Crypto custody due diligence checklist: what to ask before you appoint a custodian

Key takeaways

How to use this checklist

Run the checklist as a document request, not as a questionnaire: give each of the eight areas one owner, grade every answer by its evidence and log the gaps. The 24 questions, three per area, are collected in the checklist table with evidence and red flags.

A crypto custody due diligence process is rarely one person's job. Legal usually takes the entity and insolvency questions, information security the keys and the assurance reports, risk the insurance, operations the service levels, compliance its own area, and finance the fees and exit terms.

Rank every answer by what stands behind it:

1. A document. A licence, an auditor's report, a policy, an insurance schedule or a draft agreement that you can read in full.
2. A register entry. A public record kept by a regulator or a registry, which you open yourself.
3. A statement. A sentence on a website or in a sales deck. Record it, then ask for the document behind it.

Grade each answer: 2 for a document or register entry you have verified, 1 for a statement, 0 for no answer. With invented numbers, 17 verified answers, 5 statements and 2 blanks score 39 of 48 points, or 81%. Where the zeros fall matters more than the total: a zero on the entity, on segregation or on insurance should pause the selection.

The baselines in this guide come from rules that custodians themselves must meet, each named where it is used; treat them as a reference point when you set your own crypto custody due diligence requirements. Key technology and national law have their own guides, MPC vs HSM vs multisig custody compared and crypto custody regulation in Dubai, Singapore and Hong Kong, both listed with all Insights guides for custody buyers. Each area ends with Hex Trust's own answer, gaps included.

1. Licence and legal entity

Start with the company, not the brand: a licence belongs to one legal entity, covers named activities and often limits the clients that entity may serve. Each entry on Dubai's VARA public register, for example, shows the licence type, the activities, the issue date, a licence condition and a status.

Questions to ask about the entity

• Which legal entity will sign the custody agreement, and where is it incorporated?
• Which regulator issued its licence, under which number, for which activity and when?
• Which client classes may it serve, and which services on the group's website does it not provide?
• Is the custody company legally separate from the group's trading and lending businesses?

Open the register entry yourself and compare it with the draft agreement. VARA's Custody Services Rulebook (effective from 19 June 2025) requires a custody provider to be a separate legal entity from group companies with other virtual asset activities, with one limited exception, so ask for the group chart.

2. Segregation and insolvency treatment

Segregation is only as strong as the legal document behind it: ask how assets are held, who has title and what a liquidator could reach. Dubai's rulebook says assets in custody “are not depository liabilities or assets of the VASP”, the licensed firm. It also requires separate wallets for each client and bans rehypothecation, even with the client's consent.

Questions to ask about segregation

• Are my assets in wallets that hold my assets only, or in an omnibus wallet with a book entry?
• Can I see the segregation on-chain, at addresses I can check?
• Who holds legal title, and may the custodian lend, pledge or re-use assets?
• If the custodian fails, who returns my assets, under which law and how quickly?

Segregation still has limits. In Singapore, MAS sets out the consumer protection measures it expects of digital payment token providers in its guidelines PS-G03, revised on 19 September 2024, and the risk warning that MAS requires, as printed on Hex Trust's Singapore page, says a trust or segregated account “may not fully protect” a customer's money or tokens if the provider's business fails. Treat segregation as a matter of evidence, not of wording.

3. Key management

Ask for the standard, not the adjective: a key system is described by its model, its certification and the people who can approve a transaction. FIPS 140-3, the United States standard for cryptographic modules that NIST published on 22 March 2019, sets four increasing levels of security.

Questions to ask about keys

• Which key model protects my assets: hardware security modules (HSMs), multi-party computation (MPC), multisignature or a mix?
• Against which standard and level is it validated, and can I see the certificate?
• How are keys generated, where are backups kept and when was recovery last tested?
• How many approvers does a withdrawal need, and can one person change the policy?

As a baseline, Dubai's rulebook wants key backups stored apart from the primary keys, with encryption at least as strong, and the risk of collusion between signatories assessed. The three models are compared in the guide to how MPC, HSM and multisig custody differ.

4. Independent assurance

An assurance report helps only if you know its type, period, auditor and scope. AICPA describes SOC 1 as an examination of controls relevant to clients' internal control over financial reporting; SOC 2 addresses security, availability, processing integrity, confidentiality or privacy.

Questions to ask about reports

• Which reports exist: SOC 1, SOC 2 or both, Type I or Type II?
• Which period does the latest Type II report cover, and which entities and platforms are in scope?
• Did the auditor note exceptions, and how were they closed?
• Is there a bridge letter for the time since the period ended, and who runs penetration tests?

Read registry listings with the same care: on the Cloud Security Alliance's STAR registry, level one is a self-assessment and level two a certification or third-party attestation. Check whose certificate you are shown, because an ISO certificate may belong to a data-centre operator.

5. Insurance

An insurance figure means little until you know whether it is shared, what it covers and who underwrites it. Four facts decide its value: the limit, whether it is per client or aggregate, the insured events with their exclusions, and the insurer with the policy period.

Questions to ask about insurance

• What is the limit, and is it per client, per event or one aggregate for all clients?
• Which events, wallet tiers and assets are covered, and what is excluded?
• Who is the insurer or lead insurer, and what is the policy period?
• How is a claim made, how long does payment take and can dedicated cover be bought?

A worked example with invented figures shows why the aggregate question comes first.

The limit is smaller than the single holding of US$30,000,000, and after a covered loss of US$80,000,000 the policy could pay at most a quarter, divided among the affected clients under its terms.

To put these questions to the company, request the due-diligence pack from institutional sales.

6. Operations and service levels

Operational answers should be contractual: a withdrawal time on a web page is a description, and a service level in the agreement is a commitment. Dubai's rulebook sets two baselines: a client statement at least every month, and an audit trail of account activity kept for at least eight years.

Questions to ask about operations

• How long does a withdrawal take from each wallet tier, and is that time in the agreement with a remedy?
• Which assets and networks are supported, and how are forks, airdrops and new assets handled?
• Which statements will I receive, how often and in which format?
• When was the continuity plan last tested, and how would I be told about an incident?

7. Compliance controls

A custodian's compliance programme protects you as well as the custodian, because weak screening can delay transfers or taint assets. Ask who is accountable by name, which tools screen transactions and how the Travel Rule, the duty to send originator and beneficiary details with a transfer, is met. Dubai's rulebook also makes custody providers publish their conflicts of interest and their complaints-handling policy.

Questions to ask about compliance

• Who are the compliance officer and the money laundering officer of the company I would contract with?
• Which tools monitor transactions and screen addresses, and at which points?
• How is the Travel Rule met, including transfers to and from unhosted wallets?
• Are any client assets kept with a third party, and where is the complaints procedure published?

8. Commercial terms and exit

Price the exit as carefully as the entry: fees can be negotiated, but the transfer-out terms decide what a change of custodian costs. Dubai's rulebook expects the client agreement to say when and how assets in custody will be returned; ask every custodian for that clause.

Questions to ask about fees and exit

• What is the fee base: a percentage of assets under custody, a fixed fee, transaction fees or a mix?
• Which minimums, onboarding fees and pass-through costs such as network fees apply?
• What notice ends the agreement, how long does a full transfer out take and what does it cost?
• What is the liability cap, and which law and forum govern disputes?

Checklist table: question, evidence, red flag

This digital asset custody due diligence checklist restates the eight areas as 24 questions, each with the evidence to request and the red flag to watch for. Print it and write a grade of 2, 1 or 0 against each row.

Prepared for this guide. Last reviewed 11 October 2026.

Red flags that should stop a selection

Five findings should pause a selection until they are resolved, whatever the total score. Each is a claim that cannot be traced to a document or a register entry.

• A regulator named without a number or a register link A licence that exists can be found on the public register in a minute.
• “Fully regulated” with no entity Regulation attaches to a company and an activity, not to a group.
• An insurance figure without scope No aggregate or per-client basis, no insured events, no insurer and no policy period.
• A SOC report older than 12 months with no bridge letter Controls tested long ago say little about controls today.
• Rewards presented as certain Staking and lending rewards are variable and not guaranteed. The risks are listed for institutional staking from custody.

The same test applies to Hex Trust. On its public record, two items need closing before a reviewer could sign off: the latest listed SOC report dates from December 2023, and the insurer is not named. Both are marked “To confirm” above.

FAQ

Sources

Regulator registers, rulebooks and standards opened for this guide, with the date each page was read.

1. Virtual Assets Regulatory Authority, public register: Hex Trust MENA FZE, opened 12 October 2026.
2. Virtual Assets Regulatory Authority, public register: HT Markets MENA FZE, opened 12 October 2026.
3. Monetary Authority of Singapore, Financial Institutions Directory: Hex Technologies Pte. Ltd., opened 12 October 2026.
4. Virtual Assets Regulatory Authority, Custody Services Rulebook, version effective from 19 June 2025, Parts II and III, opened 12 October 2026.
5. Monetary Authority of Singapore, Guidelines on Consumer Protection Measures by DPT Service Providers [PS-G03], revised on 19 September 2024, opened 12 October 2026.
6. AICPA and CIMA, System and Organization Controls: SOC Suite of Services, opened 12 October 2026.
7. Cloud Security Alliance, STAR registry entries for Hex Trust, opened 12 October 2026.
8. National Institute of Standards and Technology, FIPS 140-3, Security Requirements for Cryptographic Modules, published 22 March 2019, opened 12 October 2026.

Statements about Hex Trust come from its live website (trust centre, custody, Hex Safe, wallets, storage arrangement and insurance coverage framework pages, and the Singapore and Dubai pages), read on 6 October 2026, and from the registers listed here.