How Can Banks Offer Crypto-Asset Services Through White Labelling?

How can banks offer crypto-asset services through white labelling? The bank serves customers under its own brand, while specialist firms provide the underlying custody, trading or wallet technology. However, the choice of partners and the division of responsibilities are tightly constrained: in the EU, a bank must notify the competent authority, and custody may only be delegated to licensed entities; in Hong Kong, a bank may only outsource custody to the categories of regulated entities specified by the Hong Kong Monetary Authority (HKMA), and bears ultimate responsibility for the outsourced activities.

Why Do Banks Adopt the White-Label Model?

White labelling is already common in banking. The European Banking Authority (EBA)’s 2025 Report on White Labelling shows that, in the Spring 2025 Risk Assessment Questionnaire, 35% of responding banks were engaged in white-labelling activities. The report also expects white labelling to become increasingly common in the crypto-asset space, particularly where traditional financial institutions want access to blockchain-based payment units without issuing them themselves, or want to offer crypto services without applying for a MiCA licence themselves.

For banks, offering segregated custody only also has prudential significance. The crypto-asset prudential standard of the Basel Committee on Banking Supervision, implemented from 1 January 2026, states that custody services that safekeep or administer customers’ crypto-assets on a segregated basis generally do not give rise to credit, market or liquidity requirements, although the provisions on operational risk, risk management and supervisory review still apply.

White labelling does not, however, transfer responsibility. The EBA notes that the provider contracting with the customer bears ultimate responsibility for compliance, and that the main risk of the white-label model lies in a lack of transparency about the roles and responsibilities of each party.

What Are the EU Requirements for Banks Offering Crypto Services?

Article 60 of MiCA allows credit institutions to provide crypto-asset services, but they must notify the competent authority of their home member state at least 40 working days before providing those services for the first time. The notification must include a business plan, internal AML controls and a risk assessment framework, a business continuity plan, technical documentation of ICT systems, procedures for segregating client assets, and, where custody is offered, the custody and administration policy.

Where custody is provided, Article 75 of MiCA requires a custody policy that minimises the risk of loss of clients’ assets due to fraud, cyber threats or negligence; client assets must be held on-chain separately from the provider’s own assets and be legally segregated from the provider’s estate. The provider is liable for the loss of client assets resulting from incidents attributable to it, with liability capped at the market value at the time of the loss. Most critical for white-label partnerships is Article 75(9): if another provider is used for custody, it may only be an authorized crypto-asset service provider (CASP).

What Are Hong Kong’s Requirements for Banks Offering Digital Asset Custody?

The HKMA’s digital asset custody guidance, updated in May 2026, provides that an authorized institution (AI) may only delegate or outsource custody functions to three types of entities: another AI (or a subsidiary of a locally incorporated AI), an SFC-licensed virtual asset trading platform, and a licensed stablecoin issuer that the HKMA has agreed may provide custody. Due diligence must be carried out before selection to ensure that the entity properly segregates client assets, and ultimate responsibility for delegated or outsourced activities remains with the AI.

The guidance also sets out specific requirements on asset segregation and key management: client digital assets must be held in client accounts and wallet addresses separate from the bank’s own assets; seeds and private keys and their backups must be generated and stored in a secure, tamper-resistant environment, with backups kept in Hong Kong; and most client assets must be held in offline cold storage, with the requirement for virtual assets set at 98%. An explanation from a licensing perspective is provided in the Hong Kong virtual asset custodian licence.

Conclusion

By offering crypto-asset services through white labelling, banks can leverage specialist firms’ technology to launch quickly, but their partners must be regulated entities, asset segregation and key management must meet local requirements, and ultimate responsibility always rests with the bank itself. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Is your bank evaluating offering crypto-asset custody services?

Contact Safeheron’s Sales Team to Book a 1:1 Demo