Quick answer
Crypto custody means safekeeping crypto-assets, or the private keys that control them, on someone's behalf[1]. You can hold the keys yourself or leave them with a custodian such as an exchange or bank. Lose a private key and you lose access to that crypto for good[4].
Key points
- Whoever controls the private key controls the crypto; custody is about who holds that key.
- A crypto balance in a finance app is not a bank deposit, and FDIC deposit insurance does not cover crypto assets.
- US bank regulators expect banks that safekeep crypto to manage key risk and stay responsible for any sub-custodian they use.
- In the EU, custodians must keep client crypto separate from their own estate and register each client's holdings.
- Before buying crypto through an app, ask who stores the keys, whether your coins are lent out or pooled, and what happens if the firm fails.
On this page
- Your bank or payment app sells crypto: who is holding it?
- How is a crypto balance different from money in your account?
- What do US bank regulators expect when a bank holds crypto?
- What must an EU custodian do with your crypto?
- What is a private key, in plain terms?
- What should you ask before buying crypto through a bank or app?
- FAQ
- Sources
#Your bank or payment app sells crypto: who is holding it?
Buy crypto inside a finance app and the balance appears next to your money, but it is held in a very different way. Ownership on a distributed ledger follows private keys: whoever can sign with the key can move the asset. EU law defines crypto custody as safekeeping or controlling crypto-assets, or the means of access to them, on behalf of clients — where applicable in the form of private cryptographic keys[1]. US bank regulators describe safekeeping the same way, as controlling the cryptographic keys linked to the assets[2].
So the useful question for a bank or app customer is simple: who holds the key to the coins on your screen, and what rules apply to them?
#How is a crypto balance different from money in your account?
| Question | Bank deposit | Crypto held by a custodian | Self-custody |
|---|---|---|---|
| Who controls it | The bank, which owes you the money | The custodian, which controls the keys[2] | You, through your own private key |
| FDIC deposit insurance | Deposits at an insured bank are covered up to the insurance limit[3] | Not covered, even when sold through an insured bank[3] | Not covered[3] |
| Main thing that can go wrong | See the insurance row above | A hack, a shutdown or the custodian's bankruptcy[4] | A wallet that is lost, stolen, damaged or hacked[4] |
Protection for crypto depends on how the firm holds it and on local law, not on deposit insurance.
The SEC also warns that some custodians use deposited crypto as collateral for their own purposes, known as rehypothecation, and that some commingle customers' crypto rather than holding it individually[4]. Neither is visible from the balance in your app, which is why the questions further down matter. For how insurance works on the cash side, see how deposit insurance works.
#What do US bank regulators expect when a bank holds crypto?
In July 2025 the Federal Reserve, FDIC and OCC published a joint statement on risk management for banks that safekeep crypto-assets for customers, without creating new supervisory expectations[2]. It names the compromise or loss of cryptographic keys as a central risk and notes that a bank could be liable for customers' losses. A bank that hands the job to a sub-custodian stays responsible for that sub-custodian's activities, subject to the customer agreement, and a sub-custodian mixing its own assets with those it holds for the bank would be inconsistent with sound risk management[2].
#What must an EU custodian do with your crypto?
Under the EU's MiCA regulation, a provider holding crypto for clients needs a written agreement with each client, a register of positions in each client's name, and client crypto kept operationally and legally apart from its own estate, so its creditors cannot reach those assets — in particular in insolvency[5]. It is liable for losses from incidents attributable to it, up to the market value of the lost crypto at the time of the loss[5].
Worked example
Worked example: how the MiCA cap is measured
A hypothetical EU custodian loses 2 of your tokens through a hack it is responsible for. Each was worth €1,500 when they were lost; a month later the price is €2,000. Compensation is capped at the value at the time of loss. Figures computed with code.
- Tokens lost
- 2
- Value when lost (2 × €1,500)
- €3,000
- Value a month later (2 × €2,000)
- €4,000
- Maximum liability under Article 75(8)
- €3,000
#What is a private key, in plain terms?
A private key is the code that approves transfers. It cannot be changed or replaced once created, a public address only lets others send you crypto, and a seed phrase is the list of words that restores a wallet[4]. The SEC is blunt about the stakes: lose the private key and access to the crypto in that wallet is gone permanently[4]. Wallets that stay online (hot) are handy but exposed to cyber threats; offline devices (cold) are safer from hackers but can be lost, stolen or damaged[4].
#What should you ask before buying crypto through a bank or app?
Five questions based on the SEC's checklist
Is the firm authorised?
Check its regulatory status; in the EU, look it up on ESMA's register of authorised providers[6].
Where are the keys kept?
Ask whether assets sit in hot, cold or mixed storage[4].
Are my coins lent out or pooled?
Ask directly about rehypothecation and commingling[4].
What if the firm fails?
Ask what insurance or other protection applies after a hack or bankruptcy[4].
What does it cost?
Compare all fees and charges before depositing anything[4].
Common beginner mistakes about crypto in a finance app
Treating the crypto balance like cash in the account
Crypto assets fall outside FDIC deposit insurance[3].
Thinking an app balance is 'in your wallet'
When an exchange or app holds the keys, what you have is a claim on that firm.
Sharing a seed phrase with 'support'
Anyone holding it can restore your wallet; the SEC says never share private keys or seed phrases[4].
Keeping one copy of a cold-wallet backup
Devices and paper can be lost or damaged[4].
Go deeper: for how wallets, private keys and seed phrases work under the hood, read crypto wallets explained on Protocol Insights.
The bottom line
Crypto bought through a bank or app is held by whoever controls the keys, and it does not carry deposit insurance. Check how the firm stores keys, whether it lends or pools your coins, and which rules apply where it is authorised. Holding the keys yourself removes the firm risk but leaves every mistake to you.
Frequently asked questions
If my crypto is held by an exchange or app, do I own it?
You have a claim, but the firm controls the keys. Under MiCA, EU custodians must keep client crypto legally separate from their own estate[5].
Is crypto bought through my bank protected like my savings?
No. The FDIC lists crypto assets among the products its deposit insurance does not cover, even when sold through an insured bank[3].
Can banks hold crypto for customers?
Some do. A 2025 joint statement by US bank regulators reminds banks that provide, or are considering, crypto safekeeping that they must do it in a safe and sound manner and in line with the law[2].
Can a lost private key be reset like a password?
No. A private key cannot be changed or replaced; only your seed phrase can restore the wallet[4].
Sources
- MiCA Article 3 — Definitions — ESMA Interactive Single Rulebook (Regulation (EU) 2023/1114), 2023 Primary
- Crypto-Asset Safekeeping by Banking Organizations (joint statement of the Federal Reserve, FDIC and OCC) — Board of Governors of the Federal Reserve System, 2025 Primary
- Understanding Deposit Insurance — Federal Deposit Insurance Corporation, 2026 Primary
- Crypto Asset Custody Basics for Retail Investors (Investor Bulletin) — US Securities and Exchange Commission (Investor.gov), 2025 Primary
- MiCA Article 75 — Providing custody and administration of crypto-assets on behalf of clients — ESMA Interactive Single Rulebook (Regulation (EU) 2023/1114), 2023 Primary
- Crypto-assets explained: what MiCA means for you as a consumer (joint ESAs factsheet) — European Supervisory Authorities (EBA, EIOPA, ESMA), 2025 Primary
.png){kind=link}
.jpg){kind=link}
