Cryptocurrency Custody: What Lenders Actually Need to Know

The Point

Celsius, BlockFi, Voyager: the crypto-lending graveyard is full of companies that built growth engines without custody infrastructure. They commingled assets, rehypothecated without disclosure, and treated regulatory hygiene as a speed bump rather than a foundation.

Traditional financial institutions considering cryptocurrency collateral can avoid those mistakes, but they need to understand that digital asset custody requires fundamentally different infrastructure rather than modifications to existing systems.

Why Crypto Custody Is Different

Consider Jane, a business owner who wants to borrow against her Bitcoin holdings. In traditional securities lending, her broker-dealer holds the shares, DTCC provides settlement infrastructure, and everyone knows how control works because the legal framework is fifty years old.

With cryptocurrency, none of that infrastructure exists: no broker-dealer, no central depository, no transfer agent. Control means holding private keys, and losing those keys means permanent asset loss. When Celsius filed for bankruptcy, customers discovered their crypto wasn't segregated but was instead part of the general estate, turning Jane's collateral into someone else's claim.

Custody is the whole ballgame because nothing else matters if you can't establish and maintain control over the collateral.

Qualified Custodian Requirements

The SEC's Custody Rule (Rule 206(4)-2) defines "qualified custodians" as banks, broker-dealers, FCMs, and qualifying foreign institutions, providing the baseline reference point even for institutions not directly subject to the rule.

For crypto-specific custody, the viable paths include state trust companies and national bank authority.

State Trust Companies: Wyoming created the Special Purpose Depository Institution (SPDI) charter specifically for digital assets, and South Dakota and New York have similar frameworks. These are state-examined, capital-regulated entities with fiduciary obligations rather than experiments.

National Bank Authority: The OCC clarified national bank powers in 2020-2021 through Interpretive Letter 1170 (national banks may custody crypto), Interpretive Letter 1174 (banks may hold stablecoin reserves), and Interpretive Letter 1179 (banks may operate blockchain nodes). These letters confirm that digital asset custody fits within existing bank authority rather than granting new powers, and the regulatory uncertainty is overstated by people who haven't read the actual guidance.

What to Look for in a Custodian

When Bob, a credit union CEO, evaluates custodians for a crypto collateral program, he needs to ask specific questions across several dimensions.

Key Management: Where are private keys generated (not on internet-connected systems)? What's the cold storage percentage (should be 90%+ for institutional programs)? What are the multi-signature requirements (minimum 2-of-3, preferably 3-of-5)? What are the key backup procedures (geographically distributed and audited)?

Insurance Reality: The crypto insurance market is thin, with coverage limits lower than traditional custody, premiums higher, and exclusions that can gut the policy. Social engineering losses are often excluded, insider theft is sometimes excluded. Ask for the policy itself rather than the summary, verify coverage amounts are meaningful relative to assets held, and check claims history.

Regulatory Standing: What's their examination history? Any enforcement actions? Who are the principals, and where were they during 2022? Experience matters, and so does not having run one of the failures.

UCC Article 12: The Legal Infrastructure

The 2022 UCC amendments introduced Article 12 for "controllable electronic records," providing the legal mechanism that makes crypto collateral actually work.

Under Article 12, a security interest in cryptocurrency can be perfected by control rather than just filing, and control-perfected interests have priority over filing-perfected interests. For lenders, that's the difference between a secured position and an unsecured claim in bankruptcy.

The adoption problem is that Article 12 is state-by-state, with some states having enacted it, others having pending legislation, and many having taken no action. Multi-state programs need to account for which state's law governs and whether that state has adopted Article 12.

The practical approach is to structure the control agreement to establish control under Article 12 where available, and file a UCC-1 as backup protection regardless of Article 12 status.

Control Agreements That Work

The control agreement needs to address technical control, default procedures, and custodian commitments.

Technical Control includes multi-signature setup where lender holds signing keys, hardware security module access if applicable, and clear specification of what "transferring control" means technically.

Default Procedures cover how exclusive control is activated without counterparty cooperation, liquidation authority and timing, and response windows given 24/7 market volatility.

Custodian Commitments address whose instructions the custodian follows after default, notification requirements, and indemnification for acting on lender instructions.

If the custodian won't agree to clear default procedures, that tells you something important about whether the program will actually work.

Valuation and Margin

Crypto volatility is real, with a 20% overnight move unremarkable. The margin framework needs to accommodate this through real-time or near-real-time monitoring (daily marks are insufficient), conservative LTV ratios (40-50% initial LTV rather than 70% like public equities), margin calls with response windows measured in hours rather than days, and pre-authorized liquidation procedures that execute without borrower cooperation.

If Alice pledges $100,000 in Bitcoin at 50% LTV and the price drops 30% overnight, the loan is underwater unless the margin call was issued and the liquidation executed promptly. The infrastructure to do this needs to exist before the first loan is made.

Examination Considerations

Examiners will want to see documented board approval for cryptocurrency programs with risk limits and oversight requirements, custodian due diligence covering selection criteria, evaluation process, and ongoing monitoring procedures, third-party risk management alignment with existing TPRM frameworks, concentration limits specifying how much crypto collateral exposure is acceptable, and staff training demonstrating who understands this and how you know they understand it.

The institutions that have smooth examinations are the ones that built the documentation before launching the program rather than after.

The Path Forward

The regulatory framework for crypto custody is clearer than the skeptics claim and murkier than the enthusiasts admit. OCC letters establish national bank authority, state trust charters provide regulated custody options, and UCC Article 12 enables proper security interest perfection.

What doesn't exist is the fifty years of precedent that traditional custody has, which means institutions entering this space need to be slow and deliberate, building the compliance infrastructure first and the growth strategy second.

The companies in the crypto-lending graveyard all had aggressive growth, and none had adequate custody. The lesson writes itself.

This article addresses custody considerations for financial institutions and does not constitute legal or regulatory advice. The regulatory landscape continues to evolve. Consult qualified professionals for guidance specific to your institution's situation.