Stablecoins: custody is not a technical detail

Demonstration op-ed. The author, the institution and the situations described are fictional.

Since the MiCA regulation came into force, announcements have followed one another: one bank will launch its own euro-backed token, another will let its institutional clients hold them. In executive committees, the discussion is almost always about distribution, revenue models and image. It rarely turns to the question that, in my experience, causes projects to fail: custody.

Two jobs under one word

Holding a stablecoin in custody actually covers two distinct activities. The first is safeguarding the reserves: the deposits and securities that back the token’s value. Banks know this job, but here it takes an unusual form, with daily liquidity, segregation and disclosure requirements that traditional custodians are not used to producing at that pace.

The second is safeguarding the cryptographic keys used to issue, burn and move tokens. Here, banks start from scratch. Hardware security modules, multi-signature management, key rotation and recovery procedures belong to an engineering discipline that few institutions have in-house.

The cost nobody budgets for

In the project I led, the initial budget devoted most of its resources to the client interface and to integration with the payment system. Key custody took up a single line, outsourced to a provider. Six months later, the security audit required the whole set-up to be redesigned: geographic separation of signers, a recovery procedure tested every quarter, round-the-clock on-call staff. Annual running costs tripled.

This is not an anomaly. It is the real price of an activity where an operational error cannot be fixed with a reversing entry.

Three questions to ask before starting

Who in the institution can sign a transaction at three in the morning, and under what procedure? What happens if the custody provider fails, and how quickly can the keys be rebuilt elsewhere? How are reserves reconciled with tokens in circulation, and how often is that reconciliation checked by a third party?

An institution that cannot answer these three questions precisely is not ready to issue, or even to provide custody for third parties. The good news is that the answers are known. The bad news is that they are expensive, and that the cost must be in the business plan from day one.