New FINMA Guidance on risks linked to the custody of crypto-based assets

On 12 January 2026, the Swiss Financial Market Supervisory Authority (FINMA) released its Guidance 2026/1, which outlines the risks associated with the custody of crypto-based assets. The guidance also outlines the requirements for the custody of crypto-based assets within the remit of portfolio and asset management activities, and for client information relating to structured products and exchange traded products (ETP) offerings.

As a reminder, if a Swiss bank holds its client’s crypto-based assets in segregated custody in accordance with the requirements set out in Articles 37d and 16 No. 1bis of the Banking Act, the bank generally does not have to meet capital requirements for these assets. FINMA may, however, set a maximum amount in certain specific cases where risks are involved. This exemption also applies if custody is delegated to third parties abroad, provided that equivalent conditions are met. Typically, the foreign third-party custodian must be subject to prudential supervision, and foreign law must guarantee bankruptcy protection for the crypto-based assets held in custody.

Risks linked with custody of crypto-based assets

Crypto-based assets are typically exposed to operational risks such as cyber-attacks and inadequate protection of private keys since they are stored on the blockchain.

If the custodian is a third party, counterparty risk arises because the segregation of crypto-based assets is not guaranteed if the third party becomes insolvent.

This risk increases when this third-party custodian is based abroad or when it is not prudentially regulated. In addition to these risks, crypto-based assets, in particular cryptocurrencies, are in general intrinsically volatile, excluding stablecoin at least with physical replication.

Custody in the event of investment management activities

Individual portfolio management

Financial institutions active in individual portfolio management must ensure that the assets entrusted to them for management are held in safekeeping, segregated per client, with a bank, securities firm, trading facility for distributed ledger technology securities or another institution subject to equivalent supervision (including abroad).

The appropriate safekeeping of managed crypto-based assets requires them to be held in custody by prudentially supervised institutions that have an adequate technical infrastructure and the necessary expertise, among other things. This means that the portfolio manager must conduct appropriate due diligence before the on-boarding of the relevant custodian and the exercise of regular monitoring. This can be formalised in the relevant internal guidelines of the financial institution.

Crypto-based assets held in custody must also be segregated in the event of the custodian's bankruptcy. If the assets are held abroad, the custodian institution must be subject to supervision (i.e. prudential) equivalent to Switzerland. Foreign law must also provide for bankruptcy protection for crypto-based assets that is equivalent to Switzerland.

Existing custody arrangements in which either equivalent prudential supervision is applied to foreign custodians of crypto-based assets, but equivalent bankruptcy protection is not, or those set-up with Swiss custodians under supervision of a self-regulatory organisation as required by Swiss anti-money laundering rules, which ensures bankruptcy protection, but lacks prudential supervision, are permissible by way of exception, provided the portfolio manager has met the following cumulative conditions:

• it must provide its clients with comprehensive information on the increased custody risks associated with the existing service provider, particularly in the event of bankruptcy;
• it should have informed the clients about other suitable custodians for cryptocurrency assets in Switzerland and abroad;
• it has documented the client's written consent to the use or retention of a custodian that is not suitable in the above sense.

According to FINMA, it is not possible to circumvent the requirements by using foreign vehicles or products. A Swiss institution acting as a sponsor or manager of a foreign collective investment scheme investing in crypto-based assets and placing these in its clients' portfolios must comply with the same principles for the careful safekeeping of fund assets.

Collective portfolio management (asset management)

For Swiss vehicles, a Swiss depositary bank must hold the assets in safekeeping as defined in Article 72, paragraph 1 of the Collective Investment Schemes Act (CISA). 1 of the Collective Investment Schemes Act (CISA). A depositary bank may delegate the safekeeping of fund assets to a third-party custodian or central securities depository in Switzerland or abroad, if this is appropriate (Article 73 para. 2 CISA). In accordance with the requirements set out in the Financial Services Act (FinSA), investors must be informed of the risks through the prospectus and the basic information sheet. These requirements, which apply to 'traditional' collective investment schemes (CIS), also apply to CIS with crypto assets as the underlying asset.

Direct investments in crypto-based assets forming part of Swiss collective assets must therefore generally be held in custody at a Swiss depositary bank. It is possible, however, to delegate custody to a third-party custodian that is equivalently supervised, provided that this equivalence applies not only to the supervision of the custodian, but also to the bankruptcy protection rules.

Structured products and ETps offering (FinSA requirements)

The offering of crypto-based structured products, including actively managed certificates (AMCs), is subject to the rules set out in FinSA.

The nature of the underlying crypto-assets does not affect the applicable requirements, particularly the additional requirements that apply when offering to retail clients and/or when structuring via special purpose vehicles.

Both Swiss stock exchanges (i.e. SIX Swiss Exchange and BX Swiss) have already issued specific rules for the admission of crypto ETPs and their collateralisation.

Communication to investor (risk notice)

Even if they are held in custody in accordance with the above requirements, crypto-based assets such as cryptocurrencies are not considered safe investments by FINMA, as they can be highly speculative and subject to significant volatility.

According to FINMA, investors must be aware of the potential for significant losses when engaging in such investment transactions. This means that financial institutions must provide investors with a risk notice.

Outlook

This guidance serves as a clear reminder of FINMA's approach to the requirements applicable to the custody of crypto-assets. This guidance reiterates that Switzerland is a jurisdiction in which custody rules, including bankruptcy protection, apply unambiguously to crypto-assets, provided the applicable requirements are met.

For more information on FinTech, cryptocurrencies and tax regulations in Switzerland, contact your CMS client partner or the CMS expert who wrote this article.