Custody Risk
Evaluates the reliability of the structures safeguarding underlying assets, covering both the financial and operational risks of centralized custodians and the exploit probability of smart contract custody mechanisms.
Depending on the asset type, custody will fall in one of two categories:
Centralized custody starts from an entity-type Anchor PD and applies adjustments for bankruptcy remoteness, asset segregation, charter type, insurance coverage, and operational maturity. The factor hierarchy is explicit: bankruptcy remoteness and asset segregation carry more weight than insurance, maturity, or charter type alone.
| Entity tier | Reasoning | Evidence |
|---|---|---|
| G-SIB or federally chartered bank | Statutory bank or trust charter confers the strongest fiduciary duties, legally-mandated segregation, and the strongest presumption of bankruptcy remoteness. Capital buffers, supervisory oversight, and observable financials anchor the lowest PD because client-asset protection is embedded in law rather than contract. | Decades of bank-failure data from Moody's, S&P, and the FDIC anchor the annual default rate of federally chartered G-SIBs in the 0.01–0.05% range. Examples include BNY Mellon, State Street, and J.P. Morgan custody. Basel framework resolution guidance underpins the regulatory floor. |
| Rated trust bank | Trust-style custody authority with externally-audited financials provides a strong anchor. Regulatory protections sit below the statutory bank tier and depend on charter scope, so custody-specific notches still carry information. | Examples: Anchorage Digital (federally chartered trust), Standard Custody, Paxos Trust Company. Default rates are tracked by rating agencies; fiduciary obligations are codified in state and federal trust law. |
| Regulated crypto custodian (NYDFS, equivalent) | Real but partial protection: licensed and substantively regulated, but protections are regulatory or contractual rather than statutory, bankruptcy remoteness is not automatic, and financial transparency is weaker than that of chartered banks. | NYDFS BitLicense and equivalent regimes have produced operating histories of 5–10 years. Capital requirements typically sit at <$10M paid-up versus multi-billion-dollar requirements for G-SIBs. Examples: Coinbase Custody, Fireblocks, Gemini Custody. |
| Unlicensed or unregulated VASP | Custody authority is contractual or registration-based only; fiduciary duties are weak, and asset segregation and bankruptcy remoteness depend on engineered structures rather than statute. | Prime Trust (2023) is the textbook failure: it collapsed because of legal disputes over which assets belonged to clients versus the firm, despite operational controls being in place. The root cause was lack of bankruptcy-remote structuring. Cred (2020) and Voyager (2022) follow the same pattern. |
Smart contract custody is evaluated using the same on-chain factors captured under Audit Quality and Contract Maturity, applied specifically to the custody implementation.