What Is the Difference Between Third-Party Custody and Self-Custody?
What is the difference between third-party custody and self-custody? The key is who holds signing authority. Third-party custody hands private keys to a custodian or custodian bank, which signs on the institution’s behalf; self-custody means the institution holds the private keys or key shares itself. The former removes the operational burden but places asset security in someone else’s hands; the latter keeps control in-house, but the institution must bear the consequences of any mistakes.
Where Does the Risk Sit in Each Model?
With third-party custody, an institution mainly faces counterparty risk: if the custodian is attacked, runs into business trouble, or freezes assets or delays withdrawals under the contract, the institution has little ability to intervene. With self-custody, the risk shifts inward: whether keys are configured correctly, whether signing devices are secure, and whether access can be recovered when key personnel leave or make mistakes.
A common misconception is that using MPC means self-custody. In fact, MPC is just a key technology that can be used in both custodial and non-custodial Wallet-as-a-Service. If clients cannot independently transfer or recover their assets without the service provider, it is still custody in substance.
What Happens to Assets If the Custodian Goes Bankrupt?
This is the most important question to clarify before choosing third-party custody. Regulated custody arrangements segregate client assets from the custodian’s own assets: the EU’s MiCA requires the two to be separated both operationally and legally, so the custodian’s creditors cannot claim client assets if it goes bankrupt; licensed trading platforms in Hong Kong must hold client assets on trust through a wholly-owned subsidiary; and DPT licensees in Singapore must likewise hold assets on trust for clients. Custody regulation across jurisdictions differs in the details, so confirm before signing that these arrangements are written into the contract.
Self-custody does not carry this concern: assets always remain at addresses the institution controls, provided its key backup and recovery plans are reliable.
Which Institutions Must Use Third-Party Custody?
This depends on the institution’s regulatory status. Under the SEC’s October 2026 custody rule proposal, registered investment advisers and regulated funds in the US are in principle required to use a qualified custodian, and the proposal explicitly includes eligible state trust companies. Self-custody is permitted only when no qualified custodian is available and the reason is not cost.
In Hong Kong, the SFC has said it will require licensed virtual asset dealers to place client assets with custodians it regulates; fund managers that hold the private keys to fund assets themselves will also need a license under the consultation conclusions on the virtual asset custodian license. Institutions not subject to such rules can choose based on their business and operational capabilities.
How Should Costs Be Compared?
Third-party custody fees are usually tied to asset size, so the more assets you hold, the more you pay. Self-custody avoids this fee but requires investment in wallet systems, infrastructure and a dedicated team. When comparing custody fees, calculate the total investment over several years rather than looking only at the first-year quote.
Can the Two Models Be Used Together?
Yes, and this is common: reserves that are subject to regulatory requirements or held long term are placed with a third party, such as banks offering crypto custody, while day-to-day payments and on-chain operations use self-custody wallets. The trade-off is that the two systems must be integrated, with permissions, reconciliation and contingency plans managed in a unified way.
Conclusion
When choosing between third-party custody and self-custody, first check whether your regulatory status imposes mandatory requirements, then decide which side the risk should sit on: trust in the custodian, or confidence in your own internal controls. Many institutions end up combining the two. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.
Would your institution rather place risk with a custodian or with its own internal controls?
Looking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.
Request a DemoLooking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.