Three Shifts Reshaping Crypto Custody in Switzerland
By Rene Philippe Raymond Dubout, Founder at FintechLex
Holding crypto for clients looks simple until somebody asks who owns the coins if the custodian fails. In Switzerland, depending on how client assets are held, controlled and used, a business may need only SRO affiliation, a FinTech licence or a full banking licence.
For readers unfamiliar with the Swiss system, SRO stands for Self-Regulatory Organisation. FINMA does not directly supervise every financial intermediary. Certain financial intermediaries are instead supervised for anti-money laundering compliance by SROs, which are themselves recognised and supervised by FINMA. What the industry commonly calls an "SRO company" is simply a financial intermediary affiliated with one of these organisations.
Over the years, the range of activities covered by this system has narrowed. Asset management has moved to a separate regulatory framework, and proposed reforms could bring additional crypto activities under more demanding supervision.
This distinction matters because holding crypto assets for clients does not automatically mean that a company is authorised to operate as a bank, or that its clients enjoy the same legal protections.
Someone launching a Swiss crypto custody business will often start by asking how to obtain an SRO licence. That is already the wrong question. An SRO grants membership for anti- money laundering supervision. It does not issue a custody licence, and membership does not settle whether the business needs FINMA authorisation.
I would start with three questions. Who controls the assets? Are client tokens held individually or pooled? And can the provider use them for anything beyond safekeeping?
If the client alone controls the private keys, the provider may simply be supplying software. If a custodian holds identifiable client assets individually and keeps them available for return, SRO membership and anti-money laundering supervision may be sufficient, without a banking licence.
Pooling crypto-based payment tokens is different. Even where an internal ledger records every customer's share, commercial collective custody generally needs FINMA authorisation. A FinTech licence under Article 1b of the Banking Act may suffice if entitlements are clear and assets remain available; otherwise, a banking licence may be required. Lending or using clients' coins for the custodian's own business makes the position more difficult still.
This basic distinction is not new. What has changed is the environment around it.
First shift: Regulated clients are asking harder questions
In January 2026, FINMA published Guidance 01/2026 on custody of crypto-based assets by supervised financial institutions. Its message: good custody requires more than knowing where the private keys are stored.
For portfolio managers, FINMA expects custody with prudentially supervised providers and effective protection if the custodian becomes insolvent. Foreign arrangements must also satisfy equivalent supervisory and bankruptcy-protection standards. Outsourcing does not transfer the Swiss institution's responsibility to somebody else.
There is a narrow exception for existing arrangements with Swiss SRO-supervised custodians where bankruptcy protection exists, but prudential supervision does not.
Portfolio managers must explain the increased risk, identify suitable alternatives and obtain their clients' written consent. FINMA has not abolished SRO custody. But for an SRO custodian hoping to serve regulated clients, membership and AML supervision may no longer be enough commercially. The client's compliance department has questions to answer.
Second shift: Staking depends on what actually happens to the coins
Staking is regularly compared with bank deposits because clients receive a return. The comparison has limits. On proof-of-stake networks, rewards arise from blockchain validation, not necessarily from lending money to a borrower.
FINMA Guidance 08/2023 recognises that certain direct staking arrangements can operate without a banking licence. The conditions matter: each client's original custody, staking and withdrawal addresses must be individually attributable, and the custodian must retain the withdrawal keys. The provider also needs SRO affiliation for AML supervision.
Why does this matter? Because pooling the assets of several clients to meet a validator's minimum stake may change individual custody into collective custody. A separate balance on a screen does not make a blockchain arrangement separate.
Validator signing keys operate the node; withdrawal credentials determine who can move the staked assets. A technical provider can operate a validator without receiving the withdrawal keys. When those keys pass to another provider, the legal and bankruptcy analysis changes.
Lock-up periods and slashing also complicate bankruptcy protection. FINMA's approach is provisional, not a blanket exemption for staking.
Bitcoin Suisse illustrates the distinction: its Swiss company is affiliated with the VQF SRO, while its Liechtenstein subsidiary holds MiCAR authorisation as a crypto-asset service provider. Neither status is a banking licence.
Third shift: A new Swiss licence is proposed
In October 2025, the Federal Council proposed amendments to the Financial Institutions Act creating payment instrument institutions and crypto-institutions. The first category would replace the current FinTech licence; the second would cover certain professional crypto custody and trading activities.
The consultation closed in February 2026. These are still proposals, not licences available for application today. Their final scope, transition arrangements and timing remain subject to legislation.
An SRO member should therefore plan for a potentially more demanding regime, without pretending that Parliament has already decided what it will look like.
And one protection must not be confused with another. Article 242a of the Debt Enforcement and Bankruptcy Act can allow qualifying crypto assets to be segregated if a custodian fails. It does not protect against falling prices, slashing or technical failure.
For anyone building or buying a Swiss custody business, my advice is straightforward: examine the wallets and withdrawal rights, check the client agreements, and map the actual activity against banking law before preparing the licensing budget. There is little value in choosing the cheapest regulatory route if it is not the route your business can legally use.
Sources:
FINMA Guidance 08/2023 and 01/2026
Banking Act, Art. 1b; Banking Ordinance, Art. 5a; DEBA, Art. 242a
Federal Council consultation, 22 October 2025
Liechtenstein FMA, 23 June 2026.
