Custody's Real Problem Isn't Security Anymore: 30% of Off-Exchange Crypto Is Trapped Behind Bank Workflows

I've had the same conversation three times this month. A bank, a mid-size fund, a brokerage that will stay nameless. Different balance sheets, different cities, identical complaint. Their crypto custody works. Their operations don't.

Here's what that actually looks like. The wallet is secure. The keys live in a hardware module, the approval quorum is enforced, the insurance policy is signed and countersigned. Then someone on the treasury desk needs to move a tokenized Treasury bill at 2 a.m. on a Sunday and the sign-off routes through three people asleep in two time zones. The asset is safe. It's also stuck.

That gap is the story now. Boston Consulting Group ran a study for Ripple, and the October 21 writeup of it makes a point I think is correct and also commercially convenient for the company that paid for it. Security has become table stakes. What buyers actually judge is governance, interoperability, and whether the thing plugs into the settlement, payments and treasury systems they already run.

The number buried in the research is worth circling. More than 30% of digital assets outside centralized exchanges are held through institutional custody models. Treat that as an estimate from commissioned work, not a wallet-by-wallet census. Nobody keeps a global registry of who holds what. But even as an estimate it reshapes the argument, because nearly a third of the off-exchange float is sitting in bank-shaped boxes and those boxes are being graded on features, not vault doors.

The keys aren't the point

Walk through the mechanics of a real institutional trade and the friction shows up fast.

A fund wants to buy a tokenized money market position. The custodian holds the asset. The settlement leg runs through a separate provider. The treasury system needs a position file by 6 a.m. so the risk desk can calculate exposure. In a traditional setup, that file arrives from a single bookrunner and everyone downstream reconciles against it. In crypto, it arrives as three CSVs, a webhook, and someone's spreadsheet. The asset settles in seconds. The reporting takes days.

This is why policy controls keep coming up in every RFP I hear about. Banks don't want a wallet. They want a permissions engine that mirrors the one they already have. Trading limits per desk. Pre-approval thresholds in basis points of AUM. Segregated mandates so the stablecoin desk can't touch the tokenized bond allocation. The structure employs a shared orchestration layer in some designs, where a single dashboard sits on top of three custodians underneath and routes each order to whichever one holds the mandate for that asset class.

Others want it integrated, one throat to choke, one invoice, one relationship manager. Both models are being sold right now. Neither has won.

And here's the part that gets skipped. Ripple sells custody infrastructure. Of course its research frames custody as the center of gravity. Read the report with that in mind. The commercial interest doesn't make the argument wrong, though. It just means you should check who benefits before you nod along.

Where the money actually goes

Pull the camera back and the stakes get clearer.

BCG's own long-range projection put tokenized illiquid assets at roughly $16 trillion by 2030. Whether that lands or not, the direction is set, and every one of those dollars needs a place to sit that a compliance officer will sign off on. Stablecoin float, now measured in the hundreds of billions, needs the same treatment. So does the corporate treasury money that's been creeping into short-duration crypto products over the last eighteen months.

Wall Street is moving. Quietly.

The winners in this framing aren't the vaults. Vaults are commoditized. The winners are whoever owns the connective tissue, the layer that turns a blockchain settlement into something a controller can book before lunch. That's a software business with software margins, and it's a very different business than the one custody providers have been running for the last five years.

The losers are the sub-scale pure-plays. If your entire pitch is cold storage and an insurance certificate, you're selling a feature that three larger competitors bundle for free. There are dozens of these firms. Most of them will be acquired or absorbed.

So who's actually ahead? Probably the custodians that already sit inside bank procurement cycles, boring as that sounds. A firm with an existing master services agreement and a SOC 2 report from 2021 has a shorter path to a signed contract than a crypto-native with better tech and no relationship. Procurement beats product more often than anyone in this industry likes to admit.

My honest read

Two things worth acting on.

First, if you're evaluating custody providers, stop leading with security questions. Everyone passes that test now, or they're out of business. Ask for the approval workflow diagram. Ask how a limit breach is logged and who sees it. Ask what happens to a pending transaction when the primary custodian has an outage at 3 a.m. on a holiday. Those answers separate the real operators from the demo-ware.

Second, expect consolidation and price it in. Custody fees have been compressing for three years and the compression isn't done. The providers that survive will charge less for storage and more for the integration layer, because that's where the switching costs live. If you're negotiating a contract this quarter, push for the integration work to be scoped and priced now, before you're locked in and the renewal conversation starts from a weaker position.

The uncomfortable question for the industry is this. If security is settled and the real barrier is operational integration, then custody isn't a crypto problem at all. It's an enterprise software problem that happens to touch a blockchain. And enterprise software has a habit of producing two or three dominant vendors and a long tail of also-rans.

Most of the custody market is in that long tail right now. The first transaction of its kind is easy to announce. The ten-thousandth, processed on a Tuesday, reconciled to the general ledger, and approved by a committee that never thinks about it again, is the one that matters.