Crypto custody and segregation: five documents to check

A platform balance is a useful display of an account. It is not a complete explanation of the legal and operational arrangement behind that account. For custody, the central question is how a customer's assets are identified and treated when normal service stops.

“Segregated” should lead to documents and procedures that explain the separation. The term alone does not answer which entity holds the keys, who owns the assets or what a court would decide after a failure.

Separate the records from the wallet layout

A custodian might use individual wallets or hold several customers' assets in a shared wallet supported by internal records. The second arrangement is often called omnibus custody.

New York's updated custody guidance recognizes both structures for entities within its scope. It expects customer assets to be separated from corporate assets and requires records that identify each customer's beneficial interest. Reconciliation connects those records to on-chain activity.

The lesson is narrower than “one wallet per customer is always required.” A wallet arrangement and an accounting arrangement need to be read together. The relevant legal protections depend on the provider and jurisdiction; New York's guidance is not a worldwide custody rule.

Identify the relationship in the contract

Safekeeping differs from allowing a business to use assets to generate a return. A service can present both options in the same interface while assigning very different rights to each.

The SEC's bulletin on crypto interest-bearing accounts describes risks associated with how providers use deposited crypto, including lending and related exposure. The payment of yield should prompt a separate reading of the product terms.

A practical comparison records whether the provider may lend, pledge, transfer or otherwise deploy assets, and whose consent is needed. If the explanation describes both custody and credit activity, identify where one relationship ends and the other begins.

Follow the custody chain

The name on an app may not be the entity controlling the assets. New York's guidance also addresses sub-custody, disclosures and continued separation at that additional layer.

For readers, a useful diagram is a short list of entities and responsibilities: contracting provider, custodian, sub-custodian and the party responsible for returning assets. Missing names or unclear responsibilities are unanswered questions, not details supplied by a brand.

The SEC's custody basics bulletin likewise encourages examining third-party arrangements and risks. Technical access, contractual responsibility and recovery procedures should be assessed together.

Interpret proof of reserves carefully

A published address balance can establish something about assets at a point in time. It cannot answer every question about competing claims against them.

The PCAOB Office of the Investor Advocate’s advisory explains that proof-of-reserves procedures may not establish liabilities, holders' rights or whether reported assets were borrowed. It also distinguishes these engagements from financial-statement audits.

A complete custody assessment therefore needs several kinds of evidence. Records explain allocation; contracts explain rights; operational controls explain access. None should be silently substituted for the others. Together they make the promise of safekeeping specific enough to examine.

Five documents to request

Use the following list to compare providers without turning missing evidence into a made-up safety score. A document can clarify an arrangement without eliminating its risks.

For a hypothetical provider using an omnibus wallet, the meaningful follow-up is how its records establish each customer's interest and how discrepancies are resolved. For a provider advertising individual wallets, the same contractual and asset-use questions still apply.

If an answer is unavailable, record that limitation. A public blockchain balance cannot fill a gap in the customer agreement, and a polished agreement does not independently demonstrate that operational controls work.