Table of Contents
Open a custodial crypto app and you'll see a balance, a buy button and a withdraw button. You won't see a private key anywhere. On a custodial platform, the keys and other means of access sit with the provider, not with you.
That arrangement puts obligations on the provider. Under the EU's crypto rules, a platform offering crypto custody has to protect client assets and keep a record of who owns what. It also has to hold client crypto apart from its own, return it on request and answer for certain losses.
Every one of those duties stops somewhere. This guide goes through where.
What does it mean for a platform to hold your crypto?
The legal wording is a little dry here. In the EU’s crypto regulation, custody means safekeeping or controlling, on behalf of clients, either the crypto-assets themselves or the means of access to them. In most cases that means of access is a private key. Names and passwords mean nothing to a blockchain (it only cares whether a transaction carries a valid signature from the right key).
Tap "withdraw" in a custodial app and what leaves your phone is a request, nothing more. The provider's custody system receives it, runs its checks, and only then signs with a key it holds for you. On larger platforms, that signing often happens from a shared hot wallet, in batches.
Think of a theatre cloakroom. The attendant hangs your coat somewhere at the back, out of sight, and the numbered ticket in your pocket is your only proof it's yours.
The EU's Markets in Crypto-Assets Regulation (MiCA) names ten crypto-asset services, and custody and administration of crypto-assets is first on the list (Article 3(1)(16), point (a)). Firms are authorised for specific services from that list, not for "crypto" in general. A crypto-asset service provider (CASP) whose licence covers only, say, exchanging crypto for euros can't start holding client coins until custody is added.
How does platform custody differ from self-custody?
Mostly, it's a question of who holds the keys. The chores come with them. Someone has to back the keys up and approve each transaction. Someone also has to deal with it when access goes missing.
In self-custody, that someone is you. A seed phrase, usually 12 or 24 words, will rebuild the wallet on a new phone. Lose it without a backup and there's no support desk to call.
A custodian takes those chores off your hands. Security becomes its problem, and so does recovery, usually through identity checks rather than a list of words. The price is dependence. If the company has an outage or pauses an account for a review, you wait on it. (For a side-by-side of the everyday differences, see our guide to custodial and non-custodial wallets.)
Neither model removes risk. The table below shows where each one places it.
Platform Custody vs Self-Custody: Where Responsibility Sits
What obligations does a platform take on as custodian?
MiCA's custody rules sit mainly in Article 75, and they start with a contract. A CASP providing custody has to sign an agreement with each client setting out its duties and responsibilities.
The agreement has to include, at minimum:
- the identity of both parties and a description of the service
- the custody policy and the security systems used
- the means of communication, including how clients are authenticated
- the fees, costs and charges, and the law that governs the agreement
Worth knowing: The custody agreement is usually part of a platform's terms and conditions rather than a separate document. Its custody and liability sections are where these duties are written down for that particular provider.
Record-keeping is the other half. The custodian keeps a register of positions for each client and records every movement promptly. Clients receive a statement of their positions at least once every three months, and on request, listing the crypto-assets held, their balance and value, and any transfers in the period.
How should client assets be kept apart from the platform's?
Segregation is the rule that keeps client crypto separate from the custodian's own holdings. MiCA requires it at two levels.
Operationally, client holdings and their means of access have to be clearly identified as belonging to clients, including on the blockchain itself. Legally, client crypto-assets sit outside the custodian's estate, so its creditors have no claim on them, in particular if it becomes insolvent.
The collapse of FTX in November 2022 shows why the rule exists. At the trial of its founder, Sam Bankman-Fried, prosecutors said customer deposits had been used to cover losses at Alameda Research, a sister trading firm. He was convicted on all seven counts in November 2023, and FTX customers were left waiting on bankruptcy proceedings to recover their funds.
Can the platform use client crypto?
Not for its own account. Article 70 of MiCA requires a CASP holding client crypto to safeguard clients' ownership rights and to prevent the use of their assets for its own purposes.
That rules out treating deposits as company money, whether by trading with them or using them to plug a gap elsewhere in the business. The attendant can store the coat but can't wear it.
The register of positions and the quarterly statements back this up. They give clients, and supervisors, a record to check holdings against.
What happens when you want to withdraw your crypto?
Article 75 requires custodians to have procedures for returning crypto-assets, or the means of access to them, to clients as soon as possible.
That wording leaves room for delays with a legitimate cause. A withdrawal to a new address can be held for a security review, and anti-money laundering checks can add time. The network itself can stop as well. Solana had exactly this problem on 6 February 2024, when block production halted at around 10:22 UTC and didn't restart for roughly five hours. South South Korea’s Upbit suspended deposits and withdrawals of SOL and several Solana-based tokens during the outage.
A delay with a stated reason fits within the rules. Repeated delays with no explanation are a different matter, and worth raising with the provider.
When is the custodian liable for a loss?
Article 75 of MiCA sets out the liability rule in paragraph 8:
"Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall be liable to their clients for the loss of any crypto-assets or of the means of access to the crypto-assets as a result of an incident that is attributable to them." MiCA, Article 75(8)
That sentence carries two limits. First, the incident has to be attributable to the custodian. If the custodian can show an event occurred independently of its service and operations, it isn't liable. MiCA's own example is a problem inherent in the operation of a distributed ledger that the custodian doesn't control.
Second, liability is capped at the market value of the lost crypto-asset at the time the loss occurred. Later price movements don't change that figure.
Large custody incidents do happen. On 21 February 2025, attackers took around $1.4 billion in ether from one of Bybit's cold wallets, in a theft the FBI attributed to North Korean hackers. Bybit said client assets remained backed 1:1 and absorbed the loss itself.
Why this matters: MiCA liability turns on the cause of a loss. A custodian answers for failures in its own systems and processes, up to the value of the lost assets at the time.
What changes if the platform uses another custodian?
Some platforms use a specialist custody firm to hold part or all of their clients' assets. This is sub-custody, and MiCA permits it on two conditions.
The other firm must itself be a CASP authorised to provide custody, and the platform has to tell clients that it uses one.
A single brand in the app doesn't always mean a single company holds the assets. The terms should name the entity holding client crypto, and the European Securities and Markets Authority (ESMA) publishes a register of authorised providers for checking a firm's status.
Practical example: losing access after an incident
Laura, a fictional user, holds €5,000 in crypto on a custodial platform. The platform reports a security incident in which the means of access to part of its client holdings, including Laura's, has been lost. The outcome depends on what the investigation finds.
Scenario A: a failure on the custodian's side
The investigation traces the incident to the platform's own systems, for example an unpatched vulnerability or a flaw in how it managed keys.
That makes the loss attributable to the custodian, which is exactly the situation Article 75(8) covers. Laura's claim would be based on the market value of her crypto at the moment it was lost.
Worth knowing: If Laura's crypto was worth €5,000 when it was lost and €6,500 a month later, the cap is the €5,000 figure. Liability is fixed at the time of the loss, not at today's price.
Scenario B: a fault in the network itself
This time the cause is a fault inherent in the blockchain, outside any single custodian's control.
Here, liability isn't automatic. If the platform can show the event occurred independently of its service and operations, MiCA doesn't treat the loss as attributable to it. What Laura recovers then depends on the facts, her custody agreement and any other terms that apply.
Same balance, same platform, two different outcomes. The cause of the loss decides which one applies.
What does platform custody not guarantee?
A regulated custodian protects access to crypto-assets. It doesn't protect their price.
Custody doesn't guarantee that holdings keep their value, that the service never goes offline or that a blockchain never fails. Nor does every incident lead to compensation, since liability depends on the cause.
Self-custody has limits of its own, which our article on what a hardware wallet does and doesn't give you covers. Custody is best read as a defined set of duties, and knowing where they start and stop makes one platform easier to compare with another.
Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.