FINMA's recent guidance on crypto custody has prompted a wave of questions from asset managers and their clients about a topic that had, until now, received less scrutiny than it deserved: how safe are the custodians actually holding digital assets on behalf of clients? The guidance is a useful prompt to look honestly at where the real risks in crypto custody lie, and what genuinely robust custody should look like in practice.
Counterparty Risk in Insolvency
The most fundamental risk in any custody arrangement is what happens if the custodian itself fails. In traditional finance, decades of regulation have established clear expectations around client asset segregation, ensuring that a bank's or broker's insolvency does not automatically mean the loss of client holdings. Crypto custody has not always operated to the same standard, and there have been well-publicized cases globally where client assets were not properly segregated, leaving clients as unsecured creditors in an insolvency process rather than owners of specifically protected assets. This is precisely the gap FINMA's guidance is designed to close for Swiss-regulated activity.
Foreign Custody Complexity
A second, closely related risk arises when custody is outsourced to providers in other jurisdictions. Foreign custody introduces layers of legal complexity: which jurisdiction's insolvency law applies, whether that jurisdiction recognizes client asset segregation in the same way Switzerland does, and how easily clients could actually enforce their rights in a cross-border insolvency proceeding. A custodian based offshore may offer lower costs or broader asset support, but asset managers need to weigh that against the genuine difficulty of pursuing a claim through an unfamiliar legal system if something goes wrong.
Operational and Technology Risk
Beyond insolvency scenarios, crypto custody carries operational and technology risks that have no real analogue in traditional custody. Private key management, multi-signature governance, cold versus hot storage architecture, and the processes around signing and authorizing transactions all introduce failure points that, if mismanaged, can result in irreversible loss of assets — there is no central authority to reverse a fraudulent or erroneous on-chain transaction the way there might be with a traditional bank transfer. A custodian's technology stack and operational controls are therefore not a secondary consideration; they are a core part of the risk profile of the custody arrangement itself.
Dependency on Third-Party Infrastructure
Many custody providers, particularly smaller or newer entrants, rely on third-party infrastructure providers for core custody technology — key management systems, wallet infrastructure, or even underlying custody licenses obtained through partnership arrangements. This creates a chain of dependency that clients rarely see: the custodian a client contracts with may itself be relying on another entity's technology or license, adding an additional layer of counterparty risk that is easy to overlook without close due diligence.
Lack of Prudential Supervision
Perhaps the most important structural risk is the absence, in many jurisdictions, of genuine prudential supervision over crypto custodians. A custodian that is merely registered rather than prudentially supervised operates under a materially lighter regulatory regime than a licensed bank or securities firm, with less regulatory scrutiny of capital adequacy, operational resilience, and client asset protection. FINMA's guidance draws a clear line here: prudential supervision, not just registration, is what gives clients genuine confidence that a custodian's practices are being actively checked, not just declared.
What Good Custody Looks Like
Taken together, these risk areas point to a clear set of practical expectations for what robust crypto custody should look like:
- Genuine legal and operational segregation of client assets from the custodian's own balance sheet.
- Bankruptcy-remote structuring, so client assets are protected in the specific event of custodian insolvency.
- Prudential supervision by a recognized regulator, not merely registration or licensing-in-name.
- Transparent, auditable key management and operational controls.
- Direct accountability, without unclear dependency chains on unnamed third-party infrastructure providers.
How ISP Partners Supports This
As a FINMA-regulated custodian, ISP Partners is built around exactly these expectations: genuine segregation of client assets, bankruptcy-remote custody structures, and direct prudential supervision rather than light-touch registration. For asset managers and their clients navigating a custody landscape that is under increasing regulatory scrutiny, working with a custodian that is held to this standard is not a marginal consideration — it is the foundation on which every other decision about digital asset allocation should rest.