What FINMA's New Crypto Custody Guidance Means for Asset Managers and Their Clients

The guidance arrives at a moment when demand has outpaced clarity. Swiss banks, securities firms, portfolio managers, and collective investment schemes have all expanded into crypto-related services over recent years, often relying on a patchwork of custodians, some domestic, some foreign, with varying levels of regulatory oversight. FINMA's position is now unambiguous: that approach is no longer acceptable as a default.

The core of the guidance concerns bankruptcy protection and segregation. For a Swiss bank holding crypto-based assets on behalf of clients, those assets qualify as bankruptcy-remote custody assets under Swiss law, meaning they fall outside the estate of the bank in an insolvency scenario, provided they are held in readiness for clients at all times and are either held in individual custody or in collective custody with clearly defined client shares. This protection was established under Switzerland's DLT Blanket Act in 2021. The January 2026 guidance reinforces it and extends the expectations to cover how institutions manage custody when they delegate it to third parties.

Delegation to foreign custodians is where the guidance introduces its most consequential requirements. Where custody is provided abroad, the foreign custodian must be subject to prudential supervision equivalent to the Swiss standard, and the applicable foreign law must provide comparable bankruptcy protection for client assets. Existing arrangements that fall short of this cannot be maintained indefinitely. Where a legacy arrangement with an overseas custodian lacks equivalent protection, the institution must inform clients in writing, disclose alternative custodian options, and obtain documented consent before continuing. In other words, the compliance burden has shifted from optional best practice to a documented supervisory obligation.

For portfolio managers running discretionary mandates that include crypto exposure, the implications are direct. Each client's crypto holdings must be segregated individually, not pooled across clients, and held with a prudentially supervised institution. A licensed exchange or an SRO-supervised entity does not satisfy this requirement. The guidance is also explicit that outsourcing custody does not transfer liability. The supervised institution remains fully responsible for ensuring the arrangement is compliant, regardless of where the assets are actually held.

The guidance covers structured products and ETPs with crypto underlyings too. Where such products are offered to private clients, the issuing institution must ensure that the underlying collateral is protected by legally enforceable mechanisms in the event of the custodian's bankruptcy. Swiss exchanges have already issued specific rules for the listing and collateralisation of crypto ETPs, and the FINMA guidance aligns with and reinforces those frameworks.

The overall message is clear. Holding crypto-based assets as an incidental capability bolted onto an existing service offering is no longer viable. The expectation is now full institutional-grade custody, properly segregated, bankruptcy-protected, and continuously monitored, with Swiss-standard oversight applying whether the custodian sits in Zurich or abroad. For asset managers and their clients, the practical response is to review existing custody arrangements against these standards without delay. ISP operates as a FINMA-regulated custodian with the infrastructure to meet these requirements directly. To discuss your current setup or explore what a compliant custody arrangement looks like in practice, contact Tom Rieder at ISP Group or read more about digital assets custody.