“Insured custody” is doing a lot of work in a short phrase. It usually describes something real. It rarely describes what the reader assumes.
This article stays on one question: what the insurance behind an institutional crypto custodian actually is, and where its edge sits. The wider set of risks that custody leaves with you is covered separately in what institutional custody does not protect you from. If you want the mechanics of custody itself before any of this, DAG’s explainer on institutional-grade custody for private clients is the place to start.
The policy is a crime policy rather than a safety net for your account
Custodians generally buy two related things.
A crime policy responds to dishonest acts: theft by an outsider, theft by an employee, fraudulent transfer instructions. A specie policy responds to physical loss or damage of property held in a vault, which in this context means the hardware and the key material inside a cold-storage facility.
Both are property and casualty products. They pay the insured for a covered loss. The insured is the custodian. You are the reason the custodian bought the policy, and in most structures you are not the party the insurer pays.
That single fact reframes everything else. A claim runs custodian to insurer, then custodian to you, and each of those two legs has its own conditions. If the custodian is solvent, the second leg is usually straightforward. If the custodian has failed, the second leg becomes a bankruptcy question, and the New York Department of Financial Services guidance on custodial structures is the clearest published statement of what makes that leg survivable: segregation on-chain and on the internal ledger, and a customer agreement that establishes custody rather than debt.
The arithmetic of a shared limit
Here is the part that gets left out.
A policy limit is almost always written at the platform level. It is the most the insurer will pay across all claims in the period, for all clients, from one pool. Read the number that way and it behaves differently than a headline suggests.
The model below is illustrative. The figures are chosen to be round, not because any named custodian reports them. Apply your own custodian’s real numbers and the shape holds.
| Assets under custody, platform | Policy limit | Limit as a share of assets | Cover on a $50M position, pro rata |
|---|---|---|---|
| $1 billion | $250 million | 25.0% | $12.5 million |
| $5 billion | $250 million | 5.0% | $2.5 million |
| $20 billion | $250 million | 1.25% | $625,000 |
| $50 billion | $250 million | 0.5% | $250,000 |
Three things fall out of that table.
The limit is fixed while the platform grows, so coverage per dollar held falls as the custodian succeeds. A figure that was reassuring at the point you signed can be materially thinner three years later, and nobody sends a notice when it crosses your comfort line.
A total loss event is not the scenario the limit is sized for. Insurers price for a contained incident, so the limit reflects the largest plausible single loss rather than the platform’s whole balance.
And the pro rata column is a simplification in your favor. Real policies pay claims as they are settled, so a large early claimant can absorb the limit before a later one is adjudicated.
The useful questions therefore go past whether insurance exists. What is the limit, is it shared, what are the sub-limits for hot wallet versus cold storage, and what were the custodian’s total assets under custody at the last measurement date.
What these policies characteristically exclude
Exclusions vary by carrier and by wording, and the only authoritative answer is the policy your custodian holds. Some categories come up often enough to ask about by name.
A fall in price. No custody arrangement addresses market risk, and no custodian claims it does. The confusion runs the other way: “insured” gets heard as “protected,” and the two words describe different things.
Protocol failure. A consensus incident, a failed upgrade, or a chain-level bug is not a theft. Where a ledger enforces controls itself, that is a separate layer of protection from anything an insurer wrote. The XRP Ledger is unusual here in enforcing multi-signing, deposit authorization and escrow at the protocol level, all live for years, and each one is checkable against the ledger in the complete index of enabled XRP Ledger amendments.
Your own compromised credentials. If an instruction arrives correctly authenticated through your approved channel, the custodian generally executed a valid instruction. Where the failure sits inside your organization, the custodian’s crime policy is usually the wrong policy, and your own crime or cyber cover is the one to check.
Assets in transit or in use. Coverage often narrows once assets leave cold storage. Staking, lending, and collateral arrangements can move a position out of the covered state, which is worth confirming before enabling any of them.
Insolvency of the custodian itself. A crime policy responds to theft. A company failing is not a theft, and the recovery path there runs through the customer agreement and the segregation record.
Five protections, and what each one reaches
These get spoken about interchangeably. They do different jobs.
| Protection | Who it pays | What triggers it | Reaches crypto at a custodian? |
|---|---|---|---|
| FDIC deposit insurance | Depositor at an insured bank | Failure of the insured bank | No. Covers deposits, not crypto assets |
| SIPC | Customer of a failed member brokerage | Liquidation of the member firm | No. Cash and securities only, and never a fall in value |
| Crime policy | The custodian | Theft, employee dishonesty, fraudulent transfer | Yes, within limits and exclusions |
| Specie policy | The custodian | Physical loss or damage to vaulted property | Yes, generally cold storage only |
| Segregation and custodial characterization | You, by operation of law | Custodian insolvency | This is the one that decides ownership |
The first two are the ones people reach for by instinct, and both regulators have addressed them directly. The FDIC published a fact sheet in July 2022 because customers of crypto companies were confused about whether deposit insurance applied to them. SIPC’s own description of what it protects is precise: it works to restore cash and securities held at a failed member brokerage, and it does not protect against a decline in value.
The last row decides outcomes, and it is not insurance at all. Ownership, segregation and the wording of the customer agreement do more for a large position than any limit on a policy schedule.
The accounting change that moved the ground underneath this
In March 2022 the SEC published Staff Accounting Bulletin No. 121, which told entities safeguarding crypto assets for platform users to recognize a liability and a corresponding asset for that obligation. Custody obligations became visible on the balance sheet.
On January 30, 2025 that guidance was withdrawn by Staff Accounting Bulletin No. 122. Its text says an entity with an obligation to safeguard crypto assets for others should now determine whether to recognize a liability for the risk of loss under that obligation by applying FASB ASC Subtopic 450-20, Loss Contingencies, or IAS 37. The rescission applies retrospectively in annual periods beginning after December 15, 2024.
Read plainly: the safeguarding obligation is now measured as a contingency. Under a loss contingency standard a liability is recognized when a loss is probable and the amount can be reasonably estimated, so a custodian carrying your assets faultlessly records no liability for them. That is defensible accounting and it changes what a balance sheet tells you. The obligation to you may be invisible in the financial statements until something has already gone wrong.
The bulletin also reminds entities that disclosure requirements still apply, naming Items 101, 105 and 303 of Regulation S-K and ASC Topic 275. For a public custodian the information has therefore moved from the face of the balance sheet into the risk and disclosure sections, which is where to go looking for it.
What to ask for, in order
Four requests, in the order that saves the most time.
- The customer agreement, read for characterization. Does it establish a custodial relationship and preserve your beneficial interest, or does it read as debt? Ambiguity here is the answer.
- Confirmation of the account structure. Separate wallets and ledger accounts in your name, or an omnibus wallet held for customers. Both are acceptable. They are not equivalent, and the reconciliation process between the internal ledger and the chain is the part to probe.
- The insurance terms, in writing. Limit, whether it is shared, sub-limits by storage type, named exclusions, and the policy period. A certificate of insurance summarizing cover is a starting point rather than the policy.
- Assets under custody at the last measurement date. Without it you cannot compute the row in the table above that applies to you.
If a provider treats any of these four as unusual requests, that response is itself information.
Where this analysis is limited
Several honest caveats.
Policy wordings differ by carrier, by jurisdiction and by year, and everything above describes how these products are generally built rather than what any specific policy says. Only the document your custodian holds answers the question for your account.
Custodians differ enormously. A firm with clean segregation, a strong customer agreement, and cover sized sensibly against its book is a genuinely different proposition from one without those, and nothing here is a judgment on any particular firm.
The regulatory position keeps moving. Custody rules, accounting treatment and the obligations attaching to custodians have all changed inside the last four years, twice in the case of the accounting. Check the current position rather than relying on this page’s date.
Finally, this covers safekeeping. Once assets are staked, lent, or pledged, both the coverage question and the ownership question change, and who is accountable when assets are deployed becomes the harder problem.
Common questions
Is crypto held at a custodian insured? Usually there is a crime or specie policy covering theft, held by the custodian rather than by you, subject to a limit that is generally shared across the whole platform. That is different from your holdings being covered against a fall in value, a protocol failure, or misuse of your own credentials.
Does FDIC deposit insurance cover crypto? No. It covers deposits at insured banks. The FDIC published a fact sheet in July 2022 addressing this confusion among customers of crypto companies directly.
Does SIPC cover digital assets? SIPC protects cash and securities at a failed member brokerage and does not protect against a decline in value. It was not built for digital assets and has not been extended to them.
What does a shared policy limit mean for my position? It means the limit is the ceiling for all claims from all clients in the period, so your effective cover falls as the platform grows. Ask for the limit and the platform’s assets under custody together, because neither number means much alone.
What is the single most useful question to ask a custodian? Whether the customer agreement establishes a custodial relationship rather than a debtor-creditor one, and whether assets are segregated both on-chain and on the internal ledger. That combination decides your position if the custodian fails, and no policy limit substitutes for it.
Did the SEC change how custodians report crypto they hold for clients? Yes, twice. SAB 121 in 2022 required a liability and corresponding asset on the balance sheet. SAB 122, effective January 30, 2025, rescinded that and pointed entities to loss contingency accounting instead, applied retrospectively for annual periods beginning after December 15, 2024.
Does any of this change for an estate? The coverage does not, though the access question becomes central, and a documented custodial arrangement with clean records transfers far more easily than a wallet controlled by one person. That is covered in passing digital assets to heirs.
If you want these four questions worked through against a specific provider and position, DAG covers institutional digital asset services, including custody due diligence.
Educational only. This is not legal, tax, or investment advice, and it is not a recommendation to use any particular custodian, policy, or custody arrangement. Digital assets are volatile and you can lose your entire position. Insurance terms, custody structures, and the rules governing them vary by provider and jurisdiction and change over time. The illustrative figures in this article are arithmetic examples and do not describe any specific firm. Read the actual customer agreement and policy terms, and speak with qualified counsel before acting.
Read Jake regularly? Add jakeclaver.com as a preferred source in Google to see more of it in Search and AI Overviews.
Part of our guide: Digital Asset Custody.
