Crypto custody for banks in the EU needs no separate licence, because a bank can offer it to its own clients by notification. Under MiCA Article 60 (MiCA is the EU Markets in Crypto-Assets Regulation), a credit institution notifies its home regulator at least 40 working days before it starts, and the regulator checks whether the file is complete. It does not grant a licence.
The hard decisions sit elsewhere: whether to build the key infrastructure or rent it, how much capital crypto ties up, and how long launch really takes. Below, each is answered from the regulation text, the ESMA register and what BNY, BBVA and Deutsche Bank have done so far.
Key moments
In short
- A bank offers crypto custody by notification, not authorisation: 40 working days before launch, with a 20-working-day completeness check (MiCA Art. 60).
- The custody rules are the same as for any provider: client agreement, register of positions, a statement at least every three months, three layers of segregation and liability for lost assets (MiCA Art. 75).
- The heavy capital charge, a 1,250% risk weight and a cap of 1% of Tier 1 capital, is written for crypto the bank holds itself (CRR Art. 501d). How segregated client assets are treated is a question for your supervisor.
- At least 128 entities in the ESMA register are labelled "Article 60" as of the 20 October 2026 update, most of them German; 27 list custody, and about 19 of those are banks.
Do banks need a CASP licence to offer crypto custody?#
No. A CASP is a crypto-asset service provider authorised under MiCA, and banks are exempt from that route. MiCA Article 60(1) says a credit institution "may provide crypto-asset services if it notifies the information referred to in paragraph 7 to the competent authority of its home Member State at least 40 working days before providing those services for the first time" (Regulation (EU) 2023/1114).
The regulator then has 20 working days to check whether all required information is there (Art. 60(8)). If something is missing, it asks for it and sets a deadline of up to 20 working days. The clock stops until that deadline. You cannot start while the file is incomplete. Article 60 contains no express power to approve or refuse. Article 60(10) also lifts several CASP articles for banks: applications, refusal, withdrawal, qualifying holdings and capital. Banking law already covers those.
ESMA's Q&A 2088 of 29 January 2024 confirms the scope: "A credit institution can provide any crypto-asset services on the basis of an Article 60 notification." It adds two warnings. A bank with no licence for a type of service may struggle to supply the information for it. And the notification must fit national banking rules, which differ by country.
So the notification is fast on paper. The work is in the file.
What goes into an Article 60 notification?#
Article 60(7) lists the information. Delegated Regulation (EU) 2025/303 sets out the detail. Implementing Regulation (EU) 2025/304 sets the forms. Both were published in the Official Journal on 20 February 2025. The programme of operations must cover the structure of the business, target clients, marketing channels and capacity for three years.
| Article 60(7) item | What the regulator wants | Needed for custody? |
|---|---|---|
| (a) Programme of operations | Which services, where and how they are marketed | Yes |
| (b) AML/CFT controls | Internal controls, ML/TF risk assessment, business continuity plan | Yes |
| (c) ICT documentation | Technical description of systems and security, plus a non-technical summary | Yes |
| (d) Segregation procedure | How client crypto-assets and funds are kept apart | Yes |
| (e) Custody and administration policy | How keys and assets are held | Yes |
| (j) Type of crypto-assets | Whether services relate to e-money tokens, asset-referenced tokens or other crypto-assets | Yes |
| (k) Transfer services | How transfers for clients are carried out | If you offer transfers |
Items (f) to (i) apply only to trading platforms, exchange, execution and advice. A custody-only bank skips them. Items (c) and (e) are where most of the work sits, because they describe infrastructure you either built or rented.
What MiCA requires from a bank that holds client crypto#
Once live, a notified bank follows the same custody rules as an authorised CASP. They sit in MiCA Article 75 and look familiar to anyone from securities custody, with one difference: what you protect is a private key, the secret that moves the asset on the blockchain.
The client agreement (Art. 75(1)) must state at least the parties, the service, the custody policy, how you communicate with and authenticate the client, the security systems, fees and charges, and the applicable law.
Records come next (Art. 75(2), (3) and (5)): a register of positions in the name of each client, and a statement of positions "at least once every three months and at the request of the client". The custody policy must minimise the risk of loss "due to fraud, cyber threats or negligence", and clients can ask for a summary of it.
Segregation (Art. 75(7)) has three layers. Client holdings are kept apart from the bank's own, held separately on the blockchain itself, and legally segregated so that the bank's creditors have no recourse to them. Operational segregation comes on top. Article 70 adds a general duty to protect clients' ownership rights in insolvency and forbids using client crypto for the bank's own account.
On liability (Art. 75(8)), the bank answers for loss of crypto-assets, or of the means of access to them, caused by an incident attributable to it. The liability is "capped at the market value of the crypto-asset that was lost, at the time the loss occurred." Problems inherent in a blockchain that the bank does not control are excluded.
Supervisors are already testing these controls at authorised CASPs. In July 2026 ESMA launched a common supervisory action on custody: "The CSA will assess the maturity of CASPs' digital operational resilience frameworks in relation to custody activities." It covers keys and storage, transaction controls, incident response and reliance on third parties. The work runs from late 2026 into 2027, with a report in the second half of 2027. Banks are not named in the action, but expect the same questions.
How much capital does crypto custody cost a bank?#
Probably less than most boards fear, as long as the bank holds crypto only for clients. The EU capital rule for crypto is Article 501d of the Capital Requirements Regulation, and it is about the bank's own holdings. MiCA-compliant asset-referenced tokens backed by traditional assets get a 250% risk weight. All other crypto gets 1,250%, and total exposure to it is capped at 1% of Tier 1 capital. Tokenised traditional assets are treated like the asset they represent.
Client assets held in custody under Article 75(7) are legally segregated from the bank's estate. The usual reading is that they are not the bank's own crypto exposure, but Article 501d does not carve them out in so many words. They do carry operational risk. The Basel Committee's crypto standard (SCO60, effective 1 January 2026) applies its operational-risk sections to "custodial services involving the safekeeping or administration of client cryptoassets on a segregated basis". That risk goes through the standard operational-risk approach. EU texts do not spell out a separate custody charge. Ask your supervisor how they read it before you size the business case.
The rules may still change. On 20 May 2026 the Basel Committee said it "has expedited a review of targeted elements of its prudential standard for banks' cryptoasset exposures". We found no published outcome by the end of October 2026.
Build or rent: which model fits crypto custody for banks?#
There are three ways to do it, and banks that went live use all three.
Build your own key platform#
The bank runs its own key management, wallets and controls. BBVA said in March 2025 that its Spanish crypto service uses "its own cryptographic key custody platform". BNY runs its own Digital Asset Custody platform, launched in 2022 and extended to select EU institutions in October 2026. This model gives the most control and the longest path. The bank owns the security design, the audits and the people.
License the technology, stay the custodian#
The bank remains the custodian in law and in the register, but its key infrastructure comes from a technology vendor. In this model the vendor supplies the software, and the bank writes the policies and carries the liability. Deutsche Bank has a long-standing technology partnership with Taurus and, according to Bloomberg in July 2025, planned to launch custody in 2026, reportedly with Bitpanda.
Delegate custody to an authorised CASP#
Article 75(9) allows a custody provider to use another provider, but "only make use of crypto-asset service providers authorised in accordance with Article 59", and the client must be told. A bank can also offer custody through a licensed provider that acts as the custodian, while it keeps the customer relationship and the banking app. Whether the bank still needs its own notification in that set-up, for example for passing on client orders, is a question for counsel.
| Model | Who holds the keys | What the bank builds | Time to launch (vendor estimate) | Verdict for a mid-size bank (our view) |
|---|---|---|---|---|
| Build own platform | The bank | Key management, wallets, security, audits, operations team | 12 to 24 months | Depends |
| License technology | The bank, on vendor software | Policies, integration, operations; vendor supplies the stack | 2 to 6 months for white-label | Works |
| Delegate to authorised CASP | The licensed provider | Client channel, onboarding, statements | 1 to 3 months | Works |
The time ranges come from Liminal, a custody vendor, in a July 2026 article (its "outsourced" category is mapped here to delegation); it also puts white-label setup costs at 500,000 to 2 million USD depending on scope. Treat them as one vendor's estimate, not a benchmark. We found no independent study of bank custody build costs.
What does crypto custody cost to run?#
We found no public price list from a custody vendor that serves banks, and no bank has disclosed what its custody build cost. Ask instead about the cost drivers that decide your number:
- licence or platform fee for the key infrastructure, and how it scales with assets and wallets;
- hardware security modules or multi-party computation setup, and who runs them;
- independent security audits and assurance reports, every year;
- insurance for lost or stolen keys, if any insurer will cover your setup;
- staff for operations, monitoring and incident response, around the clock;
- blockchain connectivity and Travel Rule messaging for transfers.
Which banks already offer crypto custody in Europe?#
Dozens, most of them in Germany. In the ESMA interim MiCA register (CASP file, last record update 20 October 2026), at least 128 entities are labelled "Article 60 - Notification", and 109 of their 131 service rows are in Germany. They include investment firms, brokers and e-money institutions as well as banks. Twenty-seven list custody, and about 19 of those are banks. This is a lower bound: the legal-basis field is empty for many rows from France, Cyprus, Malta, Luxembourg and Ireland.
| Bank | Regulator | Register date | Custody setup | Status |
|---|---|---|---|---|
| BNY SA/NV | National Bank of Belgium | 20 Jul 2026 | Own platform; BTC, ETH, SOL, USDC | Live, could start 27 Jul 2026 |
| BBVA | CNMV (Spain) | 5 Mar 2025 | Own key platform; BTC and ETH | Small client group from March 2025, then all private customers |
| Deutsche Bank | BaFin | 12 Oct 2026 (register dates conflict) | Vendor technology | Notified; launch not announced |
| Commerzbank | BaFin | 7 Apr 2025 | Not disclosed | Notified |
| DekaBank | BaFin | 1 Dec 2025 | Not disclosed | Notified |
| DZ BANK | BaFin | 23 Dec 2025 | Not disclosed | Notified |
The BNY row shows what happens after the completeness check. The register does not show when BNY filed, but its comment says the National Bank of Belgium confirmed completeness on 20 July 2026 and that BNY "could start to offer its crypto-asset services" from 27 July. BNY's Head of Europe, Jennifer Barker, framed the October launch with one line: "Digital asset adoption is accelerating across Europe."
Do bank clients want crypto custody at all?#
Some do, and they would rather use their bank. A study of 6,000 investors in Germany, Italy, Spain and France was published on 21 April 2026. In it, 35% said they could imagine changing banks for better crypto investment options. The study was run by Boerse Stuttgart Digital, which sells crypto custody to banks, so read it as a signal, not a market size. The wider market is large too: stablecoins pegged to the US dollar were worth about 302 billion USD on 29 October 2026, according to DeFiLlama.
Where the Article 60 route does not help#
Where the Article 60 route does not help
- It changes nothing about capital for crypto the bank holds itself: 1,250% risk weight and a 1% Tier 1 cap still apply.
- The bank carries liability for lost assets up to their market value at the time of loss, whatever vendor it uses.
- National rules transposing the Capital Requirements Directive still apply and differ by country.
- An incomplete file stops the clock; the service cannot start until the regulator has everything.
- Whether a notification covers services in other EU countries without more filings is a legal question to settle with counsel and your regulator.
How to launch crypto custody for banks in six steps#
- Decide the scope: custody only, or custody plus buying, selling and transfers. Each added service adds items to the notification and the operating model.
- Choose the model: build, license technology, or delegate to an authorised CASP. The choice decides who writes items (c) and (e) of the file.
- Check capital: confirm with your supervisor how client custody and any own crypto holdings are treated, and whether the 1% Tier 1 cap matters for your plans.
- Write the file against Article 60(7), Delegated Regulation 2025/303 and your regulator's form. Plan for at least 40 working days after submission.
- Prepare the client side: agreement, register of positions, quarterly statements and the process to return assets.
- Test incident response and key recovery before launch. ESMA's 2026 supervisory action checks these controls at authorised CASPs, and bank supervisors are likely to ask the same.
Banks that would rather not run custody at all can still add crypto as a new service for their clients. With ItisPay, you build the client experience on our API under your own brand. Custody sits with our EU-licensed CASP + Payment Institution partner, which holds the authorisation, runs KYC and carries the regulatory obligations. Your bank keeps the customer relationship; the partner holds the assets.
This article is for informational purposes only and does not constitute legal or regulatory advice.
