If You Hold User Funds, You Need a Custodian