Custodian at risk? What FINMA’s new digital asset guidance means for you

On Jan 12, FINMA has issued a new guidance clarifying expectations around the custody of crypto-based assets. The message is clear: Portfolio managers, fund managers, and issuers of structured products with crypto underlyings must reassess their custodial setup — especially when using third-party or foreign custodians.

The guidance primarily affects FINMA‑supervised institutions such as banks, securities firms, portfolio and asset managers, as well as issuers of structured products and crypto ETPs with crypto-based underlyings.

What are the key risks highlighted by FINMA?

FINMA explicitly points to several risk areas that were not always sufficiently addressed in the past:

• Counterparty risk in case of custodian insolvency
  If digital assets are held by a third-party custodian, there is a material risk that assets cannot be clearly segregated in the event of insolvency. Without proper segregation, client assets may become part of the bankruptcy estate.
  
  
• Foreign custody adds legal complexity
  When assets are held abroad, additional risks arise:
  • unclear or non-equivalent bankruptcy regimes
  • jurisdictional conflicts
  • limited enforceability of segregation claims

These complexities significantly increase recovery risk in a stress scenario.

FINMA also highlights operational and technology risks (including cyber and key management risks specific to DLT), as well as credit risk exposures and the need for clear risk disclosures to investors, particularly in connection with structured products and crypto ETPs.

• Dependency on third-party infrastructure
  Using an external custodian creates operational dependency — particularly on:

• • technical infrastructure
  • key management
  • security controls

This makes careful selection and ongoing oversight essential.

• Lack of prudential supervision
  The risk increases substantially if the custodian:
  • is not subject to prudential supervision
  • does not comply with supervisory custody standards
  • offers no equivalent investor protection framework

FINMA’s supervisory findings show that these risks were often underestimated.

What does this mean in practice?

If you are:

• a portfolio manager using a crypto custodian
• a fund manager with crypto exposure
• an issuer of structured products with crypto underlying's

you are expected to actively verify that your custodian:

• provides effective segregation of client assets
• offers bankruptcy-remote custody structures
• is subject to prudential supervision
• applies standards equivalent to Swiss regulatory expectations
• applies standards that are comparable to Swiss regulatory expectations in terms of client asset protection.

This is no longer a theoretical compliance point — it is a supervisory expectation.

Crypto‑based assets are not safe investments

FINMA emphasises that even when crypto‑based assets are held in custody in full compliance with regulatory requirements, they are not considered safe or low‑risk investments. Such assets can be highly speculative, extremely volatile, and may lead to significant losses. Financial institutions are therefore required to provide investors with a clear and explicit risk notice when offering products or services involving crypto‑based assets.

When are you on the safe side?

You are materially better positioned when your custodian offers:

✔ segregation of assets

Clear legal and operational segregation ensuring that client assets:

• remain identifiable at all times
• are protected in the event of insolvency

✔ prudential supervision

A custodian that is:

• licensed
• supervised
• subject to ongoing regulatory oversight

✔ equivalent bankruptcy protection

Custody structures aligned with Swiss standards, ensuring:

• client assets are bankruptcy-remote
• legal certainty in stress scenarios

How ISP supports you

As a licensed and FINMA‑regulated custodian, ISP provides digital asset custody designed to meet the supervisory expectations outlined in FINMA’s latest guidance — including segregation, insolvency protection, and robust operational controls.

We support:

• secure safekeeping of digital assets and tokens, with clear legal and operational segregation
• issuance and custody for structured products with crypto underlyings, aligned with disclosure and custody requirements
• bankruptcy‑remote custody structures and governance frameworks consistent with prudential supervision

If you want to reassess your current custodial setup — or design a compliant structure from day one — we are ready to support you