Institutional custody

Imagine a company holding 10 BTC whose finance manager, Jana, signs in to a custodian’s portal. She can see a balance and submit a transfer request. That does not mean she can sign a transaction herself. Signing requires private keys: secret data used to produce a valid signature. Wallets work with those keys; bitcoin is recorded on the network rather than stored inside a login account. We are following an external custody service here. With self-custody, the organization would arrange control of the keys itself. The practical difference becomes clear when Jana wants to send funds out. [2]

The company needs to understand its claim as well as the keys. Entrusting 10 BTC for safekeeping differs from lending 10 BTC to the custodian: a loan creates a repayment obligation, while custody is meant to preserve client assets. New York’s financial regulator, NYDFS, provides a specific example in guidance dated 30 September 2025. For the providers within its scope, it expects the customer’s property interest to be preserved without custody itself creating a debtor-creditor relationship. These are supervisory expectations within a defined jurisdiction, not a rule for every custodian worldwide. The word custody on a website cannot settle every legal system’s questions or predetermine the outcome of an insolvency proceeding, which may follow if the custodian cannot meet its obligations. [1]

A custodian may keep client funds in a shared wallet, known as an omnibus wallet. Its internal records then need to distinguish the clients’ claims. In a separate fee-free example, client A has 6 BTC and client B has 4 BTC, totaling 10 BTC. After A withdraws 2 BTC, the records should show A with 4 BTC and B with 4 BTC, totaling 8 BTC. Seeing eight bitcoin on the network alone does not establish who owns each share. NYDFS therefore addresses segregation of customer assets from the custodian’s own assets both on-chain and in internal records, with traceable client transactions. An omnibus arrangement is not permission to mix client assets with the firm’s operating money without appropriate safeguards. [1]

A company can require approval from 2 of 3 authorized people. Under the ordinary workflow, Jana then needs a colleague’s approval. Coinbase Prime is one example of configurable approval policies. These company permissions govern who may issue an instruction through the application; their approval count does not itself prove on-chain 2-of-3 Multisig or show how private keys are distributed. That kind of on-chain Multisig is a signing condition enforced by Bitcoin’s transaction rules. It requires two valid signatures from the designated set of three keys. Operational permissions and that cryptographic condition are separate layers. Assessing the protection also means checking who can change the approval policy and how such a change is verified. [3]

Keeping keys offline can reduce some internet risks. Cold Storage does not, however, supply a substitute when the sole approver is ill or leaves the company. The US Securities and Exchange Commission, SEC, distinguishes online (hot) and offline (cold) storage in an educational bulletin and also notes physical loss or damage to devices. Restoring technical access and obtaining authority to release a transfer are separate problems. A useful drill therefore covers both: the custodian has a recovery procedure, and the company has available substitutes with appropriate permissions. Testing security does not require revealing a private key or a Seed Phrase, the words used for wallet recovery. [2]

Another provider may sit behind the service the company knows. This is subcustody: the client deals with custodian A while custodian B handles part of the custody. Two brands relying on the same B do not automatically establish independent custody. Their keys or systems may be separate, yet the common provider creates a shared dependency worth understanding. Updated NYDFS guidance from 2025 requires prior supervisory approval for a new subcustody arrangement by entities within its scope. It also addresses protection of client assets at the next custodian and customer disclosures. The company needs to understand the entire chain, including responsibility for returning the assets. [1]

The US FDIC insures eligible bank deposits, not crypto assets themselves; an insured bank offering bitcoin does not turn it into an insured deposit. A custodian’s private insurance is a separate matter. Consider a purely illustrative covered loss of 8 million USD, a deductible of 1 million USD, the portion the insurer does not pay, and a remaining payment limit of 5 million USD. The amount after the deductible is 7 million USD, but the limit permits at most 5 million USD: min(8−1,5)=5, with all figures in millions of USD. Here min selects the smaller of the two amounts. An exclusion can prevent payment for a particular kind of loss altogether. Who is insured and who receives payment also matter. A custodian’s published total limit is not automatically an amount reserved for each client. [2] [4]

Using the same day and time zone, Jana submits a request at 09:00, a colleague approves it at 11:00 and the custodian broadcasts the transaction at 12:00. That is 3 hours after the request but 1 hour after approval. A contractual deadline must therefore identify both its starting point and what counts as completion. Accepting an instruction, broadcasting a transaction and confirming it on the blockchain are different milestones. Confirmation means inclusion in a block; later blocks add further confirmations. A trial withdrawal also checks the correct network, the full destination address and fees. A successful small transfer shows how the process works today; it cannot guarantee future service availability. [2] [3]