Evaluating a Swiss custody/VQF company? Contact Faisal Khan with the wallet architecture, custody provider, and customer flow.
Swiss Crypto Custody: Who Controls the Private Keys?
A custody analysis begins with control.
If the customer alone controls the private keys and the platform provides software without the ability to transfer assets, the legal analysis can differ materially from a custodial service where the company or its provider can move assets.
Ask:
Who creates the wallet?
Who holds each key or MPC share?
Can the customer unilaterally move assets?
Can the company unilaterally move assets?
Can a third-party custodian move assets?
What happens if the company becomes insolvent?
Individual vs Collective Custody
FINMA's published FinTech framework makes an important distinction.
It indicates that accepting cryptoassets while storing each client's assets on individual blockchain addresses can be treated differently from collective custody. FINMA states that accepting client deposits up to CHF 100 million or taking collective custody of cryptoassets can require a FinTech license, subject to the applicable conditions.
This means that pooled wallet architecture can materially change the regulatory perimeter.
Example: Individually Attributable Wallets
This can create a different legal treatment from a pooled omnibus wallet, although AML, insolvency, contractual, and operational rules still need to be addressed.
Example: Omnibus / Collective Wallet
Here the blockchain may show one pooled balance while the platform's books allocate economic interests to customers.
That structure can have additional FinTech/banking implications and should be reviewed before acquisition or launch.
Fireblocks Does Not Determine the License
Advertisements frequently list Fireblocks as though the technology vendor proves regulatory permission.
Fireblocks, Copper, BitGo, or another provider can supply valuable wallet or custody infrastructure. The legal conclusion still depends on:
contractual ownership/control;
wallet segregation;
key-management setup;
on-chain attribution;
customer claim structure;
insolvency treatment;
whether assets are lent, staked, pledged, or reused;
who can initiate transfers.
Technology is evidence of operational infrastructure, not regulatory authorization by itself.
AML Controls for Custody
Custody businesses need robust AML controls because funds can move between external blockchain addresses, exchanges, self-hosted wallets, and counterparties.
Relevant controls can include:
KYC/KYB;
wallet ownership verification where required;
sanctions screening;
blockchain analytics;
source-of-funds checks;
transaction monitoring;
high-risk typology detection;
Travel Rule compliance;
escalation and case management;
suspicious-activity reporting.
For companies combining custody with fiat settlement, crypto-fiat on/off-ramp infrastructure should be reviewed at the same time because bank and wallet risk are interconnected.
Operational Security
FINMA's 2026 guidance on crypto custody highlights the technical and operational risks surrounding safekeeping of cryptobased assets. A buyer should assess:
MPC/HSM design;
hot/warm/cold wallet policy;
approval thresholds;
transaction signing;
whitelisting;
withdrawal delays;
key backup/recovery;
privileged access;
incident response;
vendor concentration;
cyber insurance where applicable;
penetration testing;
disaster recovery.
A “clean shell” with a Fireblocks contract but no documented controls is not a finished custody business.
Insolvency and Asset Segregation
A customer should know whether its cryptoassets remain identifiable and separable if the custodian fails.
Due diligence should determine:
whether assets are legally held for the customer;
whether the company has any right of use;
whether customer assets are segregated from treasury assets;
how books and blockchain data reconcile;
whether the customer's claim is proprietary or merely contractual;
how bankruptcy treatment has been analyzed.
This can materially affect both regulatory requirements and commercial trust.
Custody Plus Yield, Lending, or Staking
Adding yield changes the analysis.
If customer assets are lent, pledged, pooled, invested, or used in staking arrangements, the product can create additional questions under banking, securities, collective investment, or other laws.
A company acquired as a simple custody platform should not expand into yield products without a fresh perimeter review.
Custody Due Diligence for a Company Acquisition
Request:
architecture diagram;
complete list of custody/wallet vendors;
executed vendor contracts;
production vs sandbox status;
wallet/address inventory;
key-control matrix;
customer terms;
insolvency legal analysis;
SRO correspondence describing custody;
any FINMA legal opinions/non-action letters;
security audits;
penetration-test reports;
insurance;
incident history;
blockchain-analytics and Travel Rule setup;
asset-reconciliation procedures;
change-of-control clauses.
For the broader transaction, combine this with buyer and seller due diligence.
Related Swiss SRO Guides
Related reading: Swiss SRO crypto exchange and on/off-ramp, Swiss SRO vs FinTech license, and Swiss SRO companies for sale.
Frequently Asked Questions
Can VQF members provide custody?
Potentially, but the wallet and client-asset architecture must be reviewed. Collective custody can bring the FinTech license perimeter into play.
Is a non-custodial wallet a VASP activity?
It depends on what the provider actually controls and performs. Pure software provision can differ from controlling customer assets.
Does Fireblocks make the company a licensed custodian?
No. It is technology infrastructure. Regulatory status depends on the legal and operational model.
Can customer assets be pooled?
They can be technically pooled, but that structure can have material Swiss licensing implications and must be analyzed before implementation.
What is the most valuable evidence in due diligence?
The custody architecture, customer contract, SRO/regulatory analysis, production vendor contracts, and evidence of how assets are actually held.
Regulatory References
Review Custody Before the Acquisition Price
A target advertised as “VQF + custody” can be valuable, but the phrase is not enough to establish that the buyer's planned custody model is permitted.
Contact Faisal Khan to review a Swiss custody/VQF acquisition.