Perspective
Custody Risk in Tokenized Assets: Who Actually Holds Your Investment?
Darren Nakos, CCIM · September 2026
Of everything I’ve covered so far in this series — what tokenization is, and what it isn’t — custody is the piece that gets glossed over the most in marketing, and it’s arguably the single most important operational question in any tokenized structure.
The basic question
If something goes wrong, who is actually holding the asset — and what are your rights against them?
Owning a token doesn’t automatically mean direct, unmediated control over the underlying asset. In a lot of structures, a custodian, transfer agent, or platform sits between you and the asset — holding the private keys, maintaining the official ledger, or acting as the registered owner on your behalf.
Common custody structures
Self-custody
You — or your entity — directly control the private keys or wallet holding the token. That’s the highest degree of control you can get, and also the highest personal responsibility. If the keys are lost or compromised, there’s often no recovery path. No customer service line can reset a lost private key.
Third-party custodian
A custodian, regulated or not, holds the keys on your behalf. That takes the operational burden off you, but it hands you counterparty risk instead: what happens if the custodian gets hacked, goes insolvent, or mismanages client assets? The custodian’s regulatory status matters a great deal here — a qualified custodian regulated under securities law is a completely different risk profile than an unregulated crypto-native one.
Platform-based custody
The issuing platform itself holds the tokens, often pooled together in one omnibus account rather than segregated by investor. This shows up often in early-stage tokenization products, and it usually carries the least legal clarity around what happens if the platform fails, gets acquired, or shuts down.
Questions worth asking before you invest in any tokenized structure
- Is the custodian regulated, and by whom?
- Is the asset held in a segregated account, or commingled with other investors’ assets?
- What happens to your position if the custodian or platform goes bankrupt?
- Is there insurance — and what does it actually cover? Cyber theft, insolvency, or both?
- Who has the practical ability to freeze, seize, or recover the token if there’s a dispute?
A useful comparison
This is the same due diligence you’d apply to a traditional brokerage account or fund administrator. The difference is that tokenized structures are newer, custody standards aren’t nearly as standardized across the industry yet, and the case law addressing disputes is a lot thinner than it is in traditional finance. When a traditional brokerage fails, there are decades of precedent and regulatory frameworks — SIPC coverage, for one — guiding how it gets resolved. Tokenized structures don’t have that same depth of precedent yet.
The takeaway
Custody risk isn’t a reason to avoid tokenized structures across the board. It’s a reason to ask the same rigorous questions of any custodian holding your capital — traditional or tokenized — and to take note when those answers aren’t easy to find in an offering’s disclosures.
This article is educational in nature and does not constitute investment, legal, or tax advice.
Next in this series Part 4 — Regulation D Explained