TL;DR
Custody is a legal status, not a key architecture. Under MiCA, the UK money laundering regulations, and FinCEN guidance, the test is whether the provider can move a client's assets without the client — not whether it uses MPC, an HSM, multisig, or a TEE. That splits the market into three tiers: qualified custodians holding real licences (Anchorage, Coinbase Custody Trust, Fireblocks Trust, BitGo, Zodia), custody technology sold to whoever is the custodian (Fireblocks' platform, Dfns), and wallet infrastructure for application teams (Openfort, Privy, Turnkey, Dynamic). Most product teams asking for a custody provider need the third tier and a clear answer to one question: can the vendor sign on its own?
Search for a crypto custody provider and you get two kinds of results: banks that will hold your assets, and software vendors that will hold your keys. Those are different products under different rules, and picking the wrong one gets expensive in a way that only surfaces during an audit or an incident.
One question sorts them. Can the provider move a client's assets without the client? Every regime that matters lands in roughly the same place on it, and none of them care which cryptography you used to get there.
What regulators actually count as custody
Three jurisdictions apply the same test.
The EU. MiCA article 3(1)(17) defines providing custody as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys." Recital 83 then removes the ambiguity: "Hardware or software providers of non-custodial wallets should not fall within the scope of this Regulation." Custody is service number one on the CASP list, and the EU-wide grandfathering window under article 143(3) closed on 1 July 2026, so there is no transitional cover left for anyone operating unauthorised.
The UK. The money laundering regulations define a custodian wallet provider as a firm that holds, stores and transfers cryptoassets. JMLSG guidance reads that list cumulatively and says so plainly: the wording "is meant to exclude non-custodial wallets. Therefore, firms who merely hold and store cryptographic keys, but are not involved in their transfer... are not likely to be in scope." The FCA published final rules on 30 June 2026, with custody safeguarding in a new CASS 17 sourcebook, applying to firms authorised from 25 October 2027.
The US. FinCEN's 2019 guidance asks whether the provider has "total independent control" over the value. A multi-signature provider that adds a second authorisation key to an unhosted wallet is not a money transmitter, because it never accepts and transmits value. It becomes one if the value sits as an entry in its own accounts, or if it maintains total independent control.
Singapore is the outlier worth knowing about. MAS brought custodial services for digital payment tokens into the Payment Services Act perimeter from 4 April 2024, with safeguarding rules from 4 October 2024, and it regulates transfer and exchange facilitation more broadly than the EU or UK do. "We never hold keys" is a weaker defence there.
Three tiers, and the line that separates them
| Tier | What it sells | Who is liable for the assets |
|---|---|---|
| Qualified custodian | Safekeeping, as a licensed entity with fiduciary duties | The custodian |
| Custody technology | The key-management platform, to whoever is the custodian | The customer |
| Wallet infrastructure | Key generation, signing, recovery, and policy inside an application | The end user |
The line between the second and third tiers is commercial (institutions versus developers) and it is disappearing. The line between the first tier and the other two is legal, and it is not.
Who holds what
Entity names matter more than brand names here. The platform you integrate and the company holding the licence are usually different legal entities.
| Provider | Licensed entity and regulator | Custody model |
|---|---|---|
| Anchorage Digital | Anchorage Digital Bank N.A. — OCC national trust bank charter, January 2021. NYDFS virtual currency licence, December 2024 | Air-gapped HSMs with business logic running inside the hardware |
| Coinbase | Coinbase Custody Trust Company — NYDFS limited purpose trust charter, October 2018, a fiduciary under §100 of the NY Banking Law. Coinbase National Trust Company — OCC preliminary conditional approval, April 2026 | Institutional cold storage |
| Fireblocks | Fireblocks Trust Company, LLC — NYDFS limited purpose trust charter, August 2024. The platform itself is not a custodian | MPC-CMP threshold signatures inside secure enclaves |
| BitGo | BitGo Bank & Trust N.A. (OCC), BitGo New York Trust Company (NYDFS), BitGo Singapore (MAS major payment institution), BitGo Custody MENA (VARA), BitGo Europe GmbH (BaFin, MiCA) | Multi-signature and MPC |
| Zodia Custody | Zodia Custody Europe S.A. — Luxembourg CSSF MiCA licence, December 2025. Zodia Custody Limited — FCA MLR registration, FRN 928347 | Air-gapped HSMs, with MPC added through a Dfns partnership |
| Komainu | Komainu (Jersey) Limited — Jersey Financial Services Commission. Komainu MEA FZE — Dubai VARA | MPC and HSM, segregated on-chain wallets |
| Copper | Copper Markets (Switzerland) AG — VQF membership, an AML self-regulatory body under FINMA oversight, not a custody licence. Withdrew its UK FCA application in December 2024. Copper ME received ADGM in-principle approval in June 2026, which precedes a licence | MPC |
| Dfns | None. States directly: "Is DFNS a custodian? No. DFNS is pure technology infrastructure" | MPC threshold signatures, plus HSM orchestration |
| Turnkey | None identified. Describes itself as "fully non-custodial" | AWS Nitro Enclaves, with a minimal unikernel and remote attestation |
| Openfort | None. Non-custodial by design | Open-source OpenSigner, 2-of-3 secret sharing, plus TEE backend wallets |
Two things fall out of that table. The bottom four rows hold no custody licence anywhere, which is the correct outcome rather than a gap. None of them can sign for a user unilaterally. And several of the top rows now sell both models from inside one corporate group.
The architecture question, answered honestly
Key protection and custody status are independent variables. That said, the architectures do differ, and the differences are not the ones vendors usually lead with.
Multisig gives each signer a complete private key. Compromise one and you have reduced the threshold by one. Rotating a signer means an on-chain sweep to a new address, which costs gas, needs coordination, and consolidates UTXOs in a way that can reveal holdings.
MPC and threshold signatures never assemble the key anywhere, and shares can be refreshed off-chain without touching the address. The trade-off runs the other way on governance: an MPC signature is indistinguishable from a single-key transaction, so the quorum that a multisig records permanently on-chain simply is not there. That is operational privacy, and it is also less auditable. Threshold ECDSA is also still pre-standardisation. NIST finalised only its first call for multi-party threshold schemes in January 2026, so implementation quality rather than the concept carries the risk.
HSMs protect the key and nothing else. Anchorage, which builds on them, says so itself: "A key held in an HSM without custom business logic is no more secure than a key held in a hot wallet, because the HSM can be made to sign if the server is compromised."
TEEs move the whole computation, including policy enforcement, into an attested enclave, so you can verify which code is signing rather than who signed. They also carry a long side-channel research record, from Foreshadow and SgxPectre through to recent DDR5 memory-controller attacks affecting Intel SGX and TDX and AMD SEV-SNP alike.
The failure mode nobody's key architecture prevented
On 21 February 2025, roughly 1.5 billion USD left a Bybit cold wallet. The multisig worked. Three legitimate signers signed with hardware wallets.
The attacker had compromised a Safe{Wallet} developer's laptop around 4 February, used the developer's AWS token to reach Safe's infrastructure the next day, stayed inside for two weeks, and on 19 February injected JavaScript into the S3-hosted Safe interface that activated only for Bybit's cold wallet. The signers read a legitimate transaction on screen while their devices signed a delegatecall that swapped the Safe's masterCopy for an attacker contract with sweep functions.
No amount of MPC, HSM, or enclave at the key layer stops that, because the key layer was never attacked. The signing interface and the vendor's cloud supply chain were. When you evaluate a custody provider, the questions that would have caught this are about deployment integrity, what the signer actually sees before approving, and whether the transaction can be verified independently of the interface presenting it.
What consolidated in 2025 and 2026
Five deals and charter decisions landed inside fourteen months:
- June 2025. Stripe acquires Privy, after buying Bridge.
- 23 October 2025. Fireblocks acquires Dynamic, putting non-custodial embedded wallets and a NYDFS-chartered trust company inside one group.
- 12 December 2025. The OCC conditionally approves five national trust bank charters at once: Circle, Ripple, BitGo, Fidelity Digital Assets, and Paxos.
- 22 January 2026. BitGo lists on the NYSE, raising 212.8 million USD at a 2.59 billion USD valuation.
- 18 May 2026. Standard Chartered agrees to acquire Zodia Custody's custody business, with the infrastructure platform carved out separately as Zodia Solutions.
Two regulatory moves matter alongside those. The SEC withdrew its 2023 safeguarding proposal on 12 June 2025, leaving the 1940 Act custody rule in place, then issued a no-action letter on 30 September 2025 letting advisers treat qualifying state-chartered trust companies as banks for crypto custody. NYDFS updated its custody guidance the same day, with expanded expectations around sub-custodians.
For a buyer, the practical consequence is that acquisition risk is no longer hypothetical. Ask what happens to your integration when your vendor is bought, and read the answer in the contract rather than the blog post.
Choosing
You need a qualified custodian when a rule says so: a registered adviser holding client crypto, a fund that needs an independent asset holder, a bank with fiduciary duties, an exchange holding customer balances. Check the licensed entity name against the regulator's register, not the marketing site, and check which entity your contract names.
You need custody technology when you are the custodian and want to run the key management yourself, on your own infrastructure, under your own licence.
You need wallet infrastructure when your users hold their own assets inside your product. Nobody is holding anyone else's money, so no custody licence applies, and the questions change: can you export keys, is the key-management code auditable, can you self-host it, and what happens if the vendor disappears. We wrote about that decision in more depth in open beats closed and self-custody as an SDK decision.
Openfort sits in that third tier and holds no custody licence, because there is nothing to license. OpenSigner is MIT-licensed and splits a key into three shares (device, auth, and recovery) with any two able to reconstruct it, and that reconstruction happens only inside a sandboxed iframe on the user's device. Our servers never see a full key, so we could not sign for a user if we wanted to. Backend wallets are a separate product with a different answer: keys live in a Google Cloud TEE and your policy decides what signs, which is the right shape for payouts and agents where no end user is present to approve.
Before you sign anything, write down who can produce a valid signature without anybody else's involvement. Whoever that is, is the custodian.
