Institutional crypto custody: how it works

For an individual, storing cryptocurrency may mean writing a seed phrase on a piece of paper. For an institution holding billions on behalf of clients, the same task becomes an operation with vaults, approval procedures, audits and contracts. This is what is called institutional custody: the professional safekeeping of third-party crypto assets, carried out by specialized companies, exchanges, banks or providers they hire.

This article explains how this custody works and what Brazilian regulation and international standards require, based on the rules in force on October 8, 2026. It does not evaluate or recommend custodians.

Three articles on the site cover neighboring topics. The choice between leaving crypto with a company or keeping it yourself is covered in Crypto wallets: custodial and non-custodial, which also recalls cases of exchange bankruptcies. Custody of tokens representing real-world assets, such as real estate and receivables, is covered in Tokenized asset custody: who controls what. And the difference between connected and disconnected wallets is in Cold wallet or hot wallet: crypto asset security.

What custody is, according to the rules

Law 14,478/2022 lists among virtual asset services the “custody or administration of virtual assets or of instruments that enable control over virtual assets” (art. 5, item IV). Anyone providing this service needs authorization, and the Banco Central (Brazil’s central bank) is the regulator.

BCB Resolution 520, in force since February 2, 2026, details what custody comprises (art. 9):

1. Safekeeping and control of the instruments that give access to the asset, such as private keys.
2. Recording the position of each client, up to date and reconciled with what appears on the blockchain.
3. Executing the transfer orders given by the holder or by someone they have authorized.
4. Handling events that affect the quantity, value or ownership of the asset.
5. Managing the data needed for these activities, including for anti-money laundering purposes.

The rule defines “control” precisely: the custodian must ensure that only the holder, or someone they have authorized, exercises the rights to the asset, and that those rights are available in time (art. 9, § 2). In other words, custody does not give the custodian the right to use what it holds.

Cold, warm and hot wallets

The core of custody is the private key, the code that authorizes the movement of assets on the blockchain. Whoever has the key has control. That is why a custodian’s first decision is where and how to store it.

Resolution 520 classifies wallets by how connected they are to the internet (art. 2):

• Cold wallet: not constantly connected to the internet. It is better protected against remote attacks, but each withdrawal requires a slower procedure.
• Hot wallet: always connected. It allows fast withdrawals, but is more exposed.
• Warm wallet: an intermediate category, connected, but with additional layers of security.

In practice, the custodian distributes assets among these types according to liquidity needs. The Brazilian rule does not set percentages, but requires the custody agreement to describe the safekeeping method and the distribution among wallets, disclose the risks of each option and record the client’s choice or consent (art. 73). IOSCO, the international organization of securities regulators, also chose not to set limits: it said they are up to each jurisdiction and that clients should understand the risks of each type of wallet (IOSCO, 2023).

The agreement must also state whether assets are held in pooled wallets (for a group of clients, also called omnibus) or individual wallets (for a single client). Pooled wallets are simpler to operate, but depend even more on internal records to know what belongs to whom.

How keys are protected

Storing a valuable key in a single place, under the control of a single person, creates a single point of failure. Institutional techniques exist to eliminate that point. Three approaches are common:

• Hardware security modules: dedicated devices that generate and store keys without exposing them to ordinary systems.
• Multisignature: the wallet requires signatures from several different keys, for example two of three, to authorize a transaction.
• Multi-party computation (MPC): the key is split into parts that never come together; each part takes part in computing the signature. NIST, the US standards institute, describes these threshold cryptography schemes as a way to achieve “secure distribution of trust” in the cryptographic operation (NIST).

Resolution 520 does not impose a specific technology, but requires a documented key safekeeping policy (art. 49). At a minimum, it must cover how keys are generated, stored and managed; the distribution among wallets; the security modules used; granting and revoking access; what to do in case of compromise; and approval levels consistent with each person’s degree of access. If the company uses multiple or split keys, the parts must be kept in different locations (art. 49, § 3).

The rule also requires continuous security monitoring, continuity plans for incidents and disasters, and vulnerability and robustness testing of systems, including smart contracts used in the operation (arts. 48 and 50). The custodian must run stress tests on its systems at least once a year and keep the results for five years (art. 82).

Asset segregation and bankruptcy

The second custody question is legal: if the custodian goes bankrupt, do client assets become part of the bankruptcy estate? The Financial Stability Board (FSB), which coordinates G20 financial regulators, noted that when crypto intermediaries failed, the commingling of assets and lack of clarity about ownership caused large losses and complicated bankruptcies (FSB, 2023 note). It therefore recommended that regulators require segregation, adequate records and protection of client ownership, including in insolvency (FSB, 2023 recommendations).

Resolution 520 turns this idea into rules:

• Client assets are held in wallets separate from those the custodian uses for itself (arts. 30 and 78).
• The keys to the custodian’s own wallets cannot have any effect on client wallets, and the operations of each must be independent (art. 78, § 1).
• There is a limited exception: the custodian may hold its own assets in client wallets only to cover immediate liquidity needs for their transactions, and the agreement must state under what conditions those assets become the clients’ if the service is interrupted (arts. 30, § 2, and 78, §§ 3 to 5).
• The custodian is liable for losses caused by negligence, lack of skill, recklessness or willful misconduct, including when the client is prevented from accessing the assets (art. 81).

Proving that the asset exists

An institution may claim it holds everything. Regulation asks it to demonstrate this. Resolution 520 provides for:

• Reconciliation: each client’s position in the internal system must match the blockchain, within deadlines set in the agreement (arts. 9 and 76).
• Proof of reserves: a mechanism to demonstrate that the provider holds the assets it claims to hold on behalf of clients (arts. 2 and 30).
• Independent audit of the statements on its own and client assets, every two years, with reasonable assurance and the report published on the company’s website (art. 30).
• Annual audit of custody service controls, including key safekeeping and system operation (art. 73, §§ 4 and 5).
• Client report with the quantity and balance of each asset, the price source and the transaction history (art. 79).

IOSCO takes the same line: it recommends “regular and frequent” reconciliations subject to independent verification and that clients be informed, in non-technical language, about how their assets and keys are held (IOSCO, recommendations 14 and 15).

Proof of reserves has a limit: it shows assets at a point in time but, on its own, does not show the company’s liabilities. That is why a full audit of the statements matters.

Outsourcing and sub-custody abroad

Many exchanges do not hold crypto assets themselves: they hire a custodian. The Brazilian rule allows this, but does not transfer the responsibility.

• A provider that hires custody must set a minimum quality standard, continuously evaluate the contractor, receive its security and anti-money laundering plans and its stress tests, and notify the Banco Central if it breaches the rule (art. 74).
• Toward the client, the hiring provider has the same responsibility as the custodian it hired (arts. 73, § 6, and 81).
• Technology suppliers, such as MPC or cloud providers, may only be hired if they attest that they cannot affect the safekeeping, record, orders or rights over the assets (art. 9, § 6).

If the custodian is abroad, the requirements increase (art. 83). It must be authorized and supervised in its own country, have a legal representative in Brazil and have assets in Brazil or financial guarantees that can be called upon in case of failure. The agreement must guarantee the Banco Central access to records, segregation with full legal validity in the custodian’s country, including in bankruptcy, and specific wallets for Brazilian clients.

Staking and other events

Some crypto assets generate events that change the client’s position, such as staking rewards (locking up assets to help validate a blockchain in exchange for compensation). Under Resolution 520, only a custodian authorized to perform the full set of custody activities may offer staking to clients (art. 9, § 5), and it must notify the Banco Central ninety days in advance (art. 82, § 5). The agreement must explain the risks of these operations (art. 73, § 2). The risks of staking itself are covered in Staking: how it works, rewards and risks.

And when the CVM comes in

The central bank’s rule applies to virtual assets. If the token is a security, such as a token representing a collective investment, custody follows the rules of the CVM (Comissão de Valores Mobiliários, Brazil’s securities regulator). The CVM itself says it has jurisdiction “only over crypto assets considered securities” and that it allows Brazilian investment funds to invest indirectly in crypto assets abroad, under its own rules (CVM, frequently asked questions). The split between the two sets of rules is covered in Tokenized asset custody.

Questions for understanding a custody service

Without pointing to any provider, these questions help you read a contract or a disclosure page:

• Is the company authorized by the Banco Central, or has it only applied for authorization? For those already operating, the application deadline ends on October 30, 2026, by the newsroom’s count (art. 88).
• Who actually holds the keys: the company itself or a third party? Where is that third party?
• Are assets held in a pooled or individual wallet? What is the distribution among cold, warm and hot wallets?
• Where is the independent audit report published? Is there proof of reserves?
• What does the agreement provide for in case of service interruption or bankruptcy? How do you transfer the assets to another custodian?
• Is there insurance or a guarantee fund? The rule requires the company to state clearly whether or not there is coverage (art. 53).

Key takeaways

• Institutional custody is a regulated service that combines technology (key protection) and law (asset segregation and liability).
• BCB Resolution 520 requires separate wallets, a documented key policy, reconciliation with the blockchain, audits, stress tests and specific rules for outsourcing and custody abroad.
• These requirements reduce the risks of loss, misappropriation and bankruptcy, but do not eliminate them and do not protect against price swings, which can lead to total loss.