Crypto fund managers making their first allocator call frequently discover the custody question too late. The fund is structured, the investor deck is circulating, and only then does the question surface: who will actually hold the keys, under which regulatory regime, and on what legal basis? That sequencing error costs time and, in illiquid markets, can cost capital. Arranging custody for a digital-asset fund is a regulated activity in most flagship jurisdictions, and the choice of custodian, domicile and governing documentation must be made together – not in sequence.
This guide sets out each step a fund manager must work through to arrange custody correctly. At every stage it identifies the regulatory basis, the cross-border implication and the mistake that derails the process in practice.
Step 1: Understand What Custody Means in a Regulated Digital-Asset Context
Custody of digital assets is the safeguarding of private keys on behalf of a third party, and in most flagship regulatory regimes it is treated as a distinct regulated activity requiring specific authorisation or registration. That framing matters because it shifts the analysis away from the pure technology question – cold wallet, multi-party computation, HSM – toward the legal question of who bears the obligation and what licence or registration covers it.
Under MiCA (the EU's Markets in Crypto-Assets Regulation), custody and administration of crypto-assets on behalf of clients is one of the enumerated CASP (Crypto-Asset Service Provider) activities. A fund that holds investor assets directly, without routing those assets through an authorised custodian, may itself be providing custody as a regulated service. In Dubai, VARA (the Virtual Assets Regulatory Authority) maintains a custody activity licence as a standalone category within its rulebooks. Singapore's MAS (Monetary Authority of Singapore) addresses custody through the Payment Services Act's digital payment token framework, and the Cayman Islands' CIMA regime under the Virtual Asset (Service Providers) Act contains its own registration pathway.
The common mistake at this step is treating custody as purely operational. Fund counsel who review only the fund's investment manager agreement, without also examining whether the proposed custody arrangement triggers a regulated-activity obligation in the custodian's or the fund's jurisdiction, will miss the issue entirely.
Step 2: Map the Fund Domicile to the Custody Regulatory Environment
The fund's domicile determines which regulatory regime governs the relationship between the fund and its custodian, and a mismatch between domicile and custodian jurisdiction adds friction that sophisticated allocators will flag in due diligence. Domicile selection and custody selection are interdependent decisions.
A Cayman-domiciled fund investing in digital assets will typically look for a custodian that is either CIMA-registered or operates from a jurisdiction whose regulatory framework CIMA recognises for this purpose. A fund domiciled within the AIFC in Kazakhstan will engage a custodian that the AFSA (Astana Financial Services Authority) regards as appropriately supervised. An EU-domiciled fund seeking a MiCA-passportable structure will require a CASP-authorised custodian in good standing with the relevant national competent authority.
The cross-border point is not academic. A fund manager in one jurisdiction may select a custodian in a second jurisdiction while the fund itself is domiciled in a third. Each of those three legs has a regulatory status, and the leg that is weakest in the eyes of the lead regulator – or the institutional investor's own compliance team – is the one that determines whether the fund can be sold into that investor's market.
The common mistake at this step is to select the fund domicile for tax reasons alone and then attempt to retrofit a custody solution. The correct sequence is to model domicile, custody and investor jurisdiction together from the outset. We match domicile to investor base, asset mix and redemption profile before a single subscription document is drafted.
For a structured analysis of fund domicile options and their regulatory consequences, contact OBOLUS at info@oboluslaw.com. The process described above is the standard path. Your entity, your investor base and your asset mix change the analysis substantially, and early counsel avoids the cost of later restructuring.
Step 3: Assess Which Custody Model Fits the Fund Structure
There are three custody models in common use for digital-asset funds, and each has a different regulatory footprint, cost structure and operational risk profile.
The first is qualified third-party custody: the fund contracts with a regulated custodian that holds private keys, provides a segregated account structure and issues regular account statements. This is the model most institutional investors expect. The custodian bears the primary obligation to the fund for safeguarding the assets, and the arrangement is documented in a custody agreement that addresses segregation, liability on loss, insurance and the procedure for instruction.
The second model is prime-brokerage custody: a crypto prime broker holds assets as part of a broader trading and financing relationship. This model is common among active trading strategies but introduces a rehypothecation risk that many fund constitutions either prohibit or require specific investor disclosure to address.
The third model is self-custody by the manager: the investment manager controls private keys directly through a multi-party computation arrangement or hardware security module. This is technically viable and is sometimes used at early stages. It is also the model that institutional allocators are most reluctant to accept, and under most leading regulatory regimes the manager will itself need authorisation to conduct custody as a regulated activity.
In our practice, funds aiming at institutional capital almost invariably require the first model. The second model works for specific trading mandates with informed investors. The third model creates regulatory exposure and investor-relations friction that generally outweighs its operational cost savings.
The common mistake at this step is to treat model selection as reversible without cost. Transitioning from self-custody to third-party custody mid-life requires new fund documentation, investor consent and, in some cases, regulatory notification.
What Does a Custody Agreement for a Digital-Asset Fund Need to Cover?
A custody agreement for a digital-asset fund must address the legal basis of the custodian's title to the assets, the segregation model, the loss-allocation regime and the operational mechanics of instruction and settlement – and several of those points have no direct precedent in traditional securities custody.
On title: the agreement must specify whether the custodian holds the assets on trust for the fund, as bailee, or under some other legal characterisation. The answer depends on the governing law of the agreement and the jurisdiction of the custodian. In common-law jurisdictions – England and Wales, the Cayman Islands, BVI, Singapore – a trust structure is generally the most protective framing for the fund, because it insulates the assets from the custodian's insolvency estate. In civil-law jurisdictions the analysis differs.
On segregation: the agreement must specify whether assets are held in an omnibus account, a sub-account or on a fully segregated on-chain basis. The latter provides the strongest investor protection and is increasingly what regulators in leading hubs expect. VARA's rules, for instance, address the safeguarding and segregation of client virtual assets explicitly.
On loss allocation: the agreement must address what happens when private keys are lost, when a smart-contract exploit drains a position or when a fork creates two competing asset claims. These events have no precise equivalent in securities custody agreements, and boilerplate from a traditional prime-broker template will not cover them.
On the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer): the custody agreement should address which party bears the obligation to collect and transmit that data on outbound transfers, particularly where the fund's redemption procedure involves sending assets to investor wallets in multiple jurisdictions.
The cross-border implication is significant: the governing law of the custody agreement determines how insolvency remoteness is assessed, and a custodian in one jurisdiction holding assets for a fund in a second jurisdiction, with investors in a third, may trigger disclosure obligations under more than one regime. We regularly advise fund managers on the intersection of those obligations before the custody agreement is signed.
Step 5: Conduct Regulatory Due Diligence on the Proposed Custodian
Regulatory due diligence on a proposed custodian should confirm that the custodian holds the correct authorisation in its home jurisdiction, that the authorisation covers the specific assets the fund will hold, and that there are no material regulatory actions, enforcement proceedings or licensing conditions that would affect the fund's reliance on that custodian.
The scope of that diligence differs by jurisdiction. A custodian authorised under MiCA as a CASP with a custody permission is subject to ongoing ESMA-coordinated supervision and financial-health reporting. A VARA-licensed custodian in Dubai is subject to VARA's rulebook requirements on capital adequacy and client-asset segregation. A custodian registered with BVI FSC under the VASP Act 2022 operates within a different framework with different ongoing obligations.
The practical point is that a custodian's self-description and its regulatory reality can differ. We have seen custodians represent that they are "regulated" when the underlying registration covers only AML compliance and not the custody activity itself. That distinction matters enormously when the fund's governing documents represent to investors that assets are held by a "regulated custodian."
Fund counsel should review the custodian's actual licence or registration certificate, confirm the activity permissions, check the relevant register directly and inquire whether any conditions or restrictions have been imposed. Allied counsel in the custodian's home jurisdiction can assist where the register is not in English or the regulatory status requires local law analysis.
The common mistake at this step is to outsource the regulatory check to the custodian itself. The custodian has an obvious interest in the outcome; the fund's counsel does not.
If you have reached this stage and your existing custody documentation has not been reviewed against the current regulatory regime in the custodian's jurisdiction, a second read is worth scheduling. Write to info@oboluslaw.com – we have seen the gap between a custodian's marketing description and its actual authorisation create material problems for funds at the investor due-diligence stage.
How Does AML and Travel Rule Compliance Interact with Fund Custody?
AML and Travel Rule obligations apply at the custodian level and, in some jurisdictions, also at the fund level – and the interaction between those two sets of obligations must be addressed in the custody documentation and the fund's own compliance programme.
Under FATF Recommendation 15 and its implementing rules across major jurisdictions, a regulated custodian is a VASP (virtual asset service provider) and must apply AML/CFT controls including the Travel Rule on outbound transfers above the applicable threshold. That means the custodian must collect originator data for the fund and beneficiary data for the recipient of any transfer. In practice this creates a data-sharing obligation that runs between the custodian, the fund administrator and, on redemption, the investor's own receiving institution.
The cross-border complication is real. A Travel Rule transfer from a VARA-regulated custodian in Dubai to an investor wallet serviced by a MAS-regulated institution in Singapore must satisfy both regimes' requirements – the sending custodian's obligations under VARA's rules and the receiving institution's obligations under the Payment Services Act. Where those two sets of requirements diverge on the data fields required or the de-minimis threshold, the custodian and the fund must agree in advance on the procedure.
The fund's own AML programme must also address the counterparty risk on the custodian's side. Operators we advise routinely include a provision in the custody agreement requiring the custodian to notify the fund of any regulatory investigation or enforcement action that could affect the custodian's AML status, because a custodian under investigation may itself become a financial-crime risk for the fund.
The common mistake at this step is to treat AML compliance as the custodian's problem alone. Where the fund instructs the custodian on which wallets to send assets to, the fund may itself be exercising a control that regulators will scrutinise for AML purposes.
Micro-Matter: Cross-Border Custody Failure at Launch
In a recent matter, a newly established fund manager – structured in a Gulf free zone but marketing primarily to European family offices – engaged a custodian that was registered in one jurisdiction but whose custody activity permission did not extend to the asset classes the fund intended to hold. The fund's offering memorandum described the custodian as "regulated," which was technically accurate in a narrow sense but was not accurate as a description of the custody arrangement. Several institutional investors flagged the discrepancy during due diligence, and the launch was delayed while the fund restructured the custody arrangement and reissued the offering documents. We were engaged at that point to map a compliant custody structure across the relevant jurisdictions, advise on the revised custody agreement and review the disclosure language in the fund documents. The fund launched successfully on the restated basis. The cost – in time, legal fees and reputational friction with early investors – was entirely avoidable with earlier counsel.
Step 7: Document the Custody Arrangement in the Fund Constitution
The custody arrangement must be reflected consistently in the fund's constitutional documents – typically the limited partnership agreement or the memorandum and articles, the offering memorandum or private placement memorandum, and the side letters where institutional investors have negotiated specific custody representations.
The offering memorandum should describe the custody model accurately, identify the custodian by name and regulatory status, and disclose the material risks that the model does not eliminate: technology failure, custodian insolvency, smart-contract exploit and regulatory change in the custodian's jurisdiction. Boilerplate risk-factor language from a traditional hedge-fund template will not cover these points.
The common mistake at this step is inconsistency between documents. We have seen constitutions describe a fully segregated custody model while the custody agreement with the same custodian permits omnibus holding. That inconsistency is a regulatory disclosure problem and a potential investor claim waiting to materialise.
Side letters for institutional investors sometimes contain custody-specific representations – for example, that the fund will not change its custodian without investor consent, or that the fund will maintain insurance against custody loss above a stated threshold. Those representations must be reviewed against the custody agreement itself before they are made.
Decision Matrix: Which Custody Approach for Which Fund Profile?
The right custody approach depends on the fund's investor profile, trading strategy and domicile, and there is no single answer that works across all configurations.
A closed-end venture-style fund with a small number of institutional limited partners, holding illiquid tokens for a defined term, is well suited to a single regulated third-party custodian in the same jurisdiction as the fund domicile. Investor concentration makes the segregated account model operationally tractable, and the illiquid nature of the portfolio reduces the need for rapid custodian instruction. The key risk is custodian insolvency over a multi-year hold period; the mitigation is custodian due diligence and contractual insolvency-remoteness provisions.
A liquid trading fund running a high-frequency strategy across multiple venues will likely require a prime-brokerage arrangement with one or more regulated crypto prime brokers. Speed of instruction and settlement efficiency take priority. The key risk is rehypothecation and counterparty concentration; the mitigation is position limits and contractual restrictions on the prime broker's use of fund assets.
A stablecoin-denominated fund targeting retail-adjacent investors in a MiCA-governed market will require a CASP-authorised custodian with explicit MiCA permission for the asset classes held. The passporting benefit of MiCA means a custodian authorised in one EU member state can serve the fund across the EU/EEA, but the fund manager must confirm that the specific assets – particularly any stablecoins classified as ARTs (asset-referenced tokens) or EMTs (e-money tokens) under MiCA – are within the scope of the custodian's CASP permission.
A multi-strategy fund combining liquid tokens with DeFi exposure faces the most complex custody question: DeFi positions held in non-custodial smart-contract protocols are not addressable by traditional custody arrangements, and the fund's constitutional documents must describe accurately how those positions are held, by whom and on what legal basis. In our practice, the DeFi sleeve is often the point at which institutional investors' counsel push back hardest.
Related at OBOLUS
- Funds and Investment Vehicles for Digital-Asset Businesses – full practice overview: structure, regulation, and investor documentation.
- Fund Domicile Selection in Kazakhstan AIFC – regime detail, AFSA authorisation and why the AIFC attracts fund managers targeting Central Asian and Gulf capital.
- Transaction Monitoring Setup: A Cross-Jurisdiction Comparison – AML programme architecture for digital-asset businesses operating across multiple regimes.
FAQ
Where should a crypto fund be domiciled?
The right domicile depends on the investor base, the asset mix and the redemption structure – not on tax alone. Cayman, BVI and ADGM are established choices with recognised fund frameworks. The AIFC offers a common-law environment with AFSA supervision and is gaining traction for funds targeting Gulf and Central Asian capital. EU domiciles make sense when the investor base is predominantly European and MiCA passporting matters. A mismatch between domicile and investor jurisdiction adds compliance cost and limits which allocators can subscribe.
Does a digital-asset fund manager need a licence?
In most flagship jurisdictions, yes. Managing a collective investment scheme or discretionary portfolio of digital assets constitutes a regulated activity under MiCA, the MAS Payment Services Act, VARA's management activity rules and equivalents in Cayman, BVI and ADGM. The licence category, capital requirement and application process vary by jurisdiction and by whether the assets are classified as securities, utility tokens or other crypto-assets. Operating without the required authorisation exposes the manager to enforcement action and can invalidate fund documents.
How is custody arranged for a crypto fund?
Custody for a digital-asset fund is arranged through a regulated third-party custodian whose authorisation covers the specific asset classes held. The fund engages the custodian under a bespoke custody agreement addressing title, segregation, loss allocation and Travel Rule obligations. The arrangement is reflected in the offering memorandum and constitutional documents. The custodian's regulatory status must be verified directly against the relevant register – not on the basis of the custodian's own marketing materials.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise funds, fund managers, custodians and token issuers on licensing across more than 70 jurisdictions, on structuring and on the tax, banking and compliance that sit around a digital-asset fund. We match domicile to investor base, asset mix and redemption profile – and we have seen the cost of arrangements that were not designed that way. Our disputes team also coordinates freezing relief and on-chain tracing across leading common-law forums for funds facing misappropriation. To discuss your custody or structuring question, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Lydia Brennan, Tax and Structuring Analyst – advising digital-asset funds on cross-border structuring, domicile selection and the regulatory dimensions of custody and tax compliance.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.