Custodians at risk?

FINMA identifies several risk areas that were not always sufficiently addressed in the past.

Counterparty risk in case of custodian insolvency
If digital assets are held with a third-party custodian, there is a material risk that assets cannot be clearly segregated in the event of insolvency. Without proper segregation, client assets may become part of the bankruptcy estate.

Foreign custody adds legal complexity
Holding assets abroad introduces additional legal and operational uncertainty, including:

• unclear or non-equivalent bankruptcy regimes
• jurisdictional conflicts
• limited enforceability of segregation claims

These factors can significantly increase recovery risk in a stress scenario.

Operational and technology risks
FINMA also highlights operational and technology risks specific to digital assets, including cyber risk and key management risks related to distributed ledger technology. In addition, institutions must carefully manage credit exposures and ensure clear risk disclosures to investors, particularly for structured products and crypto ETPs.

Dependency on third-party infrastructure
Using an external custodian creates operational dependency on the provider’s infrastructure, including its key management systems, security architecture and operational processes. This makes careful provider selection and ongoing oversight essential.

Lack of prudential supervision
Risk increases substantially if the custodian is not subject to prudential supervision, does not comply with supervisory custody standards, or operates outside a framework that provides investor protection comparable to Swiss regulation. FINMA’s supervisory findings indicate that these risks were often underestimated.

Portfolio managers, fund managers and issuers with crypto exposure are now expected to actively verify that their custodians meet key regulatory expectations.

In particular, institutions should ensure that the custodian:

• provides effective segregation of client assets
• offers bankruptcy-remote custody structures
• is subject to prudential supervision
• applies standards comparable to Swiss regulatory expectations for client asset protection

This is no longer a theoretical compliance question — it is a supervisory expectation.

FINMA emphasises that even when crypto-based assets are held in full compliance with regulatory requirements, they are not considered safe or low-risk investments. These assets can be highly speculative, extremely volatile and may lead to significant losses. Financial institutions must therefore provide investors with clear and explicit risk disclosures when offering products or services involving crypto-based assets.

When are you on the safe side?

Institutions are materially better positioned when their custodian provides:

• Segregation of assets — clear legal and operational separation ensuring client assets remain identifiable and protected in the event of insolvency

• Prudential supervision — a licensed and supervised custodian subject to ongoing regulatory oversight

• Equivalent bankruptcy protection — custody structures aligned with Swiss standards that ensure client assets remain bankruptcy-remote and legally protected in stress scenarios

As a licensed and FINMA-regulated custodian, ISP provides digital asset custody designed to meet the supervisory expectations outlined in FINMA’s latest guidance, including segregation, insolvency protection and robust operational controls.

We support:

• secure safekeeping of digital assets and tokens with clear legal and operational segregation
• issuance and custody for structured products with crypto underlyings aligned with disclosure and custody requirements
• bankruptcy-remote custody structures and governance frameworks consistent with prudential supervision

If you would like to reassess your current custodial setup — or design a compliant structure from day one — we would be pleased to support you.