To evaluate a crypto custodian, verify three things separately: who controls the keys and authorizes transfers, what legal and operational safeguards apply to your assets, and whether insurance or contract terms actually give you a route to recover a loss. Ask for evidence tied to the exact legal entity, product, assets, wallets, and customer type you would use. A bank’s authority to offer custody, a compliance label, or an insurance headline is not by itself proof that your assets are protected.
Start with the entity that holds or controls the assets
Identify the legal entity named in your custody agreement—not just the brand on the app—and every sub-custodian or service provider involved. Ask where each entity is organized, which regulator or charter applies, and which entity is responsible for your account, records, and withdrawals. Confirm that the entity described in regulatory materials is the same one contracting with you and actually providing the service.
Then trace the custody arrangement: who holds or can access private-key material, who can initiate a transaction, who must approve it, and what happens if a key or credential is compromised. A provider should be able to explain its model in concrete terms rather than relying on phrases such as “institutional-grade security.”
- How are keys generated, stored, divided, and protected?
- What signing threshold and independent approvals are required for transfers?
- How are withdrawal policies enforced, and can one person or system bypass them?
- How are access rights revoked, and how does key recovery work?
- Which vendors, affiliates, or sub-custodians can affect access to assets or transaction processing?
In October 2026, the SEC proposed treating possession of any portion of a client crypto asset’s key materials as self-custody for purposes of its proposed adviser rule. That is a proposal, not a current requirement. The practical point for a customer is to ask who controls each key share and whether the provider’s description matches the actual arrangement.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Check ownership, segregation, and records
Ask how the provider records your beneficial ownership and whether your assets are kept separate from the provider’s proprietary assets and from other customers’ assets. Find out whether your account uses individually identified addresses or an omnibus wallet, and how the provider maps wallet balances and transactions to your statements.
Read the custody agreement for the legal terms that determine what the provider may do with assets and what happens if it fails. In particular, look for terms on lending, rehypothecation, use of assets, withdrawal conditions, insolvency, liability, and dispute or recovery procedures. Do not infer that assets are segregated or unavailable for the provider’s use just because a dashboard displays a separate balance.
Ask how often the provider reconciles its internal customer records with wallet or network data, who performs that reconciliation, and how discrepancies are handled. You should be able to understand how the balance shown on your statement relates to assets held at the relevant addresses.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Request independent evidence, not just security claims
Ask for the relevant audit, examination, or independent control report and confirm its scope, covered systems and locations, testing period, exceptions, and remediation status. A certification or audit label does not necessarily cover every asset, affiliate, wallet, service, or subcontractor. Check whether the report addresses crypto-specific key management and transaction controls, and whether material third parties are included.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Also ask for the provider’s incident-response and resilience arrangements. Useful evidence covers how it would respond to key compromise, maintain or restore operations, communicate a material incident, and recover access after a disruption. Ask how withdrawal availability is managed during an incident and whether the provider depends on a small number of vendors, networks, or other critical services.
Under the SEC’s October 1, 2026 proposal, certain adviser self-custody arrangements would have to include annual cybersecurity reviews, internal-control reports initially within six months and annually thereafter, and quarterly client statements identifying crypto addresses, among other described controls. These are proposed terms, not requirements that should be assumed to apply today. The SEC’s current custody framework and its applicability depend on the adviser, asset, and arrangement.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Determine which rules apply to your arrangement
Regulatory status matters, but it is not a substitute for reviewing a provider’s controls or contract. Identify the exact charter, license, or registration the provider relies on, the regulator and jurisdiction, and whether the authorization covers the activity and legal entity in your agreement. Check whether the service is provided through a third party or sub-custodian and whether that arrangement changes who is accountable to you.
For SEC-registered investment advisers with custody, the current Advisers Act custody framework generally requires use of a qualified custodian, specified notices, a reasonable basis for quarterly account statements, and independent verification, subject to exceptions. Whether those safeguards apply to a particular customer or asset depends on the adviser and custody arrangement; an adviser’s obligations do not automatically establish the protections available under a separate retail custody contract.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesOn October 1, 2026, the SEC issued a proposal addressing custody of crypto securities and similar investments by regulated investment companies and custody of client crypto funds and securities by registered investment advisers. It would amend and redesignate the existing adviser custody rule and add crypto-specific provisions. As of October 7, 2026, it is a proposal, not an effective rule. The SEC has not thereby made every custodian subject to its proposed controls.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
The federal banking agencies’ July 14, 2025 interagency statement says existing laws, regulations, and risk-management principles apply to bank crypto-asset safekeeping and creates no new supervisory expectations. The OCC says national banks and federal savings associations may offer crypto-asset custody and execution services and may outsource bank-permissible crypto activities, subject to appropriate third-party risk management and applicable law. These statements describe authority and supervisory context; they are not endorsements of a particular bank or sub-custodian.
This is a U.S. federal baseline. State trust-company and licensing rules, non-U.S. regimes, securities classification, and product-specific terms can change the analysis. For a specific provider, review regulator records and the actual agreement and reports rather than assuming the same protections apply everywhere.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Read insurance terms—and separate them from deposit insurance
FDIC insurance is deposit insurance, not insurance for crypto custody. The FDIC says it covers eligible deposits held at an insured bank if that bank fails; it does not insure crypto assets or assets issued by non-bank crypto companies. It also does not protect against a non-bank crypto custodian’s insolvency or losses from theft or fraud. If an account combines cash and crypto, identify the legal entity holding each and determine whether the cash is an eligible deposit at an insured bank.
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Private commercial insurance is different: the policy wording and the customer contract determine what, if anything, can be recovered. Ask for the policy or a sufficiently detailed certificate, then establish:
- Who is the named insured, and are customers beneficiaries or otherwise entitled to make a direct claim?
- Which customer assets, wallets, locations, entities, and services are covered?
- Which events trigger coverage, and which are excluded?
- What are the aggregate and per-loss limits, sublimits, and deductibles?
- Who controls a claim, how are proceeds allocated, and what contractual remedy does a customer have?
Pay particular attention to exclusions or limitations involving employee misconduct, compromised credentials, social engineering, smart-contract exploits, chain events, insolvency, and third-party services. A provider’s stated aggregate limit does not establish that your assets are covered, that a specific loss would qualify, or that you could claim directly. The official sources reviewed do not establish a universal private crypto-custody insurance amount or standard policy wording.
Compare providers using the same evidence
Use the same questions and document standards for each provider. A comparison is meaningful only when it concerns the same product, customer type, assets, and custody entities.
| Area | What to compare | Evidence to request |
|---|---|---|
| Key control | Key generation and storage, signing thresholds, separation of duties, transaction policies, recovery, and withdrawal controls | Written custody and security descriptions; transaction-approval and recovery procedures |
| Asset rights and segregation | Legal and beneficial ownership, omnibus or individually identified holdings, use or lending rights, insolvency treatment, and reconciliation | Custody agreement; account and wallet mapping; reconciliation method and customer statements |
| Independent assurance | Auditor or examiner independence, report period, systems and locations covered, exceptions, remediation, and subcontractor scope | Relevant reports or examinations, with scope and findings available for review |
| Regulatory fit | Contracting entity, regulator and jurisdiction, permitted activity, and third-party custody arrangements | Legal entity details, charter or license information, regulator records, and sub-custody disclosures |
| Insurance and recourse | Policyholder, covered assets and perils, exclusions, limits, deductibles, customer rights, and recovery process | Policy or detailed certificate and the contract terms governing claims and liability |
| Operational resilience | Incident response, continuity, key-compromise response, network support, withdrawal controls, and critical dependencies | Written incident, continuity, recovery, and third-party management information |
Use this document checklist before relying on a claim
- Map the entities. Get the legal name and jurisdiction of the service entity and every sub-custodian, then match them to the agreement and regulatory status claimed.
- Trace control and recovery. Get a clear explanation of key control, approval steps, recovery, segregation, and transaction authorization.
- Review assurance evidence. Obtain applicable audit or control reports and identify their coverage, exceptions, and remediation status.
- Verify records. Request customer statements and an explanation of how balances and transactions can be reconciled to wallet or network data.
- Read asset and liability terms. Confirm ownership, permitted use, withdrawal conditions, insolvency treatment, liability, and recovery routes in the custody agreement.
- Verify insurance. Review policy evidence, exclusions, limits, and whether you have any direct claim right rather than relying on a headline figure.
- Ask about failures and complaints. Get written information on incidents, third parties, business continuity, and complaint or recovery procedures.
- Match every document to your case. Confirm that it covers the product, customer type, assets, wallets, and legal entity you would actually use.
If a provider will not supply enough information to verify a material claim, treat that claim as unverified. A missing policy or report does not prove a loss will occur, but it leaves you unable to establish the protection being advertised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
