Custody Catastrophe: A Nevada Wake-Up Call
The Fortress Fallout
The Nevada Financial Institutions Division’s (FID) cease-and-desist order against Fortress Trust in October 2024 was a stark reminder of the risks inherent in digital asset custody. Described as being in an “unsafe and unsound” condition, Fortress was barred from accepting deposits or transferring assets. The firm, which rebranded as Elemental Financial Technologies after a vendor breach in 2023 that cost between $12 million and $15 million, served over 250,000 clients. The fallout was swift: Ripple withdrew its acquisition bid, and Fortress became the second Nevada trust company to collapse in two years, following Prime Trust’s receivership in June 2023 – both sharing the same founder. The FID cited Fortress’s inability to produce financials or perform basic reconciliations as a key factor in its decision, underscoring serious operational deficiencies.
Regulatory Frameworks Under Scrutiny
The Fortress debacle has ignited a fierce debate about the suitability of various custody charters in the US. Currently, institutions can custody digital assets under four main frameworks:
- Nevada Retail Trusts
- New York Limited-Purpose Trusts and BitLicense Custodians
- OCC National Trust Banks
- Wyoming Special Purpose Depository Institutions (SPDIs)
Nevada’s regulatory regime, while mandating trust-fund segregation, has been criticised for its variable exam frequency and governance breakdowns. New York’s Department of Financial Services (DFS), on the other hand, enforces stringent custody guidelines, requiring customer assets to be treated as customer property and prohibiting their use beyond safekeeping. The DFS also mandates rigorous audit trails to reconcile omnibus wallets to individual accounts. BitLicense holders are subject to frequent risk-based exams funded by DFS assessments, creating a high barrier to entry for smaller firms. The Office of the Comptroller of the Currency (OCC) has also asserted its authority over crypto custody, applying fiduciary standards that necessitate client-asset separation and operational controls. Banks operating under the OCC framework are subject to 12- to 18-month exam cycles. Wyoming’s SPDI framework codifies bailment-based custody with strict segregation in statute and regulation, but its bespoke supervision limits its scalability.
Unpacking Custody Layers and Risks
Understanding where assets actually sit requires delving into the multi-layered nature of digital asset custody. Customer funds pass through layers of abstraction: from the exchange front-end ledger to the legal custodian, the sub-custodian managing technical operations, and finally, wallet tiers. Omnibus pooling, where multiple customers share a blockchain address, can occur at the legal-custody or infrastructure layers. While regulators generally permit omnibus arrangements if beneficial-ownership mappings are meticulously maintained, failures at any layer – such as lost keys, reconciliation errors, or vendor breaches – can strand customers, even if the custodian’s balance sheet appears healthy. As evidenced by dYdX’s brief trading halt in October 2024 due to a liquidation edge case on the Cosmos blockchain, custody risk extends far beyond legal title to encompass the entire infrastructure stack.
Consolidation and the Flight to Quality
Enforcement Actions and Their Implications
The US regulatory landscape is becoming increasingly assertive, with enforcement actions targeting both compliant and non-compliant institutions. The OCC’s consent order against Anchorage Digital, for example, focused on Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) deficiencies. This action, which was terminated in August 2025 after remediation, demonstrated that even well-capitalised institutions are not immune to scrutiny. New York’s DFS has also shown its willingness to police product lines, as evidenced by its order for Paxos Trust to cease minting BUSD. The receivership of Prime Trust and the subsequent shutdown of Fortress Trust underscore the severe consequences of operational failures and regulatory lapses.
Winners and Losers in the New Order
The current climate favours institutions operating under the stricter regulatory regimes of New York and the OCC. These frameworks mandate frequent exams, mandatory segregation with audit trails, sub-custodian approvals, and assessment-funded supervision. While these requirements increase costs, they also create a moat that competitors cannot easily cross. Wyoming’s SPDI framework offers rigorous segregation and sub-custody guardrails, but its bespoke supervision limits its ability to scale quickly. Conversely, Nevada trust companies face reputational headwinds, and platforms that relied on Prime Trust or Fortress face prolonged asset-recovery timelines and associated costs. This has resulted in a flight to supervision, with firms either migrating to DFS or OCC oversight, exiting custody altogether, consolidating under larger parents, or accepting reduced access and higher premiums.
The Road Ahead: A 90-Day Playbook
In the wake of the Fortress collapse, platforms are adopting a more cautious and proactive approach to custody. This includes:
- Adopting custody agreements that prohibit custodian use beyond safekeeping, preventing lending, rehypothecation, or pledging without customer consent.
- Implementing auto-segregation clauses that separate funds both on the books and at the infrastructure layer, with monthly reconciliations and attestations mapping addresses to owners.
- Diversifying custody by contracting with at least two custodians and decoupling infrastructure providers from legal custodians.
- Enhancing Proof-of-Reserves (PoR) with solvency disclosures that pair reserves with liabilities, backed by third-party attestations covering both sides of the balance sheet.
Regulatory arbitrage is also narrowing, with firms facing increasing market pressure to upgrade to more rigorous regulatory charters. The trend favours consolidation, with the expectation that the next 12 months will see M&A activity or wind-downs among second-tier custodians unable to meet the rising baseline for rigor and capital. Ultimately, the US crypto trust model is consolidating around firms that are better capitalised, more transparent, and more intensively supervised, with oversight commensurate with the systemic risk of holding billions in customer assets.
