Can I hold tokenized securities in my own wallet?

Often, yes, but on the issuer's terms. Many tokenized funds let onboarded investors hold tokens in their own wallets once the wallet is added to the transfer agent's allowlist; others require a platform or broker-dealer account. In either case, transfers are generally limited to approved wallets, and the transfer agent keeps power over the register. tZERO's customer agreement, for example, describes a model allowing a third-party custodian or a self-hosted wallet for certain securities, while its broker-dealer otherwise controls the wallets and keys.

What happens if I lose the keys to a self-custody wallet?

With an ordinary crypto asset, the tokens are usually lost. With a tokenized security, the transfer agent can typically verify your identity, burn the tokens in the lost wallet and reissue them to a new approved wallet, because its register, not the wallet, records your ownership. The process, evidence and fees depend on the issuer. See private-key recovery.

Is a custodial wallet at a broker-dealer protected by SIPC?

Securities held by a SIPC member broker-dealer are protected up to $500,000 per customer, including up to $250,000 for cash, if the firm fails and assets are missing. SEC staff note that investment contracts not registered under the Securities Act are not securities for SIPA purposes, and non-security crypto assets are not protected. tZERO's Form CRS warns that SIPA protections may not apply to digital asset securities.

What happens if the custodial provider fails?

A broker-dealer must keep customers' fully paid securities in its possession or control and separate from its own, so in a liquidation they are returned to customers, with SIPC covering shortfalls within limits. Other providers depend on their contracts and on whether customer assets are held as financial assets in securities accounts, which keeps them out of the provider's estate. A provider holding tokens without those protections can leave customers as unsecured creditors.

It depends on what you can manage. Self-custody avoids reliance on a provider's solvency and conduct but puts key security, backups and recordkeeping on you. A custodial account adds the provider's protections, statements, tax forms and recovery processes, and adds its failure risk and its control over access. For most tokenized securities, the transfer agent's recovery power reduces the downside of losing keys, which narrows the difference.

Self-Custody vs Custodial Wallets

Custody & Settlement

Definition

In self-custody, the investor controls the private keys to the wallet that holds the tokens, so only the investor can sign transfers from it. In a custodial or hosted wallet, a provider, such as a broker-dealer, a platform or a digital-asset custodian, controls the keys and holds the tokens for the investor, usually in its own name or in wallets it manages, with the investor's position recorded on the provider's books. For tokenized securities the choice is narrower than for open crypto assets: even in self-custody, the wallet usually has to be approved by the issuer's transfer agent, transfers are limited to other approved wallets, and the agent can typically freeze, burn and reissue tokens. Self-custody gives the investor control over signing; it does not remove the transfer agent's control over the register or the eligibility rules attached to the security.

Why it matters

Crypto custody debates are usually framed as 'not your keys, not your coins.' For tokenized securities the framing is incomplete. The keys decide who can sign a transfer; the transfer agent's register decides who owns the security; and the issuer's eligibility rules decide which wallets can hold it at all. An investor in self-custody is protected from a provider's failure but not from the transfer agent's powers, and an investor in a custodial account is protected by broker-dealer rules only if the provider is a broker-dealer and the token is a security SIPA covers. Choosing between the two means weighing four risks: losing keys, the provider failing, the provider or agent restricting access, and errors in records. The right answer for each product depends on its documents.

Common misconceptions

•Self-custody does not make a tokenized security bearer property. The transfer agent can usually still freeze, burn and reissue it.
•A custodial wallet is not automatically SIPC protected. Protection depends on the provider being a SIPC member broker-dealer and the token being a security under SIPA.
•Losing keys to a tokenized security is not always permanent. Issuers with recovery processes can reissue to a new wallet after identity checks.
•Holding tokens in your own wallet does not let you send them anywhere. Transfers are limited to wallets the transfer agent has approved.
•A custodial account is not always held in your name on the issuer's register. It is usually registered to the provider, with your position on its books.

Technical details

Side by side

Keys: self-custody, the investor; custodial, the provider.

Registered owner on the issuer's file: self-custody, usually the investor, linked to the wallet; custodial, often the provider or its nominee.

Transfer rules: in both cases, the issuer's allowlist and transfer restrictions apply; a custodial provider may add its own.

Loss of keys: self-custody, recovery through the transfer agent if it offers it; custodial, the provider's account recovery.

Provider failure: self-custody, not exposed; custodial, depends on the provider's regime (broker-dealer possession or control and SIPC, trust company law, or contract).

Broker-dealer custody of tokenized securities

Possession or control: Rule 15c3-3 requires a broker-dealer to keep customers' fully paid and excess margin securities in its possession or control, free of liens and separate from its own.

Staff statement of December 17, 2025: conditions for a broker-dealer to deem itself in possession of crypto asset securities, including blockchain assessment, private-key protection and plans for forks, lawful freeze orders and transfer to a trustee.

SIPC: up to $500,000 per customer including $250,000 for cash, for securities as SIPA defines them; unregistered investment contracts and non-security crypto assets are outside it.

Example: tZERO Digital Asset Securities, approved as a special purpose broker-dealer in September 2024, carries digital asset securities for tZERO Securities' customers and controls the wallets and keys; its Form CRS warns that SIPA protections may not apply.

Self-custody practices for tokenized securities

Wallet approval: complete the issuer's onboarding and have the specific address allowlisted before receiving tokens.

Key security: hardware wallets, multisignature or smart-contract wallets, and tested backups of recovery phrases.

Records: keep the transfer agent's confirmations and statements; on-chain history alone may not show mints, burns or corrections.

Recovery plan: know the issuer's lost-key process and the identity evidence it requires before you need it.

Estate planning: heirs need both the issuer's transfer process and access to records, not only the keys.

Questions to ask a provider

Is the provider a registered broker-dealer, a trust company or bank, or neither?

In whose name are the tokens registered with the issuer's transfer agent?

Are customer tokens held as financial assets in securities accounts, segregated from the provider's own?

Can I withdraw tokens to my own wallet, and to which wallets?

What happens to my tokens if the provider stops operating?

How investors apply the term

Investors usually apply this term by tying the definition back to the controlling documents and then asking which cash flows, rights, restrictions, or valuation assumptions it changes. A useful review looks at the term alongside fees, leverage, liquidity, reporting frequency, and manager discretion rather than treating it as a standalone concept.

The practical diligence test is simple: identify who benefits if the assumption is wrong, who has control when conditions change, and what evidence the investor receives after closing. Terms that cannot be reconciled to documents, cash movements, and monitoring data should be treated as marketing shorthand until proven otherwise.

Frequently asked questions

Can I hold tokenized securities in my own wallet?: Often, yes, but on the issuer's terms. Many tokenized funds let onboarded investors hold tokens in their own wallets once the wallet is added to the transfer agent's allowlist; others require a platform or broker-dealer account. In either case, transfers are generally limited to approved wallets, and the transfer agent keeps power over the register. tZERO's customer agreement, for example, describes a model allowing a third-party custodian or a self-hosted wallet for certain securities, while its broker-dealer otherwise controls the wallets and keys.
What happens if I lose the keys to a self-custody wallet?: With an ordinary crypto asset, the tokens are usually lost. With a tokenized security, the transfer agent can typically verify your identity, burn the tokens in the lost wallet and reissue them to a new approved wallet, because its register, not the wallet, records your ownership. The process, evidence and fees depend on the issuer. See private-key recovery.
Is a custodial wallet at a broker-dealer protected by SIPC?: Securities held by a SIPC member broker-dealer are protected up to $500,000 per customer, including up to $250,000 for cash, if the firm fails and assets are missing. SEC staff note that investment contracts not registered under the Securities Act are not securities for SIPA purposes, and non-security crypto assets are not protected. tZERO's Form CRS warns that SIPA protections may not apply to digital asset securities.
What happens if the custodial provider fails?: A broker-dealer must keep customers' fully paid securities in its possession or control and separate from its own, so in a liquidation they are returned to customers, with SIPC covering shortfalls within limits. Other providers depend on their contracts and on whether customer assets are held as financial assets in securities accounts, which keeps them out of the provider's estate. A provider holding tokens without those protections can leave customers as unsecured creditors.
Which is better?: It depends on what you can manage. Self-custody avoids reliance on a provider's solvency and conduct but puts key security, backups and recordkeeping on you. A custodial account adds the provider's protections, statements, tax forms and recovery processes, and adds its failure risk and its control over access. For most tokenized securities, the transfer agent's recovery power reduces the downside of losing keys, which narrows the difference.