The Institutional Self-Custody Shift: Why Wall Street Is Building Bitcoin Custody In-House

For years, institutional Bitcoin custody meant one thing: outsource it to Coinbase. As of early 2026, Coinbase Custody holds roughly 84% of all U.S. spot Bitcoin ETF assets, approximately $77 billion out of $91.7 billion in total ETF holdings. That concentration is now prompting the largest financial institutions in the world to build their own custody infrastructure from scratch.

The shift is not hypothetical. Morgan Stanley has filed for an OCC national trust bank charter. Fidelity Digital Assets already has one. BNY Mellon, State Street, Deutsche Bank, and Citigroup are all launching or preparing proprietary digital asset custody platforms. The era of outsourcing self-custody to a single counterparty is ending, and the implications run deep for Bitcoin's market structure, custody economics, and decentralization thesis.

Why the Shift Is Happening Now

Three regulatory and market catalysts converged in 2025 to make institutional self-custody not just possible but strategically urgent.

SAB 121 Rescission

On January 23, 2025, the SEC rescinded Staff Accounting Bulletin 121 and replaced it with SAB 122. SAB 121, in effect since March 2022, had required banks to record custodied crypto assets as both an asset and a liability on their own balance sheets, subjecting them to strict capital and liquidity requirements. The practical effect was to make bank-held crypto custody prohibitively expensive. Its removal was the single largest regulatory unlock for institutional custody.

Under SAB 122, institutions can now assess crypto custody risks using standard FASB contingency frameworks rather than the punitive balance-sheet treatment that SAB 121 imposed. For large banks, this difference amounts to billions of dollars in freed capital.

OCC Opens the Door

The Office of the Comptroller of the Currency issued two critical interpretive letters in 2025. IL 1183 (March 2025) confirmed that national banks can offer crypto custody, stablecoin services, and verification network participation without prior OCC approval. IL 1184 (May 2025) extended this to allow banks to buy and sell custodied crypto assets and outsource execution, subject to third-party risk controls.

Then, in December 2025, the OCC conditionally approved five national trust bank charters for digital asset firms: de novo charters for Circle and Ripple, plus charter conversions for Paxos, BitGo, and Fidelity Digital Assets. Three more followed in February 2026, including Morgan Stanley Digital Trust. The message was clear: the federal government was not just permitting bank crypto custody but actively chartering it.

The Coinbase Concentration Risk

The most visceral catalyst is the Coinbase custody concentration itself. Analysts have described it as a “choke point” in an industry that traditionally values decentralization. If Coinbase experienced an operational failure, regulatory action, or security breach, the fallout would simultaneously affect the majority of U.S. Bitcoin ETF products. BlackRock's iShares Bitcoin Trust (IBIT) took the first step toward diversification in April 2025 by adding Anchorage Digital Bank as a second custodian. Other issuers, including 21Shares, have since onboarded both Anchorage and BitGo alongside their existing Coinbase relationships.

Concentration in numbers: Coinbase Custody manages approximately $300 billion in total assets under custody across all clients. For spot Bitcoin ETFs alone, its 84% market share means that a single entity's operational security underpins the vast majority of regulated Bitcoin exposure in the United States.

Who Is Building What

The institutions building proprietary custody fall into two categories: asset managers that want vertical integration, and custodian banks that see digital assets as a natural extension of their existing business.

Fidelity Digital Assets

Fidelity has been the most consistent institutional builder in crypto custody. Fidelity Digital Assets launched its custody platform years before the 2024 ETF wave, giving the firm a substantial head start. In December 2025, it received an OCC national trust bank charter as Fidelity Digital Assets, National Association, making it a federally regulated custodian. In 2026, Fidelity expanded further by launching FIDD (Fidelity Digital Dollar), its own stablecoin. With $17.5 trillion in total assets under administration, Fidelity has the scale to justify a fully proprietary custody stack.

Morgan Stanley

Morgan Stanley represents the most aggressive vertical integration play on Wall Street. In February 2026, the bank filed with the OCC for a National Trust Bank Charter (Morgan Stanley Digital Trust, National Association) to custody digital assets, offer staking, and process crypto trades. In April 2026, it launched MSBT, the first spot Bitcoin ETF issued directly by a major U.S. bank, with a 0.14% expense ratio. MSBT currently uses BNY Mellon and Coinbase for custody, but the OCC charter application signals intent to bring custody in-house over time.

The strategic logic is clear: Morgan Stanley wants to own the entire value chain, including the allocation decision, the trading relationship, and the custody infrastructure. As one industry analysis noted, BlackRock built the largest Bitcoin fund by serving the allocation decision, while Morgan Stanley is building the infrastructure to own every layer of the stack.

Custodian Banks

Traditional custodian banks are extending their core business into digital assets:

• BNY Mellon launched its digital asset custody platform in early 2026, integrating wallet management, custody, and cash capabilities across public and private blockchains. It subsequently added USDC as the first stablecoin supported on the platform.
• State Street launched its own digital asset platform in early 2026, partnering with Swiss firm Taurus for tokenization and cold storage infrastructure.
• Deutsche Bank is targeting a 2026 launch, working with Bitpanda Technology Solutions and Taurus SA (in which Deutsche Bank participated in a $65 million funding round).
• Citigroup plans to launch crypto custody services in 2026 after two to three years of internal development, exploring both proprietary technology and potential third-party partnerships.
• Standard Chartered secured a MiCA regulatory license for institutional-grade Bitcoin and Ethereum custody in Europe.

The Technical Stack Behind Institutional Custody

Building institutional-grade Bitcoin custody requires a fundamentally different approach than consumer wallet security. The stack involves specialized hardware, multi-party cryptography, and operational procedures that can withstand both sophisticated attacks and regulatory audits.

Hardware Security Modules

At the foundation of every institutional custody solution sits a Hardware Security Module (HSM): a tamper-resistant device that generates, stores, and manages cryptographic keys in a physically secured environment. Unlike consumer hardware wallets, institutional HSMs are FIPS 140-2 Level 3 (or higher) certified, rack-mounted, and designed for data center deployment.

The dominant HSM vendors for crypto custody are Thales (nShield and payShield product lines), Utimaco (focused on government and defense certifications), and Securosys (Primus HSMs offering up to 30GB of secure key storage with native support for multi-party computation). IBM also competes in the space, primarily through its existing enterprise relationships.

MPC vs. Multisig

Institutions choosing between MPC and multisig face a fundamental tradeoff. Multisig uses Bitcoin's native scripting to require multiple independent keys for signing, providing on-chain verifiability but exposing the signing policy in the transaction itself. MPC distributes key shares across multiple parties and reconstructs a single signature at signing time, offering privacy and chain-agnostic flexibility but requiring trust in the MPC protocol implementation.

Most new institutional builds are choosing MPC or a hybrid approach. Fireblocks popularized MPC-based custody for its operational flexibility: key shares can be distributed across geographies, rotated without on-chain transactions, and integrated with policy engines. For Bitcoin specifically, MuSig2 and FROST threshold signatures offer Schnorr-based alternatives that produce standard single-signature outputs on chain, revealing nothing about the signing arrangement.

Air-Gapped Signing and Key Ceremonies

For the highest-security tier, air-gapped signing removes the signing device from any network entirely. Transactions are constructed on an online machine, transferred to the air-gapped signer via QR code or PSBT on a secure medium, signed offline, and returned. This eliminates remote attack vectors at the cost of operational speed.

Key ceremonies for institutional custody involve multiple authorized personnel, often across different jurisdictions, following a scripted protocol to generate and distribute key material. The process typically requires physical presence, dual control (no single person can complete any critical step), and independent auditors to verify compliance. These ceremonies can take days to complete and cost hundreds of thousands of dollars.

Defense in depth: Institutional custody stacks typically combine multiple security layers: HSM-protected key generation, MPC or threshold signing for operational transactions, air-gapped cold storage for the majority of holdings, geographic distribution of key shares, and policy engines that enforce withdrawal limits, whitelists, and multi-approval workflows.

The Cost Equation

Third-party custody fees provide the economic baseline for the build vs. buy decision. Coinbase Custody charges a $10,000 setup fee plus an annual custody fee of approximately 0.50% of assets under custody. BitGo charges 5 basis points per month on assets above $100,000. The broader market range sits between 5 and 50 basis points annually, depending on volume, service level, and the provider.

For an institution custodying $10 billion in digital assets, even 10 basis points annually translates to $10 million per year in custody fees alone, before trading, settlement, or reporting costs. At $50 billion, the number becomes $50 million. The engineering cost of building a proprietary custody stack is significant (HSM procurement, security audits, compliance infrastructure, key ceremony procedures, ongoing operations), but at institutional scale, the payback period can be as short as two to three years.

The Regulatory Landscape

The regulatory framework for institutional custody has shifted dramatically in 18 months. Beyond SAB 121's rescission and the OCC charter approvals, several other developments are reshaping the landscape.

SEC Custody Rule Clarity

In December 2025, the SEC Division of Trading and Markets issued guidance clarifying how broker-dealers can achieve “physical possession” of digital asset securities under Rule 15c3-3 (the Customer Protection Rule). The guidance requires broker-dealers to maintain access to the digital asset, the ability to transfer it on the relevant blockchain, and policies consistent with industry best practices for private key protection. This gave broker-dealers a concrete compliance path for direct custody.

The GENIUS Act

The GENIUS Act, passed in July 2025, requires stablecoin issuers to back tokens 1:1 with cash or short-term Treasurys and disclose reserves monthly. Critically, custody of stablecoin reserves may only be provided by federally supervised institutions or qualified state-regulated banks. This effectively creates a regulated custody mandate for a growing category of digital assets, further incentivizing banks to build custody infrastructure. The FDIC proposed implementation rules in April 2026, with final standards expected later in the year.

Basel Committee Standards

The Basel Committee's framework for crypto asset exposures, finalized in 2024, classifies tokenized traditional assets and stablecoins with effective stabilization mechanisms (Group 1) separately from unbacked crypto assets like Bitcoin (Group 2). Group 2 assets carry a 1,250% risk weight, making direct bank holdings of Bitcoin extremely capital-intensive. However, custody services where the bank does not take ownership of the asset receive more favorable treatment, creating a regulatory incentive for banks to offer custody without taking principal positions.

What This Means for Third-Party Custodians

The institutional self-custody shift does not spell the end of third-party custody providers, but it does reshape their addressable market. Coinbase Custody, Fireblocks, BitGo, and Anchorage built their businesses serving clients who lacked the regulatory standing or technical capability to custody digital assets themselves. As banks and asset managers build proprietary solutions, these providers face a strategic pivot.

Several adaptation paths are emerging:

• Technology licensing: selling custody infrastructure as white-label software rather than offering it as a managed service. Fireblocks already positions its MPC platform this way.
• Sub-custody and execution: serving as execution and settlement partners to bank-operated custody platforms, similar to how prime brokers operate in traditional finance.
• Obtaining bank charters themselves: BitGo and Coinbase both received OCC conditional approvals in late 2025 and early 2026, positioning them to compete as regulated banks rather than technology vendors.
• Specialization in long-tail assets: focusing on custody for the thousands of tokens, NFTs, and protocol-specific assets that banks are unlikely to support natively.

The global crypto custody market was valued at approximately $1.4 billion in 2025 and is projected to grow to $1.8 billion in 2026. The market itself is expanding, but the share captured by purpose-built crypto custodians versus traditional financial institutions is shifting.

Implications for Bitcoin Decentralization

The institutional custody shift has a complex relationship with Bitcoin's decentralization thesis. On one hand, distributing custody across dozens of independent bank-operated platforms reduces the systemic risk of Coinbase's current dominance. On the other hand, it concentrates Bitcoin holdings within regulated financial institutions that are subject to government oversight, sanctions compliance, and potential seizure orders.

The tension is structural. Institutional capital flows into Bitcoin through regulated vehicles that require regulated custody. Those custody solutions must comply with KYC/AML requirements, OFAC sanctions screening, and the travel rule. The more Bitcoin sits in institutional custody, the more it resembles the traditional financial system's custody model, where a relatively small number of custodian banks hold the majority of assets on behalf of beneficial owners.

This is precisely why self-custodial alternatives matter. Protocols that enable individuals and institutions to maintain direct control of their keys while still participating in the broader financial system represent a meaningful counterbalance to custodial concentration. Spark, for example, uses a FROST threshold signature architecture where users retain one key in a two-of-two signing arrangement. Operators cannot move funds without user participation, and users can exit to Bitcoin L1 unilaterally at any time. This model offers a path where institutional-grade security coexists with genuine self-custody, without requiring the institution to outsource trust to a third-party custodian or build a $50 million custody stack.

What Comes Next

The institutional custody landscape in mid-2026 is in a transition period. The regulatory barriers have fallen, the economic incentives favor in-house builds at scale, and the Coinbase concentration risk has created urgency. Several trends are likely to accelerate:

• More OCC charter applications from banks and asset managers seeking direct custody authority.
• Consolidation among third-party custodians as their largest clients bring custody in-house.
• Increasing adoption of MPC and threshold signature schemes over traditional multisig for operational flexibility.
• Integration of custody with stablecoin issuance, staking, and tokenized asset servicing as banks seek to justify the infrastructure investment across multiple revenue streams.
• Growing demand for self-custodial solutions that provide institutional security guarantees without the custodial trust model.

For a deeper comparison of custody approaches across the market, see our Bitcoin custody solutions comparison. Developers building custody or wallet infrastructure can explore the Spark SDK documentation for self-custodial integration patterns.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.