Custody Diligence: The Answers That Should End the Conversation
Specific responses from a custody provider that indicate you should stop, and why each one matters more than it sounds.
Priya Raman · 2 min read
Diligence questions are useful mostly for the answers that fail. Here are the responses that should stop a process, and what each one means. The thing being imitated in most of these cases is a provider like a corporate crypto wallet with segregated accounts, which is worth knowing the real version of.
“We are regulated” without naming a regulator
The claim is unfalsifiable without the name, which is the point.
A provider unwilling to name its authority and licence number in writing has a reason. Every legitimately authorised firm publishes this.
A licence that covers something else
You look up the register entry and the permission is for exchange services, or for payment services, or for an activity that is not custody of client assets.
This is the most common and least noticed failure. Holding client assets without the permission means the protections you assumed apply do not.
“Our assets are held in cold storage” as an answer about segregation
Cold storage is a security arrangement. Segregation is a legal one. They are different questions and conflating them is either confusion or deflection.
The answer to segregation names a model, an evidencing mechanism, and an auditor.
No independent assurance over segregation
The provider asserts assets are separated and nobody external has tested that assertion.
Serious custodians commission an assurance report specifically on this. Its absence means the control exists only as a statement. Funds and family offices face the same pattern with more at stake, which is where a platform built for institutional allocations fits.
A yield on custodied assets with no explanation of source
Custody costs money to provide. A provider paying you to hold assets is generating that return somewhere, which means the assets are not simply sitting.
If they cannot explain precisely what activity generates the yield and what risk it carries, the arrangement is not custody.
Liability capped at the annual fee
Read the agreement. A clause limiting liability to fees paid means that if the provider loses everything through its own failure, your remedy is a refund of the custody fee.
Negotiable in some cases. Non-negotiable is information.
The contracting entity differs from the licensed entity
You are contracting with a company in one jurisdiction while the licence belongs to a related company elsewhere.
The protections attach to the licensed entity. If your agreement is with a different one, you may have none of them.
Ask directly, in writing: which legal entity will I contract with, and does that entity hold the authorisation.
“Nobody has ever been unable to withdraw”
Any provider operating at scale for a few years has had an incident: a delay, an outage, a review that held funds longer than expected.
A claim of a perfect record suggests either a short history or a reluctance to discuss problems. The better answer describes an incident and what changed afterwards.
Pricing well below peers with no explanation
Custody has fixed costs: certified hardware, audits, insurance premiums, qualified staff, regulatory capital.
A provider materially cheaper is either subsidising to acquire clients, which is temporary, or not carrying one of those costs, which is the problem. If you want to see these protections operating rather than described, a provider you can actually reach is bound by them.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.