Key takeaways
- The real difference is who controls the keys and who is accountable when something goes wrong, not which model sounds more secure.
- Self-custody gives full control but moves key management, staffing, recovery and assurance onto the institution.
- A licensed custodian adds regulation, segregation rules and independent assurance, but adds counterparty and contractual risk.
- Many institutions split holdings between the two; the split should be a written policy.
- Whichever model you choose, ask for documents and register entries, not statements.
What each model means
Digital assets are controlled by private keys, the secret values that authorise transfers on a blockchain. Whoever controls the keys controls the assets, so the custody question is a question about key control.
Self-custody
In self-custody the institution generates, stores, backs up and uses its own keys, whether in hardware security modules (HSMs, tamper-resistant devices that hold keys), multi-party computation (MPC, which splits signing across several parties) or multisignature wallets. No third party can move the assets, and no third party stands behind them.
Third-party custody
In third-party custody a custodian holds the keys on the institution's behalf under a custody agreement. Our guide to what a digital asset custodian is explains the role, and how it differs from an exchange or a broker. The custodian's legal entity, licence and contract define what protection you actually receive.
Side-by-side comparison
The table sets out the main differences. It is qualitative on purpose: costs and incident rates vary too widely between institutions for a single figure to be honest.
| Factor | Self-custody | Third-party custody |
|---|---|---|
| Key control | Institution alone | Custodian, under client approval rules in the contract |
| Counterparty risk | None to a custodian; risk sits with internal staff and systems | Exposure to the custodian's solvency, conduct and legal structure |
| Security burden | Built, run and tested in-house | Run by the custodian; you review its evidence |
| Recovery | Institution's own backups and procedures | Custodian's procedures and contract terms |
| Independent assurance | Must be commissioned separately | May be available as SOC reports and certifications |
| Regulatory position | Depends on your own activities and jurisdiction | Custodian is licensed for the activity; you can verify it on a register |
| Cost shape | Infrastructure, people, audits, insurance enquiries | Fees set by a written proposal, plus your own oversight |
Prepared for this guide. Last reviewed .
Where self-custody fits
Self-custody can suit an institution with a strong security function, a modest number of wallets and a need for direct, immediate control. It removes custodian counterparty risk, which matters if the institution is wary of any third party holding its keys.
The cost is responsibility. The institution must design approval workflows, protect against insider collusion, store backups separately from the primary keys, test recovery and keep the system patched. Dubai's Custody Services Rulebook, which applies to licensed custodians, is a useful benchmark of what a mature setup addresses: it expects key backups stored apart from primary keys, with encryption at least as strong, and an assessment of collusion risk between signatories. A self-custodying institution has no regulator or auditor checking those points unless it arranges that itself.
Key technology choices also carry trade-offs; MPC, HSM and multisig custody compared sets them out. The cryptographic module standard FIPS 140-3, published by NIST, defines four increasing security levels, and is one reference for evaluating hardware whichever model you choose.
Where a custodian fits
A licensed custodian suits institutions that want key management, segregation and assurance delivered by a regulated firm, or that must show their own investors, auditors or regulators that assets are held by a qualified party. It does not remove risk; it changes its form.
Under VARA's Custody Services Rulebook, assets in custody are not depository liabilities or assets of the licensed firm; the rulebook also requires separate wallets for each client and bans rehypothecation, the re-use of client assets. These rules apply to VARA-licensed custody providers in Dubai. Whether a given custodian's structure would hold up in an insolvency still depends on its documents and governing law, which is covered in bankruptcy-remoteness for custodied assets. In Singapore, MAS also warns that a trust or segregated account may not fully protect customer assets if a provider fails, so read the legal basis, not only the label.
What the Hex Trust licence covers
Hex Trust MENA FZE is licensed by VARA for Custody Services under VASP Licence VL/23/08/002, issued on 15 November 2023, and the VARA register entry limits it to Institutional Investors and Qualified Investors. The licence belongs to that company only. It does not extend to wealth management, token wrapping, or lending or staking of digital payment tokens, which are not offered under the Dubai or Singapore licences. See the Hex Trust entities and leadership for the full group.
Hex Trust publishes no fee schedule; see how pricing works. Insurance, segregation and assurance details are on the security and assurance page, and the checklist guide notes which items still need confirming.
How to decide
Work through five questions in order. The answers usually point to one model, or to a defined split.
- Who must be able to prove control? If investors, auditors or regulators expect assets to sit with a qualified third party, that may decide the matter.
- Can we run and evidence the controls ourselves? Include approvals, collusion resistance, backups, recovery tests and independent testing.
- What are we prepared to trust? Compare internal key-person and process risk with a custodian's legal, operational and insolvency risk.
- How fast do we need to move assets? Direct control can be quicker; a custodian's service levels should be written into the agreement.
- How would we exit? Ask what moving assets in or out costs and how long it takes under either model.
If you choose a custodian, test it with the crypto custody due diligence checklist and confirm that the licence fits the activity in your market using crypto custody law in Dubai, Singapore and Hong Kong. The Hex Trust FAQ answers common service questions, and all related guides are in Insights.
This guide is for information only. It does not tell you which model to use, and it is not investment, legal or tax advice.
FAQ
Is self-custody cheaper than using a custodian?
Not necessarily. Self-custody avoids a custody fee, but you pay for key infrastructure, staff, audits, insurance enquiries and recovery planning yourself. The comparison is total cost of ownership, not the fee line. Hex Trust publishes no fee schedule, so a custodian's price has to come from a written proposal.
Does a custodian hold the keys or the assets?
A custodian controls the private keys that let assets on a blockchain be moved, so in practice it controls access to the assets. Who holds legal title, and what happens in an insolvency, depends on the custody terms and the jurisdiction. Ask for the documents; this is not legal advice.
Can an institution use both custody and self-custody?
Yes. Some institutions keep a working balance under their own control and place the remainder with a licensed custodian, or hold operational wallets themselves for speed. The split is a policy decision that should be written down, with approval rules for moving assets between the two.
Does self-custody need a licence?
It depends on your activities and jurisdiction. Holding your own assets for your own account is generally different from holding assets for others, which is the activity that custody rules target. Take legal advice for your structure, and check the relevant regulator's rules directly.
What should a board ask before choosing self-custody?
Ask who can authorise a transfer, how keys are backed up and recovered, what happens if a key holder leaves or acts dishonestly, which independent party tests the controls, and who bears a loss. If any answer is unclear, the control framework is not ready.
Sources
Primary sources behind this guide. The facts drawn from them were taken from the due diligence checklist, which recorded opening them on 12 October 2026. They were not re-opened for this article on 20 October 2026, so check them directly before relying on them.
- Virtual Assets Regulatory Authority, public register: Hex Trust MENA FZE.
- Virtual Assets Regulatory Authority, Custody Services Rulebook, version effective from 19 June 2025.
- Monetary Authority of Singapore, Guidelines on Consumer Protection Measures by DPT Service Providers [PS-G03], revised on 19 September 2024.
- National Institute of Standards and Technology, FIPS 140-3, Security Requirements for Cryptographic Modules, published 22 March 2019.
This guide is for information only and is not investment advice, legal advice or tax advice. It does not recommend any custodian or any digital asset. Digital assets are volatile, and the risk disclosure for digital asset services sets out the main risks.
Weighing custody for your institution
Ask institutional sales for the documents behind a custody proposal: the licence of the company that would serve you, the current assurance reports, the insurance schedule and a written fee proposal.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.