Ask for the documents before you take the meeting, then read them against each other. Most family offices diligence a brand and sign with a legal entity nobody checked. My view is that four pages decide the outcome: the auditor’s opinion paragraph, the scope section naming what was excluded, the signature block on the account agreement, and the clause saying who owns the assets.
Part of our guide: Family Office.
The short version
- Run every check against the legal entity that signs. Brand, chartered entity, and account counterparty are often three names in one group.
- A type 2 report covers whether controls operated across a period, while a type 1 describes their design on one day (AICPA SOC 2).
- Read the opinion paragraph and the exceptions first. A qualified opinion and a carve-out each narrow what the report covers.
- The account agreement decides whether you hold property or a claim. Celsius turned on its terms of use.
- Proof of reserves speaks to assets and leaves liabilities untouched (PCAOB).
Start with the paper, and know what each document proves
Bank supervisors already wrote the checklist. Their third-party guidance binds banks and works as a standard for anyone handing assets to a provider:
“Relying solely on experience with or prior knowledge of a third party is not an adequate proxy for performing appropriate due diligence”
Interagency Guidance on Third-Party Relationships: Risk Management, June 2023
Two reports get confused constantly. A SOC 1 examination covers controls bearing on your financial reporting, written for your auditors. A SOC 2 examination covers security, availability, processing integrity, confidentiality, or privacy (AICPA). Asking for “the SOC report” and taking whichever arrives answers a question you did not ask.
Four passages carry the information. The opinion paragraph, where a qualified opinion names controls that did not operate as described, sits behind a cover page most readers never turn. The scope, where the carve-out method puts a subservice organization’s controls outside the examination: if cold storage or the ledger runs at a carved-out subcontractor, your report tested none of it. The test results table, where exceptions sit under a clean cover letter. And the complementary user entity controls, obligations at the back the report assumes you perform, which a family office that never read them has by construction failed. Check the period covered against today’s date too, because a report closing eleven months ago describes a company that may no longer exist in that form.
The entity that signs, and the charter it actually holds
One brand routinely spans a chartered trust company, a licensed money transmitter, a foreign affiliate, and a technology company, and exactly one of them becomes your counterparty. Status is checkable in minutes and rarely checked. Federal registration as a money services business applies “whether or not licensed as a money services business by any State” (31 CFR 1022.380(a)(1)). Registration is a form the business files about itself; a license or charter is a grant somebody evaluated before issuing.
The registers are public. NYDFS lists which entities hold a BitLicense and which hold a New York limited purpose trust charter, powers that differ substantially. FDIC BankFind gives charter class, NMLS Consumer Access carries money transmitter licenses, and IAPD carries adviser registrations. Where a provider calls itself a qualified custodian, note that the SEC withdrew its proposed replacement for the adviser custody rule in June 2025, so the existing rule still fixes that term. Settle all of this before anyone drafts a recommendation, because an investment committee should be handed it rather than asked to assemble it.
Custody or credit: what the agreement creates
The sentence that decides an insolvency usually sits in the terms of use. A New York bankruptcy court settled ownership of billions of dollars of customer assets by reading one:
“when the cryptocurrency assets … were deposited in Earn Accounts, the cryptocurrency assets became Celsius’s property; and the cryptocurrency assets remaining in the Earn Accounts on the Petition Date became property of the Debtors’ bankruptcy estates”
In re Celsius Network LLC, Bankr. S.D.N.Y., 4 January 2023
The estate takes “all legal or equitable interests of the debtor in property” at filing, and property held under legal title alone enters only to the extent of that title (11 U.S.C. § 541(a)(1), (d)). Remoteness reduces to what the agreement transferred and whether the provider’s records identify your assets as yours. New York’s regulator states the standard, in guidance issued 30 September 2025 replacing its January 2023 version:
“the VCE Custodian will take possession only for the limited purpose of carrying out custody and safekeeping services, and that it will not thereby establish a debtor-creditor relationship with the customer”
Outside New York’s regime that language still gives you a benchmark. Read the title clause, any permission to lend, pledge, or rehypothecate, the segregation model, whether sub-custody can change without notice, and the governing law. Borrowing against a position puts the same assets into a credit agreement with its own version of those clauses.
Insurance towers and proof of reserves
Ask for the certificate rather than the number on the website. Who is the named insured, what is the limit against total assets under custody, do limits apply per occurrence or in the aggregate across every customer, what sublimits attach to hot and cold storage, and what do the exclusions say. A crime policy covering employee theft at the provider does very little for you when the provider files.
Reserve attestations invite a larger error. The PCAOB’s investor advocate stated the limitation plainly:
“The procedures undertaken likely do not address the crypto entity’s liabilities, the rights and obligations of the digital asset holders.”
PCAOB, Investor Advisory on Proof of Reserve Reports, 8 March 2023
Control of addresses at one moment says nothing about what is owed against them, and borrowed assets look identical to owned ones in a snapshot. Treat it as one input, then ask how liabilities get reconciled and who outside the company checks that work. One caution on the financial statements: SAB 122 rescinded SAB 121 in January 2025, changing how safeguarded crypto is presented across the years you are comparing.
What I actually see
The report is requested, received, and filed unread. Somebody records “SOC 2 type II on file” in the diligence memo and the item closes. Where I have gone back and looked, the exceptions were describing the exact process the family was relying on.
Diligence gets done on the group and the account gets opened with an affiliate. The entity in the report scope, the entity holding the charter, and the entity on the signature page are three different names that no page in the file ever placed next to each other.
Diligence happens once. Onboarding is thorough, then the report period lapses, a sub-custodian changes, terms get amended by portal notice, and two years later the file still holds the original pack.
The check I would run. One page, four lines. Write the exact legal entity from the signature page of the account agreement. Under it, the entity named in the scope section of the current report. Under that, the entity holding the license or charter you were told about, copied from the regulator’s register rather than the provider. Under that, the named insured on the certificate. If any two lines disagree, that is a question worth putting in writing before anything moves. It takes twenty minutes and turns up an unexplained line more often than anyone expects.
Where this goes wrong
Diligence fails by stopping at whichever artifact was easiest to obtain.
The specific failures: a SOC 2 accepted as evidence about financial reporting it never examined; a carve-out removing the subcontractor holding the keys from the only report on file; user entity controls assuming a dual authorization nobody was told to enforce; a certificate naming a parent while the account sits with a subsidiary; an aggregate limit read as though it applied to one account; a pledge clause accepted because nobody read past the fee schedule. And the version that ends in court, an internal ledger that cannot say whose assets are whose, which turns the whole question into 11 U.S.C. § 541.
The decision rule
- Name the counterparty first. Get the exact legal entity that will sign, in writing, before other work starts.
- Verify the license or charter on the regulator’s own register, and record the date you checked.
- Request the current report under NDA and read the opinion, the scope, the exceptions, and the user entity controls before the summary.
- Chase every carve-out to the subservice organization behind it, and ask for that entity’s report too.
- Read the title, rehypothecation, and segregation clauses yourself, then have counsel resolve any ambiguity.
- Demand the insurance certificate, the named insured, the limit against assets under custody, and the exclusions.
- Treat proof of reserves as an assets-only data point, and ask separately who reconciles liabilities.
- Calendar the refresh against four triggers: new report period, sub-custodian change, amended terms, change of control.
Where this sits
Diligence is one leg of a larger apparatus. The policy sets what may be held and where, governance settles who signs, the custody hub covers the arrangements, and reporting is where a provider’s weaknesses surface month by month. A trustee carries an additional duty layer, and the basis history a provider hands you becomes your tax record.
These questions cross professional boundaries, and the join is where they fail. Counsel reads the agreement, the CPA reads the provider’s reporting, operations reads the control report, and the committee reads the presentation. Each is competent inside its own document, and nobody owns the contradictions between them: a pledge the agreement permits and the policy forbids, a carve-out removing the control the committee was told about, a named insured matching none of the entities anyone else examined. Before you sign, name the person who reads all four, because that job is otherwise vacant.
Sources
- Interagency Guidance on Third-Party Relationships: Risk Management (SR 23-4)
- PCAOB, Investor Advisory: Third-Party Verification/Proof of Reserve Reports
- NYDFS, Updated Guidance on Custodial Structures (30 September 2025)
- In re Celsius Network LLC, Memorandum Opinion on Ownership of Earn Account Assets
- 11 U.S.C. § 541, Property of the estate
- 31 CFR 1022.380, Registration of money services businesses
- SEC, Staff Accounting Bulletin No. 122
Related
- Crypto family office checklist
- How to choose a crypto family office
- Digital asset investment policy statement for family offices
- Crypto governance for family offices
- Digital asset custody
- Crypto family offices
Last updated: 3 August 2026.
This article is general education, not legal, tax, accounting, or investment advice. Diligence can reduce certain counterparty risks but does not eliminate them, and nothing here evaluates or recommends any provider. Talk to a qualified attorney and CPA about your own situation.
