Custody Failures: Exchange vs Qualified Custody Failure Modes
On April 7, 2026, the FDIC Board approved a notice of proposed rulemaking establishing custody, reserve, and capital standards for FDIC-supervised institutions that issue payment stablecoins or provide crypto safekeeping services under the GENIUS Act. The rule was published in the Federal Register on April 10, opening a 60-day comment period. It is the first time the agency that insures American bank deposits has formally proposed how digital asset custody should work inside the banking system. For a compliance officer, the FDIC action is a signal that the distinction between exchange custody and qualified custody — which cost fund managers hundreds of millions during the 2022 and 2023 failures — is about to get regulatory teeth. The failure modes are structurally different, and understanding that difference is the difference between being a secured client and an unsecured creditor in bankruptcy court.
The Trigger and Why It Compounds
Custody failure compounds two related risks. First, operational failure: loss of private keys, hot wallet exploits, sub-custodian breaches, or insider theft. Second, legal failure: the custodian enters bankruptcy and client assets are treated as part of the estate rather than segregated client property. Operational failures can be insured against. Legal failures cannot, because they depend on how the custody relationship was structured in the first place.
The Galois Capital case is the canonical example. Galois was a registered investment adviser holding approximately 40 million dollars of client assets, half its AUM, on FTX. When FTX collapsed, Galois lost the entire position because FTX was not a qualified custodian under SEC Rule 206(4)-2. The SEC fined Galois 225,000 dollars for the custody rule violation. The loss was not caused by FTX's operational failure — it was caused by choosing a custodian whose terms of service made client assets part of the FTX estate.
The Blast Radius and Warning Indicators
When a non-qualified custodian fails, the blast radius follows the terms of service. Clients with assets in omnibus wallets and commingled records typically become unsecured creditors, waiting years for cents on the dollar. Clients in explicitly segregated trust structures may recover at par if segregation was maintained in practice, not just on paper. The 2022 Celsius ruling made this clear: a US bankruptcy court found that the majority of customer deposits were property of the company, relegating users to unsecured creditor status.
The earliest warning indicators are legal and structural, not operational. First, the title structure: does the account agreement state that clients retain beneficial ownership, or does it allow the custodian to use, lend, or rehypothecate? Second, segregation in practice: are client assets in wallets addressable only to individual clients with on-chain verifiability, or commingled? Third, recent SOC 1 Type II and SOC 2 Type II reports. Fourth, F/B/O account titling, which NYDFS updated guidance on September 30, 2025 requires of BitLicense holders.
Real Defenses vs. Fake Defenses
Real defenses operate at the legal structure layer. Bankruptcy remoteness through state trust company charter or federal bank charter creates a legal wall between custody assets and the custodian's creditors. Coinbase Custody Trust Company, BitGo, and Anchorage Digital Bank operate under trust or bank charters specifically to establish this separation. The SEC's September 29, 2025 no-action letter clarified that registered advisers can treat state-chartered trust companies as qualified custodians when four conditions are met: state authorization for crypto custody, audited financials and recent SOC reports, a custody agreement prohibiting lending without written consent, and a documented best-interest determination.
Fake defenses include proof of reserves without proof of liabilities — a snapshot can be gamed by borrowing before and returning after. Insurance alone is another: specie insurance covers physical theft or hacks but rarely covers bankruptcy losses, and coverage limits are almost never one-for-one with assets under custody. And arguing that an integrated exchange with a separate custody subsidiary equals a standalone qualified custodian only holds if the subsidiary is legally walled off, files separately, and has its own board and capital.
What Is Improving and the Mitigation Playbook
The constructive signals are concrete. The SEC's September 29, 2025 no-action letter gave registered advisers a documented path to state trust company custodians. The SEC Division of Trading and Markets clarified broker-dealer custody under Rule 15c3-3 on December 17, 2025. NYDFS updated sub-custody guidance on September 30, 2025. The FDIC's April 7 proposal extends this into the banking system, requiring custody reserves to be treated as customer property, segregated, protected from creditors in bankruptcy, and verified by monthly audits.
The mitigation playbook is direct. Use a custodian with a trust or bank charter, not an integrated exchange. Require F/B/O account titling and review the custody agreement for lending, rehypothecation, and title language. Obtain recent SOC reports. Document the best-interest determination per SEC no-action conditions. Monitor on-chain wallet segregation continuously, not at audit snapshots. The residual risk is that none of these structures has been tested under a major custodian failure post-2022. The legal frameworks are clearer, but the stress test has not happened.
For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.
