# If You Hold User Funds, You Need a Custodian

> The Simplest Regulatory Logic Most Projects Overlook

**Published by:** [ARCB](https://paragraph.com/@0x8fd44fab6bd57bcef96a0f5785234d3902d56111/)
**Published on:** 2026-01-10
**URL:** https://paragraph.com/@0x8fd44fab6bd57bcef96a0f5785234d3902d56111/if-you-hold-user-funds-you-need-a-custodian

## Content

This Is Not a Gray AreaMany #Web3 and digital asset projects believe custody is optional — something required only for exchanges, banks, or “centralized” platforms. That belief is incorrect. The regulatory logic is simple:If you hold, control, or can move user funds — you are performing custody.And custody triggers obligations. At #ARCB, we see many otherwise strong projects fail institutional and regulatory review because they misunderstand this single point.What “Holding User Funds” Really MeansYou do not need to brand yourself as a custodian to be one. You are effectively performing custody if any of the following are true:You control private keysYou control admin or upgrade keysYou can pause, freeze, or redirect fundsYou execute transactions on behalf of usersUsers cannot move funds without your systemAt that point, user funds depend on your control — not theirs. That is custody.Why Regulators Care About This DistinctionRegulators do not focus on marketing language. They focus on risk and responsibility. If user funds depend on your system:Who is responsible if they are lost?Who can intervene during an incident?Who is legally accountable?How are assets protected and segregated?Without a custodian, none of these questions have acceptable answers.“But We Are Non-Custodial” Is Not a DefenseMany projects claim to be non-custodial because:Funds sit in smart contractsUsers sign transactionsThe protocol is “decentralized”But regulators look deeper:Who controls the smart contract? Who controls upgrades? Who controls emergency actions?If the answer is “the team” — then custody exists, whether acknowledged or not.Why Institutions Will Not Proceed Without a CustodianInstitutional investors and partners are bound by:Fiduciary dutyCompliance rulesRisk mandatesThey cannot allocate capital to systems where:Custody responsibility is unclearAsset control is informalLegal accountability is undefinedFor them, no custodian means no entry point.Custodians Exist to Separate Roles and Reduce RiskA proper custody framework:Separates asset control from product developmentIntroduces governance and oversightEnables audits and insuranceProtects users and foundersCustody is not about centralization. It is about accountability.The Global Regulatory Direction Is ConsistentAcross jurisdictions (EU, Dubai, Singapore, Hong Kong, US):Custody is a regulated activityControl over assets must be explicitResponsibility must be assignableUser protection is non-negotiableThe rule is the same everywhere:If you touch user funds, custody applies.ARCB’s PerspectiveAt #ARCB, this principle is a baseline filter. We encourage teams to ask a simple question early:“If something goes wrong, who is officially responsible for user funds?”If the answer is unclear, custody has not been designed — and the project is not institution-ready.Final TakeawayYou do not need to call yourself a custodian to be one. If you hold user funds — you already are. The only remaining choice is whether custody is:Designed and compliantOr accidental and riskyDesign it early. #ARCB #Custody #Regulation #Web3 #RWA #DigitalAssets #Blockchain

## Publication Information

- [ARCB](https://paragraph.com/@0x8fd44fab6bd57bcef96a0f5785234d3902d56111/): Publication homepage
- [All Posts](https://paragraph.com/@0x8fd44fab6bd57bcef96a0f5785234d3902d56111/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@0x8fd44fab6bd57bcef96a0f5785234d3902d56111): Subscribe to updates
- [Twitter](https://twitter.com/ARCBHUB): Follow on Twitter