FINMA Crypto Custody Guidance 01/2026: The Custody Chain Review

On 12 January 2026 the Swiss Financial Market Supervisory Authority (FINMA) published Guidance 01/2026, Custody of cryptobased assets, addressing institutions subject to FINMA supervision and identifying banks, securities firms, managers of collective assets and portfolio managers in particular. The document carries a blunt message: it restates the rules that already govern crypto custody in Switzerland and holds firms to them, after supervisory findings showed the associated risks “were not always adequately taken into account by the supervised institutions in the past.”

Guidance 01/2026 does not create a single test for every custody context. For a Swiss bank delegating custody abroad, FINMA states that the capital exemption applies by analogy only where the foreign third-party custodian is prudentially supervised and foreign law guarantees bankruptcy protection. For individual portfolio management and Swiss collective assets, FINMA requires the specified supervised custodian and, for foreign custody, equivalent supervision and equivalent bankruptcy protection. For crypto collateral under structured products or ETPs, FINMA states that legally enforceable real security requires protection if the collateral custodian becomes insolvent. The documented exception applies only to the existing individual-portfolio-management arrangements described in section 3.2 of the guidance.

For cross-border groups that book Swiss clients into foreign crypto custodians or foreign funds, this is a review exercise with real teeth, because responsibility for getting it right stays with the Swiss-authorised institution.

Related reading: MiCA CASP transitional period end and client-asset wind-down.

What FINMA issued on 12 January 2026, and what status it carries

Guidance 01/2026 is a supervisory communication, the format FINMA uses to explain how it reads and applies rules already in statute and ordinance, and that classification matters for how a compliance team should treat it. The document tells supervised institutions how FINMA will assess their crypto custody against the existing law, and where it has seen firms fall short.

The guidance addresses institutions subject to FINMA supervision and identifies banks, securities firms, managers of collective assets and portfolio managers in particular, grouping the identified institutions together as “institutions” for the document. The trigger for the document is market growth. FINMA records “growing interest in cryptobased assets and associated services in the Swiss financial market” and an expansion of trading, investment and custody services at supervised firms, alongside evolving rules in other jurisdictions that left FINMA “increasingly confronted by questions, such as which regulatory requirements foreign custodians must fulfil.”

A short map of the legal reference points helps before the detail:

• 12 January 2026: FINMA Guidance 01/2026, Custody of cryptobased assets, published.
• 2021: the DLT Act (FINMA’s “DLT blanket act”) enters into force, introducing comprehensive bankruptcy protection for crypto-based assets held in third-party custody.
• Article 37d in conjunction with Article 16 no. 1bis of the Banking Act (BA; SR 952.0) and Article 242a of the Debt Enforcement and Bankruptcy Act (SchKG; SR 281.1): the segregation regime.
• 20 December 2023: FINMA Guidance 08/2023 “Staking,” which set out the custody segregation logic the new guidance reproduces.
• 31 May 2023: Regulation (EU) 2023/1114 (MiCA), cited by FINMA as one reason suitable supervised custodians now exist abroad.

The guidance sets no transition or remediation deadline. FINMA states that guidance has no legal impact; the relevant statutory and ordinance requirements were already in force, and Guidance 01/2026 communicates how FINMA expects those existing requirements to be applied in practice.

Why crypto custody carries the risks the guidance singles out

Section 2 of the guidance is a compact risk taxonomy, and it separates two things that firms sometimes merge. The first is technology and operations. Assets are stored “on the blockchain” and are exposed to operational risks such as cyber attacks and “the risk of inadequate protection of the private keys.” Meeting those risks needs a technical infrastructure and the expertise to run it, both established and maintained over time.

The second risk is legal, and it is the one that decides whether clients get their assets back. Where custody sits with a third party, FINMA identifies “counterparty risks insofar as the segregability of the cryptobased assets is not guaranteed in the event of the third party’s insolvency.” Put an overseas custodian into that chain and “complex legal issues may arise.” The guidance adds a dependency risk on the third party’s own infrastructure, which is why careful selection is treated as part of the duty rather than a commercial preference. FINMA is explicit that “the risk increases significantly if the third-party custodian is not subject to prudential supervision and does not have to comply with any supervisory standards for custody.”

The common error the guidance targets is treating crypto custody as an IT problem with a legal footnote. Segregability in insolvency is a legal outcome that depends on how the assets are held and which law governs the custodian, and no amount of cold-storage engineering fixes a custodian whose home-country law would fold client coins into the bankruptcy estate.

The bankruptcy-remoteness test: when crypto assets are segregable

Switzerland’s segregation regime for crypto came from the DLT Act, which FINMA calls the “DLT blanket act.” On its entry into force in 2021, comprehensive bankruptcy protection was introduced for crypto-based assets held in third-party custody, through Article 37d in conjunction with Article 16 no. 1bis of the Banking Act and Article 242a of the Debt Enforcement and Bankruptcy Act. A Swiss financial institution may therefore offer custody of and trading in crypto-based assets “within a bankruptcy-proof framework,” but only if the assets qualify for segregation.

The qualifying condition is set by Article 242a para. 2 SchKG, and FINMA reproduces the decision tree it first published in Guidance 08/2023 “Staking.” Article 242a para. 2 SchKG requires both the relevant attribution condition and continuous readiness. Individual custody is segregable where the assets are held in readiness for customers at all times. Collective custody is segregable only where each customer’s share is clearly attributable and the assets are held in readiness for customers at all times; collective custody without clearly attributable customer shares is not segregable.

The holding pattern is what determines the outcome:

• Individual custody, with the assets held in readiness for customers at all times, is segregable.
• Collective custody in which each customer’s share is clearly attributable, again held in readiness, is segregable.
• Collective custody without clearly attributable customer shares is not segregable, and those assets fall into the bankruptcy estate.

The distinction that trips firms is the middle case. Omnibus or pooled custody can still be segregable; what matters is whether individual customer entitlements are clearly attributable within the pool and the assets are held in constant readiness for customers. A pool that cannot show clear customer shares behaves, on insolvency, like a claim against a failed counterparty. This is the auditor’s-eye question worth asking first of any custody arrangement: if the custodian failed tomorrow, does the record clearly attribute these coins to these clients, and are they held ready to be returned?

Licence and capital treatment turn on the same holding test

The same readiness-and-attribution test that decides segregation also decides whether an activity needs a banking licence, under Article 1a and Article 1b BA read with Articles 5 and 5a of the Banking Ordinance (BO). FINMA’s second decision tree maps it out.

Under FINMA’s decision tree, individual custody subject to an obligation to hold the assets in readiness for customers at all times does not require a banking licence, although AMLA supervision remains applicable. Collective custody with clearly attributable customer shares and the same continuous-readiness obligation is mapped to a FinTech licence under Article 1b BA; Article 1b also requires that the accepted assets are neither invested nor interest-bearing. A banking licence is required where collective custody lacks clearly attributable customer shares or where the assets are not subject to the continuous-readiness obligation.

The accounting and prudential treatment follows the same decision tree. Individual custody, and collective custody with clearly attributable customer shares, are off balance sheet and generally do not attract capital requirements only where the assets are held in readiness for customers at all times, subject to Article 4sexies BA. If the assets are not held in readiness, or collective custody lacks clearly attributable customer shares, FINMA’s decision tree shows on-balance-sheet treatment and capital requirements.

Delegating custody abroad: the equivalence condition that does the work

The centre of gravity in Guidance 01/2026 is delegation to a third party, especially one located abroad. For a Swiss bank, FINMA states that the exemption from capital requirements applies by analogy to foreign sub-custody only where equivalent conditions are met: the foreign third-party custodian is subject to prudential supervision and foreign law guarantees bankruptcy protection for the crypto-based assets held in custody. For individual portfolio management and Swiss collective assets, the guidance separately requires equivalent foreign supervision and equivalent bankruptcy protection.

FINMA frames the foreign-custody question as a practical one that firms can now answer. It notes that regulatory developments in other jurisdictions, “such as the Markets in Crypto-Assets Regulation (MiCA) in the European Union,” have “created the basis for an appropriate custody environment for cryptobased assets,” so that “a growing number of suitable custodians of cryptobased assets with bankruptcy protection already exist abroad.” The guidance cites MiCA formally as Regulation (EU) 2023/1114 of 31 May 2023. For teams building the equivalence assessment, our guide to MiCAR reporting obligations sets out how the EU regime authorises and supervises crypto-asset service providers, and how BaFin draws the MiCAR and MiFID perimeter for tokenised securities shows how a single EU member state applies it in practice.

Equivalence works as a two-part legal judgement about a specific custodian, and naming a well-known jurisdiction does not discharge it. The firm has to establish that the entity is actually under prudential supervision, and that the law which would govern its insolvency ring-fences client crypto to a standard equivalent to Article 242a SchKG. Jurisdiction labels can mislead: an EEA custodian is not automatically inside the MiCA regime, since Norway, for instance, brought MiCA into national law through its own instrument, which is why our note on Norway’s Crypto-Asset Act and CASP reporting matters when a Swiss firm’s custody chain runs through the wider European market. The onshoring trap here is familiar from UK and EEA comparisons across financial regulation: what governs is the operative protection under the applicable law, and the name of the regime settles nothing.

Individual portfolio management: Article 24 para. 1 FinIO and the segregated-per-client rule

Portfolio managers carry a specific ordinance obligation. Under Article 24 para. 1 of the Financial Institutions Ordinance (FinIO; SR 954.11), a firm active in individual portfolio management must ensure that the assets entrusted to it are held in safekeeping, segregated per client, with one of a defined set of custodians: a bank under the Banking Act, a securities firm under the Financial Institutions Act (FinIA; SR 954.1), a trading facility for distributed ledger technology securities (a DLT trading facility) under the Financial Market Infrastructure Act (FinMIA), or another institution subject to supervision equivalent to that in Switzerland.

Applied to crypto, that means custodian selection is a regulated act, not a procurement choice. The guidance requires that managed crypto be held by prudentially supervised institutions with an adequate technical infrastructure and the necessary expertise, that segregation in the custodian’s bankruptcy be possible, and that where the assets sit abroad the custodian be under equivalent supervision and the foreign law provide equivalent bankruptcy protection. FINMA states the ownership of the problem in one line: “It is the responsibility of the institutions to ensure appropriate custody of cryptobased client assets,” and arrangements that fall short “must be adjusted in the interests of client protection.”

Where firms most often get this wrong is the assumption that a foreign fund wrapper solves the custody question. The guidance closes that door directly. The Article 24 para. 1 FinIO guarantee “may not be circumvented by structures with foreign products,” and a Swiss institution that sponsors or manages, for example, a foreign collective investment scheme that invests in crypto and places it into client portfolios is responsible for applying the same custody principles to the fund assets. The guidance applies this anti-circumvention principle to a Swiss institution that sponsors or manages a foreign collective investment scheme investing in crypto-based assets and places it in its clients’ portfolios.

The narrow exception: documented, informed, written client consent

FINMA leaves a defined path for arrangements that do not yet meet the standard, and it is narrow. Two existing-arrangement situations qualify for the exception. The first is where foreign custodians are subject to equivalent prudential supervision but no equivalent bankruptcy protection exists. The second is where Swiss custodians are supervised only by a self-regulatory organisation, so that bankruptcy protection under Article 242a SchKG is in place but prudential supervision is lacking.

In either case, continued use is “permissible by way of exception” only if the portfolio manager meets three conditions cumulatively. The firm must be able to prove that it gave clients comprehensive information about the increased custody risks tied to that custodian, particularly in a bankruptcy. It must be able to prove that it informed clients about other suitable custodians in Switzerland and abroad. And it must have documented the client’s written consent to the use or retention of a custodian that is not suitable in the sense the guidance describes.

Three points to keep straight. This is an exception for existing arrangements, so a firm cannot read it as a general licence to onboard sub-standard custodians going forward. The three conditions are cumulative, so a signed consent without evidence of the risk explanation and the alternatives disclosure does not satisfy it. And it does not touch the ban on circumventing the FinIO guarantee through foreign products. FINMA requires the portfolio manager to be able to prove that the risk and alternatives information was provided and to document the client’s written consent; the evidence file should therefore cover each of the three cumulative conditions.

Collective investment schemes and crypto ETPs

Two adjacent regimes carry their own custody rules, and the guidance ties both back to the same principle. For Swiss collective investment schemes, the Collective Investment Schemes Act (CISA; SR 951.31) governs safekeeping. Fund assets must be held by a Swiss bank acting as custodian bank under Article 72 para. 1 CISA. The custodian bank may delegate safekeeping to a third-party custodian or a central securities depository in Switzerland or abroad where appropriate, under Article 73 para. 2 CISA, and investors must be told about the risks of such transfers in the prospectus and the basic information sheet under Title 3 of the Financial Services Act (FinSA; SR 950.1). Direct investments in crypto held as Swiss collective assets must generally sit at a Swiss custodian bank, with delegation to an equivalently supervised third-party custodian allowed only where equivalent prudential supervision and equivalent bankruptcy protection rules apply.

For structured products and crypto exchange-traded products offered to retail clients, the anchor is Article 70 FinSA. Where there is no permanent portfolio management or investment advice relationship, issuing structured products to retail clients through special purpose entities is permitted only if the products are offered by prudentially supervised institutions and either a legally enforceable guarantee from a prudentially supervised financial intermediary backs the issuer’s obligations under Article 70 para. 1 FinSA, or legally enforceable real security is provided in favour of investors, under Article 70 para. 2 FinSA and Article 96 paras. 2 and 3 of the Financial Services Ordinance (FinSO; SR 950.11).

The crypto wrinkle sits in the collateral. Where the security behind a crypto product is itself crypto, “real” security under Article 96 FinSO “requires legal protection in the event of the insolvency of the custodian of the security.” FINMA notes it had already flagged these crypto-ETP risks in its 2022 and 2023 annual reports, and that both Swiss exchanges have issued admission and collateralisation rules for such products: SIX Swiss Exchange in Articles 12a to 15 of its Additional Rules for the Listing of Exchange Traded Products, and BX Swiss in Articles 6 to 9 of its equivalent rules. The segregation question moves down to the collateral custodian; holding a listed product rather than the coins directly shifts where it applies, not whether it applies.

What supervised firms should map now

The guidance converts cleanly into a review workflow, and none of the steps depend on a figure FINMA has not given. A supervised firm can start by inventorying every custody arrangement in the crypto chain, direct and delegated, domestic and foreign, including custody that sits inside fund and structured-product wrappers it sponsors or manages. Against each arrangement, the firm should apply the test governing that context: custody model, customer attribution and continuous readiness for Swiss-bank treatment; equivalent supervision and bankruptcy protection for foreign custody under sections 3.1 to 3.3; and insolvency protection for crypto collateral under section 3.4. For Swiss holdings, the parallel test is whether the assets are held in individual custody or in collective custody with clearly attributable customer shares, held in readiness for customers at all times.

The review must separate three tests. First, determine the custody model, customer attribution and continuous-readiness obligation; these drive Swiss bankruptcy, licensing and accounting or capital treatment. Second, for foreign delegation, assess the applicable supervision and insolvency-protection conditions under the relevant section of the guidance. Third, use the written-consent exception only for the existing individual-portfolio-management arrangements described in section 3.2; it is not a general fallback for banks, collective investment schemes or structured-product collateral.

Frequently Asked Questions

Does FINMA Guidance 01/2026 create new legal obligations for crypto custody?

It states FINMA’s supervisory expectations under existing Swiss law, without enacting new rules. The segregation regime it relies on came from the DLT Act in 2021, through Article 37d and Article 16 no. 1bis of the Banking Act and Article 242a SchKG. What is new is FINMA’s crystallised position on foreign custodians and its statement that supervised firms did not always account for these risks adequately in the past.

What conditions apply when a Swiss bank, portfolio manager or Swiss collective-asset arrangement delegates crypto custody abroad?

Both must hold at once. The foreign custodian must be subject to prudential supervision, and the foreign law must guarantee bankruptcy protection for the crypto-based assets held in custody, equivalent to the Swiss standard. For a Swiss bank, FINMA extends the capital exemption to foreign sub-custody by analogy only where these conditions are met; sections 3.2 and 3.3 state their own equivalent-supervision and equivalent-bankruptcy-protection conditions.

Which institutions does the guidance apply to?

Institutions subject to FINMA supervision, with banks, securities firms, managers of collective assets and portfolio managers identified in particular. The custody duties also reach a Swiss firm that sponsors or manages a foreign fund investing in crypto and places it into client portfolios, because the Article 24 para. 1 FinIO guarantee cannot be circumvented through foreign-product structures.

When are pooled or omnibus crypto holdings segregable in bankruptcy?

Collective custody is segregable where each customer’s share is clearly attributable and the assets are held in readiness for customers at all times, under Article 242a para. 2 SchKG. Collective custody without clearly attributable customer shares is not segregable and falls into the custodian’s bankruptcy estate. Individual custody held in readiness is segregable.

Can a portfolio manager keep using a custodian that does not meet the standard?

Only by exception, for existing arrangements in the two situations FINMA names, and only if three conditions are met cumulatively: proof that clients were comprehensively informed of the increased custody risks including in bankruptcy, proof that clients were informed about other suitable custodians in Switzerland and abroad, and documented written client consent to using or retaining the unsuitable custodian.

Does holding client crypto in custody require a banking licence?

Individual custody subject to an obligation to hold the assets in readiness for customers at all times does not require a banking licence, although AMLA supervision remains applicable. Collective custody with clearly attributable customer shares and continuous readiness is mapped to a FinTech licence under Article 1b BA, subject to the Article 1b conditions. A banking licence is required where collective custody lacks clearly attributable customer shares or where the assets are not subject to the continuous-readiness obligation.

How does the guidance treat crypto ETPs and structured products?

Article 70 FinSA permits structured products to be offered to the relevant retail clients only if they are issued, guaranteed or equivalently secured by one of the specified supervised institutions. A special purpose entity may issue them if the product is offered by an institution listed in Article 70 para. 2 and security equivalent to paragraph 1 is ensured. Where crypto assets constitute real security, FINMA states that Article 96 FinSO requires legal protection if the collateral custodian becomes insolvent. SIX Swiss Exchange and BX Swiss have their own admission and collateralisation rules for such products.

Related Articles

• MiCAR Reporting Obligations – how the EU regime authorises and supervises crypto-asset service providers, the reference point for FINMA’s foreign-custody equivalence test.
• MiCAR Token Classification and Reporting Obligations – how ARTs, EMTs and other crypto-assets are classified under MiCAR, which shapes the custody environment abroad.
• BaFin on Tokenised Securities and the MiCAR/MiFID Perimeter – a national supervisor’s line between MiCAR crypto-assets and MiFID financial instruments.
• MiCA CASP Transitional Period End and Client-Asset Wind-Down – what happens to client assets when a crypto-asset service provider exits.
• Bank of England Systemic Stablecoin Rules and Issuer Reporting – a parallel non-EU custody-and-backing regime for comparison.
• CARF Crypto Tax Reporting – the reporting layer that sits alongside prudential custody rules for crypto service providers.

Key Takeaways

• FINMA Guidance 01/2026, published 12 January 2026, restates existing Swiss custody law for crypto-based assets and applies it to banks, securities firms, managers of collective assets and portfolio managers; it sets no new licence, return or dated deadline.
• Swiss bankruptcy protection for crypto in third-party custody comes from the 2021 DLT Act, through Article 37d and Article 16 no. 1bis of the Banking Act and Article 242a SchKG.
• Crypto is segregable in a custodian’s bankruptcy only where it is held in individual custody, or in collective custody with clearly attributable customer shares, and held in readiness for customers at all times (Article 242a para. 2 SchKG).
• For a Swiss bank, the capital exemption applies by analogy to foreign sub-custody only where the foreign custodian is prudentially supervised and foreign law guarantees bankruptcy protection. Individual portfolio management and Swiss collective assets are subject to the equivalent-supervision and equivalent-bankruptcy-protection conditions stated in their respective sections.
• Portfolio managers must hold managed assets segregated per client with a defined set of supervised custodians under Article 24 para. 1 FinIO, and cannot circumvent that duty through foreign-product structures.
• In individual portfolio management, the two categories of unsuitable existing custody arrangements identified by FINMA may be retained only by exception, with cumulative risk disclosure, alternatives disclosure and documented written client consent.
• Responsibility for compliant custody stays with the Swiss-supervised institution, and arrangements that fail the test must be adjusted.

Sources and References

• FINMA, Guidance 01/2026 “Custody of cryptobased assets,” 12 January 2026: finma.ch (PDF).
• FINMA press release, “FINMA publishes guidance on risks associated with the custody of cryptobased assets,” 12 January 2026: finma.ch/en/news.
• FINMA, Guidance 08/2023 “Staking,” 20 December 2023 (source of the segregation decision logic reproduced in Guidance 01/2026): FINMA website, Documentation > FINMA Guidance.
• Banking Act of 8 November 1934 (BA; SR 952.0), Articles 1a, 1b, 4sexies, 16 no. 1bis and 37d.
• Federal Act on Debt Enforcement and Bankruptcy of 11 April 1889 (SchKG; SR 281.1), Article 242a.
• Banking Ordinance (BO), Articles 5 and 5a.
• Financial Institutions Act of 15 June 2018 (FinIA; SR 954.1) and Financial Institutions Ordinance of 6 November 2019 (FinIO; SR 954.11), Article 24 para. 1.
• Collective Investment Schemes Act of 23 June 2006 (CISA; SR 951.31), Articles 72 para. 1 and 73 para. 2.
• Financial Services Act of 15 June 2018 (FinSA; SR 950.1), Article 70; Financial Services Ordinance of 6 November 2019 (FinSO; SR 950.11), Article 96 paras. 2 and 3.
• Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets (MiCA), cited by FINMA as context for foreign custody environments: EUR-Lex.
• SIX Swiss Exchange AG, Additional Rules for the Listing of Exchange Traded Products, Articles 12a to 15; BX Swiss AG, Additional Rules for the Listing of Exchange Traded Products, Articles 6 to 9.

Where the custody chain now gets tested

Guidance 01/2026 requires firms to separate custody-model analysis from foreign-custodian equivalence. Under FINMA’s decision trees, continuous readiness and customer attribution determine Swiss segregation, licence and accounting or capital outcomes: individual custody with continuous readiness does not require a banking licence, collective custody with clearly attributable shares and continuous readiness is mapped to a FinTech licence, and the other branches require a banking licence and on-balance-sheet capital treatment. Foreign delegation must then be tested against the applicable supervision and bankruptcy-protection conditions. Responsibility remains with the authorised Swiss institution, while the written-consent exception is confined to the existing individual-portfolio-management arrangements described in section 3.2.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.