Third-party custodian

Exchanges outsource key storage the way they outsource payments, and the arrangement sits in the terms you accept at signup. Bitstamp Ltd's Terms of Use, last updated on 30 May 2025, state that it does not store assets directly and bind you to two sets of outside custodian terms. Your claim in a failure may run against a company you have never dealt with.

How it works

A third-party custodian holds the keys while the exchange holds the ledger. Buying, selling and moving coins between accounts are edits to a database, and the bitcoin behind those rows sits in wallets controlled by a different company under a different contract. Three arrangements show up in the terms this page is written from, and they differ in the one respect that decides everything: who owes you the coins.

Appointment as your agent. Bitstamp Ltd's Terms of Use say "We do not store any Virtual Assets or other Digital Assets directly", then take from you a "perpetual and irrevocable" agency authority, ending only if your account closes, to create a direct relationship between you and a third-party custodian. The custodian's terms "apply directly between the custodian(s) and you", and Bitstamp records that it "does not directly provide, charge for and is not responsible for, custodian services". Two sets of custodian terms are linked from that clause, hosted on bitstamp.net at paths naming BitGo and Copper, each binding you only once that firm has actually held something of yours.

Custodian of record with sub-custodians underneath. Bitstamp Europe S.A., the entity licensed by the Luxembourg regulator under MiCA, takes the opposite position: "we are your contractual counterparty for Services related to custody and administration of Crypto-Assets". It still appoints sub-custodians, publishing a list of them, and holds client coins in omnibus wallets in its own name alongside other clients' assets. The same clause warns that "in the event of a shortfall you may incur loss (shared pro-rata with other affected Clients as determined by us)".

A separate legal entity in front of outside providers. Bitvavo's User Agreement routes customer coins and euros through a Dutch foundation, a stichting, so that users hold a claim against the foundation and the assets "do not form part of Bitvavo's estate, not even in case Bitvavo suffers bankruptcy". The foundation may then store those assets "with third-party crypto-asset service providers", and Bitvavo states separately that it "utilizes sub-custodians and technical service providers" to secure the keys.

Nothing stops the chain running deeper than one link. Bitstamp Ltd's terms record that an appointed custodian is entitled "in turn to appoint sub-custodians and provide the custodian services to you through such sub-custodians or other nominees or agents".

Liability wording separates the shapes hardest, and it is written per entity rather than per brand. Bitstamp Ltd warns that if a third-party custodian enters insolvency "you may have only an unsecured claim against the third-party custodian". Bitstamp Global Ltd is blunter, saying it does "not accept any liability towards you in case of any event affecting Virtual Assets at the level of the sub-custodians", and that you "accept to solely bear the risks". Bitstamp Europe S.A. is the tightest: client assets are "legally segregated from our estate in the interest of our Clients in accordance with MICAR", and the platform answers for losses "attributable to us", capped at the market value of the asset at the moment it was lost. Bitvavo lands in the same place for custody, capping liability at the fees you paid over the preceding twelve months except where assets are lost through an incident attributable to it, in which case the cap is again market value at the time of the loss.

Why this matters when you buy bitcoin

The 231 country guides on this site answer whether an exchange may legally serve you, which is a different question from who ends up holding your keys, decided in a different document. Bitstamp alone publishes seven sets of Terms of Use across its operating entities and sales channels, and their custody clauses are not copies of each other. Which set governs your account follows from where you live, so one reader gets the MiCA segregation language and another gets the sentence about bearing sub-custodian risk alone, from the same login page.

That is why an exchange record here carries a dated security history rather than a safety score, and why only nine of the 63 records have one so far. A licence tells you an operator is supervised: Bitvavo published its MiCA licence from the Dutch AFM on 27 June 2025, which covers every EU member state plus Norway, Iceland and Liechtenstein, and it is rated 4.5 here on fees of 0.15 percent maker at the base tier. None of that names the firm with the keys, and none of it changes what happens if that firm defaults.

Two habits follow. Before funding an account, open the custody section of the terms for your entity and look for the words appoint, sub-custodian, omnibus and unsecured. After buying, move anything you are not actively trading to a device you control, which is what the 41 wallet reviews here exist for. Self-custody is the only arrangement in which the number of companies between you and your coins is zero.

Bitstamp USA Inc and the coins it does not separate

Bitstamp USA Inc writes its own version of the custody bargain, in Terms of Use last updated on 23 July 2026. It acts as custodian and may appoint sub-custodians, and everything in your wallet is held "by Bitstamp or its custodial and sub-custodial partners for your benefit". Ownership is stated flatly: "Title to Digital Assets shall at all times remain with you and shall not transfer to Bitstamp".

The same section then withholds most of the practical protection that title implies. A subheading announces that customer assets are not segregated from other customer assets, and the text says Bitstamp "shall have no obligation to segregate by blockchain address Digital Assets owned by you from Digital Assets owned by other customers", tracking who holds what "on internal ledgers maintained by Bitstamp" instead. As the owner, "you shall bear all risk of loss of such Digital Assets", and the same document repeats the warning that a custodian insolvency may leave you with "only an unsecured claim against the third-party custodian".

Bitvavo puts the identical risk in one sentence, warning that "in case of default by - or bankruptcy of - a third-party custody provider, User may not be able to retain (all) its Digital Assets". Title to a coin a stranger is holding is worth what the law where that stranger sits will hand back, and no more.

Third-party custodian vs custodial wallet

A custodial wallet is the balance you see; a third-party custodian is the firm behind it that you usually do not. Your custodial wallet is an entry in the exchange's ledger, denominated in bitcoin and redeemable on request. The third-party custodian is the legal person whose signing keys can move that bitcoin: the exchange, a named outside firm, a foundation, or a sub-custodian appointed by one of those. Every custodial wallet has a custodian somewhere. Only the terms of use tell you whether it is the company whose name is on the app.

Third-party custodian vs crypto-asset custody service

Crypto-asset custody service is the regulated activity; a third-party custodian is one way of performing it. Under MiCA the authorisation to safekeep client assets and the means of access to them comes with duties owed to you by the licensed provider: segregation, a written custody policy, a register of positions. Delegating the key handling downward does not delegate those duties. That is the difference between Bitstamp Europe S.A., which keeps the counterparty role and appoints sub-custodians beneath it, and Bitstamp Ltd, which puts you in a direct contract with an outside custodian and disclaims responsibility for that service. Same word on the tin, different party on the hook.