Qualified Custodian vs MPC vs Self-Custody: Crypto Custody Models Explained

Last updated: 1 November 2026 · Custody rule text, SEC and OCC guidance, vendor custody pages and plan prices rechecked on the original sources on 1 November 2026

The three crypto custody models are a qualified custodian, an MPC wallet platform and self-custody multisig, and they differ on one question: who can sign a transfer. A qualified custodian such as BitGo, Coinbase Custody or Anchorage Digital holds the keys under a bank or trust charter. An MPC platform such as Fireblocks or Utila splits signing into key shares, and a multisig such as Safe enforces an M-of-N quorum onchain.

Most institutions pick a legal model first and a technology second, then mix models by pool of assets. This guide compares the three models on control, regulation, failure math and year-one cost, and it sits in our digital asset custody hub. For named providers ranked side by side, see our institutional crypto custody guide; our scoring rules are on the methodology page.

The Decision Kernel

Answer three questions in order: does a rule require a third party to hold the assets, who should be able to approve a transfer, and how often do the funds move. If a rule names a qualified custodian, the decision is made before any technology debate starts.

• Use a qualified custodian if you are a registered adviser, a fund or a company whose board or auditor requires assets with a chartered bank or trust company.
• Use an MPC wallet platform if your team moves funds daily across many chains and wants policy rules, approval quorums and API access.
• Use self-custody multisig if your treasury sits on EVM chains and signers should approve every transfer onchain, where anyone can verify the quorum.
• Use a hybrid if reserves need a custodian and operating funds need speed, which is the most common pattern for larger treasuries.

The Three Custody Models at a Glance

Model	Who signs	Legal position	Example providers	Published entry price
Qualified custodian	The custodian, under your instructions	Chartered bank, trust company or other entity named in the custody rule	BitGo, Coinbase Custody Trust Company, Anchorage Digital	Quote only
MPC wallet platform	Key shares held by you, the vendor or both, under a policy engine	Self-custody unless the vendor’s chartered entity signs the contract	Fireblocks, Utila	$799 a month (Utila Starter), $999 a month (Fireblocks Essentials)
Self-custody multisig	Your own signers, M of N, enforced onchain	Self-custody	Safe	€189 a month excl. VAT (Safe Pro Starter)
Hybrid	Custodian for reserves, your signers for operating wallets	Split by pool of assets	BitGo custody plus self-custody wallets, Anchorage Digital custody plus self-custody	Mix of the above

The map shows why the models get confused. MPC shows Varies in two columns because the same software can be self-custody or custody, depending on who holds the shares and who signs the contract. A multisig is the only model where the approval rule itself is visible onchain.

Qualified Custodian

A qualified custodian holds client assets for you under a charter. The SEC custody rule, Rule 206(4)-2, lists four types: a bank or savings association, a registered broker-dealer holding assets in customer accounts, a registered futures commission merchant, and a foreign financial institution that keeps client assets segregated. The custodian signs transfers on your instruction, so your controls live in its approval workflow and contract.

• BitGo: BitGo Bank & Trust, National Association is an OCC chartered national trust bank; its custody page lists multi-sig and MPC key management, 100% cold storage and $250M of insurance.
• Coinbase: Coinbase Custody Trust Company is a fiduciary under New York banking law and a qualified custodian, with SOC 1 Type II and SOC 2 Type II audits by Deloitte & Touche and 470+ assets, per its custody page.
• Anchorage Digital: describes itself as the first federally chartered crypto bank and offers qualified custody plus self-custody, per its home page.
• Insurance scope: BitGo’s insurance page says the $250M policy covers assets where BitGo Bank & Trust maintains all of the keys, underwritten by a Lloyd’s of London and European syndicate.
• Trade-offs: fees are quoted in basis points, withdrawals run through the custodian’s process, and you take counterparty risk on the chartered entity.

MPC Wallet Platform

An MPC wallet platform splits a private key into shares that sign together, so no single device ever holds the whole key. Fireblocks says its security design distributes key shares across environments and enforces approval and signing quorums through a policy engine. On chain an MPC signature looks like any single-key transaction, so the quorum lives in the vendor policy engine, where outside observers cannot audit it.

• Fireblocks: Essentials costs $999 a month for up to 6 months with $1,000,000 of outbound volume a quarter and a 0.20% overage; Custom plans start at $36,000 a year, per its pricing page.
• Utila: Starter costs $799 a month billed quarterly, with up to $3M of outbound volume a quarter, 1,000 active wallets and 3 users, per its pricing page.
• Recovery: Fireblocks lists disaster recovery through CoinCover as an add-on, so ask every MPC vendor who holds the backup share.
• Trade-offs: share placement is a contract question, the policy engine is a vendor system, and the legal custody model stays with you unless a chartered entity signs.

Self-Custody Multisig

A multisig wallet holds funds in a smart contract that executes only when M of N named signers approve. Safe says its Safe{Wallet} accounts have handled $1T+ of transaction volume and hold $60B+ of assets across 60M+ accounts. Every signer, threshold and approval is recorded onchain, which makes multisig the easiest model for an outside auditor to verify.

• Signers: Safe lets required signers approve from web, mobile, a hardware wallet or an MPC wallet, and the transaction executes once the threshold is met.
• Pricing: the Safe{Wallet} app is the base layer; Safe Pro adds team workspaces from €189 a month excl. VAT for 2 Safe accounts, and Business from €669 a month, per its pricing page.
• Recovery: no vendor holds a key, so losing more than N minus M signers locks the funds for good.
• Trade-offs: each chain needs its own contract deployment, onchain approvals cost gas, and the model fits EVM chains best.

Hybrid Custody: Custodian Plus Operating Wallets

Most larger treasuries run more than one model: reserves with a custodian and a working balance in wallets the team controls. BitGo’s self-custody page shows the split clearly, with hot wallets where you hold the user key and backup key while BitGo holds a platform key and countersigns only within your policies. In a hybrid, the line between pools matters more than either vendor, because each pool has a different legal owner of the signing process.

• Cold reserves: qualified custody for the bulk of assets, where the custodian’s insurance and charter apply.
• Operating float: MPC or multisig wallets for payouts, trading and gas, sized to a few days or weeks of outflows.
• Transfers between pools: write down who can approve a move from reserves to the float, and set a limit per day.
• Treasury layer: our crypto treasury management platforms guide covers the payout and accounting tools that sit on top.

What the Custody Rules Require in 2026

The US rules changed several times in 2025, and the changes all point the same way: chartered custody got easier to use. On 30 September 2025, SEC staff said it would not recommend enforcement when advisers and regulated funds treat a qualifying state trust company as a bank for crypto custody. The no-action letter carries conditions an adviser has to meet every year.

Date	Source	What changed
30 January 2025	SAB 122	Rescinded SAB 121; firms holding crypto for others now judge any loss liability under ASC 450-20 or IAS 37
7 May 2025	OCC Interpretive Letter 1184	National banks may buy and sell custodied crypto at the customer’s direction and outsource custody to sub-custodians
12 June 2025	SEC withdrawal notice	SEC withdrew the 2023 Safeguarding Advisory Client Assets proposal; any new rule needs a new proposal
30 September 2025	SEC staff no-action letter	State trust companies can be treated as banks for adviser and fund crypto custody, with conditions

• Before hiring and every year, the adviser needs a reasonable basis to believe the trust company is authorised by its state banking authority and has written policies on private key management and cybersecurity.
• The adviser reviews audited GAAP financial statements and a SOC 1 or SOC 2 internal control report from the current or prior year.
• The custody agreement bars lending, pledging or rehypothecating assets without prior written consent, and keeps client assets segregated from the trust company’s own.
• The adviser discloses material risks to clients and decides the arrangement is in their best interest.

None of this applies to a company holding its own treasury, which can self-custody unless its board, auditor or lender says otherwise. The rule text also requires, with exceptions, an unannounced yearly examination by an independent public accountant for assets an adviser has custody of.

Key Failure Math for Multisig and MPC

Any M-of-N threshold, multisig or MPC, trades loss tolerance against theft resistance. You can lose N minus M keys and still move funds, and an attacker needs M keys to steal them. Raising M makes theft harder and raising N minus M makes loss harder, so 3-of-5 beats 2-of-3 on both only if you can run five independent signers.

Threshold	Keys you can lose	Keys an attacker needs	Lost odds (example)	Stolen odds (example)
1-of-1	0	1	2%	1%
2-of-3	1	2	0.1184%	0.0298%
3-of-5	2	3	0.0078%	0.0010%

The odds come from a binomial count, which you can rerun with your own inputs. Keys kept in one office or with one vendor fail together, so real odds sit closer to the 1-of-1 row than the table suggests. Spread signers across people, devices and locations, and test recovery with threshold = M signers before funding the wallet.

from math import comb

# Funds are lost if more than N-M keys are lost; stolen if an attacker gets M keys.
def p_lost(m, n, p):
    return sum(comb(n, k) * p**k * (1-p)**(n-k) for k in range(n-m+1, n+1))

def p_stolen(m, n, q):
    return sum(comb(n, k) * q**k * (1-q)**(n-k) for k in range(m, n+1))

for m, n in [(1, 1), (2, 3), (3, 5)]:
    print(m, n, round(100*p_lost(m, n, 0.02), 4), round(100*p_stolen(m, n, 0.01), 4))
# 1 1 2.0 1.0
# 2 3 0.1184 0.0298
# 3 5 0.0078 0.001

What Each Model Costs in Year One

Custodians price in basis points on assets held and quote privately, while MPC and multisig tools publish flat plans. At an example 10 bps custody fee, custody costs more than Utila Starter once you hold about $9.6M, and more than a Fireblocks first year at about $24M. The basis point rates below are examples to compare against a real quote.

Model and plan	Year-one list cost	What sets the bill
Self-custody multisig, Safe Pro Starter	€2,268 excl. VAT	Flat; 2 Safe accounts, plus gas
MPC, Utila Starter	$9,588	Flat; up to $3M outbound a quarter
MPC, Fireblocks Essentials then Custom floor	$23,994	6 months at $999, then half of the $36,000 Custom floor, up to $1M outbound a quarter
Qualified custodian, example 10 bps on $10M	$10,000	Assets held; quote only
Qualified custodian, example 25 bps on $10M	$25,000	Assets held; quote only

Break-even assets equal the platform cost divided by the fee rate, so $9,588 divided by 0.0010 gives $9.588M. At 25 bps the Utila break-even drops to $3.84M and at 50 bps to $1.92M. These are list prices only; a custodian also covers insurance and a charter that an MPC plan does not.

Which Custody Model Fits Your Organisation

Match the model to who you answer to, then check it against how often the money moves. Advisers answer to the custody rule, companies answer to their auditor and board, and protocols answer to token holders who want to see the quorum. A company with no adviser registration has the widest choice, so its auditor and board usually decide.

Organisation	Main model	Second model	Reason
Registered adviser or fund	Qualified custodian	None for client assets	Rule 206(4)-2 and the 2025 state trust company letter
Corporate treasury	Qualified custodian or MPC	MPC float	Board and auditor comfort for reserves, speed for payments
Payments company or fintech	MPC wallet platform	Custodian for reserves	Daily outflows, many chains, API driven
DAO or protocol treasury	Self-custody multisig	MPC for operations	Onchain quorum that token holders can verify
Exchange or broker	Mix of all three	Custodian for cold reserves	Hot, warm and cold tiers with different signers

Larger buyers that already lean toward a custodian can use our Fireblocks vs BitGo vs Anchorage comparison and our BitGo alternatives guide to build a shortlist.

Due Diligence Questions by Model

Send the same written questions to every finalist and compare the answers side by side. Each item maps to a risk in the tables above, so any gap in a vendor’s public pages turns into a direct question for the sales call.

1. Custodian: which chartered entity signs the custody agreement, and who regulates it?
2. Custodian: does the insurance policy cover the wallets you will use, or only wallets where the custodian holds all keys?
3. MPC: who holds each key share and the backup share, and can you sign without the vendor if it disappears?
4. MPC: can you export the policy rules and an approval log for your auditor?
5. Multisig: are signers spread across people, devices and locations, and has the team tested recovery?
6. All models: ask for the latest SOC 1 or SOC 2 report and confirm the period covers the last 12 months.
7. All models: compare answers with the provider data in our Fireblocks alternatives guide.

Final Verdict

No model is safest for every pool of money, so the right answer is a fit for each pool. Pick the legal model the rules or your board require, then pick the key technology, then size each pool by how often it moves and how much you could afford to lose from it.

1. Qualified custodian: regulated money, reserves and anything an auditor wants with a chartered entity.
2. MPC wallet platform: daily operations across many chains with policy rules and API access.
3. Self-custody multisig: EVM treasuries where an onchain, verifiable quorum matters most.
4. Hybrid: reserves with a custodian and a small operating float in MPC or multisig.

Frequently Asked Questions