Key takeaways
- A digital asset custodian safeguards the private keys that control digital assets and operates the controls around them: approvals, segregation, reporting and recovery.
- A custodian is not an exchange, a wallet app or a broker, although one group may offer several of those services through separate entities.
- Licences attach to a named legal entity and to named activities, so verify the entity on the regulator's register.
- Hex Trust MENA FZE holds VARA VASP Licence VL/23/08/002 for Custody Services, issued on 15 November 2023, limited to Institutional Investors and Qualified Investors.
What a digital asset custodian does
Digital assets such as bitcoin are not stored in a file or an account that someone can hold for you. Control rests with a private key, the secret value that authorises transfers. Whoever controls the key controls the asset. A custodian's job is to hold that control safely for a client and to release it only on properly authorised instructions.
In practice the service has five parts:
- Key generation and storage. Creating keys in a controlled environment and keeping them in hardened systems, commonly hardware security modules (HSMs) or multi-party computation (MPC).
- Transaction approval. Requiring named approvers, policies and address controls before a withdrawal is signed.
- Segregation. Keeping client assets apart from the custodian's own and, ideally, from other clients' assets.
- Reporting and records. Statements, audit trails and reconciliation of holdings.
- Recovery and continuity. Encrypted backups and tested procedures if systems, people or sites are lost.
Custodian, exchange, wallet and broker compared
The terms are often mixed up. The table separates them by main function; one corporate group can offer several, but each should sit in a properly licensed entity.
| Provider | Main function | Who controls the keys |
|---|---|---|
| Custodian | Safekeeping and control of assets for clients | The custodian, under a custody agreement |
| Exchange | Operating a market for trading | Usually the exchange, for balances held on the platform |
| Self-custody wallet | Software or hardware the owner operates | The owner |
| Broker-dealer or OTC desk | Arranging or executing trades | Depends on the settlement arrangement |
For the trading side, see the Hex Trust OTC desk; for a comparison of routes into dirham, read cashing out crypto to AED in the UAE.
How custodians are regulated
There is no single global regime. Each market licenses custody under its own law, so the same activity can fall under different regulators and rules.
- Dubai. The Virtual Assets Regulatory Authority (VARA) licenses Custody Services and publishes a public register and a Custody Services Rulebook. The rulebook says assets in custody are not the licensed firm's own assets and bans rehypothecation, the re-use of client assets.
- Singapore. The Monetary Authority of Singapore (MAS) licenses digital payment token services under the Payment Services Act 2019 and sets consumer protection expectations in guidelines PS-G03.
A licence is not a guarantee. It states which activities one legal entity may carry on and, often, which clients it may serve. The guide to custody law in Dubai, Singapore and Hong Kong sets out the three markets in more detail.
How Hex Trust describes its position
Hex Trust MENA FZE is licensed by VARA for Custody Services under VASP Licence VL/23/08/002, issued on 15 November 2023. HT Markets MENA FZE, a separate company, holds a VARA licence for Broker-Dealer Services, VL/23/08/003, issued on 31 May 2024. Hex Technologies Pte. Ltd. is licensed by MAS as a Major Payment Institution in Singapore.
Not covered: wealth management, token wrapping and lending or staking of digital payment tokens, which appear on the global website, are not offered under, or regulated by, the Dubai or Singapore licences.
Details of each company are on the About page, and the controls are described on the security and assurance page.
What institutions should check first
Start with evidence that you can verify yourself:
- The legal entity that signs the agreement, and its register entry.
- How assets are segregated, and the document that sets out legal title and insolvency treatment.
- The key model and any certification. The comparison of MPC, HSM and multisig custody explains the trade-offs.
- Independent assurance reports, with their period and scope.
- Insurance: the limit, whether it is shared by all clients, the insured events and the insurer.
- Fees, minimums and exit terms. Hex Trust sets out how its pricing works.
The full review is laid out in the crypto custody due diligence checklist. Short answers to common questions are in the FAQ, and all Insights guides are listed in the hub.
FAQ
Is a digital asset custodian the same as a crypto exchange?
No. An exchange runs a market where users trade, and may hold balances to do so. A custodian's core job is safekeeping and controlling access to assets. Some groups run both, so check which legal entity holds your assets and whether it may re-use them.
Does a custodian own my digital assets?
Under a properly structured arrangement, no. The client keeps ownership and the custodian holds and controls the assets on the client's behalf. Dubai's Custody Services Rulebook says assets in custody are not the licensed firm's own assets. Check the custody agreement for who holds legal title.
What happens to my assets if a custodian fails?
The keys sit in systems the custodian operates, so a failure raises a legal and recovery question as well as a technical one. Ask how assets would be returned, under which law, and request a legal opinion on insolvency treatment. This is not legal advice.
What is the difference between a custodian and a self-custody wallet?
With self-custody, the owner holds the keys and carries the operational risk. With a custodian, a regulated third party holds the keys under a contract, with controls, reporting and, where offered, insurance. Each shifts a different set of risks.
How do I check that a custodian is licensed?
Identify the legal entity that will sign the agreement, then open the regulator's public register yourself. For Dubai, use the VARA public register; for Singapore, the MAS Financial Institutions Directory. Compare the licensed activities and client conditions with the services you want.
Sources
These are the primary sources cited in the due diligence checklist, where each was opened on 12 October 2026. They were not re-opened for this article, and statements here are limited to what that checklist reports from them.
- Virtual Assets Regulatory Authority, public register: Hex Trust MENA FZE.
- Virtual Assets Regulatory Authority, public register: HT Markets MENA FZE.
- Virtual Assets Regulatory Authority, Custody Services Rulebook.
- Monetary Authority of Singapore, Financial Institutions Directory: Hex Technologies Pte. Ltd.
- Monetary Authority of Singapore, Guidelines on Consumer Protection Measures by DPT Service Providers [PS-G03].
This guide is for information only and is not investment advice, legal advice or tax advice. It does not recommend any custodian or any digital asset. Digital assets are volatile, and the risk disclosure for digital asset services sets out the main risks.
Speak to Hex Trust about custody
Ask institutional sales for the licence of the company that would serve you, the current assurance reports, the insurance schedule and a written fee proposal.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.