Scaled and Stable Operations: custody and asset safekeeping Scaled and Stable Operations: custody and asset safekeeping Scaled and Stable Operations: custody and asset safekeeping

Challenges for custody providers  |  Asset safekeeping  |  Terms of service |  Insurance

The term ‘custody’ in the context of virtual assets refers to the management and safekeeping of the cryptographic private keys that virtual asset owners use to execute virtual asset transactions. Whoever controls these private keys can sign transactions and change the amount of assets owned in near real-time – effectively controlling the asset.

Therefore, custody plays a very important role on the path to institutionalization, with VASPs needing to offer their own custody approach, or engage with secure custody providers.

Custody providers for virtual assets face a number of challenges, and are working in different ways to overcome them. For example, every participant in the virtual asset market needs a way to safely store and move their assets. In traditional FS, participants often rely on third parties to store and move assets safely. Yet, virtual assets are different in two ways:

1. Direct access: Virtual assets were designed to provide owners with full control over them, without the need for centralized middlemen that record ownership or transactions.
2. Ownership and bookkeeping: Virtual assets exist and are recorded only in the virtual space without a local register of ownership. This means whoever has control over the asset, specifically the private key, has ownership by design. It requires local contract law to record changes to this arrangement, i.e. between a custodian and the asset owner.

As a consequence of these differences, three solutions have emerged:

1. Self-custody solutions: These leverage direct access to the asset (referenced as ‘access to the private key’), through either software and hardware to store the assets. Solutions are differentiated between ‘hot’ and ‘cold’ storage, whereby hot indicates that the ‘wallet’ has direct access to the internet, and cold indicates ‘air-gapped’ computers, without internet access and often kept in a protected location. Examples of self-custody are Hardware Security Modules (HSM) in a data center, to simple USB stick or mobile wallets with pre-configured software. 
2. Exchange-hosted wallets: Some exchanges offer ‘hosted wallets’, which are commonly used for asset storage by retail investors and traders. Exchanges took on this role to smooth out trading activities, and over time have strengthened their service and safety. The retail investor does not have an actual wallet, and does not have access to private keys, like in the case of self-custody solutions.
3. Independent full-service custodians: These service virtual asset exchanges and institutional investors that want to safely keep a large amount of assets and operate across multiple jurisdictions. They store the assets both hot and cold, and may also offer regulatory compliance services and tax reporting. 

To prepare for large-scale adoption, VASPs will need to increase the maturity of asset safekeeping. It is important to have more than ‘cold storage’. Instead, a combination of secure vaulting and cryptographic hardware with a governance model, robust terms of service, independent reviews (audit), and value-added services that create multiple layers of security are needed.

This will help:

• Protect the asset against hacking and other cyber security risks 
• Prevent physical access or stealing of the vault or wallet hardware 
• Back-up the asset as safe as the originals 
• Prevent single points of failure by a clear separation of duties 
• Offer insurance in case the asset is being compromised 
• Manage liquidity and 24-hour access to the asset if needed 
• Continuous compliance with local and global regulations  

VASPs need to have clear legal agreements, or ‘terms of service’, with custody services providers, and these must reflect the operating locations of the custody business. These terms should emphasize compliance with local regulations of factors such as KYC programs and AML, location of private key storage, and have a clear reference to the property and insolvency law that applies to assets in case of a defaulting custodian.

Insurance is often seen as a ‘holy grail’ for the investor’s protection; however, both the attainment of sufficient coverage and any eventual payout depend on the custodian’s ability to achieve high standards of asset protection. Insurance policies are often brokered individually, for a limited period, and covering specific systems and incidents only. Due to a lack of ‘vanilla policies’, industry standards, regulation on custody best-practice, and generally poor historic data sets, fees of 1 percent p.a. of the amount protected are common, making insurance expensive.

Some custodians have been able to obtain insurance policies and offer insurance to their customers. The natural evolution would be for VASPs to likewise offer insurance to users, as this would instill confidence, and further assist institutional investors with the due diligence process.

Over time, we expect the custody choices for investors to become easier due to standardization of the industry and the emergence of certification programs. It will be helpful to have more support for institutional investors in their decision making and risk assessment in picking a custody solution that suits their needs best.