SEC guidance and the rise of hybrid custody solutions
In 2025 the U.S. Securities and Exchange Commission (SEC) issued investor-facing guidance that clarified expectations for safekeeping digital assets. The bulletin refreshed long-standing distinctions between investor self-custody and qualified third‑party custody, and it prompted renewed discussion among institutional market participants about how best to manage operational risk, regulatory compliance and user control.
Institutional custodians and asset managers have responded by refining hybrid custody offerings that blend elements of self‑custody and regulated trust custody on a single operational plane. These hybrid systems aim to deliver both the control associated with private key ownership and the compliance and insurance coverage typical of qualified custodians.
Custody models defined
The SEC guidance reiterated two foundational custody approaches that market participants use today:
- Self‑custody: Investors retain exclusive control of private keys. This model maximizes autonomy but places all operational, key‑management and recovery responsibilities on the holder.
- Third‑party (qualified) custody: A regulated custodian holds assets on behalf of clients under fiduciary or trust arrangements. This model emphasizes compliance controls, auditing and institutional‑grade operational practices.
Hybrid custody sits between these poles. Rather than forcing a single choice, it lets institutions combine custody modalities to meet bespoke risk, regulatory and liquidity requirements.
How hybrid custody architectures work
Emerging hybrid custody implementations typically use a layered approach to asset allocation, security and operational workflows. Common design patterns include:
- Segregated cold storage for the majority of assets, managed within a regulated trust or bank charter entity and subject to formal auditing and control frameworks.
- Limited hot or self‑custody allocations for operational needs — trading, settlements and real‑time transactions — controlled via multi‑party signature schemes or threshold cryptography.
- Policy‑driven co‑signing arrangements. Institutions retain primary control over transactional approvals while a custodial co‑signer enforces compliance and recovery policies.
- Unified dashboards that display holdings across custody modalities, providing transparency without sacrificing security or autonomy.
Typical splits often seen in market implementations allocate a high percentage of assets (for example, 80–95%) to trust‑level cold storage and a smaller percentage (often under 20%) to hot wallets under client control for day‑to‑day operations. The exact figures vary by institution, asset liquidity needs and risk tolerance.
Security technologies: multisig and MPC
Two technical approaches dominate hybrid custody solutions: multi‑signature (multisig) schemes and multi‑party computation (MPC).
- Multisig: Requires multiple independent signatures to authorize transactions. Institutional setups often use 2‑of‑3 or similar configurations where clients hold a majority of keys and the custodian holds a co‑signing key for policy enforcement.
- MPC: Distributes signing capability among parties without creating a single private key. MPC enables policy controls and threshold signing while reducing single points of compromise.
Both approaches can be combined with air‑gapped cold storage, offline key ceremonies and hardware security modules (HSMs) to further harden custody environments.
Regulatory and audit considerations
To meet institutional and regulator expectations, hybrid custody providers increasingly align operations with recognized audit and compliance frameworks:
- SOC 1 Type 2 and SOC 2 Type 2 reports for operational and security controls.
- Regular independent attestation and proof‑of‑reserves methodologies, where appropriate, to demonstrate asset segregation and solvency.
- Clear, documented policies prohibiting rehypothecation, lending or commingling of client assets when 1:1 custody is asserted.
- Bank or trust charters in applicable jurisdictions, which subject custody activities to additional prudential supervision and reporting.
These controls help institutions demonstrate to auditors and regulators that assets held in trust remain insulated from the custodian’s proprietary risks and insolvency events.
Insurance and risk transfer
Insurance remains a key component of institutional custody value propositions. Providers commonly layer coverage from market insurers and syndicates to protect against operational failures, theft or breach of custody systems. Typical features include:
- Coverage for assets held in specified custody environments and under defined operational conditions.
- Policies that complement, but do not replace, robust operational controls and segregation practices.
- Limitations and exclusions that institutions must understand when evaluating coverage and residual risk.
Because insurance terms and underwriter appetite evolved significantly during 2024–2025, institutions should scrutinize policy schedules, retentions and the extent to which coverage aligns with custody architectures used in practice.
Responding to SEC due‑diligence expectations
The SEC guidance encouraged investors to ask pointed questions when evaluating custody arrangements. Hybrid custodians that align with that guidance typically provide clear answers to inquiries such as:
- Who is holding the assets and under what legal arrangement?
- Which assets are covered by insurance, and what are the policy limits and exclusions?
- How are private keys generated, stored and recovered?
- Is client property segregated from the custodian’s estate and the firm’s proprietary positions?
- What are the audit and attestation regimes in place (frequency and scope)?
- How can clients exercise operational control, including withdrawals and governance over delegated keys?
- What fees, dispute resolution processes and privacy protections apply?
Transparent responses backed by documentation are now table stakes for institutions assessing custody partners.
2025 market insights and adoption drivers
By 2025 several themes are shaping institutional custody demand and product development:
- Regulatory clarity: Ongoing regulatory guidance in major jurisdictions has pushed custodians to adopt more formal control frameworks and pursue charters or regulatory recognition where feasible.
- Auditability and transparency: Investors increasingly demand real‑time and periodic attestations, clearer proof‑of‑reserves protocols and operational evidence of segregation.
- Technology maturity: MPC implementations, hardware security advances and improved orchestration tooling have reduced friction for hybrid models.
- Liquidity management: Market makers, asset managers and trading desks require reliable hot wallet access while keeping strategic reserves in highly secured cold storage.
- Geographic diversification: Cross‑border custody strategies are more common as institutions balance regulatory regimes and jurisdictional risk.
These drivers reflect a broader institutional desire to reconcile the competing priorities of control, compliance and commercial flexibility.
Operational and legal trade‑offs
Hybrid custody offers advantages but also introduces complexities that institutions must manage:
- Operational complexity: Coordinating signature policies, recovery workflows and cross‑jurisdictional legal structures requires mature operational teams.
- Legal layering: Multiple legal agreements — trust deeds, custody agreements and service‑level contracts — are necessary to define rights and responsibilities.
- Residual risk: Hot wallet exposures and policy‑enforced co‑signing introduce residual attack surfaces that must be continuously assessed.
- Cost: Enhanced audits, insurance and chartering processes increase fixed costs that institutions must justify through scale or risk reduction benefits.
Successful adoption depends on matching custody architecture to clear business requirements and stress‑testing assumptions under realistic failure scenarios.
Checklist for institutions evaluating hybrid custody
When selecting a hybrid custody solution, institutions should consider the following practical checklist:
- Legal structure and regulatory status of the custodian (charter, trust, bank oversight).
- Scope and terms of insurance coverage, including exclusions and retentions.
- Audit and attestation history (SOC reports, third‑party penetration tests, proof‑of‑reserves methodology).
- Key management technology (multisig vs MPC), key‑split policies and recovery procedures.
- Operational dashboards and reporting granularity for assets across custody modes.
- Explicit policy on rehypothecation, lending and commingling of client assets.
- SLAs for operational activities such as withdrawals, compliance requests and incident response.
- Cost model and fee transparency, including any underlying custodian fees and pass‑through charges.
Implications for exchanges, asset managers and trustees
As hybrid custody gains traction, market participants across the ecosystem will need to adapt operational models and contractual frameworks. Exchanges and trading platforms that integrate hybrid custodian services can offer institutional clients tailored liquidity while maintaining verifiable reserves. Asset managers and trustees must weigh the governance implications of co‑signing and recovery delegation versus the sovereignty of full self‑custody.
For regulators, hybrid custody presents both opportunities and oversight challenges: these models can enhance investor protection when properly implemented, but they require continued supervisory attention to ensure contractual clarity and operational integrity.
Looking ahead
In 2025 the intersection of regulatory guidance, technological maturity and institutional demand has made hybrid custody a prominent solution for organizations seeking both control and compliance. While no single architecture eliminates all risk, carefully designed hybrid custody frameworks — backed by rigorous auditing, insurance and transparent legal arrangements — offer a pragmatic path for institutions navigating today’s complex digital asset landscape.
MEXC will continue to monitor custody innovations and regulatory developments, and to report on solutions that help institutions balance security, governance and operational needs in the evolving market.
Disclaimer: This post is a compilation of publicly available information.
MEXC does not verify or guarantee the accuracy of third-party content.
Readers should conduct their own research before making any investment or participation decisions.
