HT-00 Insights index, last reviewed
Insights: custody, due-diligence and licensing guides for institutions
Hex Trust Insights publishes sourced digital asset custody guides for institutions: how custody keys are secured, what to ask a custodian before appointing one, and how custody is licensed in Dubai, Singapore and Hong Kong. Every guide is reviewed by a compliance role and dated.
File index
What Insights covers and who it is for
Insights is the guide section of this site. It is written for the people inside an institution who choose, review and oversee a digital asset custodian: risk and compliance officers, operations and treasury teams, internal auditors, and the technology reviewers who assess how private keys are stored. It is not written for retail investors, and it does not cover prices, trading ideas or the choice of tokens.
Each guide answers one question that comes up when a custodian is appointed. The first explains how custody keys are secured, and how hardware security modules, multi-party computation and multisig differ. The second is a checklist of what to ask a custodian, with the document or register entry to request in each of eight review areas. The third sets out who licenses custodians in Dubai, Singapore and Hong Kong, and what a licence does and does not cover.
The guides follow three rules. A fact carries a link to its source or names the page it was read on, with the date. A regulatory statement points to the regulator's own rulebook or public register, so that you can repeat the check yourself. Where a guide describes a Hex Trust service, it says so, quotes the company's published pages and notes where two of those pages disagree.
Insights sits next to the service files and does not replace them. To see what Hex Trust offers, read the pages on institutional crypto custody, the crypto OTC desk and institutional staking from custody. For evidence, the security and assurance file lists the reports and certifications the company publishes, custody fees and pricing explains how a proposal is priced, and licences by entity gives each licence number with its register link. The Hex Trust digital asset custodian overview shows how these files fit together.
Three guides are published today, each dated . They are grouped below by topic, and the topics that have no guide yet are named as plain text until one is published. Short answers about Hex Trust itself are kept apart, under frequently asked questions.
Everything in Insights is for information only. It is not investment, legal or tax advice, it recommends no custodian and no digital asset, and it makes no price predictions.
Start here: three guides for custody buyers
Read them in any order. Each one stands alone and links to the other two where the subjects meet.
-
MPC vs HSM vs multisig: how custody keys are secured
Where the signing key lives in each model, what a laboratory can certify, the trade-offs between the three, and the questions to ask a custodian about key management.
-
Crypto custody due diligence checklist
Eight review areas, from the licensed legal entity to commercial terms, each with the document or register entry to request so that you can verify the answer yourself.
-
Crypto custody law in Dubai, Singapore and Hong Kong
Who licenses custodians in each market, what a licence covers, where Hong Kong's custodian regime stood on 11 October 2026, and how to check a register entry yourself.
Custody technology
How a custodian stores and uses private keys decides most of its technical risk. Three models are in common use: a hardware security module (HSM) keeps a whole key inside tamper-resistant hardware, multi-party computation (MPC) splits signing across several parties, and multisig makes the blockchain itself require several independent keys. Hex Trust states that it keeps private keys in HSMs validated to FIPS 140-3 Level 3 and names the vendor as Securosys Primus (live trust centre, read ).
Due diligence and risk
A custodian review should rest on evidence that you can check without the custodian's help: a licence number that matches a public register entry, an assurance report with its auditor, type and period, an insurance summary with its limit and exclusions, and custody terms that state how client assets are segregated. The checklist turns these into questions, and the two files after it show what Hex Trust publishes against them.
Regulation and licensing
A licence belongs to one named company and covers one named activity, so the facts that matter are the entity, the licence number and the register entry: with those three you can confirm the status yourself. For example, the VARA public register lists Hex Trust MENA FZE under VL/23/08/002 for Custody Services, and the status was Active when the entry was read on (VARA register entry for Hex Trust MENA FZE).
Markets, OTC and staking
Two service files cover what happens around a custody account: executing a trade and staking from custody. No guide on either subject is published yet, so the service pages are the place to read about eligibility, process and risks. Staking is not offered in Singapore or Dubai, and the staking page states where it is available.
Planned guides, not yet published:
- How a crypto OTC desk works: RFQ, settlement and counterparty risk
- How institutional staking works: validators, slashing and unbonding
Reading paths
Two routes through the same files, depending on where you start.
New to digital asset custody
- Begin with the three key models, explained from first principles.
- Then see what an institutional custody account includes.
- Finish with short answers on custody, OTC trading and staking.
Running a custodian selection
- Build your question list from the eight review areas of the custodian checklist.
- Check the licensing position with the guide to custody rules in each of the three markets.
- Compare the answers with the assurance evidence Hex Trust publishes.
When your shortlist is ready, contact the team and ask for the due-diligence pack.
Who writes and reviews these guides
Guides carry the byline of the Hex Trust Research Team and are reviewed by the Head of Compliance before they are published. Each guide lists its sources and shows the date it was published and the date it was last updated. The updated date changes only when the content does.
- Written by
- Hex Trust Research Team
- Reviewed by
- Head of Compliance
- Review cycle for pillar guides
- Every 6 to 12 months
- Corrections
- [email protected]
Sourcing, corrections and the rules for AI-assisted drafting are set out in the editorial policy. The companies behind the guides, with their licences and offices, are described on the page about Hex Trust.
Start with the checklist
It covers the most ground: eight review areas, and the evidence to ask for in each.