Institutional Custody: Qualified Custodian, MPC and Self-Managed

An institution holding digital assets on behalf of others faces a question retail holders can answer with a device in a drawer: how do you hold a bearer instrument in a way that satisfies a regulator, an auditor and a mandate. Three models have emerged, and they differ less on cryptography than on law.

The qualified custodian model

A regulated entity — typically a trust company or a bank — holds the assets, and the client's claim is a custodial one recognised in law. The custodian is supervised, examined, and subject to capital and segregation requirements written for custody rather than for payments.

The advantage is regulatory and legal rather than technical. Many mandates require assets to sit with a qualified custodian, which makes this the only permissible option regardless of how good the alternatives are. A supervised trust charter also brings examination and reporting that produce evidence an auditor can use.

The trade is counterparty exposure and control. The client does not hold keys, movements happen at the custodian's operational pace, and the strength of the arrangement in an insolvency depends on how the assets are titled — whether they are held in trust for clients or sit on the custodian's balance sheet. That distinction is a contractual and jurisdictional matter, and it is the single most important question to ask.

The MPC model

Multi-party computation splits the signing capability across several parties so that a threshold must cooperate to sign, and no complete key ever exists in one place. There is no moment at which a private key is assembled.

This is a genuine improvement over holding a key in one location, and it maps well onto institutional controls: shares can be held by different teams, with different approval requirements and enforceable policies about what can be signed.

Two cautions. The security depends on the specific protocol and its implementation, and this is specialist cryptography where subtle errors are not visible to a buyer — an independent review of the implementation matters more than the fact that MPC is used. And a shared-share arrangement with a provider still leaves you dependent on that provider's availability and solvency, which is a counterparty question even though the marketing describes it as self-custody.

The self-managed model

The institution holds keys itself, typically in hardware security modules under multi-person control, with documented procedures and its own audit trail.

It removes counterparty risk entirely — no third party can fail, freeze or be compelled. It also relocates every operational burden inward: key ceremonies, geographic distribution, personnel vetting, continuity planning for staff departures, and an audit function that has to be satisfied by evidence you produce yourself.

The reason this is less common than its security profile suggests is not that it is weaker. It is that many mandates do not permit it, and that operating it competently requires a capability most institutions would rather buy than build.

The question that separates them

Everything above reduces to one question that a technical comparison will not surface: if the entity holding the assets fails, what does the client own.

Under a properly structured custodial arrangement, client assets are held in trust or otherwise segregated, and are not available to the failed entity's creditors. Under a weaker one, the client is an unsecured creditor with a claim rather than an asset — which is the position that has repeatedly turned out to be worth a fraction of what holders assumed.

The answer is not in the security architecture. It is in the custody agreement, the entity's regulatory status and the insolvency law of its jurisdiction, and it is legible before you sign rather than after.

A due diligence sequence

• How are assets titled, and does the agreement place them in trust for clients or on the provider's balance sheet.
• Which entity is the counterparty, in which jurisdiction, and under which supervisory regime — group marketing frequently obscures this.
• What does the insolvency analysis say, and has anyone external produced one.
• What independent assurance exists over controls, and does its scope cover key management rather than only the surrounding IT.
• What are the operational limits: withdrawal timeframes, approval workflows, and behaviour during periods of stress.
• What happens on exit — how assets are returned, on what timescale, and at whose cost.

The pattern across institutional custody failures is not that the cryptography was broken. It is that the legal arrangement was weaker than the technical one, and nobody had read it closely enough to notice the gap until it mattered.