Wallets and custody in crypto after the 2026 regulatory reset

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

Wallets and custody in crypto are no longer a retail choice between an app and a hardware device. As of October 13, 2026, the practical questions are who can authorize asset movement, how those permissions are governed, what legal segregation applies, and how failures are detected before they become losses. The issue has become more urgent as regulators update custody frameworks and attackers focus on keys, signer workflows, wallet infrastructure, and operational control planes, not only smart-contract code. The SEC proposed crypto custody rule changes on October 1, 2026, and TRM Labs reported that infrastructure attacks drove most stolen-asset losses in 2025. (sec.gov) For more background in this category, see our wallets and custody hub.

What wallets and custody actually mean

A crypto wallet is not a vault in the traditional sense. It is software, hardware, or an institutional system that manages the cryptographic material needed to sign transactions. The asset record lives on a blockchain or another distributed ledger; control comes from the ability to sign valid instructions. That distinction matters because losing a private key, seed phrase, hardware signing device, or approval credential can be economically equivalent to losing the asset itself.

Custody is broader than wallet software. It combines technical control, legal responsibility, governance, recordkeeping, and operating procedures. A person using a hardware wallet at home may have self-custody. An exchange user may have an account relationship with a platform that controls withdrawal keys. A fund or corporate treasury may use a qualified custodian, state trust company, multi-party computation provider, or a hybrid model with several approval layers.

• Self-custody means the owner, or a system controlled by the owner, has signing authority and bears the direct burden of backup, recovery, access control, and physical security.
• Third-party custody means a custodian safeguards the keys or signing process under a legal and operational arrangement.
• Shared-control custody uses multisignature, MPC, policy engines, or co-signing workflows so no single actor can move assets alone.
• Exchange custody may be convenient for trading, but it should be evaluated differently from long-term safekeeping because trading access and custody risk can be tightly linked.

Why 2026 changed the custody conversation

The custody debate became more specific in 2026 because law, accounting, banking standards, and threat data were converging on the same point: safeguarding crypto assets depends on operational proof, not slogans. In the United States, SEC Staff Accounting Bulletin No. 122 became effective on January 30, 2025, rescinding prior SAB 121 guidance and directing entities with safeguarding obligations to consider loss-contingency accounting frameworks while continuing to provide risk disclosures. (sec.gov) On October 1, 2026, the SEC then proposed rules that would permit advisers and regulated funds to self-custody crypto assets in certain circumstances, permit use of state trust companies subject to conditions, and update recordkeeping and disclosure requirements. (sec.gov)

In the European Union, MiCA Article 75 requires crypto-asset service providers that provide custody and administration to keep client crypto-assets segregated, provide statements of position at least every three months and on request, and maintain procedures to return assets or means of access as soon as possible. It also provides for liability where loss is attributable to the provider, capped at the market value of the asset when the loss occurred. (esma.europa.eu) ESMA separately highlighted that some transitional arrangements could run until July 1, 2026, depending on member-state choices. As a result, authorization status and jurisdiction still matter when evaluating a provider. (esma.europa.eu)

Comparing the main custody models

No custody model is automatically best. The right structure depends on transaction frequency, asset type, regulatory status, risk tolerance, team capability, and the consequences of an operational mistake. A long-term bitcoin holder, an active DeFi treasury, and a registered adviser do not have the same custody problem.

The core trade-off is straightforward. Self-custody reduces reliance on a platform but increases the burden of operational discipline. Custodial models reduce the user’s key-management burden but introduce counterparty, legal, and due diligence risk. Shared-control models can reduce single-point failure, but only when governance, recovery, and monitoring are designed and tested properly.

Controls that matter more than storage labels

Terms such as hot wallet, cold wallet, MPC, air-gapped, and institutional-grade are useful only when they describe verifiable controls. A cold wallet can still be compromised if the recovery phrase is photographed, stored in an online password vault, or accessible to one insider. An MPC setup can also fail if approval policies are weak or a privileged administrator can change withdrawal rules without independent review.

A serious custody setup should be able to demonstrate controls in at least six areas:

1. Key generation and backup. Keys or key shares should be created in a controlled environment, backed up securely, and recoverable without giving one person unilateral control.
2. Signer isolation. Transaction signing should be separated from everyday laptops, messaging tools, cloud dashboards, and developer environments where phishing and malware risk is higher.
3. Approval governance. Withdrawal policies should include multiple approvers, amount thresholds, address allowlists, time delays where appropriate, and escalation rules for unusual transactions.
4. Segregation and accounting. Client or business-unit assets should be distinguishable from proprietary assets, with clear records of addresses, balances, and transaction history.
5. Monitoring and reconciliation. On-chain balances, internal ledgers, custodian statements, and policy logs should be reconciled regularly, not only after an incident.
6. Incident response and recovery. The organization should know how to freeze workflows, rotate credentials, revoke access, contact counterparties, and preserve evidence if a signer, administrator, or vendor is compromised.

NIST SP 800-57 frames key management as a lifecycle discipline involving generation, storage, use, recovery, replacement, and destruction of cryptographic keys. The CryptoCurrency Security Standard describes cryptocurrency-specific controls for systems that store, manage, or interact with digital assets. (csrc.nist.gov) These frameworks do not eliminate custody risk, but they help move the discussion from marketing claims to documented processes.

Due diligence questions for investors, funds, and treasuries

Before relying on a wallet provider, custodian, exchange, or internal custody stack, decision-makers should ask questions that connect legal duties to operational reality. The answers should be documented and reviewed when assets, personnel, counterparties, or transaction patterns change.

• Who can initiate, approve, and finalize a withdrawal?
• Can one employee, administrator, vendor, or compromised device move assets alone?
• Are client, fund, treasury, and proprietary assets segregated legally and operationally?
• How are new withdrawal addresses approved, tested, and monitored?
• What assets are supported today, and what happens if a network forks, upgrades, halts, or changes staking rules?
• Is there an independent controls report, financial statement audit, penetration test, or CCSS assessment relevant to the specific custody system?
• Does insurance cover private-key compromise, social engineering, insider theft, vendor failure, and smart-contract interactions, or are those exclusions?
• How are sub-custodians, MPC vendors, cloud providers, and wallet-infrastructure vendors selected and monitored?
• What is the recovery process if an approver dies, leaves the firm, loses a device, or is suspected of compromise?
• How quickly can the organization detect and respond to an unauthorized transaction before assets move through mixers, bridges, or cross-chain routes?

These questions are not only for institutions. Individuals also need a simpler version: where the seed phrase is kept, who can find it, what happens after death or incapacity, and how a fraudulent transaction would be recognized before signing. See also: Blockchain Technology.

What remains uncertain

The October 2026 SEC custody proposal is not a final rule. The SEC fact sheet says the public comment period remains open for 60 days after publication in the Federal Register, so advisers, funds, custodians, and service providers should not treat the proposal as settled law. (sec.gov) Even if adopted, implementation details, state-law treatment, and interactions with existing custody rules will matter.

Jurisdiction also remains a major variable. MiCA creates a more unified EU framework, but authorization, supervision, and legacy transition issues can still differ by member state. In banking, the Basel cryptoasset standard is relevant for internationally active banks, while national implementation and business appetite can affect which custody services banks actually offer. (bis.org) For investors, the practical lesson is to confirm the specific legal entity, regulator, asset coverage, and client-asset protections rather than relying on a broad brand name.

Custody also does not remove market risk, protocol risk, governance risk, sanctions risk, tax risk, or the risk that a user signs a malicious transaction. Good custody reduces the probability and impact of unauthorized movement. It does not guarantee price stability, token legitimacy, or recovery after an irreversible transfer.

Practical takeaway

The strongest wallets and custody strategies start with a threat model, not a product label. For small holdings, that may mean a hardware wallet, careful backups, and clear inheritance planning. For institutions, it means documented controls, dual authorization, segregated records, independent assurance, vendor oversight, and clear legal terms. The 2026 custody environment rewards evidence: who controls the keys, how approvals work, how assets are separated, how records are reconciled, and how the organization responds when something goes wrong.

Frequently asked questions

Is self-custody safer than using a custodian?

It depends on capability. Self-custody removes reliance on a third party, but it also makes the owner responsible for key security, backup, recovery, and transaction review. A well-controlled institutional custodian may be safer for some users, while disciplined self-custody may be preferable for others.

What is MPC custody?

Multi-party computation custody divides signing authority among multiple key shares or participants so a complete private key does not need to exist in one place during signing. It can reduce single-key risk, but it still requires strong policies, vendor controls, recovery planning, and monitoring.

Does a regulated custodian guarantee recovery after a hack?

No. Regulation, segregation, and controls can improve protection and accountability, but they do not guarantee recovery. Recovery depends on the legal agreement, applicable law, attribution of the incident, insurance terms, asset movement after theft, and the custodian’s financial and operational resilience.

How often should custody controls be reviewed?

At minimum, custody controls should be reviewed after major personnel, asset, vendor, policy, or infrastructure changes. Institutions often combine continuous monitoring with scheduled quarterly or annual reviews, especially where regulation, board oversight, or independent control reports are involved.