Setting Up Institutional Crypto Custody from Scratch
In December 2025, the OCC granted national bank charters to BitGo and Fidelity Digital Assets, joining Anchorage Digital, which has held its charter since January 2021. In January 2026, BitGo filed for a 200 million dollar NYSE IPO with Goldman Sachs and Citi as lead bookrunners, with assets under custody crossing 90 billion dollars in mid-2025. Tether took a strategic equity position in Anchorage at a 4.2 billion dollar valuation in early 2026. Three structural shifts in five months — SAB 121 repeal via SAB 122, the GENIUS Act, and three federal charters — have changed the institutional crypto custody buy-versus-build math. For a CFO setting up custody from scratch in 2026, the workflow is mature but the choices still require structured decisions.
The Custody Decision Tree
The first decision is qualified custodian status. Under SEC Rule 206(4)-2, a registered investment adviser holding client crypto must use a qualified custodian unless an exemption applies. In 2026, four legal entity types qualify: federally chartered banks (Anchorage, BitGo, Fidelity Digital Assets), state-chartered trust companies (Coinbase Custody under NYDFS, BitGo Trust under South Dakota law, Gemini Trust under NYDFS), foreign financial institutions meeting equivalent protection standards, and broker-dealers. Self-custody by the adviser is not qualified custody for client assets and triggers the same fines as Galois Capital paid in 2024 for using FTX.
The second decision is single-custodian versus multi-custodian. ETF issuers have already moved to multi-custodian models — 21Shares uses Coinbase, Anchorage, and BitGo simultaneously across ARKB and CETH; Valkyrie added BitGo to Coinbase for BRRR. The case for multi-custodian: distributes operational risk and concentration risk across providers with different security architectures (Anchorage policy-driven biometric, BitGo MPC + multisig, Coinbase cold-storage hybrid). The case against: doubles operational overhead, complicates reconciliation, and most institutions starting fresh do not have the AUM to justify the complexity until they exceed roughly 500 million dollars under custody.
The Vendor Selection Workflow
Vendor selection follows a 90-day workflow. Days 1–30: define scope (which assets, which chains, which workflows — pure custody, custody plus staking, custody plus DeFi, custody plus settlement). Issue an RFP to three to five qualified custodians covering regulatory status, supported assets, security architecture, insurance coverage, settlement and withdrawal SLAs, integration APIs, fee structure, SOC 1 and SOC 2 Type II reports, and references. Anchorage processes 90 percent of transactions in under 20 minutes, BitGo supports approximately 1,500 assets across 60-plus chains, Coinbase Custody safeguards more than 70 percent of US-based crypto ETFs.
Days 30–60: due diligence. Review the last two SOC 2 Type II reports for qualified opinions or material exceptions. Confirm F/B/O account titling — required by NYDFS and SEC in 2026 to ensure assets are not part of the custodian's bankruptcy estate. Validate insurance coverage; BitGo offers up to 250 million dollars but per-account limits are typically far lower. Confirm proof-of-reserves practices, ideally with continuous on-chain attestation rather than annual snapshots. Verify regulatory standing — Anchorage's 2022 OCC consent order was lifted in August 2025, the kind of detail that should appear in due diligence rather than headlines.
Days 60–90: contract, key ceremony, operational onboarding. Custody agreements should explicitly prohibit lending, rehypothecation, or pledging without written consent. The key ceremony establishes signing authority — typically N-of-M approvals from named individuals on hardware tokens or biometric devices for transactions above a defined threshold. Operational onboarding includes API integration testing, approval workflow training, dry-run transactions, and formal go-live sign-off.
The 2 AM Pager Map
Three operational failure modes define the post-go-live phase. First, signing authority lockout: an approver loses their hardware key, leaves the firm, or is unreachable during a market event. Mitigation is N+1 approver redundancy, with at least one approver in a different time zone. Second, API integration failure: the custodian's API returns errors during a withdrawal or settlement. Mitigation is documented manual fallback procedures and a named relationship manager with a 24/7 phone number. Third, regulatory standing change at the custodian: the custodian receives an enforcement action or charter restriction. Mitigation is the multi-custodian model, or at minimum a pre-approved migration playbook to a backup qualified custodian.
What Is Improving and What to Watch
The constructive signals are concrete. Three federally chartered crypto banks now exist where there was one a year ago. Probability-of-default ratings are sub-0.50 percent across federally regulated custodians (Fidelity 0.39%, Anchorage 0.46%, BitGo 0.46%, Coinbase Prime 0.49%) versus over 2.5 percent for offshore entities. SAB 122 removed the balance-sheet liability treatment that kept traditional banks out, and US Bank has re-entered crypto custody as a result. The FDIC's April 7, 2026 proposed rulemaking under the GENIUS Act extends bank-grade custody standards into FDIC-supervised institutions. The metric to track is the number of traditional banks offering crypto custody natively rather than through sub-custodian partnerships with Fireblocks or Copper. As that number grows, custody pricing will compress and integration with traditional finance will tighten further.
For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.
