Crypto Prime Broker Due Diligence: A Checklist for Funds

By the Guardian team Updated November 2026 6 min read

Quick answer. Ask where your assets sit, in whose name, and whether they can be rehypothecated. Then test margin and liquidation terms, key and withdrawal controls, insurance, proof of reserves and default terms, with documents rather than answers.

Watch: Crypto Prime Broker Due Diligence: A Checklist for Funds 1:46

Video transcript

Before onboarding with a crypto prime broker, ask where your assets sit, in whose name, and whether they can be re-pledged.

Start with custody. Ask which entity holds your assets, whether wallets are segregated or omnibus, and who the sub-custodians are. Then request any legal opinion on insolvency.

Ask if reuse is on by default. Rehypothecation means the broker re-pledges your collateral, so you lose title and keep only a claim, which ICMA calls intrinsically unsecured.

Financing makes the broker your creditor. The SEC alleged FTX gave Alameda Research a virtually unlimited line of credit. Check that the margin rulebook binds everyone.

Test key and withdrawal controls, including venues holding your collateral. In February 2025, the FBI attributed a one point five billion dollar theft from Bybit to North Korea.

Proof of reserves helps, within limits. PCAOB investor advocate staff warned these reports are not audits and likely miss liabilities. Ask for a liabilities proof you can verify.

Plan for the day the broker cannot pay. Coinbase's risk factors say customers could end up general unsecured creditors. With counsel, review default triggers, portability, governing law and withdrawal pauses.

The broker is one counterparty. The protocols behind it are others. Guardian's capital allocator service scores each onchain position from zero to one hundred, with every input visible.

Read the full checklist below, or talk to Guardian about underwriting the positions behind your broker.

Crypto prime brokers combine trading, financing and custody for funds. The Financial Stability Board (FSB) notes that such firms may keep much of the record-keeping and asset transfer on their own books.

That works until a counterparty fails. In 2022, FTX's collapse and the withdrawal halt at Genesis showed how quickly a counterparty's problem reaches its clients.

This checklist is for operational due diligence teams. It draws on regulators' texts and brokers' public filings, quoted because they are public, not as ratings.

Custody and Segregation

Start with where the assets sit, and in whose name.

Galaxy's 2025 annual report says Galaxy Prime customers' assets sit in omnibus accounts at third-party custodians, in Galaxy Prime's name for its customers' benefit.

Galaxy believes those assets fall outside a Galaxy Prime bankruptcy estate. It also says "there can be no certainty" how a court would treat them.

Regulated custody sets a benchmark. NYDFS's 2025 guidance expects the custodians it licenses or charters to:

Segregate customer assets from corporate assets, onchain and on internal ledgers.
Keep omnibus wallets for customer assets only, with a clear audit trail.
Be ready "at all times" to reconcile their books with onchain activity.
Get its approval before any new sub-custody arrangement.

MiCA requires EU crypto-asset custodians to keep client assets legally segregated, so their creditors "have no recourse" to them in insolvency.

Ask:

Which legal entity is your counterparty, and which entity holds the assets?
Segregated or omnibus wallets? Can you see the addresses?
Who are the sub-custodians, and what do their agreements say on insolvency?
Does the agreement treat your assets as financial assets under UCC Article 8, or a local equivalent?
Has the broker obtained a legal opinion on insolvency treatment, and will it share it?
If collateral backs trading on a venue, does it stay with a custodian, and who can release it?

Our crypto custody guide covers custody models.

Rehypothecation Terms

Rehypothecation is re-pledging: the broker passes collateral you posted on to a third party.

Once it does, ICMA explains, you lose title and keep only a contractual claim to the same or similar assets. ICMA calls that claim "intrinsically unsecured".

Brokers' filings show how much the contract decides:

Galaxy: margin assets rehypothecated under "an express contractual right" would be considered Galaxy Prime's property.
Coinbase: it does not use customer assets as collateral for loans, margin or rehypothecation "without the customer's consent".

The FSB warns that without segregation safeguards, client assets could be "misappropriated or re-hypothecated" to fund other projects.

MiCA's Article 70 requires providers holding client crypto-assets to prevent their use "for their own account". Recital 94 leaves crypto lending and borrowing outside MiCA.

Ask:

Which agreements grant a reuse right, and is it on by default?
Does it cover all your assets, or only margin collateral?
Is reuse capped, and how is it reported to you?
Can you opt out, and what does that cost in financing terms?

Credit and Margin

Financing makes the broker your creditor, and special terms hide here.

The FSB notes that trading platforms may give affiliated trading firms "extended or unlimited credit lines" with lenient or no collateral.

The SEC alleged FTX gave Alameda Research a "virtually unlimited" line of credit and exempted it from "certain key FTX risk mitigation measures".

Ask for the margin rulebook, and check that it binds everyone:

Eligible collateral and haircuts per asset, and notice before they change.
Margin call timing, cure periods and how liquidation is run.
Cross-default and set-off across accounts and entities.
Whether affiliates trade on the same terms, and who checks.
How the broker funds its lending, and from whose assets.

Coinbase, for one, says it borrows crypto from third parties, "including eligible institutional customers".

Keys, Withdrawals and Insurance

Key and withdrawal controls

MiCA requires custodians to keep a custody policy that minimizes losses from "fraud, cyber threats or negligence". Clients can ask for a summary.

Coinbase says it generally seeks to hold no more than 2% of assets under custody in hot wallets.

Ask for:

The hot and cold wallet split, and the policy behind it.
Signing quorum, devices and approval workflow for withdrawals.
Address allowlisting and withdrawal delays on your account.
Key ceremony, backup and recovery test records.
A SOC 2 Type II report, pentest summaries and remediation status.

Include venues holding your collateral. In February 2025, the FBI attributed a $1.5 billion theft from Bybit to North Korea.

Our vendor due diligence questionnaire has the full security question set.

Insurance

Read the policy, not the summary. Coinbase discloses a commercial crime policy with "a one-year term without automatic renewals".

It adds that customer assets are "substantially more than our corporate assets and available insurance". Ask:

Who is the insurer, what is the limit, and is it shared across clients?
Does it cover hot wallets, cold storage, insiders and social engineering?
What are the exclusions, and when does it renew?

Proof of Reserves and Liabilities

Proof of reserves helps, within limits. In March 2023, the PCAOB's Office of the Investor Advocate warned that such reports are not audits. As summarized by DLA Piper, they:

Verify assets only "at a particular moment in time".
Likely do not address liabilities, or whether assets were borrowed.
May follow procedures directed by management.
Give no assurance on internal controls or governance.

Solvency needs both sides. Vitalik Buterin's 2022 write-up describes putting customer balances in a Merkle sum tree, so each customer can check their balance is included.

Ask:

Can you verify your own balance against a liabilities proof?
Who did the work, under what standard, and how often?
Do reserves exclude borrowed assets and assets pledged elsewhere?
Do the figures tie to audited financial statements?

Default and Wind-Down

Plan for the day the broker cannot pay.

The SEC alleged that Genesis halted Gemini Earn withdrawals in November 2022 for lack of liquid assets. Genesis then held about $900 million of those investors' assets, the SEC said.

Coinbase's own risk factors say custodied crypto "may be considered to be the property of a bankruptcy estate", which could leave customers as "general unsecured creditors".

Citing UCC Article 8, Coinbase believes a court would not treat them that way, but notes courts "have not yet considered" it.

Ask, with counsel:

What counts as a default on each side, and what notice applies?
How fast could you move assets to another custodian?
Can you withdraw custody assets during a margin dispute?
Which law governs, and is there a wind-down plan?
What incidents, outages and withdrawal pauses has it had, and where are the post-mortems?

How Guardian Helps

The broker is one counterparty. The protocols your capital reaches through it are others.

Guardian's capital allocator service underwrites onchain positions on evidence: deployed code, control and custody, dependencies, economic failure paths and operator posture.

Each position gets a 0 to 100 score with every input visible, and monitoring moves the score when the protocol changes. For your own protocol reviews, see our DeFi protocol due diligence checklist.

For custodians, bridges and other dependencies, Guardian's institutional advisory includes counterparty and integration review.

Frequently Asked Questions

What should a fund ask a crypto prime broker before onboarding?

Ask where assets are held and in whose name, and whether they can be rehypothecated. Then cover margin and liquidation, key and withdrawal controls, insurance, proof of reserves and liabilities, and what happens if the broker fails.

What is rehypothecation in crypto prime brokerage?

Re-pledging: the broker passes collateral you posted on to a third party. You lose title and keep an unsecured contractual claim to the same or similar assets. Galaxy's filing says margin assets it rehypothecates would be considered its property.

Is proof of reserves enough?

No. PCAOB investor advocate staff warned in 2023 that these reports are not audits, cover a single moment and likely do not address liabilities or borrowed assets. Ask for a liabilities proof and audited financial statements.

Are assets at a crypto prime broker safe in its bankruptcy?

It depends on the structure and the law. Galaxy and Coinbase both believe custodied assets fall outside their estates, but both disclose that customers could be treated as general unsecured creditors. Have counsel review the agreements.

Sources

Underwrite the positions behind your broker

Guardian reviews the code, controls and dependencies behind an onchain position, scores it and keeps watching, so diligence does not expire at onboarding.

Talk to Guardian Explore capital allocator services