Client Asset Protection: What the Regulations Actually Require (And What They Don't Say)

Reader Navigation Guide

Jump to sections relevant to your role

Reader Role	Relevant Sections
Compliance Officers	Click to view sections MiCA and UK CASS Requirements - Article 70, Article 75, CP25/14 How the Mechanics Work - Segregation, reconciliation, consent What Regulations Don't Say - Definitional expansions Compliance Team Actions - Implementation checklist
Legal Counsel	Click to view sections Liability Chain - CASPs, sub-custodians, clients Jurisdictional Application - EU, UK, Singapore, US, Dubai What Regulations Don't Say - Sub-custody triggers, omnibus legal requirements What We Don't Know Yet - Enforcement priorities, cross-border recognition
Risk Management	Click to view sections Why FTX Failed - Systematic failures, structural shortfalls Liability Chain - Who bears what risk Traditional Finance Comparison - Settlement, custody, insurance gaps
Operations & Technology	Click to view sections How the Mechanics Work - Three-level segregation, multi-source reconciliation Business Continuity - Key backup, disaster recovery Traditional Finance Comparison - Settlement finality, no central depository
Executive Leadership	Click to view sections Why Regulators Moved Now - $8.7B lesson Implementation Timeline - What's in force, what's coming The Bottom Line - Strategic implications

This navigation framework is exclusive to MCMS members. Share this article to provide colleagues with the same analytical depth.

The collapse of FTX in November 2022 vaporised approximately $8.7 billion in customer deposits. Not because of market volatility or a bank run, but because client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian were never actually protected. Customer fiatTraditional government-issued currency, such as USD, EUR, or NIS deposits flowed directly into Alameda Research accounts. No segregation existed. No reconciliation would have caught it because the systems were designed to hide it.

Eighteen months later, regulators responded. MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States entered force across the EU. The UK FCAUK's financial regulator overseeing conduct of firms and markets to protect consumers published CP25/14, adapting its Client AssetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian Sourcebook to crypto custodyService for securely storing and managing cryptocurrency assets. Singapore, Dubai, and New York strengthened their own frameworks. The message was clear: the era of "trust us, we're holding your coins" is over.

But here's what compliance officers are discovering as they implement these rules: the regulations tell you what to do. They rarely tell you where the definitions have quietly expanded to capture business models regulators may not have explicitly considered.

This analysis unpacks the client asset protection frameworks now in force and the definitional shifts practitioners need to catch before their auditors do.

What Client Asset Protection Actually Means Under MiCA and UK CASS

Client asset protection is not a single rule. It's an interlocking system of requirements designed to ensure that customer funds remain customer property, even when the custodian fails.

Under MiCA Article 70, CASPsEntity providing crypto services under EU MiCA requiring authorization and regulatory compliance holding client crypto-assets must establish "adequate arrangements to safeguard the ownership rights of clients." The regulation explicitly prohibits using client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian for the firm's own account. Article 75 adds operational specifics: mandatory segregation, daily reconciliation, liability for losses, and disclosure requirements.

The UK FCAUK's financial regulator overseeing conduct of firms and markets to protect consumers's CP25/14 (May 2025) takes a different architectural approach. Rather than building new rules, it adapts the existing Client AssetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian Sourcebook, which has been battle-tested through decades of traditional finance failures, to crypto custodyService for securely storing and managing cryptocurrency assets. The result: safeguarding on a trust or custodial basis, daily reconciliations between client entitlements and assets held, and a designated CASS Operational Oversight Officer for firms above a certain size.

Both frameworks permit two custody models. Segregated wallets assign each client their own walletA tool for storing, sending, and receiving cryptocurrencies with unique cryptographicThe science of encoding and decoding information, used to secure cryptocurrency transactions keys, offering maximum transparency, clearer audit trails, but higher operational costs. Omnibus wallets pool multiple clients' assets in shared wallets, requiring robust off-chainA decentralized, digital ledger of transactions maintained across multiple computers record-keeping to maintain individual entitlements. Neither model is inherently safer; what matters is whether ownership rights remain identifiable and legally protected.

“

The practical test: if your firm entered insolvency proceedings tomorrow, could a bankruptcy administrator determine exactly which assets belong to which client and ensure those assets sit outside your creditors' claims?

Who Bears the Risk, and Who's Now Liable

The liability chainA decentralized, digital ledger of transactions maintained across multiple computers under new regulations has shifted significantly. Understanding who carries what risk is no longer optional.

CASPsEntity providing crypto services under EU MiCA requiring authorization and regulatory compliance and Exchanges face direct liability for client asset losses under MiCA Article 75(8). This includes losses from cyber-attacks, theft, system failures, or operational errors. The liability is capped at the market value of lost assets at the time of occurrence, creating both protection and incentive structures.

Sub-custodians present a more complex picture. When CASPsEntity providing crypto services under EU MiCA requiring authorization and regulatory compliance delegate custody to third parties, the sub-custodian must be authorised under MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States Article 59 for custody services. But here's the catch: CASPs remain responsible for sub-custodian activities. Due diligenceProcess of verifying customer identity and assessing risk isn't a one-time checkbox. It requires ongoing monitoring of operational controls, key management procedures, and the sub-custodian's own insolvency treatment of client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian.

Clients carry more risk than many realise. Most crypto-assets fall outside traditional compensation schemes. UK customers cannot rely on the Financial Services Compensation Scheme (FSCS) or Financial Ombudsman Service for unregulated tokens. EU investors find MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States-regulated assets excluded from MiFID IIEU directive governing financial markets and investment services compensation frameworks. The implication: segregation and insolvency remoteness aren't nice-to-haves. They're the primary protection mechanism.

Retail vs Professional distinctions matter. Regulatory frameworks apply stricter safeguards for retail clients: more extensive disclosures, lower risk tolerance assumptions in suitability assessments, tighter marketing standards. Professional clients are presumed to understand product risks and absorb losses, but can opt into retail protections with informed consent.

Why Regulators Moved Now, and What FTX Revealed

The timing isn't coincidental. FTX provided regulators with a case study in everything that can go wrong when client asset protection exists only on paper.

The failures were systematic, not accidental. Customer fiatTraditional government-issued currency, such as USD, EUR, or NIS deposits were directed to Alameda Research bank accounts from the start. No segregation architecture existed to violate because none was ever built. Approximately $8.7 billion in customer assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian were deployed for proprietary trading, venture investments, real estate purchases, and political donations. Internal accounting showed inter-company "loans" that were never formalised or disclosed. Alameda held a special "allow negative" privilege on FTX, enabling unlimited borrowing against customer deposits without consent or visibility.

The bankruptcy examiner's report revealed FTX lacked sufficient funds to meet customer liabilities from at least Q1 2021, more than eighteen months before the collapse became public. No reconciliation system would have surfaced this because the shortfall was structural, not operational.

This context explains why new regulations emphasise daily reconciliation across multiple sources, explicit consent mechanisms for any asset use, and independent oversight functions. Regulators aren't just preventing the next FTX. They're preventing the architecture that made FTX possible.

How the Mechanics Actually Work

Implementation details determine whether client asset protection functions or merely exists on compliance checklists.

Segregation operates at three levels

On-chainA decentralized, digital ledger of transactions maintained across multiple computers segregation means client crypto-assets sit in wallets clearly distinguishable on the distributed ledgerA record of financial transactions from the firm's proprietary holdings.

Off-chainA decentralized, digital ledger of transactions maintained across multiple computers segregation requires accurate internal records maintaining individual client entitlements, even in omnibus structures.

Legal segregation, the piece that matters in insolvency, means assets held on trust or under custodial arrangements that place them outside the firm's bankruptcy estate.

Daily reconciliation isn't a single check

Best practice now requires multi-source reconciliation comparing internal client-specific records against on-chainA decentralized, digital ledger of transactions maintained across multiple computers walletA tool for storing, sending, and receiving cryptocurrencies balances, third-party custodian reports, and fiatTraditional government-issued currency, such as USD, EUR, or NIS account balances at credit institutions. Discrepancies must be investigated and remediated promptly. Material shortfalls trigger immediate regulatory reporting.

Consent requirements have teeth

ESMA clarified in July 2025 that standard terms and conditions are insufficient for authorising asset use. Explicit, affirmative consent must be obtained through separate mechanisms, such as pop-up confirmation boxes, before client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian can be used for lending, staking, or collateral.

For staking specifically, ESMAEU agency coordinating securities regulation and supervising credit rating agencies and trade repositories confirmed that CASPsEntity providing crypto services under EU MiCA requiring authorization and regulatory compliance cannot stake clients' crypto-assets for their own benefit, even with consent. Article 70(1) prohibits use for the CASP's own account under all circumstances.

Proof of Reserves has emerged as a transparency mechanism

The UK FCAUK's financial regulator overseeing conduct of firms and markets to protect consumers proposed, and leading custodians have adopted, cryptographicThe science of encoding and decoding information, used to secure cryptocurrency transactions proofs demonstrating that custodians holdA misspelling of 'hold,' used to mean holding onto cryptocurrency for long-term gains sufficient on-chain assetsTangible assets represented on-chain to cover client liabilities. These aren't regulatory requirements yet in most jurisdictions, but they're becoming table stakes for institutional credibility.

What the Regulations Don't Explicitly Say

This is where practitioners earn their fees. The regulations establish principles. The definitions contain the expansions that catch business models.

Sub-custody triggers faster than expected. Pre-funding client transactionsA transfer of value or data recorded on a blockchain, verified by network participants, and permanently added to the distributed ledger by transferring assets to third parties constitutes sub-custody under ESMA's interpretation. If your operational model involves moving client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian to exchanges or liquidityThe ease with which an asset can be bought or sold without affecting its price providers before executing trades, you may already be subject to sub-custody requirements you haven't implemented.

"Holding means of access" captures more than custody. The UK's approach defines custody broadly around control of cryptographicThe science of encoding and decoding information, used to secure cryptocurrency transactions keys or "means of access." Multi-signature arrangements where your firm holds one of several keys may still constitute custody depending on the specific configuration and your operational role.

Omnibus structures require more than good record-keeping. The regulations permit pooled wallets, but the legal analysis must demonstrate that individual client entitlements survive your insolvency. In common law jurisdictions, this typically requires trust arrangements. In civil law jurisdictions, statutory frameworks may provide presumptions, but may not guarantee protection.

Business continuity planning for crypto differs from traditional finance

Disaster recovery must address secure backup of encrypted private keysA secret code that allows you to access and manage your cryptocurrency across geographically diverse locations, multi-signature configurations with redundant key holders, and procedures for restoring access after key loss, system failure, or cyber-attack. Standard IT disaster recovery frameworks weren't designed for assets where losing a key means losing the asset permanently.

Where These Rules Apply, and Where They Don't

Jurisdictional complexity creates both risk and opportunity.

For firms operating across jurisdictions, the compliance floor is typically MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States, the most prescriptive framework. But local requirements may add specific obligations, particularly around marketing, disclosure language, and reporting.

When This Becomes Urgent

The implementation timeline creates different pressure points.

Already in force: MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States's full framework applies now. UK anti-money launderingRegulatory framework requiring financial institutions to detect and prevent money laundering, terrorist financing, and other illicit financial activities registration requirements apply now. Singapore and Dubai licensing regimes are operational.

2025-2026: UK FCAUK's financial regulator overseeing conduct of firms and markets to protect consumers finalisation of CP25/14 crypto custodyService for securely storing and managing cryptocurrency assets rules. Expect implementation periods of 12-18 months after final rules publish.

Ongoing: ESMAEU agency coordinating securities regulation and supervising credit rating agencies and trade repositories continues issuing Q&A guidance interpreting MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States provisions. Each clarification potentially narrows operational flexibility or expands compliance obligations.

“

The Monday morning test: If you holdA misspelling of 'hold,' used to mean holding onto cryptocurrency for long-term gains client crypto-assets today, your segregation, reconciliation, and consent mechanisms should already meet MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States standards if you serve EU clients, or be explicitly scoped out of EU exposure. If you're waiting for final UK rules before implementing controls, your risk window is open now.

Compared to Traditional Finance

Crypto client asset protection borrows heavily from traditional finance frameworks, but key differences create implementation gaps.

Settlement finality works differently. Traditional finance operates on T+2 settlement with central counterparty clearing. Crypto transactionsA transfer of value or data recorded on a blockchain, verified by network participants, and permanently added to the distributed ledger settle on-chainA decentralized, digital ledger of transactions maintained across multiple computers in minutes or hours, but finality depends on blockchain confirmation depth. Reconciliation systems must account for reorg risk on chains with probabilistic finality.

Self-custody is a real alternative. Unlike securities, where custody is functionally mandatory for most investors, crypto clients can withdraw to self-custody. This creates competitive pressure on custodians but also shifts risk discussions: clients choosing custodial arrangements are making an active decision about who controls their keys.

No central depository exists. Traditional finance benefits from central securities depositories that provide systemic record-keeping. Crypto's decentralised architecture means each custodian must independently verify on-chainA decentralized, digital ledger of transactions maintained across multiple computers holdings, creating both transparency (anyone can verify) and complexity (no authoritative single source of truth for off-chain entitlements).

Insurance markets are immature. Traditional custodians operate within well-developed insurance frameworks. Crypto custodyService for securely storing and managing cryptocurrency assets insurance remains expensive, limited in coverage, and subject to exclusions that may surprise firms when they file claims.

What Compliance Teams Should Do Now

The regulations establish requirements. Implementation requires operational decisions.

Audit your custody chainA decentralized, digital ledger of transactions maintained across multiple computers. Map every entity that touches client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian: sub-custodians, liquidityThe ease with which an asset can be bought or sold without affecting its price providers, staking validators, exchangeA platform where users can buy, sell, or trade cryptocurrencies counterparties. Determine which relationships trigger custody or sub-custody obligations under applicable frameworks.

Stress-test your insolvency analysis. Work with counsel to confirm that your segregation arrangements actually achieve bankruptcy remoteness in relevant jurisdictions. Trust documentation, custodial agreements, and operational reality must align.

Implement consent mechanisms that work. Standard terms buried in click-through agreements won't satisfy explicit consent requirements. Design user flows that make consent affirmative and documented for each asset use category.

Build reconciliation that catches structural problems, not just operational errors. FTX-style failures won't surface through balance-checking alone. Reconciliation must verify that reported client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian actually exist, are actually segregated, and are actually accessible.

Prepare for regulatory examination. Document your interpretation of ambiguous requirements. When ESMAEU agency coordinating securities regulation and supervising credit rating agencies and trade repositories or the FCA asks why you structured something a particular way, "we thought it was compliant" is weaker than "here's our analysis of Articles X, Y, and Z, and why we concluded this approach meets the regulatory objective."

What We Don't Know Yet

Intellectual honesty requires acknowledging gaps.

Enforcement priorities remain unclear. Regulators have published frameworks but limited enforcement action has occurred under new rules. Which violations will draw attention first? Likely high-profile failures, but the precise supervisory approach remains untested.

Cross-border recognition is unresolved. Will EU regulators accept UK custody arrangements as equivalent? Will Singapore-authorised custodians face additional requirements to serve EU clients? Mutual recognition frameworks are discussed but not finalised.

Proof of Reserves standards lack consensus. Different custodians implement different methodologies. Whether regulatory standardisation emerges, and what it requires, remains open.

DeFiFinancial systems built on blockchain that operate without intermediaries like banks integration creates boundary problems. When client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian interact with decentralised protocols, where does custodian responsibility begin and end? Regulatory guidance has barely touched these questions.

The Bottom Line

Client asset protection has moved from principle to prescription. The frameworks now in force, including MiCAThe EU's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuers and service providers across all 27 Member States, UK CASS adaptations, and their international equivalents, establish detailed requirements for segregation, reconciliation, consent, and governance that will reshape how crypto custodyService for securely storing and managing cryptocurrency assets operates.

For compliance teams, the work isn't reading the regulations. It's reading them as risk documents: identifying where definitions have expanded, where operational models trigger obligations they weren't designed for, and where the gap between stated compliance and actual protection might surprise you in insolvency.

The firms that will thrive in this environment aren't those with the largest legal budgets. They're the ones that treat client asset protection as an operational architecture, not a compliance checklist, and build systems that would actually return client assetsCrypto or fiat funds belonging to customers entrusted to a CASP or custodian in a crisis, not just claim to.

That's what $8.7 billion buys you: regulations that finally mean what they say.