Crypto Custody at Swiss Banks: Regulated Solutions for Institutional Holdings

On the 11th of November 2022, FTX filed for Chapter 11 bankruptcy protection in Delaware. Within days, it became apparent that the exchange had commingled client assets with proprietary funds, that billions in client deposits had been misappropriated, and that the exchange’s bankruptcy estate would not have sufficient assets to make clients whole. For the institutional crypto market, FTX was the equivalent of a Lehman moment — not merely a market disruption, but a structural crisis that exposed the fundamental custody risk that had been underpriced for years.

The aftermath forced a reckoning. Institutional investors, compliance officers, and regulators alike focussed on a question that had been treated as secondary during the bull market: who holds the keys? In Switzerland, where the regulatory infrastructure for institutional crypto custody had been developing since 2019, the post-FTX environment created both significant demand for regulated custody solutions and an opportunity for Swiss institutions to demonstrate the value of their compliance-first approach.

The Custody Risk That FTX Made Legible

The fundamental problem FTX exposed is structural to exchange-based custody: when an investor deposits crypto assets on a centralised exchange, those assets are typically transferred to the exchange’s own wallet addresses. The investor holds a credit claim against the exchange — an IOU — rather than the underlying crypto asset. If the exchange becomes insolvent, the investor is an unsecured creditor, competing with other claimants for recovery from a potentially insufficient estate.

This is categorically different from the structure of traditional securities custody, where client assets are segregated from proprietary assets under regulatory requirement and are not available to the custodian’s creditors in insolvency. The FTX collapse made clear that the exchange custody model, which had become the default for retail and many institutional participants, embedded a risk that most investors had not adequately priced.

Swiss regulation, and the Swiss DLT Act in particular, had anticipated this issue. Under Switzerland’s DLT Act, crypto assets held in segregated custody accounts by regulated Swiss custodians are treated as client assets — not as assets of the custodian — and are returned to clients in the event of the custodian’s insolvency. This statutory segregation protection is a genuine structural advantage of Swiss-regulated custody over exchange custody.

SEBA Bank: Integrated Banking and Custody

SEBA Bank holds one of only two full Swiss banking licences granted to crypto-native institutions. Its custody offering is the most comprehensive available within a single Swiss banking relationship: qualified custody of digital assets, integrated with banking services including payments, securities dealing, and credit facilities collateralised by crypto holdings.

SEBA’s custody infrastructure employs hardware security modules for key management, with a tiered cold-warm-hot wallet architecture that balances security against accessibility. Cold storage holds the majority of assets in offline, air-gapped environments; warm wallets provide liquidity for trading and settlement activity; hot wallets handle real-time transaction needs for smaller amounts. Multi-signature governance requirements mean that no single individual or system can authorise a unilateral asset transfer.

From a regulatory standpoint, SEBA’s custody operates under its banking licence, with FINMA oversight of custody operations, capital requirements applied against the custodied asset base, and audit obligations that provide clients with independent verification of holdings. Custody clients include institutional asset managers, hedge funds, and family offices that prioritise regulatory standing and bankruptcy remoteness above all other custody selection criteria.

Sygnum Bank: Institutional-Grade Custody with DeFi Exposure

Sygnum Bank, the second FINMA-licensed crypto bank headquartered in Zug, operates an institutional custody platform through its Dbtc service (Digital Banking for Tokenised Crypto). Sygnum’s custody offering is notable for its breadth: in addition to the major crypto assets, Sygnum provides custody for tokenised securities — including tokenised shares and digital bonds — issued on its own tokenisation infrastructure.

This multi-asset custody capability positions Sygnum well for the growing segment of institutional investors seeking a single custodian capable of holding both native crypto assets and tokenised traditional securities within a unified custody framework. As the tokenised asset market deepens in Switzerland — with SDX issuances and FINMA-approved tokenised fund structures — this integrated custody capability becomes increasingly valuable.

Sygnum has also made deliberate moves into DeFi-adjacent custody: providing custody services for assets that interact with DeFi protocols, a technically and legally complex area where most traditional custodians decline to operate. The legal and operational challenges of DeFi custody — including the management of smart contract risk, governance token rights, and yield-generating positions — remain a frontier that even Sygnum navigates with significant caution.

The Broader Swiss Custody Landscape

The two crypto banks represent the apex of the Swiss custody market, but they are not the only participants. A number of Swiss private banks and cantonal banks have entered the crypto custody market through varying approaches.

PostFinance, the banking subsidiary of Swiss Post and one of Switzerland’s largest retail banks by customer count, announced its crypto entry in 2023 through a partnership with Sygnum, offering custody and trading services to its retail client base through a white-label arrangement. This partnership model — incumbent bank using a specialist crypto bank’s infrastructure — has become a common route for established Swiss financial institutions seeking crypto exposure without building custody infrastructure from scratch.

Maerki Baumann, the Basel-based private bank, has been one of the more progressive traditional Swiss private banks in digital asset adoption, offering crypto custody and trading to its private banking clients as a native banking service rather than through a third-party referral. The private bank model — where client relationships are managed personally and investment discretion is high — is well-suited to the bespoke nature of institutional crypto custody requirements.

Cornèr Bank, headquartered in Lugano, similarly offers crypto services to private banking clients, reflecting Ticino’s particular orientation toward crypto businesses given its cultural and economic proximity to Italy, where crypto adoption among high-net-worth individuals has been significant.

Numerous other Swiss private banks offer crypto custody access through structured partnerships with specialist providers — either tech-layer custodians such as Taurus (a Geneva-based custody technology provider that powers the crypto custody infrastructure of multiple Swiss banks) or direct arrangements with major global custodians such as Coinbase Custody or BitGo.

FINMA’s Regulatory Requirements for Crypto Custody

FINMA’s framework for crypto custody operates under the intersection of the Banking Act, the DLT Act, and specific FINMA guidance. The core requirements that a regulated Swiss crypto custodian must satisfy include:

Asset segregation is the foundational requirement: client crypto assets must be held in segregated accounts, clearly distinguished from the custodian’s proprietary holdings. This segregation must be maintained at the technical level — separate wallet addresses, separately governed key management — not merely as an accounting entry.

Qualified intermediary status requires that crypto custodians be either licensed banks or FINMA-registered financial intermediaries with appropriate SRO affiliation. The “qualified intermediary” concept maps onto the traditional securities custody framework and establishes that professional custody of client assets is a regulated activity requiring ongoing supervision.

AML/KYC obligations apply in full: clients must be identified, transactions monitored, suspicious activity reported. For custody clients who are themselves institutions — asset managers, family offices — the custodian must conduct appropriate due diligence on the institution and its underlying beneficial owners.

Operational requirements extend to technical standards for key management, cyber security, business continuity, and independent audit of custody holdings. FINMA expects custody operations to be subject to regular third-party audits confirming that custodied assets match client records and that key management governance operates as documented.

Technical Custody Models

The technical architecture of institutional crypto custody has evolved considerably since the early exchange-custody era. Swiss institutional custodians employ several established models, often in combination.

Hardware Security Modules provide tamper-resistant physical environments for private key storage and transaction signing. HSMs generate keys internally and never expose them in plaintext; transaction signing occurs within the HSM boundary, and the signed transaction is the only output. Leading custodians use HSMs certified to FIPS 140-2 Level 3 or Common Criteria EAL 4+ standards.

Multi-signature governance distributes signing authority across multiple independent keyholders — typically requiring m-of-n signatures (for example, three of five) to authorise any transaction. This eliminates single points of failure and requires coordination among multiple authorised parties for any asset movement. Multi-signature is the baseline operational governance model for institutional custody.

Multi-Party Computation represents a more sophisticated cryptographic approach: the private key never exists as a whole in any single location. Instead, key shares are distributed among multiple parties, and the signing computation is performed jointly without any party ever possessing the complete key. MPC eliminates the attack surface of a reconstructed key while maintaining operational flexibility. Taurus, SEBA, and several global custodians have deployed MPC-based custody infrastructure.

Cold storage — maintaining keys in completely offline, air-gapped environments with no network connectivity — remains the security foundation for the majority of custodied assets. The operational friction of cold storage (transaction signing requires physical processes and time delays) is offset by its superior security against remote attack.

Institutional Demand Drivers

The immediate post-FTX demand for regulated custody has been sustained and deepened by structural developments in institutional crypto adoption. The listing and rapid growth of Bitcoin and Ethereum exchange-traded products on SIX Exchange has been particularly significant: asset managers required to hold underlying assets for physically backed ETPs need regulated custody, and Swiss custodians — SEBA, Sygnum, and the institutions they partner with — have been primary beneficiaries.

Institutional crypto allocations by Swiss family offices and foundations have also matured, moving from exploratory positions managed informally to structured allocations with formal custody arrangements, investment policy statements, and independent audit requirements. This professionalisation of the client base creates sustained demand for custody infrastructure that meets the same standards applied to traditional asset custody.

The DeFi Custody Challenge

The most significant unresolved challenge in institutional crypto custody is the integration of DeFi — decentralised finance protocols that hold assets in smart contracts rather than in wallet addresses directly controlled by private keys.

When an institution deploys assets into a DeFi lending protocol, the assets move from its custody wallet into a smart contract controlled by protocol governance — no single private key controls those assets. The traditional custody model, built around private key management, does not straightforwardly apply. The custodian cannot maintain custody of assets that are, by construction, held by protocol smart contracts.

Swiss custodians have navigated this partly through structured product wrappers — holding DeFi positions through special purpose vehicles or fund structures that can be custodied in the traditional sense — and partly through operational agreements that document protocol positions as client assets even though they are not held in the custodian’s wallets. Neither solution is fully satisfactory from a risk management perspective, and the regulatory treatment of DeFi custody remains an open question that FINMA has not yet addressed definitively.

The Outlook for Swiss Crypto Custody

Switzerland’s crypto custody market is among the most mature in the world. The combination of regulatory clarity under the DLT Act, established institutional providers in SEBA and Sygnum, a growing ecosystem of bank partnerships powered by specialist custody technology, and a deep pool of institutional clients represents a genuine competitive advantage for the Swiss custody market.

The direction of travel is toward greater integration between crypto custody and traditional asset custody: single custodians capable of holding the full institutional portfolio — equities, bonds, alternatives, and digital assets — within a unified regulatory and operational framework. Swiss banks that can achieve this integration, either organically or through technology partnership, will be well positioned to capture the institutional demand that continues to grow as digital assets become a standard allocation in sophisticated portfolios.

Donovan Vanderbilt is a contributing editor at ZUG TRADING, a publication of The Vanderbilt Portfolio AG, Zurich. The information presented is for educational purposes and does not constitute investment advice.