Start with the custody service map
Crypto custody risk management begins with understanding how the service actually operates. Map the client journey and asset flow from deposit through internal recording, storage, withdrawal, reconciliation and exit. Add the entities, systems, people and vendors involved at each stage. The map helps expose dependencies that a high-level risk statement can miss—for example, a single administrator who can change wallet rules and approve a transfer.
Risk assessment should consider the firm’s service, asset types, transaction patterns, wallet architecture, customer base and jurisdictions. Avoid copying a generic risk register without confirming that it fits the operating model. The same risk may have different consequences in a small custody arrangement and a high-volume exchange.
This article is part of the crypto custody and client asset protection guide. Wallet-specific controls are discussed in our guide to wallet governance and private keys.
Build a risk and control register
A useful register connects the risk, cause, potential impact, control, owner and evidence. For example: “Unauthorised withdrawal may occur if a destination change is not independently verified; impact may include loss of client assets; control is a separate dual-approved address-change process; evidence is the approval record and system log.” This structure supports review and testing.
Include at least these risk families:
-
Operational: incorrect ledger posting, processing error, failed handover or inadequate exception management.
-
Cyber and technology: compromised credentials, software vulnerability, outage, data corruption or failed key infrastructure.
-
Fraud and insider: collusion, misuse of privileged access, falsified approval or manipulation of client records.
-
Third-party: custodian failure, subcontractor weakness, cloud concentration or unavailable service support.
-
Legal and records: unclear client rights, inconsistent terms, incomplete records or inability to identify entitlements.
-
Resilience: unavailable key staff, failed recovery, insufficient backup or inability to wind down safely.
Score risks using a consistent method, but do not let a numeric score replace an explanation. Record the assumptions, existing controls, residual exposure and any action required. Assign accountable owners and target dates. Senior management should review material changes and overdue high-risk actions.
Assess third-party dependencies
Third-party due diligence should match the importance of the outsourced service. Establish which legal entity performs each activity, where data and key components are located, who can access them, what subcontractors are used and how the provider manages incidents. Review independent assurance reports where available, but understand their scope, period and exclusions.
The contract and operating model should address service levels, security responsibilities, incident notification, audit or assurance rights, data access, change notice, business continuity, termination assistance and asset or information portability. A provider’s marketing description is not a substitute for understanding control rights and recovery dependencies.
Map concentration. Several vendors may rely on the same cloud platform, identity provider, key management service or blockchain infrastructure. Consider whether a common failure could disable withdrawal, reconciliation and incident response at once. Maintain a realistic alternative or orderly exit plan for critical dependencies.
Test controls and follow incidents
Control testing should confirm that the procedure exists and works. A sample can trace withdrawal requests from customer instruction through verification, approval, signing and post-transaction recording. A reconciliation test can reperform a comparison and inspect how a break was handled. An access review can verify that departed users no longer hold permissions.
Test both routine and exception paths. Emergency access, vendor unavailability, a material balance discrepancy and a suspected key compromise are often where procedures become unclear. Record the test objective, sample, evidence, result, finding severity, action owner and retest outcome.
Incident learning should update the risk assessment. Identify root causes without collapsing several issues into “human error”. Ask whether incentives, unclear responsibilities, system design or vendor dependencies contributed. Track corrective actions to completion and report recurring findings to governance committees.
The Financial Stability Board’s global framework provides high-level recommendations for regulation and oversight of crypto-asset activities; it is not a firm-level custody checklist. In the EU, MiCA Article 75 provides specific custody requirements for in-scope service providers. In the UK, FCA CASS 17 is part of a future regime scheduled for 25 October 2027. Use primary texts to determine applicability.
Frequently asked questions
What is the biggest crypto custody risk?
There is no single risk that dominates every firm. Exposure depends on control design and service model. Firms commonly assess unauthorised access, inaccurate client records, operational error, third-party failure, cyber incidents and inability to recover.
How should a firm assess a crypto custodian?
Review the service and legal entity, control environment, key access model, assurance evidence, subcontractors, incident response, resilience, data and asset portability, and exit arrangements. Tailor depth to criticality.
What is custody control testing?
It is a review of whether a control is designed appropriately and operates as intended. Testing should use evidence, include relevant exceptions and track remediation.
Does outsourcing custody transfer accountability?
A contract may allocate duties, but outsourcing does not remove the need for the firm to understand and oversee material dependencies. Applicable legal responsibilities depend on jurisdiction and activity.
Continue the custody risk review
Review the wider framework in the crypto custody pillar guide and strengthen practical knowledge through the course on safeguarding and client asset protection controls.
