Negotiating Digital Asset Custody Agreements

This article explains why a custodian’s duty to protect digital assets from cyberattacks is not a default rule anywhere in the United States, and what to negotiate into the agreement wherever the custodian sits.

Digital asset custody remains one of the least settled corners of financial services.

Customers who place bitcoin, ether, or other digital assets with a custodian often assume the custodian has a legal duty to safeguard them from hackers. In many cases, the documents say otherwise.

Dilendorf Law Firm represents clients nationwide in negotiating and structuring digital asset custody agreements.

Our clients include companies, funds, family offices, trustees, and custodians. The first question we ask is simple: does the agreement actually say the custodian must safeguard the assets against foreseeable cyber risks? Surprisingly often, it does not.

Who regulates the custodian, and why does it matter?

The answer changes with the custodian. A national bank answers to the Office of the Comptroller of the Currency. A state trust company answers to its state banking regulator. A Wyoming special purpose depository institution operates under Wyoming’s own digital asset statutes. Each framework sets different ground rules.

In July 2025, the OCC, the Federal Reserve Board, and the FDIC issued a joint statement on crypto-asset safekeeping. It draws a sharp line.

A bank that holds crypto in a fiduciary capacity must comply with federal fiduciary rules, “state laws and regulations, and any other applicable legal provisions, such as the instrument that created the fiduciary relationship.”

A bank that holds crypto in a non-fiduciary capacity is different. Those “safekeeping services provided by a banking organization in a non-fiduciary capacity are established by the client contract” [1].

The agencies also named the central risk. “One of the primary risks of crypto-asset safekeeping is the possible compromise or loss of cryptographic keys or other sensitive information that could result in the loss of crypto-assets or the unauthorized transfer of the crypto-assets out of the banking organization’s control” [1].

They recommended “a well-written customer agreement, outlining clearly defined duties and responsibilities of the parties” as the tool to manage that risk [1].

Is the duty to safeguard a default rule in any state?

State statutes generally grant custody powers. They rarely define a cybersecurity standard of care. Three examples show how much the rules vary.

New York is one example. Many custodians are New York limited purpose trust companies. Their authority comes from Section 100 of the Banking Law.

It lists fiduciary powers, including the power “to receive, take, manage, hold and dispose of according to the terms of such trust, duty or power, any property or estate” entrusted to the company [2].

The statute is a grant of powers. It says nothing about cyberattacks or account takeovers. New York’s Department of Financial Services adds custody guidance on segregation, “F/B/O” titling, and limits on liens and set-off [3]. That guidance addresses insolvency. It is not a promise to defend against hackers.

South Dakota takes a similar approach. Its trust company statute authorizes a trust company to “act as agent, custodian, or attorney-in-fact for any person, and, in such capacity, take and hold property on deposit for safekeeping” [4].

Its general trust law requires a trustee to “use at least ordinary care and diligence in the execution of his trust” [5]. “Ordinary care” is a general standard. What it means for key management or account takeovers is left to the instrument and the courts.

Wyoming goes further than most. Its digital asset custody statute lets a bank opt in to an enhanced supervision framework.

A bank that does so must “maintain information technology best practices relating to digital assets held in custody.” It must also have each customer elect, “pursuant to a written agreement with the bank,” the legal relationship that governs each digital asset held in custody [6]. Even here, the agreement does the work.

Jurisdiction	Custody authority	Cyber standard in the statute	What the agreement must supply
Federal (OCC, FRB, FDIC)	Fiduciary or non-fiduciary safekeeping by banks [1]	Risk-management principles; no fixed duty	Non-fiduciary duties are “established by the client contract”
New York	Banking Law § 100 fiduciary powers [2]	None stated	Standard of care, insurance, incident response
South Dakota	Trust company custody powers, SDCL 51A-6A-29 [4]	“Ordinary care and diligence” for trustees [5]	What ordinary care means for keys and access
Wyoming	Opt-in digital asset custody, W.S. 34-29-104 [6]	“Information technology best practices”	Customer’s elected legal relationship for each asset

Sources: [1] [2] [4] [5] [6]

How large are the losses?

The threat is not theoretical. The FBI’s Internet Crime Complaint Center reported more than 1,008,000 complaints and $20.877 billion in losses in 2025. That is a 26 percent increase over 2024. Complaints with a cryptocurrency nexus accounted for $11.366 billion of the total, up 22 percent [7].

The New York Attorney General has observed that, unlike fiat deposits, “no similar compensation is available for virtual currency losses” through deposit insurance. Once a private key is exposed, recovery is “difficult if not impossible” [8].

Source: FBI IC3, 2025 Internet Crime Report, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

Why do regulators now measure the timeline in months?

On June 22, 2026, the leaders of the Five Eyes cyber security agencies issued a joint statement on artificial intelligence and cyber risk.

The signatories included the National Security Agency and the Cybersecurity and Infrastructure Security Agency. Their message was direct.

Frontier AI models are transforming offensive capabilities, and “the timeline is not years, it is months.”

Cyber risk “is a core business risk and leadership responsibility.” Boards and executives “should ensure cyber resilience is in place and works under pressure.” And “it is not enough to have controls” [9].

“Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility.”

Five Eyes Cyber Security Agencies Statement, June 22, 2026 [9]

For anyone placing digital assets with a custodian, this raises the bar. A custodian’s security posture from two years ago may no longer be adequate. A custody agreement that locks in yesterday’s standard may leave the customer carrying tomorrow’s risk.

What should the custody agreement say?

Cybersecurity protection is our primary focus when we review or draft a custody agreement. The terms below apply whether the custodian is in New York, South Dakota, Wyoming, or anywhere else.

• An express duty to safeguard. The agreement should state that the custodian must protect customer assets against foreseeable cyber risks. That includes account takeovers, credential compromise, and insider misuse. It should define the standard of care rather than leave it to inference.
• Insurance that actually covers the loss. We confirm whether the custodian carries insurance against theft and cyber events. We check whether customer assets are within the covered pool. We look for exclusions and sublimits that would defeat recovery.
• Segregation and title. Customer assets should be held in segregated or properly titled omnibus wallets. No set-off or lien should attach beyond ordinary fees [3].
• Sub-custodians. The agreement should name any sub-custodian. It should flow the custodian’s security and segregation duties down to it. Federal regulators note that, subject to the customer agreement, the bank remains responsible for its sub-custodian’s activities [1].
• Access controls and authorization. Withdrawal authorization, multi-party approval, allow-listed addresses, and procedures for changing authorized users should be written down. They should not be left to the custodian’s internal policy.
• Incident response and notice. The agreement should set deadlines for notifying the customer of a security event. It should require preservation of logs and cooperation with law enforcement and insurers.
• Liability limitations. Broad disclaimers for “unauthorized access” or “third-party acts” can swallow the purpose of custody. We negotiate carve-outs for failures of the custodian’s own controls.
• Governing law and forum. The chosen law decides which fiduciary standard applies. The chosen forum decides where a dispute is heard. Both should be selected deliberately, not accepted by default.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.