Custody is the structural problem most regulated fund managers encounter after the domicile decision is made – and it is the one most likely to kill an investor allocation if it is wrong. For a regulated entity (a fund, a fund manager, or an investment vehicle subject to regulatory supervision), custody of digital assets is not simply a question of who holds the private keys. It is a question of how segregation obligations, safeguarding rules, prime-broker relationships and cross-border reporting requirements interact with the underlying asset class. As supervisory attention on digital-asset custody tightens across the leading regimes – from MiCA's safeguarding and segregation requirements to the VARA rulebooks in Dubai and the MAS Payment Services Act framework in Singapore – a custody arrangement that worked informally at seed stage will not survive an institutional due-diligence process or a regulatory examination.
This page sets out the regulated basis for custody in the principal fund jurisdictions, the practical steps involved in building a compliant arrangement, the most common structural mistakes, and a decision matrix by fund profile. Where the facts change the analysis – and they always do – we indicate which variables matter most.
What Does Custody Mean for a Regulated Digital-Asset Fund?
Custody for a regulated fund means more than safekeeping. It means a documented, legally enforceable arrangement under which a qualifying custodian holds assets on behalf of fund investors, with the fund manager unable to unilaterally access or commingle those assets. For digital assets, this translates into private-key control, wallet architecture, and – critically – the legal ownership characterisation of on-chain holdings in the custodian's insolvency.
Most leading regimes now treat custody of virtual assets as a regulated activity in its own right. Under MiCA, custody and administration of crypto-assets on behalf of clients is a defined CASP (Crypto-Asset Service Provider) activity, requiring authorisation from the relevant national competent authority. VARA in Dubai similarly designates custody as a standalone licensed activity under its activity-based rulebook. MAS in Singapore requires a licence under the Payment Services Act for services involving digital payment tokens where the service provider holds customer assets.
The consequence for a fund manager is direct: you cannot simply appoint any counterparty to hold fund assets. The custodian must itself be regulated for that activity in the applicable jurisdiction. An unregulated custodian – or a custodian regulated only for traditional securities but not for digital assets – creates a structural defect that most institutional investors and auditors will flag immediately.
In our practice, we see fund managers discover this defect late – after the fund is constituted, after the offering memorandum is circulated, and after early investor commitments are received. Unwinding and reconstituting the custody arrangement at that stage is costly and time-consuming. The right moment to address it is before the fund documents are finalised.
For a scoped assessment of how custody rules apply to your fund structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the investor base, the asset mix – change the analysis. Map your options.
What Is the Regulated Basis for Fund Custody Across the Key Jurisdictions?
The regulated basis for custody obligations varies materially by fund domicile and by the regulator that supervises the fund manager, but a consistent core is emerging across the leading hubs.
In the EU under MiCA, a CASP providing custody must maintain client assets separately from firm assets, implement safeguarding arrangements that protect investors in an insolvency scenario, and comply with ESMA-level technical standards on custody and administration. For alternative investment funds with digital-asset exposure, the AIFMD (Alternative Investment Fund Managers Directive) depositary regime also applies – requiring a depositary with a distinct legal function from the manager. The interaction between MiCA custody obligations and the AIFMD depositary requirement is a live area of regulatory development; practitioners and national competent authorities are actively working through the overlap.
In Dubai under VARA, the custody rulebook sets out wallet architecture requirements, key management standards, insurance or equivalent financial-resilience provisions, and reconciliation obligations. A fund manager operating in the Dubai mainland must use a VARA-licensed custodian or apply for the relevant custody permission itself. VARA has made clear that delegation of custody to an unregulated entity – even a technically sophisticated one – does not discharge the regulatory obligation.
In Singapore under the MAS Payment Services Act, a major payment institution licence is required where a firm holds digital payment tokens for customers above the relevant threshold. For funds, this typically means either the fund manager itself holds the relevant licence or it appoints an MAS-licensed custodian and documents that appointment with appropriate due diligence.
In the Cayman Islands and BVI – the most common offshore domiciles for institutional digital-asset funds – the CIMA and BVI FSC frameworks apply registration or licensing requirements to virtual asset service providers, including those providing custody. Neither regime requires a full banking licence, but the expectation of documented, auditable custody arrangements is clear, and institutional investors conducting their own diligence will expect a custody solution that is recognisable to them regardless of the technical label under local law.
In Kazakhstan within the AIFC, the AFSA framework designates digital-asset custody as a regulated activity within the financial centre's common-law perimeter. The AIFC's courts and regulatory infrastructure are modelled on English law, which creates a more familiar legal environment for common-law practitioners structuring cross-border fund arrangements.
How Is a Compliant Custody Arrangement Actually Built?
Building a compliant custody arrangement for a regulated fund is a sequential process with several distinct stages, each of which carries its own legal and operational risk.
Step one is custodian selection and due diligence. The custodian must hold the appropriate regulatory permission for the activity and the asset class. For a fund with a diverse digital-asset portfolio – spot positions, staked assets, tokenised securities, stablecoins – the custodian's scope of authorised activities must cover each asset type. Many custodians are authorised for one category but not another. A mismatch creates an unregulated custody gap for the uncovered assets.
Step two is the custody agreement. This is the legal instrument that defines the relationship between the fund (or the fund manager acting for the fund) and the custodian. A well-drafted custody agreement addresses: the basis on which assets are held (bare trust, custody, safekeeping); segregation mechanics at both the legal and operational layer; the custodian's liability standard; the process for asset instructions and authentication; sub-custody arrangements; and the consequences of custodian insolvency. For digital assets specifically, the agreement must address private-key control architecture and the allocation of responsibility if keys are lost, compromised or subject to a network-level event.
Step three is integration with the fund documents. The offering memorandum, limited partnership agreement or trust deed must accurately reflect the custody arrangement. Investors read the fund documents; the custody section is one of the first things an institutional investor's legal team will review. Inconsistencies between the custody agreement and the fund documents – a common problem when custody is arranged after the fund documents are drafted – create both a disclosure problem and a potential liability.
Step four is ongoing compliance. Custody is not a one-time step. Regulatory expectations evolve, custodian permissions can change, and the asset mix of the fund may shift in ways that create new coverage gaps. Regular review of the custody arrangement – ideally mapped to the fund's annual audit cycle and the manager's compliance calendar – is necessary to maintain the integrity of the structure.
In our cross-border practice, we regularly advise fund managers on each of these steps. The most common failure point is step three: the custody agreement is finalised in isolation from the fund documents, and the two instruments describe the same arrangement in incompatible terms. Resolving that inconsistency post-close requires an amendment to at least one of the instruments, investor notice in most cases, and regulatory disclosure in some.
What Are the Most Common Structural Mistakes in Digital-Asset Fund Custody?
The mistakes we see most frequently fall into four categories, each with a distinct cost profile.
Mistake one: using an exchange wallet as custody. A number of early-stage crypto funds held assets in exchange accounts on the basis that the exchange was well-known and technically reliable. This is not custody in the regulatory or legal sense. The fund has no segregated legal interest in the assets; it holds an unsecured claim against the exchange. The collapse of several major centralised platforms has made this error visible, but it persists in smaller and less well-advised fund structures.
Mistake two: appointing a custodian without verifying the scope of its regulatory permission. A custodian regulated for one asset class or one jurisdiction may not be permitted to hold assets outside that scope. A fund investing in a mix of Bitcoin, ether, tokenised real-world assets and structured products needs a custodian whose authorisation covers each category. Spot-checking the custodian's regulatory status at the time of appointment and annually thereafter is a basic governance requirement.
Mistake three: failing to address sub-custody. Where the appointed custodian uses a sub-custodian for any portion of the fund's assets – common in multi-chain or multi-exchange strategies – the fund documents and custody agreement must address this explicitly. Regulatory expectations in most flagship jurisdictions require the primary custodian to maintain liability for sub-custodian acts unless specific conditions are met. An agreement that is silent on sub-custody creates an unresolved question of liability allocation that will surface in due diligence.
Mistake four: ignoring the depositary requirement for AIFMD-supervised funds. Fund managers within the EU who manage alternative investment funds above the relevant threshold are subject to the AIFMD depositary regime, which requires the appointment of a depositary – a distinct role from a custodian, with supervisory and oversight functions that go beyond safekeeping. A fund that has appointed a custodian but not a depositary is not compliant with the AIFMD structure, regardless of how good the custody agreement is.
How Does the Cross-Border Reality Change the Custody Analysis?
Digital-asset funds are almost always cross-border structures. The fund is domiciled in one jurisdiction, the manager is regulated in another, the investors are in a third, and the assets trade on global venues. Each of these jurisdictions may impose its own custody requirements, and those requirements do not always align.
Consider a Cayman-domiciled fund whose manager is regulated under MiCA in an EU member state and whose investor base is split between US institutional investors and Gulf-based family offices. The Cayman CIMA registration requirements apply to the fund vehicle. MiCA custody and safeguarding obligations apply to the manager's activities. The US investors will apply their own diligence standards – potentially including expectations shaped by SEC guidance on qualified custodians – and the Gulf investors may have expectations shaped by VARA or ADGM frameworks they are familiar with.
None of these requirements is automatically satisfied by compliance with any one of the others. The custody arrangement must be designed to satisfy all of them simultaneously, or it must be structured so that the parts of the arrangement subject to each regime are ring-fenced and documented separately.
We have seen this problem arise most acutely with stablecoins and tokenised assets. Stablecoins issued by Tether (USDT) and Circle (USDC) carry contract-level freeze and blacklist authority exercisable by the issuer, typically on the basis of a court order, law-enforcement direction or OFAC designation. A fund holding a material stablecoin position needs to understand that its custodian's ability to deliver those assets is not unconditional – and that the custody agreement should address what happens if the issuer exercises its freeze function against a wallet holding fund assets.
Tokenised real-world assets introduce a further layer: the legal rights conferred by the token, the jurisdiction whose law governs those rights, and the custodian's ability to enforce or transfer those rights in the relevant forum. A custodian that is technically capable of holding the token is not necessarily legally capable of enforcing the rights the token represents. Structuring the custody arrangement to address this gap is a cross-border legal question, not a technology question.
If a prior custody structure stalled due diligence or was flagged by an auditor, write to info@oboluslaw.com. A second review can surface the structural reason and the route to a compliant solution. Map your options.
Which Custody Structure Fits Which Fund Profile?
The right custody structure is a function of four variables: the fund's domicile, the manager's regulatory status, the asset mix, and the investor base. The following matrix maps the principal profiles to the likely custody structure and the key risk at each.
Profile A – Cayman or BVI fund, manager unregulated or registered only, liquid crypto-native strategy, institutional investors. This profile typically requires a qualified, independently regulated third-party custodian with a recognisable regulatory status – ideally a custodian with both offshore registration and a permission from a major-hub regulator (MAS, FCA, or equivalent). The key risk is investor due-diligence failure: institutional allocators will not accept a custody arrangement that cannot be verified against a known regulatory register. Timeline to arrange: measured in weeks if a custodian relationship is pre-existing; longer if the custodian selection process is open.
Profile B – EU-domiciled fund or EU-managed fund, AIFMD-regulated, mixed digital and traditional assets. This profile requires both a depositary (satisfying the AIFMD depositary obligation) and a custodian with MiCA CASP authorisation for the digital-asset component. Finding a single institution that satisfies both functions for digital assets is currently challenging; a split arrangement – a traditional depositary for the AIFMD function and a specialist digital-asset custodian for the crypto holdings – is the practical solution. The key risk is the interface between the two: the liability allocation and reporting flows between depositary and custodian must be addressed contractually. Timeline: typically longer than Profile A, given the depositary appointment process.
Profile C – Dubai or Abu Dhabi fund, VARA or FSRA-supervised manager, digital-asset strategy. This profile requires a VARA-licensed custodian (for VARA-supervised activity) or a custodian recognised by the FSRA within the ADGM perimeter. The DIFC perimeter and the mainland VARA perimeter are distinct; a fund operating across both needs to verify which set of rules applies to which part of the arrangement. The key risk is custody-scope mismatch between the custodian's VARA licence category and the full range of activities the fund conducts. Timeline: depends on the availability of VARA-licensed custodians with the relevant activity scope.
Profile D – Singapore or Hong Kong fund, MAS or SFC-supervised, institutional strategy. Both the MAS Payment Services Act and the SFC VASP regime impose custody-related obligations. For a Singapore structure, the MAS licensing framework for digital payment token services applies to the custodian. For a Hong Kong structure, the SFC VATP licensing regime addresses custody within the platform context, but standalone fund custody arrangements are addressed through a combination of SFC guidance and the relevant provisions of the securities laws. The key risk in both jurisdictions is the interaction between digital-asset custody rules and the general securities-law safekeeping framework, particularly for funds holding tokenised securities alongside pure-crypto positions.
Illustrative Custody Restructuring Matter
In a recent matter, an established crypto fund manager – domiciled in a mid-shore jurisdiction with an investor base split between European institutions and Gulf family offices – had used a single exchange-based custody arrangement since the fund's launch. When the manager sought to onboard a major institutional allocator, the allocator's legal team identified that the arrangement did not constitute regulated custody under any applicable regime and that the fund documents described the arrangement in terms inconsistent with the actual contractual relationship. We were engaged to restructure the custody arrangement across two jurisdictions, negotiating a replacement agreement with a licensed third-party custodian, amending the fund documents, and coordinating with allied counsel in the relevant offshore jurisdiction to ensure the amendment process was completed without triggering investor-consent mechanics that would have delayed the allocation. The restructuring was completed within a single calendar quarter. The institutional allocation proceeded.
Self-Assessment Checklist: Is Your Fund Custody Arrangement Compliant?
Fund managers and general counsel can use the following checklist to identify the most common custody gaps before they surface in a regulatory examination or investor due-diligence process.
- Does the custodian hold a regulatory permission that specifically covers custody or safekeeping of digital assets in the relevant jurisdiction?
- Does the custodian's authorised scope cover every asset type held by the fund – including stablecoins, tokenised assets and staked positions?
- Is the custody agreement legally distinct from the prime-brokerage or exchange-services agreement?
- Does the custody agreement address private-key architecture, sub-custody arrangements and the consequences of custodian insolvency?
- Are the custody arrangements described in the offering memorandum and fund documents consistent with the actual custody agreement?
- For EU-managed funds: has the AIFMD depositary requirement been addressed separately from the custody function?
- For funds holding stablecoins: does the custody agreement address issuer freeze or blacklist events?
- Is the custody arrangement reviewed at least annually against changes in the regulatory environment and the fund's asset mix?
If any of these questions cannot be answered with confidence, the custody arrangement warrants a structured legal review before the next investor onboarding or regulatory examination.
Related at OBOLUS
- Funds & Investment Vehicles practice overview – the full licensing and structuring picture for digital-asset funds across jurisdictions.
- Redemption and liquidity terms in the Isle of Man – structuring redemption mechanics for Isle of Man-domiciled fund vehicles.
- Creditor claims in crypto insolvency – protecting fund interests when a custodian or counterparty becomes insolvent.
FAQ
Where should a crypto fund be domiciled?
Fund domicile depends on the investor base, the asset mix, the manager's own regulatory status, and the redemption profile. Cayman and BVI remain the most common institutional choices for liquid crypto strategies because of their flexible fund structures and recognised regulatory frameworks. EU-regulated managers must assess the interaction between the domicile and AIFMD obligations. The wrong domicile locks in tax inefficiency and limits which investor categories the fund can accept. Domicile selection is best made before the fund documents are drafted, not after the first investor commits.
Does a digital-asset fund manager need a licence?
In most material jurisdictions, yes. A fund manager advising on or managing a portfolio of digital assets will trigger licensing obligations under MiCA (as a CASP), the MAS Payment Services Act, the SFC VASP regime, the VARA rulebooks, or the applicable domestic AML and fund-management regime depending on where the manager is established and where it markets. The threshold for licensing varies by jurisdiction, activity type and assets under management. Operating without the required permission exposes the manager to regulatory sanction and creates a material risk for investor relations and fund administration.
How is custody arranged for a crypto fund?
Custody for a crypto fund is arranged by appointing a custodian that holds a regulatory permission for digital-asset custody in the relevant jurisdiction, executing a custody agreement that addresses segregation, key architecture, sub-custody and insolvency scenarios, and ensuring the fund documents accurately reflect the arrangement. For EU-managed funds, the AIFMD depositary function is a separate layer that must be addressed alongside the custody appointment. The process typically takes several weeks from custodian selection to executed documentation, and longer where the fund documents require amendment.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We match fund domicile to investor base, asset mix and redemption profile – and where custody structures need rebuilding, we coordinate across jurisdictions to resolve the problem without disrupting existing investor relationships. Digital assets are the whole of our practice. To discuss your custody structure, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – specialising in fund structuring, cross-border tax treatment of digital assets, and custody arrangements for regulated investment vehicles.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.