Crypto Custody Models: A Comparative Analysis

Research question and scope

This article compares self-custody, exchange custody, and institutional custody on who controls the private keys and what each party gains or gives up as a result. It is general education on documented custody structures, not security or investment advice tailored to any individual's situation.

Background and context

Custody choice carries real regulatory weight in the US specifically: SEC Rule 206(4)-2 (the "Custody Rule") requires registered investment advisers to hold client crypto assets with a "qualified custodian" — generally a bank, savings association, or registered broker-dealer/futures commission merchant — rather than self-custodying client funds or using a non-qualified venue. A September 2025 no-action position reportedly clarified that state-chartered trust companies can serve as qualified custodians for crypto under specific conditions, widening the pool of institutions eligible for that status. An adviser using a non-qualified custodian is not automatically prohibited, but is expected to conduct additional due diligence precisely because that custodian lacks the Custody Rule's regulatory standing.

Methodology

This update is Kaavon's own editorial comparison, not a regulatory or legal opinion. Two 2026 institutional-custody practitioner sources — a Range.org blog post (published May 18, 2026) and a CoinRoutes academy article (published June 7, 2026) — were read directly in full for this pass and cross-checked against each other specifically to see whether independent industry sources agree on how many custody models exist and how each is defined. Neither source is a regulator or an audited primary filing; both are industry-practitioner writing, treated here as informed commentary rather than neutral benchmarks.

Key findings

• Moving from self-custody toward institutional custody generally trades direct personal control for professional security infrastructure and, often, regulatory protections.
• Self-custody removes dependency on any third party's solvency or security practices, at the cost of the holder bearing full security responsibility themselves.
• Neither direction on this spectrum is documented as universally superior — the right fit depends on the holder's specific needs, technical comfort, and risk tolerance.

Self-custody

In self-custody, an individual directly controls their own private keys, generally through a personal hardware or software wallet, bearing full responsibility for security in exchange for not depending on any third party's solvency or security practices.

Exchange custody

In exchange custody, a centralized platform holds private keys on behalf of users, offering convenience and account-recovery options, while introducing dependency on that platform's own security, solvency, and operational practices.

Institutional (qualified) custody

• Specialized institutional custodians offer custody services generally built around regulatory compliance, insurance, and enterprise-grade security infrastructure (such as hardware security modules and multi-party approval processes).
• This category is generally aimed at institutions and large holders rather than typical individual users.

A fourth arrangement some sources treat separately: hybrid and MPC custody

Both practitioner sources read for this pass describe a fourth arrangement beyond the three above, but they classify it differently. Range.org calls hybrid custody — key control split between the client and one or more providers using threshold (multi-party computation) signing, such as a 2-of-3 arrangement among the client, a provider, and an offline backup — "the dominant institutional pattern in 2026," and explicitly flags that whether hybrid counts as custodial at all is "an open question." CoinRoutes, by contrast, treats MPC and multi-sig as a technology layer that can be applied on top of any of the other three models, not as a separate model in its own right. Evidence for the exchange-custody risk category specifically: Range names FTX, Celsius, and Voyager as documented exchange-custody failures, consistent with the institutional practice (noted in the same source) of using exchanges for trade execution only and withdrawing promptly rather than holding balances there.

Comparing the models

Independent critical analysis

The two practitioner sources read for this pass do not just phrase the same taxonomy differently — they disagree on a substantive point with real regulatory consequence. Range treats hybrid/MPC custody as a fourth, potentially non-custodial arrangement whose classification is unresolved; CoinRoutes treats MPC as a technique that sits inside whichever of the other three models deploys it, implying no separate classification question exists. This is not a minor labeling dispute: whether an arrangement counts as "custody" in the regulatory sense determines whether SEC Rule 206(4)-2's qualified-custodian requirement attaches to it at all. An institution adopting a 2-of-3 MPC setup under Range's framing may be making an open regulatory judgment call; under CoinRoutes' framing, the same setup is simply a security technique layered on an already-classified model. Since this article's own sources don't agree, the honest conclusion is that an institution facing this choice should treat the custody-rule applicability of hybrid/MPC arrangements as a specific open question to raise with counsel, not as settled by industry consensus — the two most current sources available for this research disagree on exactly that point.

Limitations of this comparison

• This describes general custody-model structures, not the specific security practices or track record of any named platform or custodian.
• "Risk" here describes a structural category of risk inherent to the model, not a probability estimate or current incident history.
• Both practitioner sources used for this update are industry-authored (a custody-infrastructure company and a trading-technology company, respectively), not regulators or audited filings, and neither names specific qualified-custodian providers by license status — any provider-specific claim (for example, a reported OCC national trust charter for a named custodian) found during this research was not independently confirmed against a primary regulatory filing and is therefore not included here.
• This is general education, not a personalized recommendation for any individual's or institution's specific holdings, risk tolerance, or regulatory obligations.

Research conclusion

Self-custody, exchange custody, and institutional custody represent three genuinely different points on a control-versus-convenience spectrum, and a fourth arrangement — hybrid/MPC custody — is reported by one 2026 practitioner source as now the dominant institutional pattern, though whether it is a distinct model or a technique layered on the other three remains genuinely disputed between the two current sources reviewed for this update. No single model is documented as objectively correct for every holder, and the hybrid/MPC classification question specifically should be treated as unresolved rather than settled.

References

• Primary/practitioner (read directly in full): Range.org, "The institutional custody stack: choosing the right model" (range.org/blog/choosing-the-right-institutional-custody-stack), May 18, 2026 — four-model taxonomy, hybrid custody as "dominant institutional pattern," FTX/Celsius/Voyager as exchange-custody risk examples.
• Primary/practitioner (read directly in full): CoinRoutes, "Custody Models for Institutions: Who Controls the Keys, and Why It Matters" (coinroutes.com/academy/custody-models-institutions), June 7, 2026 — alternate four-model taxonomy treating MPC as a cross-cutting technique.
• Secondary (found via WebSearch, not independently fetched): general reporting on SEC Rule 206(4)-2's qualified-custodian requirement for registered investment advisers and a September 2025 no-action position on state-chartered trust companies.