First confirm to whom the client actually has a claim
A client opening an account in its own name and contracting directly with a bank is a different arrangement from a platform pooling client funds in its own name and then recording them internally. Under a custody agreement, the platform may be the only contracting party, and the merchant may not be able to demand payment directly from the custodian. The contractual relationship, account name, beneficial ownership and operational authority should be examined together, rather than judging solely on the basis of a screenshot showing that "funds are at a certain bank".
It is also possible to require the counterparty to explain its subcontracting or re-custody chain. The fact that the platform contracts with one institution does not mean the assets always remain in accounts directly controlled by that institution; the counterparty may use other banks or custodians. It should be understood who in the chain maintains client details, who can suspend withdrawals, and how notification is made when an event occurs at different levels. A transparent hierarchy chart helps identify concentration risk, but it does not replace legal review of the validity of contracts at each level and the attribution of assets.
Outsourcing custody does not automatically outsource responsibility
Article 73 of the EU's MiCA expressly provides that a crypto-asset service provider subject to it that outsources operational functions does not change its own obligations to clients and needs to retain supervisory capacity. This is an express rule in a specific jurisdiction; other regions must check their own requirements. Civil compensation also requires assessment of undertakings, fault, loss and causation: a counterparty's breach of contract does not necessarily mean the platform bears all losses, nor does it mean the platform can refuse responsibility across the board.
Hypothetical scenario: the bank is sound, but the platform cannot redeem
Assume the bank where client funds are deposited has not failed, but the platform's internal records are missing and the funds have been misappropriated, so clients cannot withdraw. The US FDIC explains that its insurance covers deposit risk at insured banks and does not cover crypto assets or the failure of non-bank platforms themselves. Even where insurable deposits are involved, specific conditions such as account and beneficiary records must be verified; bank participation in insurance must not be described as a comprehensive guarantee by the platform.
Due diligence must cover how funds are recovered after a failure
Before signing, the custodian's qualifications, account purpose, reconciliation capability, whether set-off or lien arrangements exist, and who can obtain client details and issue return instructions after the platform ceases operations should be verified. The platform should maintain independent records sufficient to prove each client's rights and test the operational path for changing institutions. Marketing may explain what protections have been adopted, but it should not promise that "third-party custody means zero risk", nor should it push all recovery work back onto clients.
Recommended actions
- Map the contractual and account relationships among clients, the platform and custodians.
- Review set-off, lien, insolvency and exit clauses, and verify whether clients can directly request return of assets.
- Verify insurance or guarantee claims in marketing materials, and retain customer details and independent reconciliation records.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- Article 73 of MiCA: Outsourcing — ESMA / EU legislature
- Advisory to FDIC-Insured Institutions Regarding Deposit Insurance and Dealings with Crypto Companies — U.S. FDIC
