Bank-controlled bitcoin custody means one thing in practice: no movement of customer assets can happen without the bank taking part in it. The provider may run the platform, operate the nodes and maintain the software. The bank holds a key that every withdrawal needs, and the bank's officers hold the controls that stop one.
That is a higher bar than most custody arrangements meet, and it is the one the federal banking agencies described in their 2025 joint statement on crypto-asset safekeeping. This article explains the three questions that separate custody models, what the agencies said about each, and what a board should ask for in writing.
Three questions that separate custody models
1. Where the keys live
If a private key has ever existed as a file, it can be copied. Keys should be generated inside a hardware security module, marked non-exportable, and used only there. We specify FIPS 140-3 Level 3 validated hardware. If the hardware is unavailable, the right behavior is to refuse to sign, not to fall back to software.
The agencies make a related point. A bank that simply takes possession of keys a customer already held may not have control of the assets, because copies may exist elsewhere.
2. Who has to agree before funds move
Single-key custody means trusting the custodian completely. Multi-signature with a threshold, for example two of three keys, changes the question from whether the bank trusts the provider to whether anyone can act alone. When one of those keys is in the bank's own hardware, nobody can, and the rule is enforced by the Bitcoin network itself instead of a policy document.
3. Whether the bank can stop a transaction and see why
Examiners will ask for the stop button and the log. The stop button should be limited to authorized roles and act at several points of the flow, so a transaction cannot slip past a single checkpoint. The log should be append-only and attribute every action to a person and a role.
What the regulators mean by control
The joint statement gives a working definition. A bank has control of a crypto-asset when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of the bank's control. The same standard applies to any sub-custodian the bank uses.
Two details in the statement deserve a director's attention.
- Responsibility stays with the bank. Subject to the customer agreement, a bank is responsible for the activities its sub-custodian performs. Outsourcing the work does not move the liability.
- The risk the agencies name first is key loss. A compromised or lost key can mean lost assets, and the statement notes that the bank faces the risk of being held liable for its customers' losses.
A model in which the bank must sign every withdrawal satisfies the definition by construction. A model in which a provider holds all the keys asks the bank to prove control through contracts and audits of someone else's systems. The first is easier to explain to an examiner, and easier for a director to understand without a technical background.
The freeze switch should have a timer
Automation is useful for spotting anomalies. It is dangerous when it can lock a customer out indefinitely. The right pattern is a ladder: annotate, verify, hold for a fixed time, and only then block, with the block requiring a person at the bank and an independent key. A hold nobody confirms should expire on its own.
"AI proposes. The bank disposes."
The same principle applies to manual controls. A freeze or an emergency stop should be recorded with the name of the officer who triggered it, the reason, and the time it was lifted.
Segregation is not optional
The joint statement asks banks to weigh account models. Omnibus accounts may be more efficient, but they create larger targets for theft. Separate accounts need more keys and more management.
We hold that separation is worth the effort. Per-client wallets with per-client keys keep each customer's holdings cryptographically apart, make attribution simple for auditors, and remove the single key whose loss would affect everyone. The statement is also clear on one point that is not a matter of preference: a sub-custodian commingling its own assets with those held for the bank is inconsistent with appropriate risk management.
What a board should require in writing
- Keys generated and held only in validated hardware, with no software fallback
- A signing key held by the bank in its own hardware, with the threshold enforced on-chain
- Verification by the bank of the exact transaction before it signs
- Emergency stop and wallet freeze operated by bank officers and limited by role
- The compliance sequence (identity, sanctions screening, monitoring, suspicious activity reporting) inside the transaction flow
- An append-only audit log and analytics the bank's internal audit can query
- A documented key ceremony and a recovery process under dual control
- Notice of any suspected key compromise or irreversible transaction error
This is the model LedgerBridge Bitcoin Custody implements, and our security and compliance overview describes each control. For a structured way to compare providers, use the vendor due diligence questions. Banks earlier in the decision can start with the decision guide for community banks.
To see the controls from the operator's chair, request a demo.
Frequently asked questions
What is bank-controlled custody?
A custody arrangement in which the bank is a required signer for every movement of customer assets and operates the stop and freeze controls itself. A technology provider may run the platform, but it cannot move funds alone. The bank's key lives in the bank's own hardware security module.
Why use multi-signature instead of a single key?
A single key gives whoever holds it complete authority and creates one point of failure. With a threshold such as two of three, no single party can move funds, and the loss of one key does not mean the loss of the assets. On Bitcoin the threshold is enforced by the network, so it cannot be bypassed by changing a setting.
What do regulators expect from a bank offering crypto custody?
The agencies' July 2025 joint statement applies existing risk management principles and creates no new expectations. It emphasizes control of cryptographic keys, a plan for lost or compromised keys, cybersecurity, Bank Secrecy Act and sanctions compliance, third-party risk management for any sub-custodian, and an audit program that covers key generation, storage and deletion.
Can the bank recover assets if the provider is unavailable?
It should be able to, and the board should ask how. In a two of three design, the bank's key together with a recovery key held under dual control is enough to move assets without the provider. The recovery process should be documented, tested and included in the bank's business continuity plan.
This article is general information, not legal advice. Consult your counsel and your primary regulator before offering custody services.