How Virtual Asset Service Providers safeguard assets and what every investor should ask before trusting one.
Imagine waking up to find your exchange has frozen withdrawals. Your balance still shows on the screen. The coins behind it are gone. It sounds dramatic. It has happened more than once in crypto’s short history. The lesson is simple and painful: owning crypto means little if you cannot prove who controls the keys.
That is where the Virtual Asset Service Provider or VASP enters the story.. At the heart of every VASP sits one critical function: custody.
ChatGPT Generated Image
What Exactly Is a VASP?
The term comes from the Financial Action Task Force, the standard-setter for anti-money-laundering rules. A VASP is any business that on behalf of others does one or more of the following:
Exchanges between crypto and fiat currencyExchanges between one or more forms of cryptoTransfers of virtual assetsSafekeeping or administration of virtual assetsFinancial services tied to token offerings
Custody is the one on that list yet it carries the most weight. A custodian does not just move coins. It holds the keys that make those coins spendable.
Why Custody Is the Part
Banks guard money behind vaults, insurance and decades of regulation. Crypto has none of that by default. A private key is a string of characters and whoever has it controls the assets. There is no password reset and no chargeback.
So a VASP offering custody faces three threats:
External hacks: attackers target hot wallets connected to the internet.Insider risk: a single employee with access can become a single point of failure.Operational mistakes: lost keys, poor backups or sent-to-wrong-address errors are permanent.
How Professional Custody Actually Works
Serious VASPs do not rely on one trick. They layer defenses, like a bank vault with several locks.
Storage: the majority of assets sit offline in hardware devices away from internet-connected attackers.Hot wallets with limits: only a small float stays online to serve withdrawals.Multi-signature or MPC: no single person or device can approve a transactionSegregation of client assets: customer funds are kept separate from the company’s money.Regular audits and proof of reserves: independent checks confirm that assets truly exist.
Think of multi-signature like a deposit box needing three keys held by three different people. Stealing one key achieves nothing.
The Regulatory Side: Rules Are Catching Up
Regulators worldwide treat custody as a licensed activity. While details differ by country common expectations are emerging:
Licensing or registration with the financial authority.KYC and AML controls to verify customers and monitor activity.The FATF Travel Rule, requiring sender and receiver information to accompany transfers.Clear disclosure of how assets are held, who controls keys and what happens in insolvency.Governance and risk management, including incident response and business continuity plans.
Frameworks such as the EU’s MiCA regulation and licensing regimes in Singapore, Dubai and Hong Kong have raised the bar. In India VASPs must register with the Financial Intelligence Unit. Follow AML obligations and the broader regulatory picture continues to evolve.
Custodial vs. Non-Custodial: A Quick Comparison
Custodial (VASP holds keys): recovery, customer support and compliance but you trust a third party.Non-custodial (you hold keys): control and no counterparty risk but you carry all responsibility.
Neither is universally better. A long-term holder with a portfolio might split assets across both while a business handling client money often needs a regulated custodian.
A Lesson From the Wreckage
When several major platforms collapsed in years a pattern surfaced. Customer assets had been mixed with company funds internal records were weak. Nobody outside the firm could verify balances. Users learned that an account balance is merely a promise, not proof.
Those failures shaped today’s rules. Segregation, audits and transparency are no longer extras. They are the price of entry for any VASP that wants to be trusted.
A Tale of Two Investors
Consider Asha and Rohan who each bought the amount of crypto in the same week. Asha chose a VASP that published reserve reports used multi-signature cold storage and kept customer funds segregated. Rohan chased a platform promising returns with no license no audit and vague answers about where coins were stored.
Months later both platforms faced a security incident. Asha’s provider froze withdrawals briefly investigated and restored access because most assets were safely offline. Rohan’s platform went silent. His balance still displayed on the app. The funds were gone.
Same market, same timing, different outcomes. The difference was not luck. It was custody.
Your Due-Diligence Checklist
Before parking your assets with any VASP ask these questions:
Is the provider licensed or registered in a jurisdiction?What percentage of assets is held in storage?Does it use multi-signature or MPC wallets?Are client assets legally segregated from company funds?Does it publish audits or proof of reserves?Is there insurance and what does it cover?What is the withdrawal and incident-response policy?
If a provider cannot answer these clearly treat that silence as your answer.
What the Future Holds
Custody is evolving quickly. Institutional demand has pushed banks and asset managers into the space bringing stricter standards with them. Expect to see:
tokenization real-world assets, such as bonds and property needing the same safekeeping.Smarter key management, using hardware security modules and advanced MPC.Real-time transparency with on-chain proof of reserves replacing reports.Global rule alignment, reducing gaps between jurisdictions.
The Bottom Line
Crypto promises freedom but freedom without security is fragile. VASP custody sits at the intersection of technology, regulation and trust. When done well it lets people use assets without becoming experts in key management. When done poorly it turns a balance into an illusion.
So before you ask what a platform can earn you ask what it can protect. Verify licenses, demand transparency understand where your keys live and never put everything in one place. The old crypto saying still holds: not your keys, not your coins. A trustworthy VASP simply earns the right to hold them for you.
Who Holds Your Keys? Inside VASP Crypto Asset Custody was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.