Choosing a Custodian: What to Ask and What to Verify

Most of choosing a custodian is reading documents, and the documents are standard. A provider that cannot produce them quickly is telling you something. It helps to see a real one. a business wallet with institutional controls publishes the limits, the fees and the timing in one place.

Check the licence yourself

Every provider names a regulator. Take the licence number and look it up on the regulator’s own public register, not on the provider’s website.

Check that the company name on the register matches the company you will be contracting with, that the permission actually covers holding client assets rather than something narrower, and that there are no restrictions attached.

The middle one catches more providers than you would expect. Permission to run an exchange is not permission to hold your assets.

Documents to ask for

Audited accounts for the last two years, to see whether the business is solvent and whether the auditor raised anything.

An independent report on whether client assets are genuinely kept separate. This is the single most informative document and serious custodians have one.

The insurance certificate, not a summary on a web page.

A security audit report covering a period of operation rather than a point in time.

The custody agreement itself, particularly the sections on liability, on insolvency, and on how withdrawals work under pressure. Businesses face the same thing from the other side, which is what a platform set up for client account handling is for.

Questions with revealing answers

What happens if you become insolvent? A good answer cites the specific rule that keeps client assets away from creditors. A weak answer is reassurance with no citation.

How long before a newly added withdrawal address can be used? If the answer is immediately, there are no meaningful controls.

Has a client ever been unable to withdraw when they asked, and why? Any provider of reasonable age has had an incident. One that says never has either not operated long or is not being candid. One that describes what happened and what changed is the better sign.

How many people are needed to move assets? Tests whether duties are genuinely separated.

Can we test a withdrawal during onboarding? Should be yes.

Practical fit

Which assets and networks are supported and how a new one gets added. How the fees work: a percentage of assets, per transaction, a minimum. Withdrawal cut-off times and weekend cover. What reports are produced and in what format. And what happens if something goes wrong outside office hours.

That last one matters more than it seems, because you find out the answer at the worst possible time.

Warning signs

A licence covering something other than custody. Insurance described only in marketing language. Reluctance to name the auditor. No independent check on segregation. An agreement limiting liability to the annual fee. And pricing well below everyone else without an explanation.

Custody has real costs: hardware, audits, insurance, staff, capital. A provider much cheaper than its peers is either buying clients or not paying one of those costs.

Afterwards

Check the register again once a year, ask for the updated reports, and confirm the insurance was renewed. Companies change ownership and permissions, and nobody will ring to tell you. For buying and selling specifically, a crypto exchange with published fees publishes its fees and its account terms in full.