Different Asset Classes, Different Custody Disciplines

"Digital asset custody" sounds like one capability. In practice it is at least four, because the asset class changes the legal claim you are safeguarding, the dependency stack you rely on, and the risks that can actually hurt you. An architecture designed for bitcoin does not automatically serve tokenized securities. Assuming it does is one of the most common design errors we see in institutional programmes.

Cryptocurrencies: pure key discipline

Native cryptoassets such as BTC or ETH are bearer-like instruments, typically with no issuer liability behind them. Control of private keys is control of the asset, fully and finally.

The custody focus follows directly: key security, wallet segregation, node strategy, staking and slashing controls. The key dependencies are the base-layer protocol, validators or miners, the wallet stack and nodes. The risk map is dominated by protocol events, key compromise, and the AML, sanctions and Travel Rule perimeter.

This is custody at its most cryptographic. If the keys are safe and the operational controls hold, the asset is safe.

Stablecoins: keys plus issuer terms

A stablecoin is a digital cash token with an issuer and a reserve structure behind it. The claim is a tokenized promise tied to a redemption model, which means control depends on keys plus issuer terms, admin rights and redemption mechanics.

Custody focus shifts accordingly: issuer quality, reserve transparency, contract governance and chain selection matter as much as key management. Dependencies now include the issuer, reserve assets, smart contracts, admin keys and multiple rails. The risk map adds depeg risk, freeze and blacklist rights, reserve rules, and e-money or stablecoin-specific oversight.

A custodian who can safeguard the keys but has no view of freeze rights or reserve mechanics is protecting the token, not the value.

Tokenized deposits: banking law on digital rails

A tokenized deposit is a bank-issued representation of a deposit claim on digital rails. It is a bank liability first and a token second. Control combines token mechanics with banking entitlements and account relationships.

Here the custody focus becomes reconciliation to bank records, role-based access and identity-linked controls. Dependencies run through the issuing bank, core banking systems, the identity layer, and permissioned or restricted rails. The risk map is dominated by bank credit exposure, legal enforceability, banking law and AML/KYC.

In effect, this is the asset class where custody re-converges with traditional banking operations, but with a cryptographic layer that operations teams have to be equipped to run.

Tokenized securities: keys are not enough

Debt, bonds, funds or equity represented on DLT carry a security or entitlement claim with an issuer and investor-rights framework. Control is not only keys: it also depends on legal ownership records and transfer rules.

The custody focus is entitlement tracking, corporate-action servicing, whitelisting and transfer control discipline. Dependencies include the issuer, registrar and transfer-agent roles, corporate actions and market infrastructure. Risks concentrate in ownership-record mismatch, lifecycle events, securities law and investor protection.

This is the asset class where a purely cryptographic custody model fails most visibly: a perfectly secured key to a token that the legal register no longer recognises secures nothing.

The takeaway for architecture

The asset class changes the legal claim, the dependency stack, and the risk map, and therefore the custody architecture. Different requirements, different regulation, different risks. An institution planning a multi-asset offering needs an architecture that treats these differences as design inputs from day one, not as exceptions bolted on later.

That mapping (which asset classes, which claims, which controls, on which infrastructure) is one of the first artefacts we produce in our Advisory Program, before any technology decision is made. The result is The Vault Blueprint: a modular infrastructure plan built around your actual asset mix, independently validated for security and risk by our partner Halborn.