Crypto custodian licence terms compared: capital, segregation, cold storage and insurance

The crypto custodian licence capital requirement runs from EUR 125,000 under MiCA (Class 2) to AED 600,000 or 25% of overheads under VARA, USD 250,000 or six months’ expenditure at ADGM’s FSRA, a USD 1 million base at the DIFC’s DFSA, and no fixed figure under NYDFS beyond a bond or trust account, generally at least USD 500,000. Every licensing regime whose custody conduct rules were read here segregates client assets, none sets a cold-storage ratio, and insurance is a licence condition only under VARA; India only registers custodians.

This piece compares terms, not regulators; whether a wallet or multi-signature product is custody at all is answered separately.

VARA rules are cited by Part and letter as in the 19 May 2025 PDF, current from 19 June 2025 per the VARA index. MiCA, FSRA, DFSA FER and FIU-IND text was read on 25 September 2026; every other source on 29 September 2026.

Capital: fixed floors against overhead formulas

Three of the five licensing regulators use a fixed floor, or a share of your cost base if higher. The VARA Company Rulebook sets AED 600,000 against 25% of fixed annual overheads, held in a VARA-beneficiary trust account or open-ended surety bond. MiCA Article 67(1) sets EUR 125,000 against a quarter of the preceding year’s fixed overheads, and Article 67(4) lets an insurance policy stand in for own funds. The FSRA Guidance of 10 June 2025 sets USD 250,000 against six months of Annual Audited Expenditure. The DFSA is the outlier: PIB Rule 3.6.2 gives a firm whose only Financial Service is Providing Custody of Crypto Assets a base of USD 1 million. New York sets no figure: 23 NYCRR 200.8 leaves capital to the superintendent, and the bond or trust account under 200.9(a) is set at the amount the superintendent accepts, which NYDFS puts at a general minimum of USD 500,000. Fees sit alongside: the DFSA charges USD 25,000 to apply and USD 35,000 a year where Crypto Tokens are covered (FER VER35/04-26, read 25 September 2026); the FSRA adds USD 20,000 on application and USD 15,000 a year (Guidance para 176); VARA’s are on the VARA cost and capital page.

Segregation: separate wallets, separate entities, no recourse

Every regime whose custody conduct rules were read here keeps client assets apart from the custodian’s, but the unit varies. VARA is the most granular: Rule III.B.3 puts each client’s Virtual Assets in separate VA Wallets and Rule III.B.2 prohibits rehypothecation regardless of consent. Rule III.B.5 then makes the custodian a separate legal entity from any group member doing other VA Activities, so a Dubai group running exchange and custody needs two companies. MiCA gets there through insolvency law: Article 75(7) requires clients’ crypto-assets to be held separately on the ledger and legally segregated so the CASP’s creditors have no recourse in insolvency. The FSRA applies its Client Investments regime by reading “Investment” as including “Virtual Asset” (COBS 17.8.2). New York allows a per-customer or a customer-only omnibus model under the Industry Letter of 30 September 2025, provided customer assets are segregated from the custodian and its affiliates on-chain and on the ledger.

Cold storage: key controls instead of a percentage

None of these regimes sets a cold-storage ratio. VARA’s Rule III.C.1 requires a risk-based analysis to decide how much sits in hot, warm and cold wallets, documented and independently audited. The key controls: keys online or in one location cannot transact on one individual’s access, the seed phrase is split into at least two separately backed-up parts, and multi-signature is to be considered and may be required. The FSRA’s expectations run the same way: offline generation, storage, backup and destruction of keys, multi-signature or an equivalent multi-user authorisation, and no single individual holding critical privileged information. MiCA leaves the engineering to the Article 75(3) custody policy; the NYDFS rules read here prescribe no ratio either. The self-custody compliance controls checklist operationalises that control set.

Insurance, bonds and the liability cap

VARA alone makes insurance a licence condition: Company Rulebook Rule VI.D.1 requires professional indemnity, directors’ and officers’, and commercial crime insurance for all Virtual Assets in hot wallets, from a regulated insurer, and Rule VI.D.4 lets VARA accept other protection only where cover is proven unobtainable. The FSRA does not require insurance but recommends policies covering at a minimum hot wallets. MiCA uses insurance as a prudential instrument: under Article 67(4) to (6) a CASP may meet its safeguard with a policy of at least one year, 90 days’ cancellation notice, published on its website. Article 75(8) adds a liability rule: the custodian answers for loss from an incident attributable to it, capped at market value at the time of loss. New York substitutes the 200.9(a) bond or trust account, the latter held with a Qualified Custodian, at the amount the superintendent accepts, generally at least USD 500,000 per NYDFS.

Staking, statements and how long the clock runs

Staking from custody is a licence term in Dubai: under Part IV of the Custody Services Rulebook it may be offered only if expressly authorised, runs as a sub-set of custody in the same entity, cannot be offered on an opt-out basis, keeps each client’s staked assets on single-client nodes, and starts only after a separate risk disclosure is accepted. Statements run at least monthly under VARA, with an eight-year audit trail, and at least every three months under MiCA Article 75(5). On timing, MiCA Article 63 allows 40 working days from a complete file, with mid-2026 practice running 4 to 12 months; VARA and the FSRA publish no duration.

The Advisers Act custody rule, 17 CFR 275.206(4)-2, as at 29 September 2026 still lists only FDIC-insured banks, registered broker-dealers, registered futures commission merchants and foreign financial institutions as qualified custodians, with no crypto-specific category. Nothing federal is enacted: the CLARITY Act, H.R.3633, failed Senate cloture 49-50 on 15 September 2026, GENIUS Act implementing rules are proposals only, and FinCEN FIN-2019-G001 remains the operative money-transmission position. Whether you need MiCA, Dubai or both is answered in MiCA vs VARA.

Choose a regime in this order:

1. Confirm you are a custodian. Controlling the means of access is the MiCA test, VARA reads substance over branding, FIU-IND applies a functional test, FinCEN asks whether you can transact unilaterally.
2. Price the capital against your cost base. Overhead-linked formulas bite harder as headcount grows; a fixed USD 1 million base bites on day one.
3. Count the companies. VARA custody sits in its own entity; New York’s trust charter carries fiduciary powers a BitLicensee lacks.
4. Build the wallets to the strictest key rule you face. Split seeds and multi-user authorisation satisfy VARA and the FSRA and fill MiCA’s custody policy.
5. Settle the money route from India first. Equity sent from India to capitalise a foreign custodian is overseas investment under FEMA and needs the RBI trail: see FEMA, ODI and LRS compliance, the LRS vs ODI split and crypto tax for India operators in 2026.

On an engagement across these regimes, Infinilex counsel qualified in India, the UAE and the US sign those legs of the work; for a MiCA custody authorisation Infinilex scopes the work, builds the fact record and briefs the EU local counsel who file, named to you before they act. See VARA licensing, ADGM and DIFC crypto licensing and MiCA authorisation; for India, the FIU-IND registered VASP list.

Frequently asked questions

Further reading

Self-custody meets institutional control · VARA vs ADGM vs DIFC · VARA licence cost, capital and timeline · MiCA vs VARA · Crypto licence requirements by country · The UAE VASP licensing checklist

This article is general information for founders, not legal advice for your custody product. Positions are stated as at 29 September 2026, with MiCA, FSRA, DFSA FER and FIU-IND text as read on 25 September 2026. The US position is mid-change and this page is re-verified quarterly. Check current rules for your facts before relying on any of the above.