Client rights in crypto custody and staking

The legal review starts with the asset and the actual powers over it. Security tokens and other excluded assets need their own perimeter analysis before applying ordinary cryptoasset rules. In the EU, MiCA excludes financial instruments and defines custody through safekeeping or control of assets or their means of access. A complete private key is not the sole test. (Regulation (EU) 2023/1114, Articles 2(4)(a) and 3(1)(17).)

Engineering should document signing thresholds, approval rights, administrator overrides, recovery shares and withdrawal-address changes. Include combinations of providers that can act together. Legal and compliance teams can then classify each entity's role before onboarding or changing recovery powers.

Shared control also matters in Singapore. MAS explains that control need not be exclusive. A provider participating in transaction signing requires a different assessment from software that never holds keys or participates in transfers. (MAS, Payment Services Act FAQs, question 26, 19 April 2024.)

Can wallet recovery turn a software role into custody?

Read the Indonesian-EU MPC and recovery analysis. It identifies how signing and recovery powers change the licensing assessment; use that assessment to identify who owes the client custody duties.

Name the contracting custodian, every provider holding assets or access means, and the entity responsible for withdrawals. Record permissions against each legal entity and service. Check home-country permissions and cross-border asset restrictions separately before onboarding. Incorporation, a vendor contract and another group company's licence do not establish the platform's permission. (MiCA, Articles 59–60.)

An EU custodian delegating custody must use a provider qualifying under Article 59 and inform clients. Outsourcing also leaves the appointing provider responsible and requires written duties, oversight, information access and exit arrangements. The relevant distinction is between a technical supplier and a provider actually performing custody. (MiCA, Articles 73 and 75(9).)

Prefunding future customer orders with another provider engages this custody analysis. ESMA distinguishes a transfer settling a specific order already executed. The operations team should classify each transfer purpose before funding the account. (ESMA Q&A 2608, 9 July 2025.)

For UK business, current anti-money-laundering registration and the forthcoming authorisation regime must be assessed separately. In-scope custodian wallet providers carrying on business in the UK require FCA registration. The new custody and staking regime starts on 25 October 2027; its application window runs from 30 September 2026 to 28 February 2027. Registration does not itself establish client ownership or permission under the new regime. Existing investment and financial-promotion rules can also apply. (Money Laundering Regulations 2017, regulations 8, 9, 14A and 56; SI 2026/102, regulations 1 and 40; FCA application-period direction, 20 February 2026.)

Should the overseas provider become the EU custodian or supply a narrower service?

Read the South African custodian's EU route analysis. It separates an authorised custody business from a supplier role and identifies what must change before either route can proceed.

Before enabling staking, the product owner and counsel should document ownership, withdrawal credentials, reward allocation, fees, lock-up periods and slashing losses. Identify any lending, collateral or onward-use permission separately. A feature allowing assets to secure a provider's borrowing changes the client's exposure even if the interface still calls the balance custody.

In the EU, the Commission treats custodial staking as ancillary to custody and calls for explicit client consent. It also treats losses arising from the underlying staking activity as attributable to the custodian. MiCA caps attributable-loss liability at market value when the loss occurs. A validator's disclaimer does not remove that statutory obligation. (MiCA, Article 75(8); Commission answer in ESMA Q&A 2067, 20 June 2024.)

Client consent cannot authorise the custodian to stake client assets for its own account. A disclosed service sharing rewards with the client is distinguishable. Remove own-account use before launch and align the customer terms with the validator agreement. (MiCA, Article 70(1); ESMA Q&A 2607, 9 July 2025.)

In the UK, qualifying blockchain-validation staking has been excluded from the collective investment scheme definition since 31 January 2025. That exclusion does not cover every yield or lending product or settle other regulatory questions. Review the actual arrangement and the separate staking permission coming in 2027. (SI 2025/17, Articles 1–2; SI 2026/102, regulation 40.)

Singapore's MAS guidelines expect providers not to facilitate retail customers' staking or lending. For non-retail customers, written risk disclosure and acknowledgement are expected before proceeding. A customer-directed transfer to a specified account is not, by itself, arranging staking. Classify the customer and transaction before enabling the feature. (MAS Guidelines PS-G03, paragraphs 2.1 and 3.7.)

Which powers can a validator hold without taking over the custody role?

Read the South African validator and Irish custodian analysis. It connects withdrawal control, validator duties and loss allocation, including the difference between compensating the customer and recovering from the supplier.

Pooling customers' assets is different from mixing them with the firm's own assets. MiCA requires legal, operational and on-chain separation from the custodian's assets, together with records identifying each client's rights. An omnibus wallet therefore needs a reliable allocation ledger and a clear treatment of shortfalls. (MiCA, Article 75(2) and (7).)

Singapore's rules require customer assets to enter a trust account or be returned by the next business day. They permit specified customer pooling and preserve lawful claims and liens. A third-party safeguarding arrangement also requires written acknowledgement of the trust and restrictions on liens, with defined exceptions. Read these exceptions alongside any security or fee clause. (Payment Services Regulations 2019, regulations 18B–18D.)

National law must support the claimed ownership and failure outcome. For an Irish custodian, establish whether the client retains proprietary rights against the actual custody structure; Irish company-liquidation rules do not establish a trust merely because the service is called custody. In England and Wales, the Property (Digital Assets etc) Act 2025 permits digital things to qualify as property but does not identify the owner or create the customer's trust. (Companies Act 2014 (Ireland), section 614; Property (Digital Assets etc) Act 2025, sections 1–2.)

Counsel should resolve title transfers, liens, set-off and the downstream provider's insolvency law before assets move. If the arrangement replaces ownership with a repayment claim, amend the structure or assess and document that different product.

Can a foreign infrastructure provider support Singapore custody without becoming the customer-facing custodian?

Read the Mauritius-Singapore custody route analysis. It compares control and contractual roles, helping the reader identify which entity must provide the custody service and maintain the required safeguards.

A withdrawal promise needs an operational route and records available after a provider stops cooperating. MiCA requires procedures for return as soon as possible. The Commission interprets this as return of the same asset type, without imposing conversion into cash or another asset. Client-requested conversion is a separate service requiring the relevant permission. (MiCA, Article 75(6); Commission answer in ESMA Q&A 2320, 18 February 2026.)

Before onboarding, delegation or investment, obtain this custody evidence:

• Control map: signing, recovery, overrides and withdrawal powers for every entity.
• Permission record: the entity, authorised service, territory and applicable start date.
• Entitlement documents: customer terms, custody agreements, trust acknowledgements and any title-transfer, lien or asset-use clause.
• Allocation records: wallet addresses, client positions, transaction histories, rewards, fees and reconciliations.
• Failure provisions: liability, claims procedure, applicable law, supplier cooperation and access to records.
• Tested exit: return instructions, replacement-provider arrangements, lock-up constraints and evidence that recovery can be executed.

Use the evidence to assign the work. A missing permission requires authorisation or a change in activity before launch. Conflicting entitlement or liability terms require contract and operational changes before assets move. An acquisition or investment requires verification of actual balances, liabilities and remediation, with unresolved material issues addressed in the transaction documents. A register entry alone cannot answer all three questions.