DAC8 Compliance for Crypto Custody Providers

Pure custody providers — entities that safeguard crypto-assets without providing exchange or trading services — have distinct DAC8 obligations that differ from those of full-service exchanges.

Custody-Specific Scope

Custody providers must report transactions that occur within their custody services, including transfers of crypto-assets into and out of custody accounts, transfers between custody clients within the same platform, and any exchange or conversion transactions facilitated through the custody service.

If the custody provider offers only safekeeping (no trading, no transfers between clients), the volume of reportable transactions may be relatively low. However, the due diligence and identification obligations still apply in full — every custody client must provide TINs, self-certifications, and complete identification data.

Institutional vs Retail Custody

Institutional custody providers serving corporate clients, funds, and family offices face different practical challenges than retail-focused custodians. Institutional clients typically have established compliance departments that can provide TINs and self-certifications efficiently. However, the controlling person requirements for entity clients add complexity — the custody provider must identify and report information about the beneficial owners of each entity client.

Retail custody providers face the mass data collection challenge similar to exchanges, requiring automated onboarding flows and persistent follow-up for missing data.

Valuation Considerations

Some Member States may require custody providers to report the value of assets held in custody at the end of the reporting period. This creates a valuation challenge for crypto-assets that are held but not actively traded, particularly for illiquid tokens or tokens without reliable market prices.

Conclusion

Custody providers must not underestimate their DAC8 obligations simply because they do not operate trading platforms. Full due diligence, data collection, and reporting requirements apply, and the entity identification obligations for institutional clients add an additional layer of complexity.