Every institution moving into tokenization, stablecoins, or crypto exposure eventually runs into the same question: who holds the keys, and how do you prove it. That question is custody, and it shapes most of the other decisions in a digital asset program, from which chains you support to how fast you can bring on a new client or asset class.
This guide covers what digital asset custody means, how it works across a financial institution's operations, and what to look for when evaluating a digital asset custody provider.
Digital asset custody is the set of systems and controls that let an institution hold, move, and account for digital assets, including native crypto, stablecoins, tokenized deposits, and tokenized securities. At its core, custody has to answer four questions:
Ownership on a blockchain is enforced cryptographically: whoever controls the private key tied to an address controls the asset. That's a different mechanism than a signature card or an account number, and it's why key management and policy enforcement sit so close together in a digital asset custody program.
Custody for a financial institution breaks down into five domains. Most gaps in a digital asset custody platform trace back to one of these being underbuilt, so it's worth knowing them before evaluating a provider.
Most digital asset custody tooling handles domains 4 and 5, authorization and settlement, reasonably well. Where institutions run into trouble is domains 1 through 3: client ownership, governance, and lifecycle operations. Those are the domains that map back into legal entities, approval hierarchies, and regulatory obligations, and they're exactly where the gaps below tend to show up.
Most digital asset custody tooling on the market was built for a crypto exchange or a retail wallet, then adapted for a bank afterward. Five capabilities tend to separate a platform that can operate at institutional scale from one that can't:
None of these are disqualifying on their own. Taken together, they separate a product built for a hosted wallet use case from one built to sit inside an institution's existing governance, compliance, and treasury architecture.
Kaleido Custody was built around those five capabilities directly, as part of the broader Kaleido platform rather than as a standalone wallet product.
Wallet architecture. Kaleido Custody's Wallet Manager supports both segregated wallets, a dedicated address per client with ownership derived directly from the ledger, and omnibus wallets, a single on-chain address with an off-chain sub-ledger tracking each client's entitlement and reconciling against the chain in real time. Most institutions run both: segregated wallets for regulated securities, omnibus for fungible flows such as tokenized deposits. Hot, warm, and cold tiers, including air-gapped configurations, layer operational risk controls on top of either model.
Governance. Kaleido Custody's Policy Manager runs on Open Policy Agent (OPA) with Rego, an open, auditable policy language, and enforces policy before a transaction signs rather than after. It supports role-based access control, maker/checker, four-eye approval, multi-level sequential chains, and threshold or quorum signing, each conditionable on transaction value, velocity, counterparty, asset type, and jurisdiction. AML, sanctions, and Travel Rule screening, through integrations with external platforms, plug into that same pre-signing flow, with every policy decision and signing event logged in a way an institution can independently verify.
Asset and network coverage. Kaleido's Digital Assets layer, Tokenize and Custody working together, handles native crypto (Bitcoin, Ethereum, Solana and similar), stablecoins, tokenized deposits, tokenized securities under standards such as ERC-3643, and fully custom contracts, on one platform. Chain coverage spans public EVM chains (Ethereum, Polygon, Arbitrum, Base, Avalanche), permissioned enterprise networks (Hyperledger Besu and Besu-based consortium chains, where Kaleido's team are core enterprise maintainers of the protocol), and select non-EVM networks such as Bitcoin and Solana.
Key management. Kaleido's Key Manager integrates with the HSM or KMS an institution already trusts, across providers such as Thales Luna, IBM, Fortanix, AWS CloudHSM, Google Cloud HSM, Azure Key Vault, and HashiCorp Vault, plus any PKCS#11-compliant HSM through Kaleido's open Remote Signing Module toolkit. Kaleido never generates or holds the private key. The Remote Signing Module, deployed alongside the HSM, re-verifies the transaction payload against approved policy before the HSM ever signs, closing the gap between "the workflow approved this" and "the key actually signed this."
Transaction submission. Kaleido's Workflow Engine and Chain Infrastructure layer keep transaction submission and status monitoring inside the same platform that enforces policy, so settlement control never hands off to a separate vendor with no visibility into the approval chain that got the transaction there.
What is the difference between custody and a regular blockchain wallet? A wallet generates keys, stores them, and signs transactions. Custody adds separation of duties (keys are not accessible from the signing decision point), policy enforcement (not all signing requests are approved), and auditability (every signing event is logged and queryable). A wallet is personal or application infrastructure; custody is regulated infrastructure designed to prove that assets were never at unauthorized risk.
Do we need an HSM for institutional custody? For Tier 1 institutions, yes. An HSM provides FIPS 140-2 or EAL4+ certification, tamper detection, and generates audit logs of key access that satisfy regulatory review. A cloud key vault can work for smaller institutions or non-regulated custody, but HSMs are the standard for institutions holding client assets.
How is digital asset custody different from traditional custody? Traditional custody relies on trusted intermediaries, such as a CSD or clearinghouse, who can reverse or hold a transaction after the fact. Digital asset custody enforces ownership cryptographically through private keys tied to addresses on a shared ledger. There is no intermediary who can undo a signed transaction, which shifts the burden onto pre-transaction policy controls and key management rather than post-transaction recovery.
What happens if a key is compromised in custody? A compromised key in institutional custody is a 1-2 hour incident, not a catastrophe. Because custody systems separate keys from signing orchestration, a single key is never capable of authorizing arbitrary transactions. It can only sign within its tier (e.g., a Tier 1 key might be limited to transactions under $10K). Moreover, audit logs allow you to identify immediately which transactions were signed with the compromised key, which clients are affected, and what recovery action is needed. This is why separation of duties and auditability are not optional as they are how you bound the blast radius of key compromise.
Can we store all our digital assets in a single wallet address? No. Regulatory frameworks like MiCA Article 70 and common-law custody liability require asset segregation. Client assets must be segregated from the custodian's assets. Assets of different clients should be segregated (or you maintain a documented exception). In practice, most institutions use a tiered model: a single "master" address holds net positions, but individual client withdrawals are signed from tier-specific addresses, creating an audit trail that links each transaction to a specific client and approval chain.
What compliance standards apply to digital asset custody? MiCA Article 70 is the EU standard (now effective). The U.S. has no federal custody standard yet, but the SEC has filed custody guidance, and state regulators (particularly New York, under the BitLicense framework) impose custody standards. Common-law trust law and SEC Rule 17a-3 (custodial record-keeping) provide the conceptual basis. ISO 27001 (information security) and SOC 2 Type 2 (internal controls) are operational baselines. Most Tier 1 institutions we work with require custodians to be SOC 2 Type 2 certified and to undergo annual third-party security audits.
What is the difference between segregated and omnibus wallet models? Segregated wallets give each client a dedicated on-chain address, with ownership derived directly from the ledger. Omnibus models pool multiple clients into a single on-chain address, with an off-chain sub-ledger tracking each client's entitlement and reconciling against the chain in real time. Most institutions use a hybrid of both, depending on asset type and regulatory requirement.
Can Kaleido access an institution's private keys? No. Keys are generated and held within the institution's own HSM or KMS, or a customer-controlled cloud HSM. The custody platform enforces policy and orchestrates the signing request but never generates or holds the private key itself.
Put together, these five capabilities are what separate custody infrastructure from a wallet with a compliance layer added on top. That difference is usually invisible in a demo. It tends to surface later, when a new client needs a segregated wallet, a new jurisdiction needs a different approval chain, or a new asset class doesn't fit the token standard the platform launched with.
Digital asset custody works best as an extension of an institution's existing governance, account structures, and compliance program, not as a separate crypto workstream bolted onto the side.
If your institution is evaluating digital asset custody providers, talk to our team about how Kaleido Custody fits into your existing infrastructure.
Kaleido makes it click-button simple to build a blockchain, launch a token, and choose your custody solution. Put our platform to work for you.
Request a DemoKaleido makes it click-button simple to build a blockchain, launch a token, and choose your custody solution. Put our platform to work for you.
Request a Demo
