Crypto Custody: Definition and Swiss Regulatory Framework

Definition

Crypto custody refers to the safekeeping and management of private keys that control access to digital assets on a blockchain. Because ownership of cryptocurrency is determined by possession of private keys — alphanumeric strings that authorise transactions — custody in the digital-asset context is fundamentally about key management: generating, storing, protecting and recovering the cryptographic keys that represent claim to on-chain assets.

Unlike traditional securities custody, where a central securities depository maintains a definitive register of ownership, crypto custody operates on the principle that “possession of the key is possession of the asset.” This architectural distinction creates both opportunities — direct, intermediary-free ownership — and challenges, particularly for institutional participants accustomed to the safety nets provided by traditional custodial infrastructure.

How It Works

Self-Custody

Self-custody means that the asset holder directly controls their private keys, without relying on a third party. Keys are typically stored in hardware wallets (dedicated physical devices), software wallets (applications on a computer or mobile device) or, for the most security-conscious holders, air-gapped devices that never connect to the internet.

Self-custody provides maximum sovereignty — no third party can freeze, seize or lose the user’s assets — but places the full burden of security on the individual. Loss of private keys means permanent, irrecoverable loss of the associated assets.

Third-Party Custody

Third-party custody involves entrusting private keys to a professional custodian that safeguards them on behalf of the asset holder. Custodians employ a range of security measures:

• Multi-signature schemes — Requiring multiple independent keys to authorise a transaction, distributed across different individuals, locations or devices
• Hardware security modules (HSMs) — Tamper-resistant hardware devices that generate and store keys within a secure enclave
• Cold storage — Keeping the majority of keys offline, disconnected from the internet, to protect against remote attacks
• Multi-party computation (MPC) — Distributing key fragments across multiple parties so that no single party can reconstruct the full key
• Insurance — Commercial insurance policies covering loss from theft, fraud or operational failure

Qualified Custody

Qualified custody — custody provided by a regulated financial institution — is the standard required by institutional investors. Qualified custodians are subject to regulatory oversight, capital requirements, audit obligations and client-asset segregation rules. In Switzerland, qualified custody is provided by FINMA-licensed banks and securities firms.

Swiss Context

FINMA Framework

Switzerland has developed one of the most comprehensive regulatory frameworks for crypto custody globally. FINMA’s approach integrates digital-asset custody into the existing framework for financial-intermediary supervision:

Banking Act — Custodians that accept crypto assets from clients in a custodial capacity may be classified as accepting public deposits, triggering banking-licence requirements. FINMA has provided guidance on the conditions under which crypto custody constitutes deposit-taking.

DLT Act — Switzerland’s DLT legislation, enacted in 2021, provides explicit legal recognition of digital assets and establishes rules for their segregation in the event of custodian insolvency. Under the DLT Act, crypto assets held in custody are segregated from the custodian’s bankruptcy estate, provided that they can be clearly attributed to the client.

Anti-money-laundering — Custodians are subject to AML obligations, including client identification (KYC), transaction monitoring and suspicious-activity reporting. FINMA-recognised self-regulatory organisations provide the compliance framework for custodians that do not hold full banking licences.

Swiss Custody Providers

Crypto Valley hosts several of the world’s most significant institutional custody providers:

• Sygnum — FINMA-licensed digital-asset bank offering segregated custody with multi-signature infrastructure and integrated staking services
• AMINA (formerly SEBA) — FINMA-licensed bank providing institutional custody, trading and tokenisation services
• Bitcoin Suisse — One of Switzerland’s oldest crypto intermediaries, offering custody alongside brokerage and staking products
• Metaco — Swiss custody-technology provider offering institutional-grade key-management infrastructure (acquired by Ripple in 2023)
• Fireblocks — Global custody-technology provider with significant Swiss institutional client base

Institutional Adoption

The availability of FINMA-regulated custody has been a decisive enabler of institutional crypto adoption in Switzerland. Pension funds, family offices and asset managers require regulated custody as a prerequisite for digital-asset allocation. The maturity of the Swiss custody landscape — encompassing regulatory clarity, insurance availability and operational track records — gives Switzerland a structural advantage over jurisdictions where custody infrastructure remains nascent.

Key Considerations

Regulatory status — Investors should verify that their custodian holds the appropriate FINMA licence or operates under a recognised regulatory framework. Unregulated custodians do not provide the client-asset segregation and insolvency protections available under Swiss law.

Insurance coverage — Custodial insurance policies vary significantly in scope, limits and exclusions. Investors should review policy terms carefully, noting the difference between coverage for external theft, internal fraud and operational errors.

Key-management architecture — Understanding whether a custodian uses multi-signature, MPC or HSM-based key management is important for assessing the security model. Each approach has different risk characteristics and trade-offs.

Segregation and bankruptcy-remoteness — Under Switzerland’s DLT Act, properly segregated crypto assets are protected from custodian insolvency. Clients should confirm that their custodian’s operational procedures ensure clear attribution of assets to individual clients.

Interoperability — The ability to move assets between custodians, access DeFi protocols and participate in on-chain governance from custodial accounts varies by provider. Institutional investors should evaluate custodians’ support for the activities they intend to conduct with their digital assets.

Donovan Vanderbilt is a contributing editor at ZUG BLOCKCHAIN, a publication of The Vanderbilt Portfolio AG, Zurich. The information presented is for educational purposes and does not constitute investment advice.