Published on 23.01.2026
Thirty-second summary:
FINMA has communicated its requirements for cryptoasset custody.
Responsibilities of asset managers :
- Ensure that the asset custodian is authorized by FINMA or an equivalent foreign authority
- Ensure that in the event of the custodian’s bankruptcy, cryptoassets are removed from the bankrupt estate
- Ensure that the custodian has the infrastructure and expertise for crypto asset custody.
Any exception to the above must be the subject of documented information to the customer on the increased risks associated with the custodian, a proposal for alternative custodians, and if the customer wishes to retain his custodian, a written instruction.
Why this communication from FINMA?
Cryptoassets are increasingly being used in individual asset management. However, cryptoassets are exposed to specific risks, such as
- Cyber attacks
- Private key storage.
- Bankruptcy of the custodian, if the cryptoassets’ diversion is not guaranteed. Complex legal issues may also arise if the custodian is foreign.
On January 12, FINMA published a communication concerning the risks associated with cryptoasset custody. This article summarizes these requirements for asset managers.
1. Why this communication?
Distributed ledger technology (DLT) presents a number of novel features. Assets stored on the blockchain are exposed to specific risks, such as cyber attacks and the risk that private keys are not stored securely enough. There is also a counterparty risk when the distraction of cryptoassets is not guaranteed in the event of the custodian’s bankruptcy. If the custodian is also located abroad, complex legal issues may arise. Finally, some custodians do not at this stage have the appropriate infrastructure to hold cryptoassets.
2. Manager’s liability in the event of use of cryptoassets :
If cryptoassets are used, the asset manager is responsible for selecting, monitoring and evaluating the custodian of these cryptoassets. In particular, the criteria in point 2 below must be met.
Look-through principle: If a fund manager or sponsor places the proceeds in the accounts of their individual clients, the same requirements apply to the custody of cryptoassets (mandatory look-through).
3. Criteria to be met by cryptoasset custodians in the context of asset management :
Supervised institution: Cryptoassets invested in managed portfolios must be held exclusively by institutions subject to FINMA supervision (banks, securities houses, infrastructures based on distributed ledger technology), or equivalent foreign supervision (custodians subject to MICA are considered equivalent in particular).
Bankruptcy protection: Cryptoassets must be able to be withdrawn from the estate in the event of the custodian’s bankruptcy. If they are deposited abroad, equivalent bankruptcy protection is required.
Establishment calibrated and equipped for cryptoassets: The manager must verify the methods used to hold cryptoassets, and in particular the possible use of sub-custodians. Custodians must have a robust technical infrastructure and sufficient operational expertise for the custody of cryptoactives.
4. Exceptional regime
If there is an exception to the above, for example if the custodian is not subject to prudential supervision or does not have bankruptcy protection, then the customer must be informed of the increased counterparty risk this entails for him (particularly in the event of bankruptcy). Other custodians meeting these criteria should be proposed. If the customer nevertheless decides to continue with the current custodian, a written instruction must be kept in the manager’s file.
5. Commentary:
Generally speaking, if the manager makes significant use of cryptoactives, we recommend specific information on the risks of these instruments, by updating the company’s mandate or information sheet. In particular, this information should cover the risks of custodian insolvency, loss or compromise of private keys, cyber-attacks, operational failures, legal limitations in the event of bankruptcy, and a reminder of the risky and highly speculative nature (high volatility) of these products.
Finally, the FINMA communication specifies other requirements concerning collective asset management under the CISA and the distribution of structured products under the LSFin or crypto-ETPs, which you can find here: https://www.finma.ch/fr/news/2026/01/20260112-mm-am-01-26/
