// Technical guidance note
A methodical, measurable, and comparable approach to rating the risk of a digital asset custody arrangement, for financial institutions, rating agencies, auditors, and risk functions.
The framework was developed with input of experts from the organizations listed below during ACCESS 26. We intend it to be applied, challenged, and improved, and we welcome continued engagement from across the industry.
“Banks, asset managers, and market infrastructures need a shared, evidence-based way to judge whether a custody arrangement deserves their reliance.”
This framework draws on industry incidents, supervisory expectations, and the experience of institutions that operate custody every day. Exclusive control, segregation, and recoverability cannot be averaged away, and every rating traces back to its evidence.
Risk scope, preconditions, control pillars and custody assertions. The full method for assessing any custody arrangement, from initial screening to a final, evidence-backed risk rating.
A comprehensive, step-by-step method for calculating the Custody Risk Rating, from control scores to a final, defensible result. Configurable variables tailor it to each evaluation.
Complete assessments of real custody setups, showing how to apply the framework with evidence and scoring at each step.
Every assessment moves through the same four layers, in order. Together they produce one rating that is traceable to evidence and comparable across custodians.
Rate the custodian as a whole, or a specific asset and how it is held.
2 scopesA readiness gate, assessed first. Each precondition is pass or fail.
6 preconditionsEvidence gathered and scored across technology, process, configuration, governance and resiliency.
20 control categoriesAll 20 control categories, the scoring method and worked assessments in one PDF.
Heads of digital assets, CISOs, CTOs, compliance leaders and risk leaders at financial institutions that operate, select or supervise digital asset custody. It also serves rating agencies, auditors and risk functions that assess custodians during due diligence.
Almost certainly. The framework is technology-neutral and model-neutral: the same pillars, categories and assertions apply to any custody arrangement, whether self-custody, a third-party custodian or a shared model, and to any key-management approach, from HSMs and MPC to multi-signature wallets, across cold, warm and hot storage. Rate the custodian as a whole, or a specific asset and activity such as staking.
The 20 control categories span five pillars. Technology: how keys are generated, stored, signed with and kept cryptographically sound. Process: authorization workflow, separation of duties, key ceremonies and insider-risk containment. Configuration: the parameters that enforce your risk appetite at execution. Governance: policy change control, regulatory compliance, audit and insurance. Resiliency: continuity, recovery, third-party dependencies and monitoring.
Written by Halborn, developed from the feedback and collaboration of custody experts from BNY, Fidelity, Grayscale, JP Morgan, Western Union, UBS, Citi and other institutions.
The framework includes fully worked assessment examples that show the scoring, gate logic and evidence step by step. They cover custodians at different ends of the risk scale, including one where a single failed hard gate sets the final rating despite strong controls elsewhere.
Yes. Halborn supports financial institutions, custodians and their counterparties across the full custody lifecycle, from independent risk assessments and advisory to hands-on operational support. Engagements can apply this framework to produce an evidence-based Custody Risk Rating, or be tailored to the specific needs of your arrangement. Contact Halborn to discuss an assessment.
The opinion the rating expresses. Hard gates cannot be averaged away.
One number from 0.00 to 1.00: the higher of the weighted base score and the hard-gate floor.
