Crypto Exchange Custody Models
How exchanges hold customer assets — self-custody, third-party, MPC, and hybrid hot/cold models — plus the qualified-custodian question.
Custody is where trust — and regulatory risk — concentrates. How you hold customer assets shapes your security posture, your compliance obligations, and increasingly whether institutions will touch you at all. Here are the models operators actually choose in 2026.
The models
| Model | Who holds keys | Trade-off |
|---|---|---|
| Self-custody | You, fully | Max control, max operational burden & single-point risk |
| Third-party custodian | External custodian | Offloads security & some liability; adds dependency |
| MPC | Key split across parties (no single key) | Eliminates single point of failure; institutional default |
| Hybrid (MPC + cold) | Split hot for trading, cold for the rest | The 2026 "gold standard" |
MPC (multi-party computation) has become the industry standard for new builds — it removes the single point of failure while keeping operations fast. And hybrid MPC with cold storage is now widely called the institutional gold standard (Cobo, ChainUp).
The qualified-custodian question
If you'll serve US institutions, custody isn't just technical — it's regulatory. Under the SEC Custody Rule, investment advisers with custody of client assets must use a qualified custodian; for digital assets that has meant certain state-chartered trust companies and banks (Cobo). The bar is rising: in early 2026, BitGo obtained the first OCC national trust bank charter granted to a crypto custodian. If institutional flow is your target, plan for a qualified-custodian relationship — it's often a gating requirement.
What operators should decide
- Match custody to your audience. Retail-first can run MPC hybrid; institutional-first likely needs a qualified custodian in the stack.
- Segregate hot and cold with clear policy, and keep the hot float small.
- Document key management — recovery, quorum, and offboarding. This is core KYC/AML and audit territory and a headline item in any vendor due diligence.
When you choose a provider, ask exactly which custody model powers the platform and whether it supports the custodians your target market expects.
The takeaway
MPC is the default, hybrid MPC-plus-cold is the institutional standard, and a qualified custodian is the gate for serving US institutions. Pick the model your audience demands, keep the hot float small, and treat key management as a first-class operational discipline.
Regulatory requirements vary by jurisdiction and evolve quickly; verify current rules with qualified counsel. Not legal advice.
GammaFloww Team
Derivatives exchange infrastructure engineers
The GammaFloww team builds white-label crypto derivatives exchange infrastructure — matching engines, liquidity, and risk systems — used by partners to launch futures and options venues. These guides distill what we've learned shipping and operating that stack.
More in Operator Playbook
How Crypto Exchanges Make Money: Revenue Models Explained
A clear, sourced breakdown of how crypto exchanges earn — trading fees, derivatives, liquidations, listings and more.
Maker-Taker Fees, Explained
The maker-taker model is how exchanges price liquidity — and the main revenue lever you control as an operator. Here's how it works.
How Crypto Exchanges Get Liquidity
A new exchange with no traders has no liquidity — and no liquidity means no traders. Here's how venues break the cold-start loop.
Inside a Crypto Matching Engine
The matching engine is the heart of any exchange. Here's how price-time priority works, why latency and throughput matter.
Thinking about launching your own venue?
GammaFloww is the white-label engine behind modern derivatives exchanges. See how fast you could go live.