What Types of Crypto Custody Exist, and Who Is Liable in Each

In 2022 Celsius Network held crypto for hundreds of thousands of people. It held some of it in a product called Earn and some of it in a product called Custody. Same company. Often the same customer. Different paragraph of the terms of use.

When Celsius entered Chapter 11, the bankruptcy court was asked who owned what. On 4 January 2023 it held that assets in Earn accounts, roughly 4.2 billion dollars of them, were property of the bankruptcy estate rather than of the customers, because the terms of use those customers had accepted transferred title to Celsius.

The court’s reasoning turned on contract language. Not on where the keys were, not on which blockchain, not on any technical property of the asset. On what the agreement said.

And the ruling was explicitly narrow. It decided Earn accounts. It did not decide the Custody Program, the Withhold Accounts or the Borrow Program, and it left individual customers free to raise defenses of their own.

That is the whole subject of this article in one case. “Custody” is not one thing with one answer. It is a family of arrangements that look identical from a phone screen and produce completely different results the moment something fails.

In re Celsius Network LLC, No. 22-10964 (MG), Bankr. S.D.N.Y., memorandum opinion of 4 January 2023.

The six arrangements, and where the loss lands in each

Self-custody. You hold the private keys. Nobody else can move the asset and nobody else is obliged to help you if you cannot. There is no counterparty, which means there is no counterparty risk and also no recourse. Loss of the key is loss of the asset, and this is the only arrangement on this list where that sentence is literally true.

Exchange custody. The exchange holds the keys, usually pooling customer assets in shared wallets with an internal ledger recording who owns what. Your claim is contractual, defined entirely by the user agreement, and this is the arrangement Celsius was operating. What you own depends on what the agreement says you own. The pooling itself is not the problem. The problem is that pooling plus a title-transfer clause turns a bailment into a loan, and the user cannot see the difference from the app.

Qualified custodian. This is a defined term, not a marketing one. The Advisers Act custody rule requires a registered investment adviser with custody of client assets to place them with a qualified custodian, and 17 CFR 275.206(4)-2(d)(6) defines that as four categories:

“(i) A bank as defined in section 202(a)(2) of the Advisers Act … or a savings association as defined in section 3(b)(1) of the Federal Deposit Insurance Act … that has deposits insured by the Federal Deposit Insurance Corporation …; (ii) A broker-dealer registered under section 15(b)(1) of the Securities Exchange Act of 1934 …; (iii) A futures commission merchant registered under section 4f(a) of the Commodity Exchange Act …; and (iv) A foreign financial institution that customarily holds financial assets for its customers, provided that the foreign financial institution keeps the advisory clients’ assets in customer accounts segregated from its proprietary assets.”

Notice what is not on that list: a crypto company. There is no category for a technology firm that is very good at holding keys.

The route in is category (i), and it is worth reading the statute it points at. The Advisers Act defines a bank to include, at 15 U.S.C. 80b-2(a)(2)(C):

“any other banking institution, savings association … or trust company, whether incorporated or not, doing business under the laws of any State or of the United States, a substantial portion of the business of which consists of receiving deposits or exercising fiduciary powers similar to those permitted to national banks under the authority of the Comptroller of the Currency, and which is supervised and examined by State or Federal authority having supervision over banks or savings associations, and which is not operated for the purpose of evading the provisions of this subchapter.”

That is the mechanism behind every state-chartered crypto trust company. The arrangement is not a crypto exemption. It is a trust company doing what trust companies have always done, supervised by a state banking regulator, and the fiduciary powers clause is the part doing the work.

The rule also requires more than a custodian. It requires client-name or client-only accounts, written notice of the custodian’s identity, quarterly statements sent by the custodian directly, and an annual surprise examination by an independent public accountant who files a Form ADV-E. If someone tells you assets are with a qualified custodian and cannot tell you who sends the statement, one of those two things is not true.

Bank fiduciary custody. A bank holding assets in a fiduciary capacity is governed by 12 CFR part 9 (or part 150 for federal savings associations). The OCC restated this in May 2025: “If the bank acts in a fiduciary capacity, the bank must comply with 12 C.F.R. part 9 or 150, as applicable.” Fiduciary duties are the strongest position a customer can hold on this list, and assets held in that capacity are held for the customer rather than owned by the bank.

Bank non-fiduciary custody. The same bank, the same vault, a different legal capacity, and a materially weaker set of duties. OCC Interpretive Letter 1170 permits both, and the choice between them is made in your account agreement, not by the bank’s charter. This distinction is invisible in marketing copy and decisive in a failure.

Sub-custody. Your bank holds the relationship and another firm holds the keys. The OCC expressly permits this:

“Similarly, a bank may use a sub-custodian to provide custody services, including the services described above, subject to appropriate third-party risk management practices.”

Your legal claim runs to the bank. The asset sits with someone you may never have heard of. Both facts are true at once, and the second one is the one that determines what physically happens to the coins.

Sources, read in full: 17 CFR 275.206(4)-2 (eCFR); 15 U.S.C. 80b-2 (US Code); OCC Interpretive Letter 1184, 7 May 2025, https://www.occ.gov/topics/charters-and-licensing/interpretations-and-actions/2025/int1184.pdf

What the 2025 accounting change did and did not do

In January 2025 the SEC rescinded the bulletin that had required custodians to carry safeguarded crypto on their own balance sheets at gross value. Under Staff Accounting Bulletin 122, an entity holding crypto for others instead decides whether to recognize a liability for the risk of loss, measured under the ordinary loss-contingency standards, FASB ASC Subtopic 450-20 or IAS 37.

This was reported at the time as a change in who owns custodied crypto. It was not. It is a change in how a custodian reports its obligation. Your property rights come from your agreement and from the law of the state that governs it, and no accounting bulletin alters them in either direction.

The practical effect is on supply rather than on rights: custody became economic for regulated institutions, so more of them offer it. That is a real and useful change. It is not a change in your claim.

Source, read in full: SEC, Staff Accounting Bulletin No. 122, 23 January 2025

Insurance is the most misread word in this business

Three different things get called insurance and only one of them is what most readers assume.

FDIC deposit insurance covers deposits at an insured bank if the bank fails. It does not cover crypto, and it has never covered crypto. A firm that holds dollars at an insured bank may accurately say those dollars are covered. That statement says nothing about the coins.

Crime or specie insurance is a commercial policy a custodian buys against theft, and it is usually written against the custodian’s own losses rather than as a direct benefit to you. It typically carries a limit far below assets under custody, because pricing full coverage on that risk is not currently practical.

A private guarantee fund is a promise by the platform, backed by the platform. A guarantee fund’s value in a bankruptcy is the value of an unsecured claim against a bankrupt company.

None of the three answers the question you care about, which is whether the asset is yours or theirs when the lawyers arrive. Only the agreement answers that.

The one question worth asking

Not “is it insured”. Not “is it in cold storage”. Not “how many audits”.

Does this agreement say the asset remains mine, or does it transfer title to you?

Celsius customers who read that paragraph and those who did not ended up in the same position, because the answer was in the document either way. The 4.2 billion dollars did not turn on the technology. It turned on a sentence that was available to read the whole time.

—