The Most Important Custody Question Is Who Can Approve a Transfer

Crypto custody is becoming more institutional, but the central security question has not changed: who can move the assets?

Two developments put that question in focus. Rain has applied for an Office of the Comptroller of the Currency charter to create a national trust bank that would custody digital assets and dollars while managing stablecoin reserves, issuance and redemptions for institutional clients. Separately, Russia has registered its first crypto exchanges and custodians under a new legal framework, including Sberbank, which reportedly plans to launch crypto products on December 1.

Those are meaningful changes in who may offer crypto services. They do not, by themselves, explain how those services will be secured.

A charter application is not a charter. Registration is not a security architecture. Even an approved custodian still has to solve the unglamorous problems that determine whether client assets remain safe: employee permissions, withdrawal approvals, key backups, account recovery, transaction screening and incident response.

Regulation can establish a perimeter. It cannot approve each transfer correctly.

Custody is really a system of permissions

“Custody” sounds like a single service, but it is better understood as a collection of operational decisions.

A provider must decide how private keys are generated, where signing authority resides and how many approvals are required before assets can leave. It also needs procedures for replacing authorized personnel, responding to compromised credentials and stopping a suspicious withdrawal without freezing legitimate activity indefinitely.

That is why the identity of the custodian tells only part of the story. A bank, trust company or registered platform may operate within a defined legal framework, but users still need to understand its control model.

Consider a simple transfer request. One employee or customer initiates it. Someone—or some automated system—checks whether the destination is permitted. Additional approvers may be required. The transaction is then signed and broadcast.

Security depends on every step. If one compromised account can initiate and approve a withdrawal, the legal status of the provider may matter mainly after the money is gone. If several independent approvals are required, the attacker has a harder job. If destination addresses must be added in advance and confirmed through a separate channel, hurried social engineering becomes less effective.

These controls are not exciting. That is precisely why they matter.

Rain’s application joins custody to the stablecoin lifecycle

Rain’s proposed national trust bank would have a broader role than simply storing tokens, according to CoinDesk’s report. It would custody digital assets and dollars while managing stablecoin reserves, issuance and redemptions for institutional clients.

That combination links asset security to payment operations.

Stablecoin infrastructure has several distinct points of control. There are the digital assets in customer or institutional accounts, the dollars or other reserve assets supporting issuance, and the processes through which tokens are created or redeemed. A weakness in any one layer can become a problem for the others.

For an institutional client, the practical questions therefore extend beyond private-key storage. Who can authorize issuance? What approval is required for redemption? Are reserve movements governed separately from token transfers? Can a compromised administrator change withdrawal details and approve a transaction in the same session?

The supplied report does not answer those questions, and Rain’s application should not be treated as evidence that it has already received the charter. Still, the proposed structure illustrates where custody is heading: closer integration between wallets, reserve management and conventional dollar accounts.

That may reduce reliance on third-party banks. It may also concentrate more functions inside one operating environment. Consolidation can simplify accountability, but it makes permission design more consequential. One set of credentials should not become a master key for every part of the system.

Russia’s registrations create a starting point, not a safety verdict

Russia’s first registrations of crypto exchanges and custodians similarly establish which organizations can begin operating under the new framework. Cointelegraph identified Sberbank among the registered custodians and reported that the bank intends to introduce crypto products on December 1.

For users, the familiar bank name may carry more weight than the underlying product details. That instinct is understandable. Established institutions generally have compliance departments, internal controls and experience handling financial accounts.

Crypto nevertheless introduces different failure modes.

Transactions can be irreversible. Address substitution malware can quietly replace a destination. Phishing pages can capture account credentials or persuade a user to authorize a malicious action. Internal operators may have access that customers cannot see. Recovery procedures can become an attack path when support staff are manipulated.

Registration can create supervision and legal obligations, depending on the framework. It does not prove that a particular wallet has been tested under stress, that customer assets are segregated or that withdrawals require strong independent authorization.

The correct response is not to assume that regulated custody is unsafe. It is to stop using “regulated” as a substitute for the rest of the due diligence.

Retail users face the same problem at a smaller scale

The institutional version involves boards, compliance teams and policy engines. The personal version is simpler, but not necessarily easier.

With self-custody, the person holding the recovery phrase ultimately controls the assets. That removes exposure to a custodian’s withdrawal policies and insolvency risk, but it replaces them with personal responsibility. A lost recovery phrase, malicious signature or compromised backup can be final.

Exchange custody reverses that arrangement. The platform controls the keys, while the customer authenticates through an account. That may offer familiar recovery options, but it introduces dependence on the platform’s security, withdrawal availability and support process.

Neither model eliminates risk. They relocate it.

For money kept with a third party, users should enable the strongest available authentication, use a unique password and confirm important account alerts through the provider’s official application or website rather than an emailed link. Withdrawal allowlists and delays can help when offered, particularly if changing an approved address triggers a waiting period.

For self-custody, the priority is protecting the recovery material and verifying what the wallet is asking the user to sign. A hardware device can isolate keys from an internet-connected computer, but it cannot identify every malicious contract or prevent someone from voluntarily approving the wrong transaction.

Large transfers deserve a test transaction. Addresses should be checked on the signing device, not only on a computer screen. Recovery phrases should never be entered into unsolicited websites, support chats or forms promising account verification. Real support staff do not need the words that control the wallet.

Ask about controls before comparing brand names

Institutional clients evaluating a custodian should request specifics rather than settle for general assurances. The useful questions are concrete:

- How many people or systems must authorize a withdrawal? - Can one administrator change permissions and move funds? - Are transaction limits different for routine and exceptional transfers? - How are new destination addresses approved? - What happens when an employee leaves or a credential is compromised? - Are customer assets separated operationally and legally from the provider’s own assets? - How quickly can withdrawals be paused, and who can restart them? - What records will clients receive after an incident?

Retail customers will not always receive detailed answers. The absence of public detail is itself worth noticing, especially when a service is promoted primarily through regulatory status or institutional branding.

A provider does not need to reveal information that would help attackers. It should, however, be able to explain its security model at a level that lets customers understand where authority sits and how abuse is constrained.

The takeaway

Rain’s OCC application and Russia’s first crypto registrations show financial institutions moving further into custody and stablecoin operations. That could give businesses more regulated counterparties and more direct access to digital-asset services.

It does not make custody automatic or boring.

Before trusting a bank, exchange or specialized custodian, find out who can authorize a transfer, what prevents one compromised account from completing it and what happens when the controls fail. Self-custody demands the same discipline in a different form: secure the recovery path, verify every destination and treat signatures as financial instructions rather than routine clicks.

The logo on the account matters. The permission system behind it matters more.

Readers weighing personal custody against exchange exposure can review Fueled Crypto’s guide to cold-storage wallets before choosing a setup.