Tokenized ETF Custody Solutions: Institutional and Self-Custody Options for On-Chain Fund Products

Custody Infrastructure for Tokenized Fund Products

Holding tokenized fund tokens requires either institutional custody (qualified custodian holding private keys) or self-custody (investor controlling their own keys). For institutional allocators — pension funds, endowments, registered investment advisors — qualified custody is typically mandated by SEC Rule 206(4)-2 (the Custody Rule) and fiduciary duty. Within the $11.70B tokenized fund market tracked by RWA.xyz, custody infrastructure has become a critical enabler — without qualified custody solutions, the largest institutional allocators cannot participate, regardless of how attractive the yield or how robust the product.

The custody landscape for tokenized fund products is fundamentally different from traditional securities custody. Traditional securities are held at central securities depositories (DTCC in the US) with custody banks (BNY Mellon, State Street, JP Morgan) maintaining book-entry records. Tokenized securities exist as ERC-20 tokens on blockchain — meaning custody requires securing private keys that control the on-chain tokens rather than maintaining ledger entries at a central depository. This architectural difference creates both new risks (key loss, smart contract vulnerability) and new capabilities (24/7 availability, programmable custody, direct on-chain verification).

Institutional Custody Providers

Fireblocks

Fireblocks provides multi-party computation (MPC) wallet infrastructure — the most widely used institutional custody platform for digital assets. MPC technology distributes key fragments across multiple secure environments so that no single point of compromise can access the full private key.

Key Capabilities for Tokenized Fund Products:

• Chain support: Ethereum, Polygon, Solana, Avalanche, Arbitrum, Optimism, and 40+ additional chains — covering every chain where tokenized fund products are deployed
• Product compatibility: BUIDL, OUSG, USDY, USYC, syrupUSDC, BENJI (on supported chains), and USTB
• DeFi access: Fireblocks’ DeFi integration enables institutional investors to interact with protocols like Flux Finance directly from their custody environment — critical for leveraged OUSG strategies
• Policy engine: Configurable transaction approval policies (e.g., require 2-of-3 approvals for transactions above $1M, allow single-signer for transactions under $50K)
• Insurance: Comprehensive insurance coverage against theft and operational errors
• Client base: 1,800+ institutional clients including banks, hedge funds, exchanges, and asset managers

Fireblocks’ Significance: Fireblocks is the de facto standard for institutional digital asset operations. Its wide adoption means that most institutional investors evaluating tokenized fund products already have Fireblocks infrastructure in place, eliminating a major onboarding barrier.

Anchorage Digital

Anchorage Digital Bank is a federally chartered digital asset bank — the only OCC-chartered crypto custodian in the US. The federal bank charter provides the highest regulatory standard for digital asset custody, equivalent in regulatory rigor to traditional custody banks.

Key Capabilities:

• Federal bank charter status provides unambiguous “qualified custodian” classification under the SEC Custody Rule
• Supports custody of tokenized securities including BUIDL and other Securitize-issued tokens
• Staking, lending, and governance services alongside basic custody
• Insurance through a combination of commercial insurance and Anchorage’s bank capital reserves
• SOC 2 Type II certification for operational security controls

Anchorage’s Significance: For registered investment advisors (RIAs) subject to the SEC Custody Rule, Anchorage’s bank charter provides the clearest qualified custodian status available for digital assets. RIAs holding tokenized fund products through Anchorage can demonstrate Custody Rule compliance with the strongest available regulatory framework.

BitGo

BitGo provides qualified custody through its South Dakota Trust Company charter — making it a state-chartered qualified custodian. BitGo supports multi-signature and MPC custody across Ethereum and other chains.

Key Capabilities:

• Qualified custodian status via South Dakota Trust Company charter
• $250M insurance coverage against theft and operational errors
• Multi-signature and MPC custody options for flexible security models
• API-driven infrastructure for programmatic custody operations
• Portfolio management tools for tracking tokenized fund positions across products

BitGo’s strength is its API-driven infrastructure, enabling corporate treasuries and DAO treasuries to build automated custody workflows — including scheduled subscription/redemption of tokenized fund products — on top of BitGo’s platform.

Copper

Copper’s ClearLoop infrastructure uniquely integrates custody with exchange access, allowing institutions to trade digital assets on centralized exchanges while maintaining segregated custody — the assets never leave Copper’s custody until settlement is confirmed. This “off-exchange” settlement model reduces counterparty risk with exchanges.

Copper supports tokenized securities on Ethereum and is expanding multi-chain capabilities. For tokenized fund investors who also trade other digital assets, Copper’s integrated custody-plus-trading model provides operational efficiency.

BNY Mellon: Traditional Custodian Layer

For BUIDL specifically, BNY Mellon serves as custodian of the underlying Treasury assets — not the tokens themselves. This means BUIDL’s custody operates on two layers:

1. Token Layer: The investor’s custody provider (Fireblocks, Anchorage, BitGo) holds the BUIDL ERC-20 tokens on Ethereum
2. Asset Layer: BNY Mellon holds the US Treasury bills, repurchase agreements, and cash that back the BUIDL tokens

This dual-layer custody model provides institutional comfort: even if the tokenization infrastructure (Securitize) experienced operational failure, the underlying assets remain safely held by BNY Mellon — the world’s largest custodian bank with $46 trillion in assets under custody. The BUIDL deep dive and counterparty assessment evaluate this custody structure in detail.

Self-Custody Options

Hardware Wallets (Ledger, Trezor)

Individual and smaller institutional investors can hold tokenized fund tokens in hardware wallets. Ledger devices (Nano X, Nano S Plus) support ERC-20 tokens — covering all Ethereum-based fund products (BUIDL, OUSG, USDY, USYC, syrupUSDC).

Self-Custody Advantages:

• No counterparty risk with custody providers
• Direct control over keys and transaction signing
• No custody fees (institutional custody costs 5-50 basis points annually)
• 24/7 availability without custodian operational hours

Self-Custody Risks:

• Key loss means permanent, irrecoverable loss of fund positions — there is no “reset password” for blockchain keys
• No insurance coverage against theft (unless separately arranged)
• Does not satisfy SEC Custody Rule qualified custodian requirements for RIAs
• Hardware device failure requires backup seed phrase recovery

Best Practice: Use a hardware wallet connected to MetaMask (via USB or Bluetooth) for signing. Store the seed phrase in multiple secure physical locations (bank safe deposit box, fireproof safe). Never store seed phrases digitally (computer, phone, cloud storage, email).

Software Wallets (MetaMask, Coinbase Wallet)

MetaMask and similar browser wallets provide convenient access for smaller positions and active DeFi integration (e.g., OUSG on Flux Finance). The tradeoff is security: hot wallets (connected to the internet) are vulnerable to phishing attacks, browser exploits, and malware.

Recommended Maximum Positions by Wallet Type:

Multi-Sig Wallets (Gnosis Safe)

DAO treasuries and corporate treasuries frequently use Gnosis Safe multi-signature wallets. Safe requires multiple signers to approve transactions — for example, 3-of-5 authorized signers must approve any fund subscription or redemption. This eliminates single-point-of-failure risk while maintaining on-chain self-custody.

All ERC-20 tokenized fund products are fully compatible with Gnosis Safe. Safe’s batch transaction feature enables atomic multi-step operations — approve USDC, subscribe to fund, verify receipt — in a single multi-sig execution.

Custody Selection Framework

Regulatory Requirements

SEC-Registered Investment Advisors: Must use a qualified custodian under Rule 206(4)-2. Qualified custodian options for tokenized fund products: Anchorage Digital (OCC-chartered bank), BitGo (South Dakota Trust Company), or Coinbase Custody Trust (New York Trust Company). Fireblocks provides the infrastructure but investors should confirm their specific Fireblocks configuration meets qualified custodian requirements.

Non-Regulated Investors: No custodian mandate. Self-custody via hardware wallet is the lowest-cost option, though insurance and operational risk should be weighed against custody fees.

Institutional Fiduciaries: Pension funds, endowments, and foundations should evaluate custody insurance coverage, SOC 2 certifications, regulatory status, and disaster recovery capabilities. The risk metrics analysis includes custody risk as a scoring factor.

Chain Support Verification

The custody provider must support the specific chain where the tokenized fund product is deployed. Critical verification points:

The Ethereum dominance analysis explains why Ethereum custody is the baseline requirement for most tokenized fund investments.

Insurance and Recovery

Custody insurance typically covers theft, employee fraud, and operational errors — but does not cover smart contract exploits, blockchain protocol failures, or issuer default. Investors should understand the specific insurance coverage limits and exclusions of their custody provider.

Insurance Coverage Comparison:

Integration with Tokenization Platforms

The custody provider should integrate with the tokenization platforms used for subscription and redemption. Securitize (for BUIDL) requires the custody wallet to be whitelisted — the custody provider should support the whitelisting workflow. Similarly, Ondo (for OUSG, USDY) requires wallet verification during onboarding.

Fireblocks and Anchorage have the deepest integration with Securitize, enabling seamless BUIDL subscription and redemption workflows from within the custody environment.

Cost Analysis

Institutional custody costs range from 5 to 50 basis points annually, depending on the provider, assets under custody, and services required. For a $10M tokenized fund position earning 3.45% APY (BUIDL), custody costs of 10 basis points reduce effective yield by $10,000 annually — from $346,000 to $336,000. The fee analysis includes custody costs in the total cost of ownership framework.

Regulatory Requirements for Custody of Tokenized Securities

The SEC Custody Rule (Rule 206(4)-2 under the Investment Advisers Act) requires registered investment advisers to maintain client assets with a “qualified custodian.” For tokenized fund tokens classified as securities, institutional investors using RIAs must custody their BUIDL, OUSG, BENJI, or USYC tokens with qualified custodians rather than self-custody wallets. Qualified custodian status is held by banks (BNY Mellon, State Street), broker-dealers (Securitize Markets), and trust companies (Anchorage Digital, BitGo).

SAB 121, issued by the SEC, requires entities that safeguard crypto-assets for platform users to report those assets as liabilities on their balance sheet. While subsequent amendments have partially relaxed this requirement for certain banking institutions, the guidance affects how custody providers price their services and structure their offerings for tokenized fund products. Institutional investors should verify that their chosen custodian’s compliance with current SEC guidance is appropriate for their regulatory obligations.

Insurance and Recovery: Protecting Against Key Loss

For self-custodied tokens, key loss represents the primary operational risk. A lost private key means permanent loss of access to tokenized fund tokens — unlike traditional fund shares which can be recovered through identity verification with the fund administrator. Multi-signature wallets (requiring 2-of-3 or 3-of-5 key holders to authorize transactions) mitigate this risk for institutional holders. Securitize and issuer platforms can implement recovery mechanisms for permissioned tokens — if a verified investor loses wallet access, the issuer can freeze the tokens and reissue them to a new wallet after identity verification. This recovery capability is unique to permissioned tokens and unavailable for permissionless DeFi positions.

Custody Provider Selection: Decision Framework

When selecting a custody provider for tokenized fund products, institutional investors should evaluate regulatory status (OCC-chartered bank, state trust company, or broker-dealer registration), chain support breadth (Ethereum minimum, plus any alternative chains where target products are deployed), insurance coverage limits and exclusions, integration depth with tokenization platforms like Securitize, and total cost relative to portfolio yield. At current rates, custody costs of 10-50 basis points represent 3-14% of gross yield — a significant consideration when evaluating the total cost of ownership for tokenized fund positions.

The buying guide includes custody setup instructions for each product. The platform comparison maps product-custody compatibility. For comprehensive risk assessment including custody risk factors, see risk metrics. For the counterparty assessment evaluating custodian quality, see the counterparty analysis. For TVL data, see the TVL tracker. For yield data, see the yield monitor.