Crypto Custody Models: Exchange, Qualified Custodian, Self-Custody

The first question I ask when a client tells me their corporation holds crypto is not how much. It is where.

Almost nobody has a crisp answer. They name a platform, or they say “in a wallet”, and the follow-up questions land badly: who can move it, who else could move it, and what exactly do you own if the place holding it stops answering the phone. Those are not technology questions. They are counterparty and internal control questions, and they are the ones that decide whether an unpleasant week becomes a permanent loss.

Three arrangements, three different things you actually own

Platform custody. You have an account balance on a trading platform. The platform holds the private keys, usually pooling client assets in shared wallets. What you own is a contractual claim against the platform. The coins on the blockchain are not addressed to you. Where the platform also pays you a return on that balance, the claim is weaker still, because a yield product makes you an unsecured creditor of whoever is doing the lending.

Third-party qualified custodian. A regulated custodian holds the keys, in your name or in a designated client account, under a written custody agreement. You still do not touch the keys, but the entity that does is separate from the venue you trade on, is audited, and is contractually accountable to you.

Self-custody. Your organisation holds the private keys. There is no counterparty at all. There is also nobody to call, no recovery process, and no insurance policy that turns up when something goes wrong.

Most Canadian businesses drift into the first one because it is the default: you buy on a platform and you leave it there. Drifting is the problem. Nobody made a decision, so nobody documented one, and there is no control environment around an asset that can leave the company in a single irreversible transaction.

What the regulators have already decided for you

If you use a platform that serves Canadians, part of this question has an answer you did not choose. The Ontario Securities Commission publishes the list of registered crypto asset trading platforms and the decisions that authorise them, and those decisions carry terms and conditions. When OSC staff swept six registered platforms, the areas they tested included custody arrangements over client crypto assets, insurance bonding policies, corporate governance and conflicts of interest, set out in Staff Notice 33-757.

That matters more than the marketing page. A registered platform operates under enforceable conditions about where client assets sit. An unregistered offshore venue operates under whatever its own terms of service say, which you have not read and which it can amend. The registration question is upstream of the custody question, not parallel to it.

Canada also has its own worked example of what platform custody looks like when it fails. The OSC published an investigative report on QuadrigaCX, and the outcome for account holders is the reason I treat “the balance shows on my dashboard” as evidence of nothing at all.

The comparison I actually walk clients through

The right-hand column is where I see the most self-inflicted damage. Self-custody is not free. It transfers the entire control burden onto an organisation that usually has one person who understands it, no written procedure, and no tested backup. A company in that position has not removed counterparty risk. It has replaced it with key person risk, which is worse because it is invisible until the person is unavailable.

Choosing

Is the crypto held for trading or as a balance you intend to keep?
│
├── Trading, actively, small balances
│      → Platform custody is defensible. Cap the balance
│        at what you can afford to lose entirely.
│
└── Held
    ├── Is the amount material to the balance sheet?
    │   │
    │   ├── No  → Platform or self-custody, but write down
    │   │         which, who controls it, and how it is
    │   │         backed up.
    │   │
    │   └── Yes
    │       ├── Do you have two independent people who can
    │       │   run a signing procedure?
    │       │      No  → Use a qualified custodian.
    │       │      Yes → Self-custody with multisig is
    │       │            workable. Document it first.
    │       └── Any external reporting or assurance need?
    │              → Custodian. The statement is the point.
    └── Unsure how material it is?
           → Value it at year end and decide from the number.

The questions that separate a real answer from a slide

When a platform or custodian tells me client assets are “segregated and secure”, I want the same five things I would want from any service organisation:

Are client assets held separately from the firm’s own assets, and is that supported by something more than a sentence in the terms of service? Who is the custodian, and is it the same corporate group as the trading venue? What insurance exists, what does it cover, and what is excluded? What happens to my assets in an insolvency, and has anyone written down the legal analysis? And what independent reporting is available, whether that is an assurance report over reserves or a service organisation control report? The limits of a proof-of-reserves attestation are worth understanding before you accept one as comfort.

For a holding you expect to keep for a decade, add a sixth question: what the custodian’s plan is for post-quantum signature schemes. The answer matters less than whether anyone there has considered it.

If the answers are vague, that is the answer.

What this changes in your books and your controls

Custody choice drives the control environment, not the accounting. A corporation holding crypto still records it the same way regardless of who holds the keys, and the corporate structuring questions in holding crypto in a corporation are unaffected. What changes is everything around it: who authorises a transfer, who reconciles, what evidence exists at year end, and what your insurer and your bank will ask.

The baseline is not exotic. The Canadian Centre for Cyber Security’s baseline controls for small and medium organisations covers most of it: strong authentication, patched devices, backups that have been restored at least once, and a named person accountable. The wider security posture around company finances applies here with more force, because a crypto transfer cannot be reversed by a phone call to the bank.

One more thing that gets missed. Custody arrangements change who bears the loss, but they do not change the tax consequence of the loss, and the analysis of what happens when keys or a platform are lost is unforgiving. Designing the arrangement is far cheaper than arguing about the deduction afterwards.

If your corporation is holding crypto and nobody has written down where it sits, send me the platform names, the balances at your last year end, and who currently has the ability to move funds. I will tell you what your actual exposure is, what your auditor or reviewer will ask for, and which of the three models fits the amount you are carrying. Get in touch.