A wallet balance answers how much a system reports. It does not, by itself, explain who can authorize a transfer, what rights the account holder has or what happens if a service provider fails. Custody review becomes clearer when those questions are examined separately.
Control of keys and control of the account
A crypto wallet manages the credentials used to authorize transactions; the assets are recorded on the relevant ledger. With self-custody, responsibility for protecting and recovering access rests with the holder. Third-party custody delegates some of those responsibilities to a provider. The SEC’s custody basics bulletin explains these distinctions and the tradeoffs between connected and offline wallets.
Offline key storage can reduce exposure to some online threats, while introducing physical protection and recovery considerations. A strong password for an account is a different control from safeguarding the keys that move assets. Both can matter, and neither label alone describes the entire arrangement.
| Layer | Central question | Relevant evidence |
|---|---|---|
| Technical control | Who can authorize a movement? | Signing authority, recovery process and access records |
| Contractual rights | What does the account holder own or claim? | Agreement, asset-use permissions and withdrawal terms |
| Counterparty condition | Can the provider meet its obligations? | Financial information, liabilities and assurance scope |
The agreement explains the financial relationship
Holding assets for safekeeping is different from borrowing them or using them as collateral. A review should identify whether a provider may lend, pledge or otherwise use customer assets, and whether assets are separated from its own property. The relevant entity and agreement matter as much as the familiar name on the application.
The SEC’s crypto asset investor alert describes risks from platform failures, withdrawal restrictions and incomplete protections. Those observations make the contract a practical starting point: identify the claim, access conditions and consequences of provider distress. A segregation statement should be examined with the applicable agreement and legal structure, rather than treated as an unconditional promise of recovery.
Read what an assurance report actually covers
A proof-of-reserves report may address selected assets at a particular time. It does not automatically provide a complete account of liabilities, encumbrances or financial condition. The SEC’s bulletin on alternatives to financial statement audits explains why these reports are not equivalent to a full financial statement audit.
Useful distinctions include the entity covered, reporting date, assets and obligations examined, standards used and level of assurance. An audit also has a defined scope and date; it is not a guarantee against future failure. The relevant question is which uncertainty a report addresses and which remains.
Follow a withdrawal through the process
A practical review can trace an ordinary withdrawal and an interrupted one: who requests it, who approves it, what information is checked and how an exception is resolved. Comparing those steps with the agreement, account records and provider disclosures gives a more complete picture than a balance screenshot or a security slogan.