Custody Is the Decision That Sets Your Company Count

VARA's Custody Services Rulebook states that a VASP providing Custody Services must be a separate legal entity from any member of its group that provides services relating to virtual-asset activities other than custody. That is not a governance preference expressed as a rule. It is a rule about corporate structure, and it bites on the group as a whole, not on the applicant alone.

The wallet architecture is definitional rather than merely prudential. The rulebook requires each client's virtual assets to be segregated into separate wallets containing the virtual assets of that client only, and Schedule 1 of the Regulations puts the same point the other way round: only VASPs which segregate each client's assets in separate VA Wallets will qualify for a Custody Services Licence, or as otherwise permitted in the Custody Services Rulebook. That trailing limb matters and is often dropped when the sentence is quoted. The Regulations reserve a rulebook-level exception rather than stating an absolute rule — but the Custody Services Rulebook itself requires per-client wallets without qualification, so on the published texts as they currently stand an omnibus model is not a lower grade of custody so much as something the qualifying condition does not presently describe.

VARA's licensed-activities page states the absolute version: custody is the only regulated activity required to be segregated from other virtual-asset licence categories, and a custodian must be set up as a distinct legal entity with a standalone licence. Read on its own, that sentence closes off two structures the rulebook expressly leaves open, highlighting the importance of understanding how a trade licence works.

The first is transfer and settlement. The Custody Services Rulebook permits a custodian to apply for a VA Transfer and Settlement Services licence in the same entity, granted only where VARA is satisfied on the relevant requirements, including the implementation and strict enforcement of policies achieving the necessary segregation between the two operations. The second is staking. Staking from Custody Services is treated as a subset of the custody activity and is therefore not subject to the separate-entity requirement at all — but it may only be provided where VARA has explicitly authorised it and that authorisation is expressly stipulated in the licence. This flexibility can be crucial when considering how the two licensing regimes differ.

Both exceptions are conditional, and both are the regulator's decision rather than the applicant's. The practical point for a group designing its structure is that the difference between one company and three is not settled by the public summary. It is settled by whether a segregation case can be made that VARA accepts, and that case is made in a business plan long before it is made in an application. For guidance on these decisions, consulting Velarozone's advisers can be invaluable.

If a client wants to be able to re-use the assets it holds, the activity it needs is not custody. VARA prohibits rehypothecation of virtual assets held under Custody Services regardless of whether client consent has been obtained, and goes further: a custodian must not seek or attempt to obtain such consent. Under VA Management and Investment Services the same practice is permitted with explicit prior consent. Under Lending and Borrowing Services it is governed by the client agreement and the collateral terms.

One word therefore separates three regimes, three rulebook stacks and, given the exclusivity rule, three different answers on entity count. In our experience this is where a large share of these conversations actually resolves — not on whether the firm is a custodian, but on whether the business model it has described can survive being one.

ADGM's FSRA describes three wallet arrangements. Type 1 is a custodial wallet where the firm is wholly responsible and effectively holds the private keys as agent, with control over the assets. Type 2 is an outsourced custodial wallet, where the operational function sits with a third party but the firm retains responsibility to clients at all times — and a footnote pulls multi-signature arrangements in which the authorised firm is one of the required signatories into this type. Type 3 is a non-custodial or self-custody wallet, where the firm at no point has partial or full control and cannot effect unilateral transfers without the client's authorisation.

The federal guidance published by the Capital Market Authority, formerly the Securities and Commodities Authority, draws the same three lines: an in-house custodial wallet, an outsourced arrangement in which the licensed body remains bound to bear full responsibility, and a non-custodial arrangement in which the provider is merely providing the technology.

Read the licensing sentences carefully in both. ADGM says Type 1 and Type 2 would generally be regarded as Providing Custody and require a Financial Services Permission, and that Type 3 providers would generally not be required to seek one. The federal guidance says a Type 3 provider would generally not be required to hold the safe-custody licence. Neither regulator writes a bright line, because neither can: control is a fact about the key-management design, and it is an engineering fact before it is a legal one.

ADGM finalised its staking rules in April 2026. Where an authorised firm stakes client assets on the client's instruction, it needs a permission for Managing Assets or for Providing Custody; where it stakes at its own discretion, only Managing Assets will do. A custodian that wants to stake on its own initiative therefore has a permission problem rather than a product problem, and the framework was extended at the same time to non-Proof-of-Stake models with materially similar characteristics, which is a boundary nobody has enumerated.

Dubai reaches the same subject from two directions and does not publish a tie-breaker. Taking responsibility for the staking of virtual assets to earn validator or node-operator rewards is given as an example of VA Management and Investment Services in Schedule 1 of the Regulations. Staking from Custody Services is an add-on permission on a custody licence. Which of the two a particular staking model falls into — or whether it falls into neither — is not something VARA publishes an answer to, and we do not assert one.

The table below is a map of where the published rules put each function, and of what that implies for legal form. It is not a licensing route, and it will not survive contact with a specific key-management design without advice.

Multi-party computation, threshold signatures, multi-signature quorums, smart-contract vaults, recovery keys and delegated-withdrawal designs are not addressed in any of the published texts above. ADGM's guidance pulls one multi-signature case into Type 2 by footnote and stops there. Everything else is left to the assessment of control, and control is exactly what these architectures are designed to distribute.

That gap is not an oversight, and it will not close. It is where the structuring work sits, and it has to be done before incorporation, because the entity is fixed at the first approval and the segregation rules bite on legal form rather than on intention. A group that incorporates first and analyses afterwards is not making a paperwork error; it is making a corporate one.

None of the questions above is answered by a form, and the published texts stop precisely where the key-management design begins. What decides your company count is how control is distributed across your architecture, and that is read against three regulators' definitions at once rather than looked up in any of them.

Bring us the key-management design, the group's ownership chart and an honest description of what the firm will hold and for whom, and we will tell you where the custody line falls for your structure and what would move it. Do that before incorporation, because the entity is fixed at the first approval and the segregation rules bite on legal form. This is structuring commentary rather than legal advice, and it is not an opinion on how any regulator will read a particular set of facts.