What is crypto custody?
Crypto custody includes the secure safekeeping, storage, and control of crypto assets or the means to access such assets for customers, possibly in the form of private cryptographic keys used to hold, store, or manage crypto assets on behalf of others.
Digital assets include cryptocurrencies, security tokens and crypto securities. They are based on distributed ledger technology (DLT). The underlying ownership rights of the digital assets are stored transparently in the DLT network.
To access the DLT network, the owners of digital assets use a wallet. This is usually managed by the crypto custodian (digital asset service provider) who also stores the associated access key (private key). However, there are also constellations in which the client opts for self-custody, including the storage of the private keys.
Depending on the type of custody (self-custody vs. custody by the crypto custodian), the crypto custodian requires not just a connection to the DLT network but also a suitable wallet structure. To offer the crypto custody service, the crypto custodian must choose between a segregated wallet structure and an omnibus wallet structure. In a segregated wallet structure, each client is assigned their own wallet. In an omnibus wallet structure, the digital assets of several clients are held in an omnibus wallet (collective custody). In this structure, the ownership rights of individual clients must be kept separate (โoff-chainโ) at all times due to regulatory requirements and other factors.
What are the regulatory requirements for crypto custody services?
From 2025, Germany will be subject to an overarching European legal framework (MiCAR) for crypto custody, as well as national laws (including the German Banking Act (KWG)) that regulate various digital assetsย (seeย Figureย 2[1]).
While the custody of cryptocurrencies such as Bitcoin, Ether and Central Bank Digital Currencies (CBDCs) will in future be governed by the EUโs MiCAR (Markets in Crypto-Assets Regulation) standards, existing financial instruments such as crypto securities and security tokens under MiFIDย II will remain under the supervision of BaFin with regulation in accordance with the German Banking Act. Custody of crypto securities will then fall under regular custody business, whereas the custody of security tokens in Germany will be considered qualified crypto custody under the German Banking Act.
MiCAR is the first EU-wide regulation for crypto assets and services. It creates legal certainty and removes regulatory barriers within the EUโs fragmented legal framework.
Both MiCAR and the German Banking Act impose general and specific requirements on the day-to-day business of CASPs, which are essentially based onย principles of investor protection, market transparency and organization already established by MiFID.
With the entry into force of MiCAR, investor protection in the event of insolvency has been strengthened and existing segregation obligations between the clientโs crypto assets and the crypto custodian have been expanded. MiCAR and the German Banking Act require the provider to apply for a license. BaFin has a standardized application process for custody, while MiCAR offers three options for licensing until the end of the grandfathering period. For example, financial institutions already regulated under MiFIDย II can benefit from the accelerated notification procedure.
Related digital asset services according to MiCAR:
