Crypto custody is a legal relationship as well as a technical service. A platform can display your balance and hold enough coins while its contract leaves important questions unanswered about ownership, delegation and insolvency. To assess custody risk, trace the asset from your account to the institution holding the keys and establish what claim you would have if a link failed.
FINMA’s guidance of 12 January 2026 makes that distinction concrete. Its focus is Swiss supervised institutions and the custody arrangements they use, including foreign custodians. The document is a useful lens for reading a custody offer, but it is not a promise that every crypto customer everywhere receives Swiss insolvency protection.
Follow the custody chain past the brand name
Start with the legal entity named in the account agreement. The app name, website brand and group holding company may be different from the entity that owes you duties. Record the exact entity, jurisdiction, applicable service and the document that governs it.
Next ask whether that entity controls the private keys itself or delegates custody. A bank may work with a specialist custodian; that custodian may use another service for part of its operations. The customer’s account screen rarely explains the full chain.
Delegation is not automatically a defect. Specialist infrastructure may be valuable. The issue is whether the responsibilities, legal protections and dependencies remain clear when another party is involved. A short diagram often reveals questions that a long product brochure obscures.
Use a simple chain: customer, contracting entity, custodian, any subcustodian, and the relevant wallets or record system. Beside each link, note who keeps the ownership record, who can authorise a transfer, and whose law would govern an insolvency.
Understand what FINMA actually addressed
In Guidance 01/2026, FINMA identifies technical risks around private keys and cyberattacks, alongside counterparty risks where assets cannot be segregated from a failed custodian’s estate. Foreign arrangements introduce additional legal questions.
For Swiss portfolio-management arrangements covered by the guidance, the regulator emphasises prudential supervision and the ability to segregate client cryptoassets in insolvency. When custody is abroad, equivalent supervision and equivalent bankruptcy protection matter. The guidance also addresses banks, collective assets and crypto-related structured products in their respective legal contexts.
These are not interchangeable categories. Do not extract one sentence about a bank’s custody assets and apply it to an unregulated offshore exchange account. The identity of the customer, the institution and the product determines which rules are relevant.
The document also describes limited exceptions for certain existing portfolio-management arrangements, involving disclosure, information about alternatives and written client consent. That is another reason to read the scope carefully rather than reduce the guidance to a blanket slogan about approved custody.
Separate ownership records from wallet addresses
A dedicated blockchain address can make a balance easier to observe, but it does not alone settle the legal ownership question. Conversely, an omnibus wallet can hold assets for multiple customers while an internal ledger records individual entitlements. What matters is how the technical arrangement and legal records work together.
Ask whether the assets are held for you as custody assets, transferred under a lending arrangement, or represented by a contractual claim. A product that pays yield may involve additional rights to use or transfer assets. The label “wallet” does not resolve those differences.
Look for provisions on lending, staking, collateral, reuse and transfers to affiliates. Determine whether these are optional services, default features or rights contained in the general terms. A customer may believe they selected simple storage while agreeing to a broader arrangement.
A useful response from a provider points to the operative clauses and explains the recordkeeping. A statement that funds are “safe” or “fully backed” is too broad to answer which assets could be recovered, by whom and through which process.
Use four separate questions about a failure
The first question is whether the provider has the assets. The second is whether its records correctly attribute an entitlement to you. The third is whether the relevant law permits those assets to be separated from the provider’s own estate. The fourth is how long recovery would take.
Evidence for one question is not evidence for all four. A wallet balance may help with the first. A statement of account may help with the second. Neither supplies a legal conclusion on the third, and neither guarantees immediate access.
| Question | Useful evidence | What it does not establish |
|---|---|---|
| Are assets held? | Asset records and appropriately scoped assurance | All liabilities or legal ownership |
| Which assets are mine? | Account records and allocation method | Insolvency treatment by itself |
| Can they be segregated? | Contract and jurisdiction-specific legal analysis | Speed of recovery |
| Can I access them during disruption? | Tested withdrawal and recovery arrangements | Uninterrupted service in every failure |
| Who else is involved? | Named delegation chain | That each entity has identical protections |
Use “unknown” when the provider has not supplied evidence. Filling a blank with an assumption makes the comparison look more complete while making it less reliable.
Read proof of reserves as a limited piece of evidence
A proof-of-reserves page may provide information about assets controlled at a particular time. Its usefulness depends on the method, scope, timing and relationship to liabilities. It should be read alongside the custody contract rather than treated as a substitute.
Questions include whether the report addresses all relevant customer liabilities, how ownership of the demonstrated assets is established, and whether there are encumbrances or other claims. Also ask what period the evidence covers. A point-in-time observation is not continuous assurance.
Do not infer that a particular provider is insolvent because its report is limited. The proper conclusion is narrower: the report does not answer a particular question. That distinction helps keep due diligence factual.
Likewise, avoid assuming that an audit label covers the entire service. Financial-statement audits, security certifications, asset attestations and technical wallet demonstrations can have different purposes. Read the stated scope and any limitations before deciding what confidence the document supports.
Work through a two-provider example
Imagine a business holding €60,000 equivalent in cryptoassets for an operational purpose. Provider A offers inexpensive storage and a clear withdrawal interface, but the contract allows delegation without naming the subcustodian in the available documents. Provider B costs more and names the custody chain, although its insolvency analysis still needs review.
The first task is to resolve A’s missing information, not to declare B the winner. Request the delegation details and contract clauses. If A supplies adequate evidence, the comparison changes. If it does not, the uncertainty remains a real factor.
Now suppose the business needs €8,000 equivalent within two working days to meet obligations. Even a strong legal ownership position does not guarantee that access during a provider failure. The operational plan must therefore consider the amount needed promptly and a usable alternative source of liquidity.
This example contains no quoted market fees and no recommendation of an institution. It shows two different decisions: where assets should be held, and how the business avoids depending on immediate recovery from an insolvent intermediary.
Compare custody with self-custody honestly
Self-custody changes the risk allocation. It can remove a particular custodian from the chain, but it gives the owner responsibility for key security, recovery, transaction authorisation and continuity. Losing a key or signing a harmful transaction can create a problem that a custody contract cannot repair.
For an organisation, ask who can initiate and approve transfers, how staff departures are handled, and how access survives the unavailability of a key person. An arrangement understood by one founder is a business dependency even if the wallet technology is sound.
Do not move everything merely because the legal review of a provider takes time. Evaluate the destination and recovery process first. A hurried migration can exchange an uncertain counterparty risk for an immediate operational error.
The appropriate comparison is between complete operating arrangements. Include people, records, recovery and the purpose of the assets. Comparing a provider’s fee with the price of a hardware device leaves most of the work out.
Keep evidence that would survive the provider’s website
Save the agreement version you accepted, statements showing balances and transactions, and relevant provider correspondence. Keep an inventory of the legal entities involved. Store copies in a place that remains accessible if the account or website becomes unavailable.
Record how deposits and withdrawals reconcile with your own books. A transaction hash can be useful evidence of a blockchain movement, but it does not explain every off-chain trade, fee or contractual entitlement. Preserve the associated account records too.
Review changes to terms, entity transfers and service availability. A custody arrangement can change without the app looking different. If the contracting entity changes, revisit the legal and operational analysis rather than assuming the old conclusion still applies.
For a material holding, professional advice should address the actual agreement and jurisdiction. A general article can identify the questions; it cannot determine the result of a future insolvency proceeding.
A short decision record is more useful than a safety score
Finish the review with a factual record: the purpose and amount of the holding, the contracting entity, custody chain, asset-use rights, evidence reviewed, unresolved questions and operational fallback. Name the person who owns the next action.
A numerical score can help organise a comparison, but it can also conceal a decisive gap. A low fee and good interface should not mathematically cancel an unanswered ownership question. Treat necessary conditions as conditions.
Revisit the record when the amount grows or the use changes. A small experimental balance and a reserve needed for payroll deserve different levels of investigation. The relevant question is how a failure would affect the owner, not whether the service has an attractive reputation.
Questions
Does a separate wallet address prove that crypto is legally mine?
No. It is part of the technical arrangement. The agreement, ownership records and applicable law determine the legal claim.
Does proof of reserves protect customers in bankruptcy?
It may provide evidence about assets within its stated scope. It does not by itself establish segregation rights, all liabilities or the speed of recovery.
Does FINMA’s January 2026 guidance apply to every exchange?
No. It addresses specified Swiss supervised activities and arrangements. Its requirements should not be generalised to unrelated providers or jurisdictions.
Is self-custody always safer?
It removes some intermediary dependencies but introduces direct responsibility for keys, authorisation and recovery. Compare the complete arrangements.
