An institution that buys Bitcoin has to decide who will hold the keys that move it.
Its board also needs to know who can approve a transfer and how access would be restored if the usual people or systems fail.
Vincent Fong, Chief Editor of Fintech News Network, put the concern to a panel of custodians at the Luno Institutional Digital Asset Conference in Kuala Lumpur.
“Who do we trust with our assets, and is it actually safe?”
His question led the panellists through what an institution would need to check before holding crypto itself or entrusting it to a digital asset custody provider.
Holding the Keys
Angela Ang, Managing Director (APAC) at BitGo, explained that the distinction between self-custody and third-party custody starts with control of the private keys.
Under BitGo’s regulated custody arrangement, the custodian holds the keys and keeps client assets in cold storage, with the wallets disconnected from the internet.
An institution using a wallet it controls itself remains responsible for those keys, even if it obtains the technology from a provider.
Tan Ji Sheng, CEO of Gambit Custody, used individual self-custody to make the risk easier to picture.
Someone using a software wallet must retain the recovery phrase, and a hardware wallet still requires a backup if the device is lost.
An institution has to manage that responsibility across the people authorised to act for it.
Aaron Thian, Institutional Sales Director at Anchorage Digital, asked whether it wanted to “buy a safe box” or “sign up for a bank account”.
His analogy captured the difference between controlling a wallet and asking a digital asset custodian to manage the procedures around transfers.
Once it delegates that work, the institution needs to know what happens to its assets if the provider itself runs into trouble.
If a Digital Asset Custodian Fails
Angela urged clients to establish whether their holdings would remain legally theirs, separate from a custodian’s estate, if the firm became insolvent.
She listed segregation alongside regulatory status, contractual protections and insolvency arrangements as part of that check.
Ji Sheng said Gambit distinguishes a firm’s treasury assets from funds it holds for customers when setting up vaults.
Depending on the client arrangement, customer assets can have their own vaults or be held together in a vault separate from the firm’s holdings.
Aaron said Anchorage segregates clients’ holdings in wallets on-chain, allowing individual wallets to be audited.
Angela also cited BitGo’s insurance cover of up to US$250 million for assets where it controls all the keys, calling it a selling point for clients.
Clients should compare policy wording across providers, she said, and examine the controls intended to prevent a loss in the first place.
Cold storage limits online exposure, and institutions need to understand how a custodian protects the keys used to approve transfers.
Angela explained that a hardware security module can protect a key share used in a multiparty computation arrangement.
The technologies can work together, and she urged institutions to examine each layer of control and understand what it does.
Angela also asked whether an institution could regain access to its assets if the technology, staff or infrastructure behind the custody arrangement failed.
She described this as standard business continuity planning.
When the Token Represents Another Asset
Those controls can secure a tokenised bond or deposit as well, though they cannot by themselves establish ownership of what the token represents.
Angela explained that the blockchain is the primary record for crypto native to it.
A tokenised security or deposit involves a second record, such as an issuer’s bond register or a bank’s deposit ledger.
“There is another ledger that you also need to keep updated,” she said.
If the records diverge, control of the token may not establish a claim to the underlying asset. Ji Sheng warned that protecting the token is of little use if the asset behind it is no longer there.
Rules governing the products differ as well.
The Securities Commission Malaysia consulted on a proposed framework for tokenised capital market products in 2025.
Its FAQ on tokenised capital market products distinguishes them from crypto assets, says existing requirements for the underlying product still apply and expects intermediaries to address ownership and record-keeping risks.
Aaron said Singapore’s permission to safeguard crypto assets does not automatically extend to tokenised products, so an institution must check that its chosen provider can hold the specific asset it intends to buy.
When the institution prepares its accounts, Ji Sheng said its auditor needs to be able to sign off on what it holds. He imagined a firm buying an asset and hearing its auditor say,
“I don’t know how to audit it.”
Its custodian should be able to help the firm explain the holding.
Watch the full conversation below to hear how the panellists would assess a custodian before placing an institution’s assets in its care.
Featured image: Edited by Fintech News Malaysia based on images by Luno via LIDAC26.
