before shortlisting or routing an introduction.
Procurement caveat: Require current company, licence and onboarding evidence before shortlisting or routing an introduction.

Provider profile Onchain Custodian — official domain ↗

Metaco

Wallet Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Metaco is Ripple-owned institutional custody and tokenization technology. Its Harmonize platform is used by banks and custodians to build custody services; the technology vendor should not be treated as the legal custodian by default.
Security: Ripple/Metaco materials emphasize institutional key-management and smart-contract governance capabilities; buyers should request current architecture and assurance documentation for the deployed configuration.
Asset protection: Asset segregation and insolvency treatment are determined by the institution deploying the technology and the legal custody arrangement, not by Metaco technology alone.
Procurement caveat: Identify the regulated institution actually safeguarding assets. Metaco/Ripple provides technology that can power custody, while legal custody rests with the deploying institution unless a separate Ripple custody entity is contracted.

Provider profile Ripple — Institutional Digital Asset Custody Platform ↗Ripple — Metaco acquisition / custody technology ↗Ripple — DZ Bank selects Metaco Harmonize ↗

Digivault

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Digivault historically provided FCA-registered institutional custody and public partnership materials document its custody role.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: The historic brand/entity and current similarly named companies must not be conflated. Verify the FCA record, ownership and operating company before procurement.
Procurement caveat: The historic brand/entity and current similarly named companies must not be conflated. Verify the FCA record, ownership and operating company before procurement.

Provider profile Digivault — official domain ↗Poundtoken — Digivault custody partnership ↗

Trustology

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Bitpanda acquired Trustology in 2022 and rebranded the business as Bitpanda Custody.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not present Trustology as a separate current provider. Evaluate Bitpanda Custody and its current entity/permissions instead.
Procurement caveat: Do not present Trustology as a separate current provider. Evaluate Bitpanda Custody and its current entity/permissions instead.

Provider profile Bitpanda — Trustology becomes Bitpanda Custody ↗

Koine

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Koine historically developed institutional custody and settlement and received an in-principle ADGM approval, but current active licensing and operations were not established.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: An in-principle historical approval is not proof of a current licence or active custody service. Require fresh regulator and entity evidence.
Procurement caveat: An in-principle historical approval is not proof of a current licence or active custody service. Require fresh regulator and entity evidence.

Provider profile Koine — official domain ↗

Aegis Custody

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Aegis markets itself as a licensed institutional digital-asset custodian. The exact legal entity and licence applicable to a buyer should be confirmed directly before procurement.
Security: Aegis describes institutional-grade custody controls, but the public materials reviewed do not provide enough detail to score independent assurance coverage consistently.
Asset protection: Aegis states that its custody offering is insured; policy scope, exclusions and named insured entities are contract-specific and should be obtained directly.
Procurement caveat: Do not rely on the brand-level “licensed and insured” description alone. Verify current licence numbers, contracting entity, insurance certificate and asset segregation.

Provider profile Aegis Custody ↗

First Digital Trust

Digital Asset Custodians · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: First Digital states that it is an independent public trust corporation headquartered in Hong Kong and provides custody/asset-servicing solutions.
Security: First Digital publishes institutional custody technology commentary, but this review did not establish sufficient current external-assurance artifacts tied to the custody product.
Asset protection: The business is structured around trust and custody concepts; exact segregation, bankruptcy treatment and insurance should be confirmed from current client documents.
Procurement caveat: Confirm current Hong Kong trust registration details, client-asset structure and assurance reports rather than relying on general trust-company status.

Provider profile First Digital ↗First Digital about ↗First Digital custody guide ↗

Liminal Custody

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Liminal publishes entity-specific regulatory disclosures, including an ADGM-regulated custody entity and other regional structures; Singapore disclosures describe an exemption rather than a full custody licence for that entity.
Security: Liminal’s Trust Center lists SOC 2 Type I/II, ISO 27001 and CCSS Level 3-related controls plus security monitoring.
Asset protection: Its client disclosure describes separation of customer tokens, reconciliation and cold-wallet safeguarding for the relevant service.
Procurement caveat: Entity selection is critical. A licence or exemption in one jurisdiction does not apply to all Liminal companies; verify the contracting entity and exact permission.

Provider profile Liminal Trust Center ↗Liminal client disclosure ↗

CYBAVO

Wallet Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Circle acquired CYBAVO and explicitly described the platform as non-custodial infrastructure and developer services.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: CYBAVO technology can support custody workflows but is not evidence that CYBAVO remains an independent legal custodian.
Procurement caveat: CYBAVO technology can support custody workflows but is not evidence that CYBAVO remains an independent legal custodian.

Provider profile Circle — CYBAVO acquisition ↗Circle — Programmable Wallets ↗

BCB Group

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: BCB Group describes payments, trading and custody services and states that its custody operations use Metaco infrastructure.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Technology deployment does not by itself establish every legal custody permission. Confirm the contracting BCB entity and jurisdiction.
Procurement caveat: Technology deployment does not by itself establish every legal custody permission. Confirm the contracting BCB entity and jurisdiction.

Provider profile BCB Group — custody operations on Metaco ↗BCB Group — company and regulatory timeline ↗

Protego Trust

Status Watch · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: The OCC conditionally approved Protego Trust’s conversion to Protego Trust Bank, N.A. in February 2021 while it was still in an organizational phase and required conditions to be met before operation.
Security: No current operational custody-security assurance should be inferred from the historical conditional approval.
Asset protection: The 2021 approval describes intended cryptocurrency custody after conversion; current client-asset protection cannot be asserted without current operating evidence.
Procurement caveat: This review did not establish current OCC operating status from contemporary primary evidence. A 2021 conditional approval must not be presented as proof of a current active national trust bank.

Provider profile OCC — Protego conditional approval announcement ↗OCC — Conditional Approval #1259 ↗OCC — 2025 digital-asset trust charter approvals ↗

Paxos

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Paxos Trust Company is a New York limited purpose trust company supervised by NYDFS.
Security: Paxos has published SOC 1 Type II and SOC 2 Type II assurance across custody and related products.
Asset protection: Specific current segregation/insurance terms were not independently verified in this review and should be confirmed for the selected product.
Procurement caveat: NYDFS announced a 2025 settlement concerning historical AML/compliance deficiencies; procurement teams should review current remediation and controls.

Provider profile NYDFS virtual currency list ↗Paxos SOC assurance ↗NYDFS 2025 Paxos settlement ↗

NYDIG

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: NYDIG Trust Company LLC is listed by NYDFS as a limited purpose trust company.
Security: NYDIG publishes SOC 1 Type II and SOC 2 Type II assurance for its custody/control environment.
Asset protection: NYDIG describes its custody as audited and insured; exact insurance and legal-segregation terms should be confirmed contractually.
Procurement caveat: Confirm asset scope and legal entity because NYDIG’s institutional offering is strongly bitcoin-focused.

Provider profile NYDFS virtual currency list ↗NYDIG financial infrastructure ↗

Casa

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Casa explicitly states it provides non-custodial self-custody security software and does not hold, control or transmit customer funds.
Security: Casa states it meets SOC 2 requirements and uses distributed multisig/key-location design to remove single points of failure.
Asset protection: Customers retain self-custody; Casa states it does not hold, control or transmit customer funds.
Procurement caveat: Do not classify Casa as a third-party legal custodian; its value proposition is specifically reducing reliance on custodians/counterparties.

Provider profile Casa — self-custody platform ↗Casa — enterprise self-custody ↗Casa — licensing/disclosures ↗

Unchained

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Unchained offers collaborative multisig custody for bitcoin in which control is distributed across keys rather than surrendered to a single custodian.
Security: Security relies on geographically/operationally distributed multisig keys and cold-storage practices rather than a single custodian key store.
Asset protection: The collaborative model is designed to reduce single-party control and counterparty risk; exact key quorum and third-party roles depend on the product.
Procurement caveat: This is not conventional sole-control third-party custody. Buyers must understand key ownership, quorum design and recovery/legal responsibilities.

Provider profile Unchained — collaborative custody ↗Unchained — multisig institutional custody discussion ↗

Xapo Bank

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Xapo Bank states it is regulated as a Gibraltar credit institution and its VASP operates under Gibraltar’s DLT framework.
Security: Xapo publishes MPC custody architecture and SOC 2 Type II assurance for its bitcoin custody environment.
Asset protection: Xapo states client bitcoin is held 1:1, segregated and not lent or rehypothecated without consent.
Procurement caveat: Banking and VASP activities can sit in different legal entities; confirm which entity holds the asset.

Provider profile Xapo custody ↗Xapo MPC custody vault ↗Xapo regulatory overview ↗

Bitcoin Suisse

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: This review verifies the custody/control framework but does not independently certify every regulatory permission of Bitcoin Suisse entities.
Security: Bitcoin Suisse publishes ISAE 3402 Type II assurance by PwC and independent penetration testing.
Asset protection: Bitcoin Suisse describes segregated crypto custody for clients.
Procurement caveat: Confirm the applicable legal entity, regulator and insolvency treatment for the client jurisdiction.

Provider profile Bitcoin Suisse custody ↗Bitcoin Suisse fund custody ↗

Swissquote Custody

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Swissquote operates regulated banking/financial entities; group disclosures identify regulated entities providing custodian services that include crypto assets.
Security: Swissquote describes multi-signature controls, offline cryptographic material and access-control architecture for crypto safeguarding.
Asset protection: Custody is integrated into regulated Swissquote account structures; exact entity, segregation and compensation/insurance treatment depend on the client jurisdiction.
Procurement caveat: Confirm the legal entity and custody model for the buyer’s country; Swissquote group entities do not all have identical permissions.

Provider profile Swissquote crypto products ↗Swissquote crypto wallet ↗

AMINA Bank

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: AMINA describes itself as a FINMA-regulated Swiss bank and securities dealer providing crypto custody.
Security: AMINA publishes HSM and multi-signature custody controls.
Asset protection: AMINA states client assets are fully segregated under Swiss law; its off-exchange collateral model describes bankruptcy-remote, off-balance-sheet treatment for eligible collateral.
Procurement caveat: Confirm whether the mandate uses bank custody or the separate off-exchange collateral structure.

Provider profile AMINA custody ↗AMINA custody explainer ↗AMINA off-exchange custody ↗

Sygnum

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: This review focuses on Sygnum’s bank custody platform; the exact licence/perimeter for each jurisdiction should be checked against the contracting entity.
Security: Sygnum has published ISAE 3402 Type II assurance for its multi-custody platform and ISAE 3000 assurance for key ceremonies.
Asset protection: Specific current segregation/insurance terms were not independently verified in this review.
Procurement caveat: Verify contracting entity, jurisdiction and the custody model selected.

Provider profile Sygnum assurance report ↗

Matrixport

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Matrixport’s institutional custody is provided through Cactus Custody. Cactus describes itself as a qualified custodian operating under regulatory/AML requirements and has historically disclosed Hong Kong trust-company/TCSP credentials.
Security: Cactus publishes a Trust Center describing ISO certifications, advanced HSM controls, global multi-signature architecture and audit/security controls.
Asset protection: Cactus describes segregated accounts, layered hot/cold architecture and insurance coverage; policy terms and legal entity should be confirmed directly.
Procurement caveat: The provider profile is named Matrixport, but the custody service/legal perimeter is Cactus Custody. Procurement should contract and verify the actual custody entity, not infer custody status from the broader Matrixport group.

Provider profile Cactus Custody ↗Cactus Trust Center ↗Cactus custody models ↗

HashKey

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: HashKey Group states that client assets for its Hong Kong platform are segregated and held by HashKey Custody Services Limited, a licensed trust/company service provider.
Security: HashKey publishes institutional security and certification claims at group/platform level; buyers should verify which certifications cover the custody legal entity.
Asset protection: HashKey states client assets are segregated from platform assets and held through the custody entity for the relevant Hong Kong service.
Procurement caveat: Do not transfer exchange-level licences or ISO claims automatically to every HashKey entity. Verify the custody company, licence and assurance scope.

Provider profile HashKey licence announcement ↗HashKey Group ↗

Bakkt

Status Watch · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Bakkt historically operated institutional custody, but its 2026 SEC/investor filings state that it exited the custody business in 2025 as part of a strategic transformation.
Security: Legacy custody controls are historical and should not be attributed to current Bakkt services after the divestiture.
Asset protection: Historical custody arrangements must not be treated as current Bakkt asset protection. Identify the current custodian in any Bakkt-enabled workflow.
Procurement caveat: Do not present Bakkt as a current custody provider based on older Bakkt Warehouse materials. Current Bakkt focuses on trading, payments and infrastructure.

Provider profile Bakkt — 2026 Form 8-K / custody divestiture ↗Bakkt — current Markets ↗

BlockFi Custody

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: BlockFi's restructuring materials document the Chapter 11 case and wind-down rather than an active institutional custody service.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Historical profile only. Do not infer an active custody offering from pre-bankruptcy materials.
Procurement caveat: Historical profile only. Do not infer an active custody offering from pre-bankruptcy materials.

Provider profile BlockFi restructuring administration ↗

Kingdom Trust

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Kingdom Trust stopped acting as custodian in January 2024 and accounts moved to Digital Trust as successor custodian.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Keep the legacy page for research, but evaluate Digital Trust for current custody and do not route to Kingdom Trust as a standalone provider.
Procurement caveat: Keep the legacy page for research, but evaluate Digital Trust for current custody and do not route to Kingdom Trust as a standalone provider.

Provider profile Kingdom Trust — custody transition date ↗Choice — Kingdom Trust and Digital Trust relationship ↗

Prime Trust

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Nevada's Financial Institutions Division stated that Prime Trust failed to safeguard assets, could not meet all withdrawals and was placed into court-supervised receivership.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Historical profile only. Do not treat Prime Trust as an active custody candidate or route introductions.
Procurement caveat: Historical profile only. Do not treat Prime Trust as an active custody candidate or route introductions.

Provider profile Nevada FID — receivership petition ↗Nevada FID — cease-and-desist statement ↗

Curv

Wallet Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: PayPal acquired Curv in 2021 as digital-asset security and wallet technology; Curv is not presented as a standalone current legal custodian.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not shortlist the legacy Curv brand as an independent custodian. Identify the current PayPal product and legal custody arrangement.
Procurement caveat: Do not shortlist the legacy Curv brand as an independent custodian. Identify the current PayPal product and legal custody arrangement.

Provider profile PayPal — acquisition of Curv ↗

Tetra Trust

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Tetra Trust states it is a regulated Canadian trust company providing institutional digital-asset custody.
Security: Tetra states it has completed multiple SOC 2 Type II examinations without qualifications and publishes security-focused custody controls.
Asset protection: Tetra states client assets can be held in segregated custody accounts and cold storage; it also publishes proof-of-reserves information.
Procurement caveat: Confirm the precise account structure, asset eligibility, insurance and current regulatory permissions for the mandate before onboarding.

Provider profile Tetra Trust ↗Tetra custody controls ↗Tetra / Wealthsimple custody ↗

Aquanow

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Aquanow operates regulated entities in several jurisdictions. Its UAE disclosures allow direct incidental custody for broker-dealer clients, while other legal entities may not provide custody.
Security: Aquanow states that its control framework includes ISO 27001:2022 and SOC 2-related assurance.
Asset protection: UAE disclosures describe direct incidental custody and use of an external custodian such as Zodia in some arrangements; treatment varies by product and entity.
Procurement caveat: Custody is legal-entity and jurisdiction specific. For example, Aquanow disclosures for Türkiye state that the local entity does not provide custody. Confirm the contracting entity before comparison.

Provider profile Aquanow ↗Aquanow banks & brokerages ↗Aquanow UAE risk disclosure ↗Aquanow Türkiye risk disclosure ↗

Ledn

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Ledn offers holding, trading and bitcoin-backed lending; its current materials describe collateral held in segregated or bankruptcy-remote custody.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Ledn is primarily a lending/wealth platform. Confirm the actual custodian, rehypothecation terms, funding structure and jurisdiction for each product.
Procurement caveat: Ledn is primarily a lending/wealth platform. Confirm the actual custodian, rehypothecation terms, funding structure and jurisdiction for each product.

Provider profile Ledn — current platform and custody statements ↗Ledn — custodied loans ↗

Nexo Institutional

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Nexo Prime markets institutional custody while naming Fireblocks and Ledger Vault in its custody framework; EEA custody can be provided by Tangany and DLT Finance.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Nexo branding is not sufficient to identify the legal custodian. Confirm partner, entity, jurisdiction and product terms.
Procurement caveat: Nexo branding is not sufficient to identify the legal custodian. Confirm partner, entity, jurisdiction and product terms.

Provider profile Nexo Prime — institutional services ↗Nexo EEA — custody entity disclosure ↗

CoinShares

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: CoinShares is a digital-asset manager and product issuer; its ETP assets are held with external custodians such as Komainu, Coinbase Custody and BitGo.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not classify CoinShares itself as the legal custodian merely because its products hold digital assets.
Procurement caveat: Do not classify CoinShares itself as the legal custodian merely because its products hold digital assets.

Provider profile CoinShares — ETP custody model ↗CoinShares — Bitcoin ETF custodians ↗

Zerohash

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Zero Hash documentation states that Zero Hash Trust is a North Carolina-chartered non-depository trust company; the group also holds U.S. money-transmission/BitLicense permissions and other registrations.
Security: Zero Hash publishes SOC 1 Type II, SOC 2 Type II, ISO 27001:2022 and Regulation SCI-related assurance/control coverage.
Asset protection: Custody documentation states client assets are held in segregated accounts and not commingled with company funds; wallet- or ledger-level segregation options are described.
Procurement caveat: Differentiate Zero Hash LLC, Zero Hash Trust and non-U.S. group entities when assessing licences and safeguarding.

Provider profile Zero Hash custody docs ↗Zero Hash security ↗Zero Hash Trust Center ↗

B2C2

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: B2C2 describes itself as an institutional digital-asset liquidity provider. In a 2026 settlement integration it states B2C2 will custody assets with Anchorage Digital Bank, confirming a separate custody provider.
Security: Custody-specific security controls belong to the connected custodian, not B2C2’s liquidity role.
Asset protection: In the cited Anchorage integration, assets are custodied with Anchorage Digital Bank while B2C2 supplies institutional liquidity and settlement connectivity.
Procurement caveat: Directory category is retained for URL/taxonomy stability, but evidence does not support treating B2C2 itself as the legal asset custodian.

Provider profile B2C2 — company role/institutional liquidity ↗B2C2 — Anchorage custody integration ↗

FalconX

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: FalconX markets integrated institutional custody and staking. In the U.S., its 2026 qualified-custody workflow places assets with NYDFS-regulated Fireblocks Trust while FalconX supplies the integrated prime-brokerage interface.
Security: FalconX documents MPC, configurable policies and insurance for its custody offering; its U.S. qualified-custody integration uses segregated, bankruptcy-remote wallets at Fireblocks Trust.
Asset protection: Asset segregation and bankruptcy-remoteness are explicitly described for the Fireblocks Trust qualified-custody workflow; other FalconX custody arrangements require entity-specific confirmation.
Procurement caveat: Do not assume that the same FalconX entity is the legal custodian in every jurisdiction; U.S. qualified custody is explicitly provided by Fireblocks Trust.

Provider profile FalconX — custody ↗FalconX — qualified custody via Fireblocks Trust ↗FalconX — licences ↗

Galaxy Digital

Wallet Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Galaxy markets flexible custody infrastructure that institutions can deploy on-premises, in their cloud, through Galaxy infrastructure or in hybrid architectures while retaining control over policies and governance.
Security: Galaxy documents an always-offline Impenetrable Vault architecture with no inbound network communication and also offers MPC-based flexibility. Its site states up to $1 billion insurance per client for each Impenetrable Vault, subject to terms.
Asset protection: The infrastructure model is designed for institutional control; legal asset protection depends on the institution and deployment model. Insurance availability must be confirmed against current policy terms and exclusions.
Procurement caveat: Do not infer that Galaxy Digital is the legal asset custodian from the custody-infrastructure product. Confirm the operating and contracting entity and who legally controls/safeguards assets.

Provider profile Galaxy — Custody Infrastructure ↗Galaxy — Impenetrable Vault ↗Galaxy — BNY digital asset infrastructure collaboration ↗

GSR

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: GSR's public materials establish market making, trading and liquidity activity, not a standalone legal custody service.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Custody references in GSR research are educational. Do not treat GSR as a custodian without entity-specific primary evidence.
Procurement caveat: Custody references in GSR research are educational. Do not treat GSR as a custodian without entity-specific primary evidence.

Provider profile GSR — company ↗GSR — digital-asset reference pack ↗

Wintermute

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Wintermute explicitly states that its entities trade their own assets and do not manage, custody or hold assets for investors or customers.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Remove Wintermute from legal-custodian shortlists. It remains relevant as liquidity and market infrastructure.
Procurement caveat: Remove Wintermute from legal-custodian shortlists. It remains relevant as liquidity and market infrastructure.

Provider profile Wintermute — entity and no-custody disclosure ↗Wintermute — institutional liquidity role ↗

BitOasis Custody

Digital Asset Custodians · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: BitOasis operates regulated virtual-asset platform entities in the Middle East; the exact custody permission depends on the client entity and jurisdiction.
Security: The reviewed public terms refer to institutional-grade custody solutions but do not establish enough standalone independent-assurance evidence for the custody entity.
Asset protection: BitOasis terms state that client virtual assets are held in segregated wallets using institutional-grade custody solutions.
Procurement caveat: Verify whether custody is directly provided or outsourced for the specific legal entity, and obtain the current regulator permission and wallet/segregation terms.

Provider profile BitOasis terms ↗BitOasis ↗

Rain Institutional

Digital Asset Custodians · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Rain’s official materials describe regulated brokerage/custody operations in the UAE, including ADGM permissions for eligible services.
Security: Public material reviewed here does not provide enough current product-level independent assurance evidence for a separate security dimension.
Asset protection: Rain terms describe how client assets may be held and can involve locations outside ADGM; legal treatment is therefore entity- and product-specific.
Procurement caveat: Treat Rain as a regional regulated platform rather than a globally uniform qualified-custodian product. Review the precise terms for asset location and safeguarding.

Provider profile Rain about ↗Rain ADGM permission ↗

M2

Digital Asset Custodians · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: M2 disclosures identify M2 Custody Limited as regulated/authorized by the FSRA in ADGM for the relevant UAE service perimeter.
Security: M2 describes institutional security controls but this review did not establish enough public external-assurance material for a full security evidence dimension.
Asset protection: Custody is offered through the regulated ADGM structure; exact segregation, insurance and insolvency protections should be confirmed in client documentation.
Procurement caveat: Availability is jurisdiction-restricted. Confirm UAE residency/eligibility requirements and the contracting M2 entity.

Provider profile M2 ↗M2 regulatory / restricted locations ↗

Laser Digital

Digital Asset Custodians · reviewed 17 Aug 2026

1/4 evidence dimensions

Regulation / role: Laser Digital announced OCC conditional approval in 2026 to establish Laser Digital National Trust Bank. Conditional approval is not the same as final authorization to operate the proposed U.S. trust bank.
Security: No sufficiently specific public custody-control assurance evidence was established for the proposed U.S. custody bank in this review.
Asset protection: The proposed U.S. trust bank is intended to provide federally supervised fiduciary trust services, but final operating safeguards depend on completion of OCC conditions and product launch.
Procurement caveat: Do not market Laser Digital National Trust Bank as fully operational or finally chartered until OCC conditions are satisfied and final authorization is confirmed.

Provider profile Laser Digital conditional approval ↗Laser Digital ↗

Nomura Digital

Digital Asset Custodians · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Nomura's digital-asset ecosystem includes specialist businesses such as Laser Digital and the Komainu custody venture; the group brand is not itself the custody contract.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Identify the operating entity, normally a specialist affiliate or venture, and do not transfer its licences to Nomura Holdings generally.
Procurement caveat: Identify the operating entity, normally a specialist affiliate or venture, and do not transfer its licences to Nomura Holdings generally.

Provider profile Laser Digital — institutional digital assets ↗Komainu — institutional custody ↗

SBI Digital Asset Holdings

Digital Asset Custodians · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: SBI Digital Asset Holdings oversees and invests in an ecosystem that includes trading, market infrastructure, security and custody ventures such as SBI Zodia Custody; the holding company itself is not established here as the legal custodian.
Security: Security/custody controls are implemented by operating subsidiaries and joint ventures rather than demonstrated at the holding-company level.
Asset protection: Asset protection must be evaluated at the specific SBI operating entity or JV that contracts with the client.
Procurement caveat: Do not transfer licences or custody status from SBI Zodia Custody, SBI VC Trade or other affiliates to SBI Digital Asset Holdings itself.

Provider profile SBI Group — AsiaNext/SBI DAH ecosystem and SBI Zodia Custody ↗SBI Group — SBI DAH businesses ↗

SBI VC Trade

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: SBI VC Trade operates as a Japanese regulated crypto-asset exchange service provider; customer asset safeguarding is subject to the Japanese exchange regulatory framework.
Security: Official materials describe customer crypto held in operator-controlled wallets, principally cold storage, with hot-wallet limits and operational security controls.
Asset protection: SBI VC Trade documentation describes segregation of customer crypto assets from proprietary holdings and corresponding safeguards for hot-wallet balances.
Procurement caveat: Classify this as exchange custody rather than a neutral third-party institutional custodian. Institutional procurement requirements may differ materially.

Provider profile SBI VC Trade security guidance ↗SBI VC Trade staking / account-held assets ↗

KODA

Digital Asset Custodians · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: KODA presents itself as a regulated/certified institutional digital-asset custodian in South Korea.
Security: KODA publishes ISMS/SOC-oriented controls and detailed custody security practices including cold-wallet operational controls.
Asset protection: KODA discloses institutional insurance coverage and controlled cold-wallet processes; exact policy wording and beneficiary treatment should still be requested.
Procurement caveat: Confirm the current Korean regulatory registration/licence status, insurance certificate and eligible asset list directly in procurement.

Provider profile KODA ↗KODA work guidelines ↗

BDACS

Digital Asset Custodians · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: BDACS describes itself as an institutional digital-asset custodian operating within South Korea’s regulated virtual-asset environment.
Security: BDACS describes institutional MPC/cold-storage controls and finance-grade security architecture; buyers should request current external assurance artifacts.
Asset protection: Public materials emphasize institutional safeguarding, but this review did not establish a universal public insurance/insolvency structure.
Procurement caveat: Verify current Korean regulatory status, licence/registration identifiers, insurance and customer-asset legal treatment before onboarding.

Provider profile BDACS custody ↗BDACS ↗

BNY Mellon Digital Assets

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: BNY is a regulated global custodian bank; its digital-asset custody platform has operated in the U.S. since 2022.
Security: Specific digital-asset SOC/ISO evidence was not independently verified in this review.
Asset protection: BNY states its digital-asset custody platform supports asset segregation and institutional compliance controls.
Procurement caveat: Confirm supported asset set, jurisdiction and operational model because availability can differ from BNY’s traditional custody footprint.

Provider profile BNY digital assets platform ↗BNY custody launch ↗BNY digital assets custody ↗

State Street Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: State Street is a regulated global custodian bank; the reviewed digital-asset materials describe capabilities delivered within its institutional asset-servicing framework.
Security: State Street says its Digital Asset Platform is underpinned by enhanced security, operational and on-chain compliance controls; public product-specific assurance details remain limited.
Asset protection: Public materials reviewed do not provide enough product-level detail to generalize segregation or insurance for every digital-asset use case.
Procurement caveat: Distinguish platform launch and rollout capabilities from currently available custody products in each jurisdiction and asset class.

Provider profile State Street Digital Asset Solutions ↗State Street Digital Asset Platform launch ↗

Northern Trust Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Northern Trust is an established regulated global custodian and asset servicer; the reviewed digital-asset work sits within that institutional framework.
Security: Public materials emphasize institutional controls and integration with core asset-servicing infrastructure but do not expose detailed digital-asset assurance reports in the reviewed sources.
Asset protection: The reviewed sources focus on institutional tokenized-asset workflows rather than publishing a universal crypto-asset segregation or insurance model.
Procurement caveat: Current evidence is strongest for tokenized financial assets. Do not infer broad spot-crypto custody availability without mandate-specific confirmation.

Provider profile Northern Trust tokenized asset custody ↗Northern Trust digital assets ↗

CACEIS

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: CACEIS received French PSAN status for digital-asset custody and reported institutional custody live in France and Luxembourg in 2026.
Security: CACEIS uses institutional custody infrastructure including Taurus technology; specific public service-level SOC/ISO evidence was not independently verified here.
Asset protection: Detailed digital-asset segregation/insolvency terms were not independently verified in this review.
Procurement caveat: CACEIS reported a staged country rollout; verify current availability in the target jurisdiction.

Provider profile CACEIS 2026 digital-assets update ↗CACEIS PSAN information ↗CACEIS digital-assets business line ↗

SIX Digital Exchange

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: SIX Digital Exchange states it is a FINMA-regulated CSD and received FINMA approval in 2026 to provide crypto custody.
Security: Specific public SOC/ISO evidence for the crypto-custody service was not independently verified in this review.
Asset protection: As a regulated CSD, SDX provides institutional custody infrastructure; detailed asset-specific insolvency treatment should be confirmed for the mandate.
Procurement caveat: Confirm which SDX entity/service covers the target asset and client jurisdiction.

Provider profile SDX homepage ↗SDX Web3 institutional services ↗

DBS Digital Exchange

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: DBS provides institutional digital custody within its regulated banking/digital-exchange ecosystem; exact service permissions vary by client/entity.
Security: Specific public SOC/ISO evidence for the digital-custody service was not independently verified in this review.
Asset protection: DBS describes institutional-grade custody; detailed segregation/insolvency treatment should be confirmed contractually.
Procurement caveat: Confirm eligibility, jurisdiction and whether custody is provided by DBS Bank or another group entity.

Provider profile DBS digital custody ↗DBS Digital Exchange ↗

Standard Chartered

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Standard Chartered announced a Luxembourg digital-asset custody entity and in June 2026 reported MiCA authorization supporting European custody operations; it also operates custody in the UAE.
Security: The bank describes institutional security and regulated-entity controls, but detailed custody-specific public SOC/ISO evidence was not established in this review.
Asset protection: Custody is provided through regulated bank/custody structures; exact client-asset segregation and contractual protections should be confirmed for the selected entity.
Procurement caveat: Confirm which Standard Chartered legal entity contracts the mandate, the asset list, MiCA passporting status and the applicable safeguarding terms.

Provider profile Standard Chartered digital assets ↗Luxembourg custody licence ↗2026 MiCA authorization ↗

BBVA Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: BBVA publicly announced Spanish regulatory clearance/notification under MiCA for bitcoin and ether trading/custody services.
Security: BBVA states it uses its own cryptographic-key custody platform; specific public SOC/ISO evidence for the service was not independently verified in this review.
Asset protection: Detailed digital-asset segregation/insolvency terms were not independently verified in this review.
Procurement caveat: Asset coverage is currently narrower than many crypto-native custodians; institutional availability should be confirmed separately from retail rollout.

Provider profile BBVA Spain custody announcement ↗BBVA service launch ↗

Commerzbank

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Commerzbank states it is authorized under Article 60 MiCAR for custody/administration and transfer services for crypto-assets.
Security: Commerzbank states the service runs on its own crypto-custody infrastructure; specific public SOC/ISO evidence for the service was not independently verified in this review.
Asset protection: Commerzbank states digital assets are fully segregated by client.
Procurement caveat: Confirm eligible client segment, asset scope and operational availability for each jurisdiction.

Provider profile Commerzbank crypto custody ↗Commerzbank MiCAR self-classification ↗

J.P. Morgan Digital Assets

Tokenization Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Kinexys Digital Assets is presented by J.P. Morgan as a multi-asset tokenization, settlement and collateral platform. The reviewed product pages do not present Kinexys Digital Assets itself as a standalone third-party digital-asset custodian.
Security: Platform security and operational controls are institutionally governed, but this review did not establish custody-specific assurance evidence because Kinexys is classified here as infrastructure rather than the legal asset custodian.
Asset protection: Not treated as a custody-provider claim. Asset ownership, custody and collateral arrangements depend on the specific Kinexys application and connected Securities Services/custodian structure.
Procurement caveat: Do not infer a standalone custody service from J.P. Morgan bank status or from Kinexys tokenization activity; verify the separate Securities Services custody chain for any mandate.

Provider profile J.P. Morgan — Kinexys Digital Assets ↗J.P. Morgan — About Kinexys ↗J.P. Morgan — Tokenized Collateral Network ↗

HSBC Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: HSBC is a major regulated custodian bank. Its current public materials describe digital-asset custody as part of its institutional securities-services development.
Security: HSBC describes bank-grade safeguarding expectations and institutional controls, but the reviewed source does not establish product-specific external assurance for the developing custody service.
Asset protection: HSBC discusses segregation as a core institutional custody requirement; the exact structure for the developing tokenized-securities custody service remains mandate-specific.
Procurement caveat: Do not present the developing tokenized-securities custody proposition as broad live cryptocurrency custody. Confirm product availability and jurisdiction.

Provider profile HSBC digital assets & currencies ↗HSBC institutional digital-assets perspective ↗

BNP Paribas Securities Services

Custody Banks · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: BNP Paribas Securities Services has participated in digital-asset custody development and in a 2026 public-blockchain fund pilot operated the wallet setup and held the private key.
Security: The reviewed public material establishes controlled private-key handling but does not provide a public general-purpose crypto-custody assurance package.
Asset protection: In the cited 2026 pilot, Securities Services operated the wallet and held the private key within a controlled regulated setup.
Procurement caveat: The 2026 cited setup was a controlled one-off intra-group pilot; do not infer that every BNP Paribas Securities Services entity offers broad crypto custody commercially.

Provider profile BNP Paribas — public blockchain fund tokenisation pilot ↗

Société Générale Securities Services

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: SGSS provides established local and global securities custody. Public evidence for generalized crypto custody under the SGSS brand is narrower and product-specific.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not transfer SG-FORGE crypto permissions to SGSS. Confirm the precise Societe Generale entity and asset type.
Procurement caveat: Do not transfer SG-FORGE crypto permissions to SGSS. Confirm the precise Societe Generale entity and asset type.

Provider profile SGSS — services and locations ↗

Société Générale FORGE

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: SG-FORGE states that it is a French investment firm licensed as a Crypto-Asset Service Provider and authorized for custody and administration of crypto-assets.
Security: SG-FORGE has publicly described institutional custody technology integrations, including orchestration through Metaco infrastructure; product-level assurance evidence should still be requested.
Asset protection: The regulated custody authorization creates a defined legal service perimeter, but contractual segregation and insolvency treatment remain mandate-specific.
Procurement caveat: Confirm the exact service, asset eligibility and contracting entity because SG-FORGE spans tokenized securities, stablecoin and crypto-asset activities.

Provider profile SG-FORGE legal information ↗SG-FORGE DASP/CASP licence ↗

UBS Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: UBS is a regulated global bank; its digital-asset offering is delivered within bank and securities-service frameworks.
Security: Public UBS material reviewed here does not provide sufficient product-specific security assurance detail for a standalone crypto-custody rating.
Asset protection: The reviewed evidence concerns regulated tokenized financial products rather than a universal third-party cryptocurrency safeguarding model.
Procurement caveat: Evidence is strongest for tokenized financial instruments. Confirm whether the intended mandate involves tokenized securities or native crypto assets.

Provider profile UBS Tokenize ↗

Deutsche Bank Digital Assets

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Deutsche Bank and Taurus publicly announced a partnership to build/provide digital-asset custody and tokenization services; current product availability should be confirmed.
Security: Taurus technology used in the partnership has published ISO 27001:2022 certification; Deutsche Bank service-specific assurance was not independently verified here.
Asset protection: Detailed segregation and insolvency treatment for a live Deutsche Bank mandate were not independently verified in this review.
Procurement caveat: Treat this as a confirmed strategic custody program, not as proof that every product/jurisdiction is commercially live today.

Provider profile Deutsche Bank Flow custody partnership ↗Taurus / Deutsche Bank partnership ↗

Citi Digital Assets

Custody Banks · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Citi states it is investing in digital-asset custody, plans institutional digital-asset custody services in 2026, and acts as custodian for its 2026 Digital Depositary Receipts product.
Security: Custody-specific public assurance details for the new digital-asset service were not established in this review; buyers should request current control reports and architecture documentation.
Asset protection: Citi states it acts as custodian for tokenized Digital Depositary Receipts; broader digital-asset safekeeping terms, segregation and insolvency treatment remain product- and entity-specific.
Procurement caveat: Confirm the specific Citi legal entity, jurisdiction, supported asset types and whether the requested digital-asset custody service is live for the mandate.

Provider profile Citi — Making It Real: Digital Assets ↗Citi — Where Can We Take You in 2026? ↗Citi — Digital Depositary Receipts launch ↗

Clearstream

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Clearstream operates regulated securities depositories and custody infrastructure; its digital issuance and custody propositions are embedded in that market-infrastructure framework.
Security: Clearstream describes regulatory-compliant crypto/digital custody infrastructure, but product-level cyber assurance artifacts were not independently established in this review.
Asset protection: Digital assets and tokenized securities are supported through account and depository structures; buyers should confirm legal asset segregation for the instrument and venue.
Procurement caveat: Clearstream is primarily a regulated securities-market infrastructure provider. Do not equate digital-securities custody with broad native-crypto custody.

Provider profile Clearstream digital issuance ↗

Fidelity Digital Assets

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Fidelity Digital Assets has historically operated a New York trust-company custody entity; current mandate scope should be confirmed against current entity documentation.
Security: Fidelity publishes physical, cyber and operational controls around its institutional cold-storage custody environment.
Asset protection: Specific current insurance/segregation terms were not independently verified in this review.
Procurement caveat: Verify current legal entity, asset coverage and custody terms before relying on older regulatory filings.

Provider profile Fidelity trading & custody ↗SEC-hosted Fidelity custody filing ↗

DZ BANK

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: DZ BANK’s current institutional product site states that it offers professional custody and transfer of crypto-assets to institutional clients.
Security: Specific public SOC/ISO evidence for the digital-custody service was not independently verified in this review.
Asset protection: Detailed legal segregation/insurance terms were not independently verified in this review.
Procurement caveat: Confirm asset coverage, client eligibility and current regulatory perimeter for the mandate.

Provider profile DZ BANK institutional crypto products ↗DZ BANK custody platform launch ↗

DekaBank

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: DekaBank public reporting states that it obtained a crypto-custody licence in December 2024 and can cover digital-asset value-chain activities.
Security: The reviewed public reporting does not expose sufficient crypto-custody-specific security assurance detail for an independent security evidence dimension.
Asset protection: As a regulated bank/custodian, DekaBank applies institutional asset-servicing controls, but mandate-specific digital-asset segregation should be confirmed.
Procurement caveat: Confirm current commercial availability, asset scope and whether the mandate concerns crypto securities, native crypto assets or both.

Provider profile DekaBank 2025 annual report ↗

LBBW

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: LBBW is a regulated German bank. Its public materials describe a cryptocurrency custody proposition for corporate clients implemented with Bitpanda technology/infrastructure.
Security: LBBW states the partner model is intended to provide regulated and secure infrastructure, but public custody-specific assurance evidence for the full operating chain is limited.
Asset protection: Because the service uses partner infrastructure, buyers should establish which entity legally safeguards assets and how client assets are segregated through the custody chain.
Procurement caveat: This is partner-enabled custody rather than proof that LBBW independently operates every technical custody component. Verify the legal custodian/sub-custodian chain.

Provider profile LBBW / Bitpanda custody partnership ↗

Bank Frick

Custody Banks · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Bank Frick announced MiCAR authorization in January 2026 for crypto-asset services including custody, order handling and transfers across the EEA.
Security: Bank Frick publishes custody policy and operational/security controls for crypto-asset safeguarding within its regulated banking environment.
Asset protection: Its custody policy describes safeguarding of crypto-assets/private keys and the legal/operational treatment of client assets under the applicable framework.
Procurement caveat: Confirm supported assets, country availability and the precise Bank Frick service/entity used by the buyer.

Provider profile Bank Frick MiCAR authorization ↗Bank Frick blockchain banking ↗Bank Frick crypto custody policy ↗

VP Bank

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: VP Bank documents a digital custody solution for tokenized ownership rights in physical assets such as art, watches and collectibles.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: This evidence does not establish broad cryptocurrency custody. Confirm eligible instruments, legal structure and client access.
Procurement caveat: This evidence does not establish broad cryptocurrency custody. Confirm eligible instruments, legal structure and client access.

Provider profile VP Bank — digital custody innovation ↗

Julius Baer

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Julius Baer provides digital-asset services within its regulated private-banking framework.
Security: The reviewed public materials emphasize secure bank-grade handling but do not disclose enough product-specific technical assurance detail for a separate security verification.
Asset protection: Client digital assets can be stored through the bank’s offering; exact custody chain, segregation and sub-custodian structure should be confirmed for the mandate.
Procurement caveat: This is a private-bank service, not a generic open custody platform. Eligibility, jurisdictions and asset list can be restrictive.

Provider profile Julius Baer digital assets ↗

Maerki Baumann

Custody Banks · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Maerki Baumann provides digital-asset services through its regulated Swiss private-bank framework.
Security: The bank describes multi-level security controls for digital-asset custody, though independent assurance-report scope should be requested for institutional procurement.
Asset protection: Its current custody page describes segregated or omnibus wallet structures, making account architecture an explicit procurement choice.
Procurement caveat: Confirm whether the mandate uses segregated or omnibus wallets and obtain current custody terms, sub-custodian details and supported-asset list.

Provider profile Maerki Baumann trading & custody ↗

Arab Bank Switzerland

Custody Banks · reviewed 17 Aug 2026

2/4 evidence dimensions

Regulation / role: Arab Bank Switzerland offers digital-asset services from its regulated Swiss banking platform.
Security: Public materials describe secure institutional service delivery but do not provide enough specific external-assurance evidence for this review.
Asset protection: Digital assets are safeguarded within the bank’s custody offering; exact account and sub-custody structure should be confirmed contractually.
Procurement caveat: Confirm asset coverage, client eligibility, sub-custody chain and jurisdiction before procurement.

Provider profile Arab Bank Switzerland digital assets ↗

DBS Bank

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: DBS documents an integrated institutional digital-asset exchange and bank custody service using institutional cold wallets separate from the exchange.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Access is limited to eligible institutional, accredited or wealth clients and supported assets; confirm jurisdiction and product eligibility.
Procurement caveat: Access is limited to eligible institutional, accredited or wealth clients and supported assets; confirm jurisdiction and product eligibility.

Provider profile DBS — digital exchange and custody launch ↗DBS — custody and exchange growth ↗

OCBC Digital Assets

Custody Banks · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: OCBC states its asset-tokenisation capability covers the lifecycle from minting and ownership transfer through custody and redemption; recent projects focus on tokenized securities/funds.
Security: Bank governance and regulated project controls are documented; a dedicated public crypto-custody security architecture was not established in this review.
Asset protection: Custody evidence is strongest for tokenized financial assets and controlled bank workflows rather than generalized crypto safekeeping.
Procurement caveat: The reviewed evidence supports tokenized-asset custody capability but does not establish a broad retail or institutional crypto-custody catalogue for all digital assets.

Provider profile OCBC — tokenised bonds platform/custody lifecycle ↗OCBC — 2026 tokenised gold fund ↗

UOB Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: UOB participates in tokenization and digital-asset experiments, while cited custody in a 2025 green-bond project was performed by Northern Trust.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not present UOB as a broad crypto custodian without a current UOB source establishing the service and contracting entity.
Procurement caveat: Do not present UOB as a broad crypto custodian without a current UOB source establishing the service and contracting entity.

Provider profile UOB — green-bond tokenization with Northern Trust custody ↗

MUFG Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: MUFG runs digital-asset and tokenization initiatives, but a generalized crypto custody service under the broad MUFG Digital Assets label was not established.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Confirm the specific bank, trust-bank or Progmat-related operating entity and do not infer custody from group innovation activity alone.
Procurement caveat: Confirm the specific bank, trust-bank or Progmat-related operating entity and do not infer custody from group innovation activity alone.

Provider profile MUFG — digital transformation initiatives ↗

SMBC Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: SMBC documents stablecoin research with TIS, Ava Labs and Fireblocks, but this does not establish SMBC as a live general crypto custodian.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Treat as a bank digital-assets initiative until a current primary source establishes service availability, entity and custody terms.
Procurement caveat: Treat as a bank digital-assets initiative until a current primary source establishes service availability, entity and custody terms.

Provider profile SMBC/TIS — stablecoin joint study ↗

Mizuho Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Mizuho participates in security-token, DeFi and digital-collateral initiatives; its broader global custody business outside Japan was agreed for transfer to State Street.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not infer generalized crypto custody from tokenization pilots. Confirm Mizuho entity, geography, asset type and post-transfer service scope.
Procurement caveat: Do not infer generalized crypto custody from tokenization pilots. Confirm Mizuho entity, geography, asset type and post-transfer service scope.

Provider profile Mizuho — security-token transfer pilot ↗State Street — acquisition of Mizuho global custody business ↗

NAB Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: This review did not establish a current general digital-asset custody service from NAB primary materials.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Keep as a discovery record only. Require a current official product page, contracting entity and custody terms before comparison or introduction.
Procurement caveat: Keep as a discovery record only. Require a current official product page, contracting entity and custody terms before comparison or introduction.

Provider profile NAB — official corporate site ↗

ANZ Digital Assets

Custody Banks · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: ANZ documents A$DC and Project Guardian tokenization work, not a broad third-party crypto custody service.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not infer legal custody from stablecoin issuance or tokenization experiments. Confirm current product and entity before shortlisting.
Procurement caveat: Do not infer legal custody from stablecoin issuance or tokenization experiments. Confirm current product and entity before shortlisting.

Provider profile ANZ — Project Guardian and A$DC ↗

Alchemy

Wallet Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Alchemy describes itself as a blockchain developer and infrastructure platform providing APIs, nodes, data and developer tooling.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not classify Alchemy as a legal custodian. Applications built on Alchemy need their own custody model and responsible entity.
Procurement caveat: Do not classify Alchemy as a legal custodian. Applications built on Alchemy need their own custody model and responsible entity.

Provider profile Alchemy — platform ↗Alchemy — company and role ↗

Dfns

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Dfns provides wallet, key, policy and transaction infrastructure that lets banks, fintechs and custodians launch custody under their own regulatory and control model.
Security: Dfns documents MPC/HSM key-management options and separates key control from infrastructure control.
Asset protection: Who controls assets/keys depends on the configured custody model; Dfns does not impose one legal custody stance.
Procurement caveat: Dfns technology can power a custodian but the deploying institution remains responsible for the legal custody role unless a separate arrangement states otherwise.

Provider profile Dfns — core banking/custody platform ↗Dfns — Wallet as a Service ↗Dfns — HSM/key management ↗

Turnkey

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Turnkey explicitly describes its core wallet infrastructure as fully non-custodial, with customers retaining control of assets and keys.
Security: Turnkey documents secure-enclave key generation/access control and a verifiable audit trail; its architecture is designed to avoid provider custody.
Asset protection: The core product states customers retain full control of assets; legal custody remains with the customer/end user or another custodian.
Procurement caveat: A business can build custodial products using infrastructure, but Turnkey itself should not be classified as the legal custodian unless a separate arrangement says otherwise.

Provider profile Turnkey — wallet infrastructure ↗Turnkey — non-custodial compliance architecture ↗

Privy

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Privy provides embedded/user/treasury/agent wallets and programmable key infrastructure. Its custodial-wallet offering can be backed by a licensed custodian selected through the product stack.
Security: Privy documents TEE-based key management and programmable authorization; control architecture varies by wallet model.
Asset protection: In self-custodial setups users retain key control; in custodial setups a licensed custody arrangement/partner must be identified.
Procurement caveat: Do not treat Privy alone as the regulated custodian; custody responsibility depends on deployment and any licensed custody partner.

Provider profile Privy — digital asset infrastructure ↗Privy — custodial wallets ↗Privy — digital asset accounts/custody models ↗

Blockdaemon

Wallet Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Blockdaemon's Institutional Vault is self-hosted; Blockdaemon states it never holds or sees key shares and clients retain exclusive control.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: The technology can power regulated custody, but Blockdaemon is not automatically the legal custodian in a deployment.
Procurement caveat: The technology can power regulated custody, but Blockdaemon is not automatically the legal custodian in a deployment.

Provider profile Blockdaemon — institutional infrastructure ↗Blockdaemon — self-hosted independence ↗

Safe

Wallet Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Safe explicitly describes its wallet as self-custody: designated signers control assets and Safe cannot access or move funds.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Safe is not a third-party legal custodian. Institutions remain responsible for signer governance, recovery and legal controls.
Procurement caveat: Safe is not a third-party legal custodian. Institutions remain responsible for signer governance, recovery and legal controls.

Provider profile Safe — self-custody wallet ↗Safe — security and custody model ↗

Coinbase Custody

Exchange Custody · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Coinbase Custody Trust Company is a New York limited purpose trust company and qualified custodian under New York banking law.
Security: Coinbase Prime publishes SOC 1 Type II and SOC 2 Type II assurance for custody controls.
Asset protection: Coinbase markets segregated institutional custody; exact insurance and insolvency terms depend on entity/product documentation.
Procurement caveat: Distinguish Coinbase exchange services from the qualified-custody trust entity during due diligence.

Provider profile NYDFS Coinbase Custody charter ↗Coinbase Prime custody ↗Coinbase asset security ↗

Kraken Custody

Exchange Custody · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Kraken Custody is provided through Kraken Financial, a state-chartered bank in Wyoming.
Security: Kraken publishes institutional custody security controls; a current SOC/ISO attestation was not independently verified in this review.
Asset protection: Kraken states custody assets are fully segregated from the exchange and withdrawable.
Procurement caveat: Confirm availability, asset coverage and contracting terms by client jurisdiction.

Provider profile Kraken Custody ↗Kraken custody brochure ↗Kraken qualified custody release ↗

Gemini Custody

Exchange Custody · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Gemini Trust Company is a New York trust company and Gemini markets qualified custody under New York banking law.
Security: Gemini publishes SOC 1 Type II, SOC 2 Type II and ISO 27001:2022 assurance/certification.
Asset protection: Gemini states customer funds are held 1:1 and advertises cold-storage insurance for specified losses; policy terms and limits should be checked.
Procurement caveat: Insurance is not blanket protection against every loss scenario; review the policy scope and exclusions.

Provider profile NYDFS virtual currency list ↗Gemini institutional custody ↗Gemini trust center ↗

Bitstamp Institutional

Exchange Custody · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Bitstamp states customer crypto is held 1:1 in custody and uses third-party custodial partners including BitGo; current Bitstamp by Robinhood materials continue to describe custodian-backed cold storage.
Security: Bitstamp has described extensive cold storage and insurance provided through custodial partners; current percentages/policies should be confirmed before procurement.
Asset protection: Customer assets are described as held 1:1 and separated from corporate assets, with offline assets held through regulated custodial partners.
Procurement caveat: Bitstamp is the exchange/customer relationship, but legal safekeeping may be provided by third-party custodians. Confirm the current custodian by asset/entity.

Provider profile Bitstamp — custody with BitGo ↗Bitstamp — about/security and custodians ↗

Bullish

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Bullish documents full-reserve exchange custody and regulated custody permissions in Germany and New York.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Permissions and client protections are entity- and jurisdiction-specific; confirm the Bullish contracting entity for each mandate.
Procurement caveat: Permissions and client protections are entity- and jurisdiction-specific; confirm the Bullish contracting entity for each mandate.

Provider profile Bullish — New York custody licence ↗Bullish — Germany custody licences ↗

OKX Institutional

Exchange Custody · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: OKX states its EEA entity is MiCA-authorized and that the authorization includes custody and administration of crypto-assets; institutions may use OKX custody or selected off-exchange regulated partners.
Security: OKX’s EEA materials describe custody policy, client position records and segregation of client crypto assets from its own assets.
Asset protection: EEA terms state client crypto assets are held separately from OKX assets and custody records are maintained per client.
Procurement caveat: OKX is a global group. Confirm the legal entity, jurisdiction and custody route before treating a specific account as MiCA custody.

Provider profile OKX — institutional MiCA and custody ↗OKX — EEA terms/custody policy ↗

Bitfinex

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Bitfinex provides custodial exchange accounts and documents security controls for assets held on its platform.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Exchange safekeeping is not automatically qualified or independent third-party custody. Confirm entity, jurisdiction, segregation and insolvency treatment.
Procurement caveat: Exchange safekeeping is not automatically qualified or independent third-party custody. Confirm entity, jurisdiction, segregation and insolvency treatment.

Provider profile Bitfinex — security ↗Bitfinex — terms of service ↗

Crypto.com Custody

Exchange Custody · reviewed 17 Aug 2026

4/4 evidence dimensions

Regulation / role: Crypto.com announced conditional OCC approval for a national trust bank charter in February 2026; conditional approval is not the same as a completed charter.
Security: Crypto.com Custody Trust Company publishes SOC 1 Type II and SOC 2 Type II assurance.
Asset protection: Crypto.com describes segregated custody accounts/wallets and insurance coverage; exact terms should be reviewed contractually.
Procurement caveat: Do not present the OCC charter as final until completion is confirmed by the OCC.

Provider profile Crypto.com SOC reports ↗Crypto.com custody/staking ↗Crypto.com OCC conditional approval ↗

Binance Institutional

Exchange Custody · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Binance institutional workflows can use Ceffu, which describes itself as Binance Exchange’s institutional custody partner. Ceffu Custody FZE is separately regulated by Dubai VARA for custody services.
Security: Ceffu documents MPC/cold-custody controls and independent assurance certifications; these controls belong to the Ceffu custody stack, not automatically to every Binance account.
Asset protection: Ceffu states MirrorRSV assets remain safeguarded in qualified cold custody with segregation and on-chain verification.
Procurement caveat: Binance branding must not be treated as proof that Binance itself is the legal custodian. Confirm whether assets are held on exchange or under a Ceffu entity and which jurisdiction applies.

Provider profile Ceffu — about institutional custody partnership ↗Ceffu Custody FZE — VARA custody entity ↗Ceffu — MirrorRSV ↗

Bybit Institutional

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Bybit describes ByCustody as an institutional custody framework with client-asset segregation inside its broader exchange and financial platform.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Confirm the contracting entity, jurisdiction, legal segregation and whether assets remain exchange-custodied or use an external custodian.
Procurement caveat: Confirm the contracting entity, jurisdiction, legal segregation and whether assets remain exchange-custodied or use an external custodian.

Provider profile Bybit — 2026 platform and ByCustody overview ↗

Gate Institutional

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Gate's institutional service describes secure custody as one module alongside trading, lending, APIs and operational support.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Confirm which Gate legal entity holds assets and whether the mandate uses exchange custody or an independent custodian.
Procurement caveat: Confirm which Gate legal entity holds assets and whether the mandate uses exchange custody or an independent custodian.

Provider profile Gate — institutional service upgrade ↗

KuCoin Institutional

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: KuCoin Institutional includes custody within its exchange platform and separately supports an off-exchange arrangement with Cactus Custody.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Identify whether KuCoin or Cactus is the legal custodian for the selected workflow and confirm jurisdictional availability.
Procurement caveat: Identify whether KuCoin or Cactus is the legal custodian for the selected workflow and confirm jurisdictional availability.

Provider profile KuCoin — Institutional launch ↗KuCoin — Cactus Custody off-exchange solution ↗

Bitget Institutional

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Bitget documents exchange custodial accounts and multiple third-party custody connections including Copper, Cactus, Fireblocks, OSL and Bitfire.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Custody responsibility differs by route. Confirm the actual custodian, entity and settlement agreement.
Procurement caveat: Custody responsibility differs by route. Confirm the actual custodian, entity and settlement agreement.

Provider profile Bitget — institutional custody ↗

HTX Institutional

Exchange Custody · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: HTX Institutional describes third-party custody where client assets stay with external custodians and HTX has no access to private keys.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Treat HTX as the trading venue in this model, not the legal custodian. Verify the selected third-party custodian and tri-party agreement.
Procurement caveat: Treat HTX as the trading venue in this model, not the legal custodian. Verify the selected third-party custodian and tri-party agreement.

Provider profile HTX Institutional — third-party custody ↗

Deribit

Exchange Custody · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Deribit FZE membership terms define custody of virtual assets transferred to accounts and require segregation where Deribit provides custody. Deribit also supports third-party/hybrid custody.
Security: Current terms specify asset segregation for Deribit-provided custody; third-party custody controls belong to the selected custodian.
Asset protection: Deribit terms state clients retain legal title to crypto assets held in custody/margin, subject to applicable law and the contractual structure.
Procurement caveat: Custody responsibility changes with the selected model; under third-party custody the external custodian remains solely responsible for custody and transfer services.

Provider profile Deribit — FZE membership terms ↗Deribit — hybrid custody ↗

LMAX Digital

Exchange Custody · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: LMAX Digital states it is regulated by the Gibraltar Financial Services Commission as a DLT provider for execution and custody services.
Security: LMAX documents tiered offline cold/vault wallets, multisignature controls, offline HSM processes and geographically separated key storage.
Asset protection: Client coins are described as held in cold or vault storage, with the majority in fully offline vault wallets.
Procurement caveat: Confirm the current asset list, legal entity and jurisdictional eligibility for the mandate.

Provider profile LMAX Digital — custody technology ↗LMAX Digital — overview ↗

CME CF Custody Network

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: CME CF materials establish cryptocurrency reference rates and benchmarks, not a legal custody network operated by CME CF.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: The directory name may imply custody. Keep outside normal custody comparison until a current primary source establishes a contracting custody service.
Procurement caveat: The directory name may imply custody. Keep outside normal custody comparison until a current primary source establishes a contracting custody service.

Provider profile CME Group — cryptocurrency benchmarks ↗

Cboe Digital

Status Watch · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Cboe states that Cboe Digital no longer operates a spot digital-asset market and surrendered the related state licences; digital-asset futures moved to Cboe Futures Exchange.
Security: Only controls explicitly stated in the cited primary sources should be relied on; request current assurance reports during due diligence.
Asset protection: Do not list Cboe Digital as a current spot custody candidate. Cboe's current role is derivatives and clearing infrastructure.
Procurement caveat: Do not list Cboe Digital as a current spot custody candidate. Cboe's current role is derivatives and clearing infrastructure.

Provider profile Cboe — current U.S. regulation status ↗Cboe — digital business update ↗

Bitpanda Custody

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Bitpanda Enterprise markets regulated institutional custody across the UK, EU and MENA, with custodial and non-custodial deployment options.
Security: Bitpanda documents certified HSM-backed key custody, policy approvals, immutable audit logs and high-availability architecture.
Asset protection: Custodial deployments place key safeguarding with the relevant Bitpanda entity; non-custodial deployments shift responsibility to the partner.
Procurement caveat: The precise legal entity and regulatory permission differ by region; confirm which entity holds keys and client assets.

Provider profile Bitpanda Enterprise — institutional custody ↗Bitpanda Enterprise — overview ↗

Ripple Custody

Tokenization Infrastructure · reviewed 17 Aug 2026

3/4 evidence dimensions

Regulation / role: Ripple offers institutional custody technology and owns Standard Custody & Trust Company, a New York limited purpose trust company.
Security: Specific current SOC/ISO assurance for Ripple Custody was not independently verified in this review.
Asset protection: Regulated asset holding may be provided by Standard Custody or another entity; technology and regulated-custodian roles must be separated in due diligence.
Procurement caveat: Do not equate the Ripple technology brand with a single regulated custody legal entity; verify the contracting entity.

Provider profile Ripple institutional platform ↗Ripple / Standard Custody acquisition ↗NYDFS Standard Custody charter ↗

Securitize

Tokenization Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Securitize operates through regulated affiliates including an SEC-registered broker-dealer, an SEC-registered transfer agent and an ATS. Reviewed materials distinguish these roles from the legal custodian of underlying fund assets.
Security: No custody-specific key-management assurance was treated as applicable because Securitize is classified here as tokenization/securities infrastructure rather than the legal third-party custodian.
Asset protection: Underlying securities custody depends on the product structure and appointed custodian. For example, Securitize materials for VanEck VBILL name State Street Bank and Trust Company as custodian of fund assets.
Procurement caveat: Do not classify Securitize as the underlying asset custodian merely because it provides issuance, transfer-agent, broker-dealer, ATS or fund-administration services.

Provider profile FINRA BrokerCheck — Securitize Markets, LLC ↗FINRA ATS list — Securitize Markets ATS ↗SEC filing — Securitize regulated affiliates ↗Securitize — VanEck VBILL launch / State Street custodian ↗

Archax

Digital Asset Custodians · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Archax describes itself as an FCA-regulated digital asset exchange, broker and custodian and operates custody for cryptocurrencies and regulated digital assets.
Security: Archax states its custody uses Fireblocks MPC technology; current assurance reports and insurance terms should be requested during due diligence.
Asset protection: Archax states client assets are segregated and held in an insolvency-remote custody structure; legal treatment remains contract/entity specific.
Procurement caveat: Confirm the Archax legal entity, permission scope and asset eligibility for the intended mandate.

Provider profile Archax — regulated digital asset infrastructure ↗Archax — custody service ↗Archax — custody and TA expansion ↗

Figure

Wallet Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Figure Markets states its MPC wallets provide decentralized/self custody and its terms describe Figure Wallets as self-custody or unhosted multi-signature wallets.
Security: The reviewed material identifies MPC and unhosted/self-custody architecture; custody-specific third-party safekeeping assurance is therefore not the correct classification.
Asset protection: Users are described as retaining self-custody/control in Figure Wallets for relevant assets.
Procurement caveat: Do not treat Figure Markets’ self-custody wallet offering as evidence that Figure is the third-party legal custodian of user assets.

Provider profile Figure Markets — platform/self custody ↗Figure Markets — terms of service ↗

Canton Network

Tokenization Infrastructure · reviewed 18 Aug 2026

2/4 evidence dimensions

Regulation / role: Canton Network is an institutional blockchain network for tokenization, settlement, financing and related workflows. Canton explicitly describes a custody ecosystem with separate custody and wallet providers rather than acting as the custodian itself.
Security: Canton emphasizes privacy, permissioning, application-level control and institutional interoperability. Custody security remains the responsibility of the chosen wallet/custody provider and participant architecture.
Asset protection: Not a custody-provider claim. Canton materials state participants can choose self-custodial or fully custodial options through its wallet and custody ecosystem.
Procurement caveat: Do not classify Canton Network as a custody provider. Custody and signing authority remain with connected custodians, wallets or participating institutions.

Provider profile Canton Network — homepage / DTCC tokenization ↗Canton Network — FAQ ↗Canton Network — custody ecosystem and wallet stack ↗

Partior

Tokenization Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Partior presents itself as global blockchain settlement infrastructure for real-time clearing, atomic settlement, tokenized deposits and regulated digital money.
Security: Security and resilience are infrastructure concerns, but this review found no custody-specific assurance claim that would make Partior a legal custodian.
Asset protection: Partior settles claims/digital money across its network; custody of underlying assets remains with relevant banks, issuers, wallets or connected custodians.
Procurement caveat: The reviewed sources do not establish Partior as a third-party digital-asset custodian.

Provider profile Partior — settlement network ↗Partior — our story/unified ledger ↗

Fnality

Tokenization Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Fnality operates the Sterling Fnality Payment System, a regulated DLT-based wholesale payment system using settlement balances backed 1:1 by funds held at central bank.
Security: The reviewed materials emphasize regulated payment-system design, central-bank backing and bankruptcy-remote settlement balances rather than custody controls.
Asset protection: Settlement balances are backed 1:1 by funds held at central bank under the Fnality system design; that is settlement-asset protection, not customer crypto custody.
Procurement caveat: A regulated wholesale payment system is not the same as a digital-asset custodian. Do not classify Fnality as legal safekeeper of investor crypto assets.

Provider profile Fnality — payment systems ↗Fnality — Sterling payment operations ↗

21X

Tokenization Infrastructure · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: 21X operates an EU-regulated DLT Trading and Settlement System for tokenized financial instruments. Its public materials distinguish the market infrastructure from separate digital-custody partners such as Cashlink.
Security: The reviewed sources establish regulated market infrastructure but do not establish a standalone custody-security assurance package for 21X as legal custodian.
Asset protection: Asset recordkeeping and settlement occur within the DLT TSS; where separate custody is required, the legal custody chain must be verified independently.
Procurement caveat: Do not infer a standalone 21X crypto-custody service from the DLT TSS framework; custody and key safeguarding may be delivered by participants or partners.

Provider profile 21X — services ↗21X — EU DLT TSS licence ↗21X — Cashlink custody collaboration ↗

Ondo Finance

Tokenization Infrastructure · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Ondo documents tokenized securities structures in which underlying assets are held with U.S.-registered custodial broker-dealers and, in European institutional workflows, Clearstream provides custody, settlement and collateralization.
Security: Ondo documents independent smart-contract audits for Ondo Stocks, but those controls are distinct from legal custody of the underlying securities.
Asset protection: Ondo states underlying Ondo Stocks holdings are held with one or more U.S.-registered custodial broker-dealers and are subject to daily third-party attestations; Clearstream is being integrated for institutional custody and post-trade workflows in Europe.
Procurement caveat: Ondo is the tokenization/issuer layer in the reviewed structures, not the legal custodian of the underlying securities.

Provider profile Ondo — Trust & Transparency ↗Ondo — Clearstream and 360X partnership ↗Ondo — U.S. custodial tokenized securities launch ↗

Circle

Digital Asset Custodians · reviewed 18 Aug 2026

3/4 evidence dimensions

Regulation / role: Circle documents a Direct End-User Custody model for Digital Asset Accounts in which Circle handles custody, compliance and regulatory oversight. Circle also states Circle National Trust received final OCC approval in July 2026 and, upon opening, will provide fiduciary digital-asset custody for Circle and affiliates.
Security: This review established custody and segregation claims but did not establish a public custody-specific SOC/ISO assurance package for the Digital Asset Accounts service.
Asset protection: Circle states funds in Digital Asset Accounts are held in secure, segregated custody managed by Circle. Contractual account structure and insolvency treatment should be confirmed for the specific product and entity.
Procurement caveat: Confirm the current contracting entity and whether Circle National Trust is operational for the requested service; its announced trust-bank custody scope is affiliate-focused.

Provider profile Circle — Digital Asset Accounts ↗Circle developer docs — Digital Asset Accounts ↗Circle — final OCC approval for Circle National Trust ↗OCC — 2025 digital-asset trust charter approvals ↗

Chainalysis

Compliance & Security · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Chainalysis provides blockchain data, analytics and compliance tools to banks, custodians, exchanges and public-sector users; it is not presented as an asset custodian.
Security: The platform supplies risk/compliance intelligence; key-management or asset-safekeeping controls are not its product role.
Asset protection: No customer asset custody claim established; Chainalysis is a compliance/risk layer used around custody operations.
Procurement caveat: Do not infer custody from Chainalysis customer use cases involving custodians or banks.

Provider profile Chainalysis — financial institutions ↗Chainalysis — platform ↗

TRM Labs

Compliance & Security · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: TRM Labs provides blockchain intelligence, transaction/entity screening, investigations and compliance tooling; it does not present itself as a legal asset custodian.
Security: TRM’s security relevance is analytics and compliance rather than private-key custody.
Asset protection: No customer asset-safekeeping claim established in this review.
Procurement caveat: Custody references on TRM materials generally describe customers/integrations, not TRM holding assets.

Provider profile TRM Labs — financial institution compliance guide ↗TRM Labs — digital asset controls guide ↗

Elliptic

Compliance & Security · reviewed 18 Aug 2026

4/4 evidence dimensions

Regulation / role: Elliptic provides blockchain analytics, screening, monitoring, investigations and regulatory-reporting tools for banks, crypto businesses and public-sector users.
Security: The security role is transaction/entity intelligence rather than private-key safekeeping.
Asset protection: No customer-asset custody is established in the reviewed sources.
Procurement caveat: Its content discusses how banks can build custody programs, but Elliptic itself is not presented as the custodian.

Provider profile Elliptic — platform ↗Elliptic — blockchain analytics in financial institutions ↗

Status watch

Finoa: former custody status corrected

Finoa states that Finoa GmbH voluntarily surrendered its German crypto-custody licence, with formal revocation effective 31 December 2025. Current offering is technology infrastructure rather than regulated crypto custody.

Finoa privacy policy / licence status ↗Finoa current service statement ↗

Open corrected Finoa profile →

Status intelligence

Material provider-status watch

Etana Custody — current availability not verified

Receivership/liquidation-related proceedings and active litigation mean legacy custody descriptions should not be treated as evidence of current service availability. Introduction routing is disabled pending clearer operating-status evidence.

View status profile →

Taxonomy quality control

Custodian vs. custody technology

We separate legal asset custodians from technology that helps institutions self-custody or operate wallets. Existing URLs remain available for continuity, but classification is corrected.

Company	Old classification	Current classification	Why
Fordefi	Digital Asset Custodians	Wallet Infrastructure	Official materials position Fordefi as institutional MPC wallet infrastructure preserving self-custody rather than a third-party custodian.
Ledger Enterprise	Digital Asset Custodians	Wallet Infrastructure	Ledger Enterprise positions its institutional technology as self-custody infrastructure; the enterprise platform should not be classified as the legal asset custodian.
GK8	Digital Asset Custodians	Wallet Infrastructure	GK8 supplies institutional custody/self-custody technology and key-management infrastructure; it should not be presented as the regulated legal custodian by default.

Research governance

See how research decisions are controlled

Review the editorial policy, correction process, research changelog and next evidence-review priorities.

Editorial policy Research changelog Next 40 reviews