The scale on September 30, 2026
How much crypto do custodians hold? One large group gives a number every quarter. Coinbase’s quarterly report, filed on October 29, 2026, put its assets on platform at $376.6 billion at September 30, 2026, against $515.9 billion a year earlier, a fall it put down mainly to lower crypto prices.
The measure counts crypto and stablecoins held or managed for customers, custody services included, and leaves out any assets for which the customer holds full or partial keys. The same filing calls its custody subsidiary, Coinbase Custody Trust Company, “a fiduciary under New York State Law and a qualified custodian under the Investment Advisers Act of 1940.”
How US regulators built the rules
Five documents from two agencies set the US framework.
| Date | Regulator and document | What it said |
|---|---|---|
| July 22, 2020 | OCC Interpretive Letter 1170 | A national bank may provide crypto custody, “including by holding the unique cryptographic keys” |
| January 23, 2025 | SEC Staff Accounting Bulletin 122 | Withdrew the staff’s earlier guidance on accounting for crypto held for platform users, effective January 30, 2025; firms now apply the loss-contingency standard |
| March 7, 2025 | OCC Interpretive Letter 1183 | Reaffirmed that custody is permissible and dropped the requirement to get supervisory non-objection first |
| September 30, 2025 | SEC Division of Investment Management, no-action letter | Advisers and funds may treat a state trust company as a “bank” for crypto custody, on conditions |
| December 12, 2025 | OCC decision on Paxos Trust Company | Conditional approval to convert into a national trust bank that “will not take deposits” |
The 2025 no-action letter spells out what a fund manager has to check before and every year after hiring a state trust company. It must see audited financial statements and an independent internal-control report such as a SOC 1 or SOC 2. The custody contract has to bar lending or rehypothecating client crypto without written consent, and keep it apart from the trust company’s own assets.
The EU and UK versions
MiCA lists custody first among its crypto-asset services and defines it as “the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets.” Article 75 requires client coins to be held apart on the ledger and out of reach of the provider’s creditors, and caps a provider’s liability for a loss it caused at the coins’ market value.
Britain’s anti-money-laundering rules name a custodian wallet provider as a business that safeguards cryptoassets, or the private keys to them, for customers. For an individual the same arrangement usually takes the form of an exchange account, a custodial wallet in which the platform holds the keys.
The mistake: reading custody as insurance
A custodian holds keys; it does not insure balances. The OCC’s Paxos decision says the bank “will not be insured by the Federal Deposit Insurance Corporation,” and custodian Anchorage Digital tells clients its custody assets are not FDIC-insured either.
The legal footing also varies by document. The SEC letter states that it “has no legal force or effect,” and the OCC letters are interpretations that a later letter can revise, as Interpretive Letter 1183 did when it rescinded Letter 1179 of November 18, 2021. Before handing over keys, find out which charter or license your custodian holds and what its contract says about segregation.