Custody arrangement review: what the decision maker looks at

A custody arrangement review is the check a receiving party runs before it agrees to hold tokens, or let a third party hold them, for an issuer. The decision maker checks four things: key control, loss cover, counterparty formation, and whether records match daily practice. The review ends in approval, conditional approval, or refusal.

What happens at each stage

The review runs in four stages. Each stage has its own owner and its own file to close before the next one opens.

Stage	What the reviewer checks	Typical duration
Intake	Corporate documents, ownership chain, source of funds	2–4 business days
Technical review	Key management model, wallet architecture, backup procedure	5–10 business days
Risk sign-off	Insurance or indemnity cover, incident history, exposure limit	3–5 business days
Decision	Approval, conditions, or refusal issued in writing	1–2 business days

The point of no return sits between technical review and risk sign-off. Once risk sign-off starts, withdrawing the file and resubmitting later means starting intake again, not resuming where it stopped.

What to prepare

Six steps carry a file from a blank folder to a signed arrangement. Each step has a named owner.

The issuer's legal team assembles corporate documents: incorporation certificate, register extract, beneficial ownership chart.
The compliance officer commissions a background check on the receiving custodian, covering licensing history and enforcement record. Where the check touches personal data of individual signatories, run a Legitimate interest assessment overview first.
The technical lead documents the key management model: who holds signing keys, how many signatures are required, and where backups sit.
The finance function confirms insurance or indemnity cover and states the exposure limit that applies to this counterparty.
The legal team drafts the custody agreement and routes it for internal sign-off before it reaches the counterparty.
The compliance officer logs the file and sets a review date, typically twelve months out.

A file missing any one of these items stalls at intake. The reviewing side does not chase missing documents; it pauses the clock and waits.

Who decides

The decision sits with the receiving side's risk and compliance function. For exposure above the counterparty's internal threshold, the file moves to a credit or investment committee for a second signature. Neither body publishes reasons for a refusal. The issuer receives a short written outcome and, where relevant, a list of conditions to meet before resubmission.

If your situation differs

If you are appointing a third-party custodian rather than keeping custody in-house, add one step: request the custodian's own segregation policy before signing anything that references it.

If custody stays in-house, the same four-stage review runs against the issuer's own key-holders instead of an outside party. The risk sign-off stage still applies; an internal arrangement is not exempt from it.

If the counterparty sits outside the EU, add extra time for document legalisation and translation. The intake stage alone can run twice as long as the table above suggests.

What this review does not cover

This review answers one question: is this custody arrangement safe enough to sign. It does not answer whether the counterparty behind it is trustworthy on its own terms; that sits with a Counterparty report before appointing a developer.

It does not check whether a document the other side produced actually proves what it claims once filed locally; see Document in Lithuania and its limits.

It does not confirm what a counterpart's home jurisdiction can or cannot establish about its own standing; that question belongs to Jurisdiction in Estonia.

Verified

Verified: 6 May 2025. This page describes procedural practice observed across custody reviews run for clients. It is not a summary of a statutory requirement, and no single external source covers the sequence in full.

FAQ

How long does custody arrangement review take in practice?

Most reviews close in two to four weeks from a complete file. A file with multiple signatories, cross-border counterparties, or missing documents can run six to eight weeks. The clock starts on the day the file is complete, not the day the request arrives.

Which documents are needed to start?

The file needs the counterparty's incorporation documents, a register extract, a beneficial ownership chart, and a description of the key management model. Missing any one of these pauses the intake stage until it arrives.

What happens if the other side does not respond?

The file stays open for a fixed period, typically thirty days, after which the reviewing side closes it as withdrawn. A closed file can be reopened, but the review restarts from intake rather than resuming where it stopped.