FINMA Publishes Guidance on the Risks Associated With the Custody of Cryptobased Assets – Outlook for Regulated Swiss Financial Institutions

A. Introduction

Swiss supervised institutions, such as banks, securities firms, managers of collective assets and portfolio managers, have increasingly extended their service offering to include services relating to cryptobased assets, including cryptocurrencies such as Bitcoin and Ether (Crypto Assets), in particular in the areas of trading, custody and portfolio management services. The provision of custody and other services relating to Crypto Assets heavily relies on the distributed ledger technology. Crypto Assets and services related thereto are consequently subject to specific technology related operational risks, such as the risk of cyber-attacks or inadequate protection of private keys. In addition, the utilized custody arrangements, in particular if sub-custodians domiciled outside of Switzerland are used, may expose Swiss supervised institutions and their clients to considerable counterparty risks.

In light of the increased activities by Swiss supervised institutions in the area of Crypto Assets and the pertaining risks, on January 12, 2026, the Swiss Financial Market Supervisory Authority FINMA (FINMA) published the «FINMA Guidance 01/2026 – Custody of cryptobased assets» (FINMA Guidance Custody of Crypto Assets) under which it outlines the regulatory risks discovered in the context of FINMA’s supervision that are associated with the custody of Crypto Assets and clarifies its regulatory practice with regard to the supervisory operational and credit risk management requirements relating thereto.

In addition to generally stipulating that supervised institutions must adequately address the operational risk resulting from the provision of services related to Crypto Assets by putting in place a robust technical infastructre and sufficient internal expertise, under the FINMA Guidance Custody or Crypto Assets, FINMA specifcally clarifies which measures it expects Swiss supervised institutions to implement to address the concrete risks resulting from custody arrangements relating to Crypto Assets.

B. Overview of the Requirements Set Out Under the Finma Gudinace Custody of Crypto Assets

The FINMA Guidance Custody of Crypto Asstes specifically set outs FINMA’s supervisory practice in the areas of (i) custody services provided by Swiss licensed banks, (ii) portfolio management services relating to Crypto Assets, (iii) the management of collective assets under the Federal Act on Collective Investment Schemes (CISA) and (iv) the offering of exchange traded products (ETPs) with Crypto Assets as underlyings.

1. Custody of Crypto Assets by a Bank

Under the current banking insolvency regime (article 37 of the Federal Act on Banks and Savings Institutions (FBA) in conjunction with article 16 no. 1 FBA), Swiss banks can offer their clients custody arrangements in relation to Crypto Assets under which the segregation of the respective Crypto Assets can be ensured in a bankruptcy scenario. Under the FINMA Guidance 08/2023 – Staking (FINMA Guidance Staking) (see also Homburger Bulletin – FINMA Issues Guidance on Staking Services of December 2023), FINMA previously clarified the regulatory requirements which a custody arrangement offered by a bank must satisfy in order to ensure the segregation of Crypto Assets held in custody. Pursuant to the FINMA Guidance Staking, Crypto Assets held by a bank in custody for its clients can be segregated in bankruptcy if (i) the Crypto Assets are held in custody (aa) individually segregated on a client level and (bb) subject to the custodian’s obligation to ensure their immediate availability or (ii) the Crypto Assets are held in custody (aa) in an omnibus account but with records of each client’s fractional share and (bb) subject to the bank’s obligation to ensure their immediate availability. In contrast, if Crypto Assets are held by bank in custody (a) in an omnibus account and with no records of each client’s fractional share or (b) not subject to the bank’s obligation to ensure their immediate availability, such Crypto Assets are not capable of being segregated in bankruptcy proceedings.

Under the FINMA Guidance Custody of Crypto Assets, FINMA has reiterated its previous stance and, in particular, confirmed that Crypto Assets held in custody by a bank that are held under a custody arrangement that ensures segregation of such assets, do from a regulatory perspective not qualify as balance sheet assets of the bank and are as a consequence not subject to the capital adequacy requirements set out under the Federal Capital Adequacy Ordinance (CAO).

Banks will, however, under the custody set up offered to its clients often utilize third-party custodians either in Switzerland and/or abroad. Pursuant to the FINMA Guidance Custody of Crypto Assets, no capital requirements under CAO will apply in the context of a sub-custody arrangement involving a sub-custodian abroad if conditions equivalent to the segregation requirements under Swiss law are met. For third party sub-custody arrangement utilized by Swiss banks this means that (i) the foreign third-party custodian must also subject to prudential supervision and (ii) the applicable foreign bankruptcy laws ensure a segregation of the Crypto Assets held in custody in favor of the Bank (and/or its clients) in the bankruptcy of the sub-custodian.

2. Portfolio Management Services relating to Crypto Assets

Pursuant to article 24(1) of the Financial Institutions Ordinance (FinIO), portfolio managers licensed by FINMA under article 17 et seq. of the Swiss Financial Institutions Act (FinIA) must ensure that client assets entrusted to them are held in custody, segregated on a client-per-client basis, with a Swiss bank, a Swiss securities firm, a Swiss DLT trading facility, or a foreign financial institution subject to equivalent prudential supervision.

According to the FINMA Guidance Custody of Crypto Assets, these requirements also apply to Crypto Assets, including cryptocurrencies such as Bitcoin and Ether. This position taken by FINMA is noteworthy given that portfolio management activities relating to cryptocurrencies and other Crypto Assets that do not qualify as financial instruments within the meaning of the Federal Act on Financial Services (FinSA) do not, as such, trigger the licensing requirements applicable to portfolio managers.

Pursuant to the FINMA Guidance Custody of Crypto Assets, portfolio managers must carefully select the custodians for Crypto Assets. In particular, Crypto Assets must be held with institutions that are subject to prudential supervision, have adequate technical infrastructure and expertise, and ensure bankruptcy protection and segregation of client assets in the event of insolvency. Where custody is provided outside Switzerland, portfolio managers must verify that the applicable foreign supervisory regime and insolvency framework are equivalent to Swiss standards, including with respect to the effective segregation of Crypto Assets in bankruptcy proceedings. It is noteworthy that FINMA does not mention insurance solutions that would fully protect the clients as a possible alternative.

While FINMA expects portfolio managers to adjust custody arrangements that do not comply with these requirements, it acknowledges that legacy arrangements may exist. By way of exception, existing custody arrangements need not be adjusted where (i) foreign custodians are subject to equivalent prudential supervision but no equivalent bankruptcy protection is available, or (ii) custody is provided by Swiss custodians registered with a self-regulatory organization (Selbstregulierungsorganisation) pursuant to article 14 of the Swiss Anti-Money Laundering Act where bankruptcy protection pursuant to article 242a of the Swiss Debt Enforcement and Bankruptcy Act is ensured, but prudential supervision is lacking, provided in each case that the portfolio manager has, cumulatively, (a) comprehensively informed clients of the increased custody risks associated with the existing custodian, in particular insolvency risks, (b) informed clients of alternative suitable custodians in Switzerland and abroad, and (c) obtained and documented the client’s explicit written consent to the continued use of the non-compliant custodian.

Finally, FINMA states that the custody requirements applicable to Crypto Assets may not be circumvented through the use of foreign structures. In particular, where a Swiss portfolio manager invests, on behalf of its clients, in a foreign collective investment scheme for which it acts as sponsor or asset manager, it must ensure that the custody requirements set out in article 24 para. 1 FinIO also apply to the investments made by such foreign collective investment scheme in Crypto Assets.

3. Management of Collective Assets under CISA

According to article 73 para 1 CISA the assets of a Swiss collective investment scheme must be held in custody by a Swiss custodian bank (Depotbank). In accordance with article 73 paragraph 2 CISA, the custodian bank may delegate the safekeeping of assets to a third-party custodian or a central securities depository in Switzerland or abroad, provided that such delegation is appropriate. In such cases, investors must be informed in the fund prospectus and in the key information document of the risks associated with the sub-custody arrangement. Moreover, with respect to financial instruments in which a Swiss collective investment scheme has invested, sub-custody may be delegated only to supervised third-party custodians or central securities depositories (article 73 para. 3 CISA).

According to the FINMA Guidance Custody of Crypto Assets, the requirements set out in article 73 CISA also apply to direct investments in Crypto Assets by Swiss collective investment schemes. Based on this, FINMA concludes that Crypto Assets must, as a rule, be held in custody by a Swiss custodian bank and that any delegation of custody by such Swiss custodian bank is permissible only to a third-party custodian subject to equivalent prudential supervision. Consequently, even where a Crypto Asset does not qualify as a financial instrument within the meaning of FinSA –such as cryptocurrencies like Bitcoin or Ether – it may only be held in sub-custody only with a supervised custodian. This supervisory position goes beyond the wording of article 73 paragraph 2 CISA.

4.  Offering of ETPs with Crypto Assets as Underlying

ETPs with Crypto Assets as underlying are typically issued in the form of tracker certificates which establish a synthetic exposure to the respective underlying. ETPs can be admitted to trading at SIX Swiss Exchange or BX Swiss, in each case in compliance with the applicable listing rules.

ETPs qualify as structured products within the meaning of article 3 lit. a Nr. 4 FinSA. Pursuant to article 70 FinSA, the issuance of structured products to retail clients by special purpose vehicles is permitted if (i) such products are offered by prudentially supervised institutions in accordance with Article 70 para. 2 FinSA, (ii) a legally enforceable guarantee is granted by a prudentially supervised financial intermediary in accordance with Article 70 para. 1 FinSA in relation to the payment obligations of the issuing special purpose vehicle or (iii) a legally enforceable real security is provided in favor of the investors.

ETPs with Crypto Assets as underlying are typically issued by special purpose vehicles, with the requirements pursuant to article 70 FinSA being met by granting the investors an enforceable security interest, such as a pledge, over the underlying Crypto Assets (or the redemption claim relating thereto). The Crypto Assets subject to the investors› security are oftentimes held by third party custodians domiciled outside of Switzerland.

Under the FINMA Guidance Custody of Crypto Assets, FINMA, in particular, states that custody arrangements underlying the collateral set-up of ETPs, may pose certain risks. However, FINMA acknowledges that these risks have been addressed for listed ETPs under both SIX Swiss Exchange’s and BX Swiss› regulations, as under the applicable listing requirements, the Crypto Assets serving as collateral for the investors in an ETP must be held by a Swiss custodian adequately licensed to provide such custody services or by a foreign custodian subject to equivalent supervision (see also Homburger Bulletin – SIX Publishes New Directive in Crypto Assets as Underlying Instruments of February 2024). In the FINMA Guidance Custody of Crypto Assets, FINMA further clarifies that «real» security pursuant to Article 70 para. 1 FinSA and Article 96 of the Ordinance on Financial Services, in FINMA’s view, requires legal protection in the event of the insolvency of the custodian of the security.

C. Outlook

The FINMA Guidance Custody of Crypto Assets provides helpful clarification with regard to custody arrangements offered and/or used by Swiss supervised institutions:

• Banks: The clarifications set out by FINMA in relation to Crypto Assets held in custody by Swiss banks is substantially in line with FINMA’s existing regulatory practice and the arrangements, including regarding outsourcing, utilized by banks in the Swiss market. However, the additional considerations published by FINMA with regard to the use of sub-custodians may lead to a need for banks to review their third-party sub-custody arrangements and the pertaining Digital Asset Resolution Plan (DARP). Under FINMA’s current (unpublished) practice, FINMA applies a risk-weight of approximately 800% to Crypto Assets held on the balance sheet of a bank when calibrating the applicable risk-weighted capital requirements. Due to these considerable capital requirements (which for many Swiss banks prevent them from engaging in on-balance sheet activities relating to Crypto Assets) it will, in particular, be worthwhile for Swiss banks to review their third-party sub-custody arrangements with non-Swiss custodians and to ensure that the applicable bankruptcy regime in connection with the utilized contractual framework provides for a robust protection of the Crypto Assets held in sub-custody outside of Switzerland. In view of the considerable capital requirements applicable to Crypto Assets held on-balance sheet, banks may want to take the necessary precautions to avoid any uncertainties regarding the treatment of such Crypto Assets in a bankruptcy of a sub-custodian.
• Portfolio Managers: Portfolio managers who invest in Crypto Assets on behalf of their clients must review the existing custody arrangements of their clients to ensure compliance with the FINMA Guidance Custody of Crypto Assets. This requires an analysis of the relevant custodians› regulatory status and insolvency framework, as well as a review of their technical infrastructure and expertise. Where legacy custody arrangements may be continued without modification under FINMA’s Guidance Custody of Crypto Assets, portfolio managers must inform their clients of the risks associated with such custody arrangements and of potential alternatives, and must obtain the clients› consent to the continued use of such custody arrangements
• Collective Investment Schemes: Any Swiss collective investment scheme or its custodian bank that does not yet comply with the custody requirements for crypto-based assets set out in the FINMA Guidance Custody of Crypto Assets must adapt its arrangements accordingly. As the FINMA Guidance Custody of Crypto Assets does not allow for any transitional period, these adjustments must be implemented as soon as possible.

Finally, as the FINMA Guidance Custody of Crypto Assets ultimately only codifies FINMA’s supervisory practice, the requirements set out thereunder apply immediately, with no formal transitional periods applying.