How to start a virtual assets custody services business

As digital assets move from the fringes of finance into the portfolios of funds, corporate treasuries and everyday investors, one question has become central: who holds the keys? Custody, the safekeeping of assets on behalf of others, is the foundation on which every other part of the virtual assets market rests. Exchanges, brokers and asset managers all depend on it, and institutional investors will not commit capital without it. For founders with the right expertise, a regulated custody business represents one of the most durable opportunities in the sector. It is also one of the most demanding. What follows is a practical framework for building one properly.

1. Understand what custody really means

In traditional finance, custody means holding securities for clients. In virtual assets, it means something more specific and more technical: controlling or safeguarding the private keys that give access to a client’s holdings. Whoever controls those keys controls the assets. A custodian’s obligation is therefore absolute. The assets never belong to the firm, they must be kept separate from its own holdings, they must be recoverable if something goes wrong, and their existence must be provable to the client and the regulator at any moment.

Founders should be precise about where the line falls. Supplying wallet software to clients who alone hold their keys is generally not custody. Once a firm controls or safeguards keys on a client’s behalf in any form, however the technology is packaged, it is providing a custody service and requires the appropriate licence.

Within this definition, three broad business models have emerged. Institutional custodians hold assets for funds, exchanges and corporate treasuries, clients who arrive with auditors and risk committees and who buy operational controls as much as storage. Key management and wallet infrastructure providers build the cryptographic machinery itself, from multi-party computation to hardware security modules and multi-signature governance. Custody and administration providers combine safekeeping with reconciliation, reporting and asset servicing, competing on the quality of their records. Choosing a model early shapes everything that follows, from hiring to technology to target clients.

2. Choose a jurisdiction with a mature regulatory framework

Custody is only as credible as the regulation behind it. Institutional clients need assurance that their provider operates under a clear, tested supervisory regime, which makes jurisdiction one of the most consequential decisions a founder will take.

Dubai has positioned itself at the forefront of this field. The Virtual Assets Regulatory Authority (VARA), established under Dubai Law No. 4 of 2022, was the first regulator in the world created specifically for virtual assets. Its framework has matured quickly. According to figures reported for 2025, assets under management across VARA-regulated entities exceeded AED 9.6 billion, transaction volumes through regulated firms approached AED 2.5 trillion, and more than three million investors and traders were serviced from the emirate. By the end of that year, 39 of the 50 licensed providers were classified as fully operational, a sign of a functioning regime rather than an experimental one.

For international founders, a well-structured company formation in Dubai offers a practical route into this market. Free zones such as Meydan Free Zone permit full foreign ownership without a local partner and allow the setup process to be completed digitally. The regulatory requirements, however, apply equally to foreign-owned and UAE-owned applicants.

3. Navigate licensing and structural requirements

Under Dubai’s framework, virtual assets custody services fall under a dedicated activity code, 6619.84, and the regulator treats custody as the most sensitive activity in the entire virtual assets group. Approval from VARA is required before the business licence is issued, and applications follow a staged process submitted through a Dubai free zone authority.

The defining structural feature is exclusivity. A custody licence cannot be combined with any other activity. A custodian may not also operate an exchange, act as a broker-dealer, advise clients, manage assets on a discretionary basis or trade on its own account. Critically, it may not lend out client assets; lending and borrowing sit under a separate activity entirely. Founders who wish to offer additional services must establish separate entities, each with its own regulatory approval.

This separation is deliberate. It removes the conflicts of interest that have caused some of the most damaging failures in the history of digital assets, where client holdings were quietly deployed for the firm’s own purposes. For a new custodian, the rule is also a selling point: it demonstrates to clients that their assets are held and nothing more.

4. Build security and operational controls into the foundations

In custody, security is not a feature. It is the product. A licensed custodian must be able to demonstrate secure key generation and storage, rigorous segregation of client assets, provable records of holdings, controlled transaction authorisation and tested recovery arrangements. VARA’s rulebooks set out detailed requirements in each of these areas.

In practice, this means designing a storage architecture that balances security with usability, typically across cold, warm and hot environments, with strict controls governing how assets move between them. Transactions should only be signed on verified client instruction, with multiple layers of authorisation. Reconciliation must be continuous, so that the firm can prove at any time exactly what it holds and for whom.

Resilience matters just as much. Business continuity plans, key recovery procedures and disaster recovery arrangements must be documented and regularly tested. Robust financial crime controls, including customer due diligence, transaction monitoring and sanctions screening, should be operational before the first client is onboarded. Custodians should also plan for asset servicing events such as network forks, airdrops and, where permitted, staking rewards.

The team behind these controls is decisive. Regulators and institutional clients alike will scrutinise the experience of those responsible for security engineering, compliance and operations. A founding team strong in technology should recruit seasoned risk and compliance professionals early.

5. Win institutional trust and grow deliberately

The most valuable custody clients are institutions, and institutions buy trust. They expect independent audits, clear contractual protections, transparent reporting and, increasingly, insurance coverage. Winning them takes time, but the relationships tend to be long-lasting, and the barrier to entry is real security engineering rather than marketing.

Growth should follow credibility. Early clients should be served impeccably, with every reconciliation clean and every report audit-ready. Partnerships with licensed exchanges, brokers and fund administrators can open doors, since each of them needs a trusted custodian alongside their own services. Firms with a background in traditional fund administration will find their expertise transfers particularly well to the custody-and-servicing model.

Conclusion

Starting a virtual assets custody business is a serious undertaking. It requires a precisely defined model, a mature regulatory home, strict adherence to licensing boundaries and uncompromising security. For founders who meet those standards, the reward is a central role in a market that cannot function without them. As institutional capital continues to flow into digital assets, the firms that can prove, at every moment, that client assets are safe will be the ones that endure.