Securities Custody: Euroclear, Clearstream, Pershing

When an investor buys a stock or bond, the security does not sit in their safe—it is recorded in a multi-tier custody system. Who holds the assets, under whose law, and through which chain of intermediaries directly affects their protection, accessibility, and exposure to sanctions. This infrastructure is called custody.

What is custody

A custodian ensures the safe keeping of securities and their servicing: settles trades, credits dividends and coupons, processes corporate actions, assists with reclaiming excess withholding tax, and produces reports. The securities themselves are held separately from the custodian's balance sheet, so in the event of its bankruptcy they typically remain the client's property rather than joining the insolvency estate. Staying out of the estate and being immediately usable are, however, two different results: what exactly the client owns, how it is recorded and how it comes back are separate questions, examined below — segregation on its own settles none of them.

One position, four ledgers

Take the simplest private-wealth case and follow it up the chain (figures illustrative). A client of a London broker buys 100 shares of a US-listed company and sees a line on a statement: 100 shares. That line lives in exactly one place — the broker's internal ledger — and it is the only record anywhere in which the client appears by name. One tier up, the broker's nominee company holds a single omnibus position in that issuer at a global custodian, say 1,200,000 shares for all of the broker's clients together; the custodian's books show the nominee, not the client. The custodian's US sub-custodian, a DTC participant, holds its own aggregate at the Depository Trust Company, and on the issuer's register the holder of nearly the whole issue is DTC's nominee, Cede & Co. Four ledgers, four names, and the client's name appears only on the first.

The rights are layered the same way. Against the broker, a UK client is a beneficial co-owner of the pooled shares held on trust under the FCA's client asset rules — outside the broker's estate if it fails. The broker's nominee holds an entitlement against the global custodian under the custody agreement's governing law; from the US tier upward the position is a security entitlement under Article 8 of the Uniform Commercial Code. Nobody in the chain has a right against anyone but the next tier, and the issuer owes its dividend to Cede & Co. alone; when it pays, the money travels down the same four ledgers, with US withholding tax taken on the way unless the client's treaty documentation has moved up the chain in advance (dividend flows).

Three trade-offs show already in this one position. The omnibus structure is cheap — one account per market — but the client's title is only as good as the broker's ledger and its reconciliation, because nothing above the broker knows the client exists. Each tier sits under its own law: the client's protection is set by the broker's regime, while the shares answer to US law and to whatever freeze reaches the US tier. And title and access are different things: a sanctions order, a court freeze or an administrator's stay at any of the four ledgers stops the flow without moving ownership at all. The sections below take each of these apart.

How the custody industry emerged

The multi-tier system grew out of the crisis of the late 1960s. On Wall Street, trading volumes outpaced the capacity of paper processing: certificates physically could not move from seller to buyer in time, exchanges shortened trading hours and closed on Wednesdays to clear the backlog. This became known as the paperwork crisis. The response was immobilization—certificates were brought to a central depository and stopped being moved around, and the transfer of rights was reduced to account entries. The next step was dematerialization, when the paper certificate disappeared altogether.

In the United States, this logic gave rise in 1973 to the Depository Trust Company, whose nominee holder Cede & Co. is still listed as the owner of most American shares. In Europe, two international depositories emerged to serve the Eurobond market: Euroclear, launched in 1968 by the Brussels office of Morgan Guaranty Trust, and Cedel, founded in Luxembourg in 1970 and renamed Clearstream in 2000. This pair of ICSDs has been handling cross-border settlements ever since.

The custody chain

Between the investor and the issuer there are usually several links: the broker maintains the client's account, the global custodian holds the assets and connects through local sub-custodians to depositories in each country. The longer the chain, the more intermediaries whose law and solvency matter. The largest global custodians are BNY, State Street, JPMorgan and Citi; Pershing (part of BNY) serves American brokers and independent advisors.

Global custodian and sub-custodians

A retail investor almost never opens an account directly with a depository. Between them, their broker and the (I)CSD stands a global custodian—a bank that maintains a single client account and through its own network of sub-custodians accesses local markets: in each country a local agent operates with access to the national CSD. The market is concentrated. The "Big Four"—BNY, State Street, JPMorgan and Citi—hold around $180 trillion in assets under custody and administration in total; the largest, BNY (formerly Bank of New York Mellon), reached nearly $60 trillion in assets under custody and administration by the end of 2025.

What the service includes

Custody is just the foundation. The custodian settles trades, processes corporate actions (dividends, coupons, splits, tenders), collects income and files for reclaim of excess withholding tax under treaties, provides proxy voting at meetings, facilitates securities lending and currency conversion, and produces reports for the client and regulator. The reverse operation — moving the portfolio to another custodian — is priced separately and per position, and costs most when it is the bank that ends the relationship (account closure and portfolio exit). For private wealth, an inheritance dimension is added: upon the owner's death, it is through the custody chain that access to the foreign portfolio is unlocked.

CSD and ICSD

At the top are the depositories. A national central securities depository (CSD) maintains the record of a country's securities and conducts settlements—in the United States this is DTC within the DTCC group. For cross-border securities and Eurobonds, international central securities depositories (ICSDs) operate: Euroclear Bank in Brussels and Clearstream Banking in Luxembourg. Their scale is enormous: assets under custody at Euroclear reached €40.7 trillion at the end of 2024, and at Clearstream around €20 trillion.

Ownership, claim, record, access

Before segregation can protect anyone, the vocabulary needs fixing. Behind the phrase "my securities are in custody" sit four independent legal facts, and every failure scenario later in this guide turns on which of them survives:

• Title or proprietary interest — the asset belongs to the client (or to a pool of clients) and does not form part of the intermediary's insolvency estate.
• Contractual claim — the intermediary owes the client delivery of an asset or payment of money; on insolvency such a claim competes with other creditors unless a protective regime intervenes.
• Record — an entry in someone's books. A record is evidence of a position, not the position itself, and records at different tiers of the chain can disagree.
• Access — the practical ability to sell, transfer or receive income today. A sanctions freeze, an administrator's stay or a foreign moratorium removes access without touching title.

In a multi-tier chain the investor's rights almost always run against their own intermediary — the broker or bank whose contract they signed — not against the depository or the issuer several tiers up. Each tier holds rights against the next tier only. Which of the four facts survives decides not only the outcome but the route to enforce it — a proprietary claim inside the insolvency, a contractual claim against the firm, or a licence application to the freezing authority; the map of those routes is in the disputes guide.

The legal form of that right differs by system. In English-law custody the standard analysis is a trust: the firm holds pooled securities as trustee and clients are co-owners of the pool in proportion to their entitlements. The FCA client asset rules frame the duty directly: a firm must "make adequate arrangements so as to safeguard clients' ownership rights, especially in the event of the firm's insolvency" and must not use safe custody assets for its own account without express consent (CASS 6.2.1R); client positions are registered in the client's name or a nominee's, with the firm's own assets separately identified (CASS 6.2.3R, 6.2.5R). In the United States, holdings through DTC are analysed under Article 8 of the Uniform Commercial Code as a security entitlement: a bundle of rights against one's own intermediary plus a pro-rata interest in the fungible pool that intermediary holds — deliberately not a traceable right to specific certificates. In the EU, MiFID's safeguarding rules (Delegated Directive (EU) 2017/593, Article 2) require records that "distinguish assets held for one client from assets held for any other client and from their own assets" and reconciliation with third parties on a regular basis.

Cash never fits the property model. Money standing to the client's credit is a claim — against a bank as a deposit, or against a segregated client-money pool — and follows different rules at every point below.

The models compare as follows on the axes that matter at failure.

In the first three rows the asset should stay out of the intermediary's insolvency estate; in the last row the client is a creditor from the outset, and only a specific statutory regime — client money rules, safeguarding, a reserve requirement — changes that outcome.

Client account and the firm's internal ledger

Every intermediated holding lives in two record layers at once. The upper layer is the external account: what the next tier of the chain — the global custodian, the sub-custodian, the CSD — holds in the name of the firm or its nominee. The lower layer is the firm's internal ledger, which alone says which client owns how much of that external position. The market above the firm sees only the aggregate; individual clients exist solely in their own intermediary's books.

Two consequences follow. First, the split between the client account and the firm's house account — the account where the intermediary keeps its own proprietary assets — is the single most load-bearing boundary in the whole architecture: client asset rules on both sides of the Atlantic exist mainly to police it. Second, client-level ownership is only ever as good as the internal ledger and its reconciliation against the outside world. A perfect legal regime applied to broken records still produces losses.

The Lehman collapse showed what happens when the boundary blurs. Lehman Brothers International (Europe) failed in September 2008 with large amounts of client money never properly segregated; it took until February 2012 for the UK Supreme Court to settle the basic questions (Re Lehman Brothers International (Europe) [2012] UKSC 6): the statutory trust over client money arises on receipt, not on segregation; identifiable client money sitting in house accounts joins the client money pool; and the pool is shared by every client with a contractual right to segregation — not only those whose money was actually segregated. The protective reading prevailed, but clients whose money had been correctly segregated shared their pool with those whose money had not, and the answer took three and a half years of litigation to obtain.

Nominee and omnibus

Two words describe two different design choices that are often conflated. A nominee answers the question "in whose name is the external account": legal title of record sits with a nominee company so that client assets never appear under the firm's own name and cannot be mistaken for its property. An omnibus account answers the question "how many clients share one account": positions of many clients are pooled in a single external account, with the client-by-client split kept one tier below.

Omnibus pooling is the default economics of the industry — one account per market instead of thousands — and it is lawful in most regimes as long as records allow each client's assets to be distinguished without delay. Its cost appears exactly at failure: a shortfall in a pooled account has no name on it, so it must be allocated by rule rather than traced to a culprit. Individual segregation at the sub-custodian or CSD level narrows that exposure but does not eliminate reliance on the firm's ledger, adds cost per account, and is not offered in every market. In the EU, CSDR requires CSD participants to offer clients the choice between omnibus client segregation and individual client segregation at the CSD level and to disclose the costs and protection levels of each (Article 38).

When the client agrees to give up title

Everything above protects assets the firm still holds for the client. Three doors lead out of that position, and all three are opened by the client's own signature.

The first is securities lending. Under the UK rules a firm may not enter into securities financing transactions with a client's safe custody assets, or otherwise use them for its own account, unless the client has given express prior consent to that use on specified terms; in an omnibus account either every client must have consented, or the firm must have systems ensuring that only consenting clients' assets are used (CASS 6.4.1R), and the firm must adopt arrangements ensuring that the borrower provides appropriate collateral (CASS 6.4.2AR). MiFID II states the same principle at directive level: adequate arrangements to safeguard clients' ownership rights and "to prevent the use of a client's financial instruments on own account except with the client's express consent" (Article 16(8)). While shares are on loan the client no longer holds them: it holds a contractual claim to equivalent shares back plus whatever collateral the arrangement gives it — outside the trust pool, dependent on the borrower and the collateral, not on segregation.

The second door is a title transfer collateral arrangement (TTCA): the client transfers full ownership of securities to the firm as collateral for margin or other obligations, keeping only a personal right to equivalent securities back. Title has moved, custody rules no longer apply to those securities, and on the firm's insolvency the client is an unsecured creditor for their value. MiFID II Article 16(10) forbids firms from concluding TTCAs with retail clients to secure their obligations; professional clients — including private-wealth vehicles opted up to that status — remain free to sign them. Switzerland draws a similar line by form: an account holder may authorise its custodian to dispose of intermediated securities in the custodian's own name, but unless the holder is a qualified investor the authorisation must be in writing and may not be included in general terms and conditions (FISA, Article 22).

The third door is margin. In the US, SEC Rule 15c3-3 requires possession or control only of fully-paid and excess margin securities — those with a market value above 140% of the customer's debit balance (paragraphs (a)(5) and (b)(1)); securities within that band collateralise the margin loan and can be pledged or lent by the broker. Fully-paid securities may still be borrowed from the customer, but only under a written agreement, against collateral fully securing the loan and marked to market daily, and with a prominent notice that the Securities Investor Protection Act may not protect the lender and the collateral may be its only recourse if the broker fails (paragraph (b)(3)). That notice is the honest summary of every lending programme: a property right traded for a secured creditor position. The pre-2008 prime-brokerage market showed the unlimited version: the IMF's working paper on deleveraging after Lehman records that in the United Kingdom a prime broker's re-use of a customer's assets could then be "for an unlimited amount", and that rehypothecation fell sharply after Lehman's bankruptcy because firms feared losing collateral if their prime broker became insolvent (IMF WP 09/42). In the vocabulary of this guide, a lending consent or a TTCA moves the client from the first rows of the holding-model table to the last.

The chain, link by link

The abstract chain becomes concrete when each link's records, name and law are laid side by side. The table below tracks a typical cross-border position — a private client of an EU or UK broker holding US shares.

Read vertically, the table shows why the client's insolvency risk is concentrated at the bottom of the chain — their own broker — while their market-access risk is distributed across every link above, each under its own law. The booking centre chosen by the bank fixes which client asset regime applies at the tier that actually knows the client, and the same layering logic governs the cash side of the relationship in correspondent banking.

Reconciliation: securities and cash separately

Because the client exists only in one ledger, regimes prescribe how often that ledger must be checked — internally for consistency and externally against the next tier.

For securities under the UK rules, a firm must run an internal custody record check at least monthly (CASS 6.6.11R), reconcile against every third party holding client assets at least monthly (CASS 6.6.37R), and count physical instruments at least every six months (CASS 6.6.22R). Discrepancies must be investigated and resolved without undue delay, and while a shortfall exists the firm must cover it from its own resources: set aside its own equivalent assets, or its own money treated as client money under the client money rules, until the gap is closed (CASS 6.6.54R). The EU baseline is the same architecture with less prescriptive frequency — reconciliation "on a regular basis" (Delegated Directive 2017/593, Article 2(1)(c)).

Cash follows a different mechanic because it is a claim, not property. In the US, SEC Rule 15c3-3 makes the broker-dealer hold customers' fully-paid and excess margin securities in its possession or control, and back net cash owed to customers with a special reserve bank account "for the exclusive benefit of customers": the reserve is computed weekly as of the last business day of the week, with the deposit due no later than one hour after banking opens on the second following business day — and firms with average total credits of $500 million or more must compute daily. Between computation dates customer cash can lawfully finance a defined set of customer-related debits, which is why cash protection is periodic, not continuous.

The duty to return: timeline, shortfall, costs

A solvent exit is a service: the portfolio transfers out under the contract, priced per position, on the terms described in account closure. The hard questions arise on failure, and the two reference regimes answer them in structurally similar ways.

In the UK, an investment firm holding client assets goes into the special administration regime, whose first statutory objective is to "ensure the return of client assets as soon as is reasonably practicable" (Investment Bank Special Administration Regulations 2011, reg 10). The administrator may set a bar date for asset claims, and a shortfall in an omnibus account is "borne pro rata by all clients for whom the investment bank holds securities of that particular description in that same account"; each client's share of the shortfall becomes an unsecured claim against the firm, valued at market price on the date the firm entered special administration (reg 12). The cost of the return process is paid by the clients: under the special administration rules, expenses properly incurred by the administrator in pursuing Objective 1 are paid out of the client assets, first in the order of priority (Rules 2011, rule 135(1)(a)) — return is not free, and the deduction hits clients whose records were perfect together with everyone else. One correction exists: where the administrator considers that costs were incurred because the firm itself breached the client money rules or another relevant requirement, the amount — agreed by the creditors' committee or fixed by the court — is assigned to the firm and paid out of the firm's own assets, but only so far as those assets stretch (reg 19A).

In the US, a failed broker-dealer goes into SIPA liquidation. Where records are accurate, the trustee's fastest tool is a bulk transfer of customer accounts to a solvent broker; otherwise each customer files a claim for their net equity, shares pro rata in the fund of customer property, and SIPC advances up to $500,000 per customer (of which at most $250,000 for cash) to cover what customer property does not. Anything above that becomes a general unsecured claim. SIPC does not protect against a fall in the market value of securities, and cash in futures accounts sits outside SIPC entirely.

Responsibility along the chain is layered, not joint. The client's own firm answers for its ledger and its conduct; for a sub-custodian's failure, a MiFID firm answers for "due skill, care and diligence in the selection, appointment and periodic review" of the sub-custodian (Delegated Directive 2017/593, Article 3) — a negligence standard, not a guarantee — and depositing client instruments in a third country is restricted where safekeeping there is not specifically regulated. The strict version of liability exists only in the EU fund world: a UCITS or AIF depositary must return equivalent instruments lost in custody even at a sub-custodian, which is precisely why that standard cannot be read across into ordinary brokerage or private-bank custody terms.

Who answers for what

Laid out by participant, the promises look like this — and the column that matters is the last one.

Provider documents restate this architecture rather than improve on it. Charles Schwab's account protection terms, for example, state that "clients' fully paid securities are segregated from other firm assets and held at third party depository institutions" and repeat the SIPC limits and exclusions — first-party confirmation that the protective content comes from the regime, and that marketing language adds nothing above it.

Civil-law contrast: Switzerland

The two reference regimes above are a common-law trust model and a US statutory one. Most private-wealth booking centres sit in civil-law systems, and Switzerland shows how a statute reaches the same destination by a different road. The Federal Intermediated Securities Act (FISA, SR 957.1, quoted from the Federal Council's English translation) uses no trust: the account holder's intermediated securities are a statutory asset which, when a custodian goes into compulsory liquidation, the liquidator must exclude from the custodian's estate up to the number credited to account holders' securities accounts (Article 17(1)). Two features have no UK equivalent. A presumption: if the custodian did not keep its own and its clients' securities in separate accounts with the sub-custodian, everything in the mixed accounts is presumed to belong to the account holders (Article 17(2)) — the mixing that cost Lehman's UK clients three and a half years of litigation is settled by a rule of evidence in the clients' favour. And the shortfall order: if the excluded securities do not satisfy account holders in full, the custodian's own holdings of the same kind are taken next, "even where such intermediated securities have been held separately", and only the remaining gap is borne by account holders in proportion to their credited positions, with a compensation claim against the custodian for the balance (Article 19(1)–(2)). Where a sub-custodian fails, the custodian must itself seek the exclusion of its account holders' securities from the sub-custodian's estate (Article 18); excluded securities are transferred to a custodian designated by the account holder or delivered to it (Article 17(4)).

Re-run the omnibus example under this rule (figures invented): 10,000 shares credited to clients, 9,600 found, and the custodian also holds 300 shares of the same issuer for its own book. Under the UK regime the 400-share gap is shared pro rata — a client with 500 shares receives 480 plus a claim for 20 — and the house position stays with the general estate. Under FISA Article 19 the 300 house shares go to the clients first: the gap shrinks to 100 shares, 1% of the pool, and the same client receives 495 shares in kind plus a compensation claim for 5. The cash boundary is drawn as elsewhere: deposit protection through esisuisse covers deposits up to CHF 100,000 per depositor per bank, funded by the banks up to CHF 8.1 billion in total (esisuisse); securities are not deposits, and their protection is the segregation right itself.

Four failure scenarios

Each scenario below separates the four layers — legal right, accounting fact, procedure, residual risk — because they diverge in exactly these situations.

Omnibus shortfall

A broker's omnibus account at its custodian should hold 10,000 shares of an issuer for twenty clients; the monthly external reconciliation finds 9,600. The numbers here are invented for illustration. The legal right of each client is co-ownership of (or an entitlement against) the pool — nobody can point to "their" 400 missing shares. The accounting fact is a 4% gap between the internal ledger and the external record. The procedure while the firm is solvent: it must make the gap good from its own assets or own money held as client money (CASS 6.6.54R). If the firm fails first, the shortfall is shared pro rata: a client entitled to 500 shares receives 480, plus an unsecured claim for the value of 20 shares at market price on the date of administration (reg 12 of the UK regime). The residual risk is the unsecured claim and the market movement of the missing slice while the procedure runs. Which fact flips the result: individual client segregation at the sub-custodian or CSD takes this client's line out of the shared pool, so a gap in the omnibus account is not its gap — though a gap created inside the broker's own ledger still is; a Swiss-law custodian's own holdings of the same issuer are taken before clients share anything (FISA Article 19); and a client who signed a lending consent or a title transfer arrangement is outside the pool altogether, holding a claim and collateral rather than a share of what was found.

Sub-custodian in another jurisdiction

The client's own broker and its books are intact, but the local sub-custodian in the market where the shares sit has failed or been frozen. The legal right against the broker is unchanged; whether the pooled position at the sub-custodian is insolvency-remote is now a question of the local market's law, not of the client's contract. The accounting fact: the chain reconciles perfectly — every ledger agrees the assets are exactly where they are stuck. The procedure runs through the local regime — whether the foreign proceeding is recognised and how the custodian's claim ranks there are questions of cross-border insolvency law, not of the client's contract — with the global custodian pursuing the position as account holder; the client's firm answers only for negligent selection or monitoring, not for the loss itself. The residual risk is time and local law — and in the sanctions variant, described in the geopolitical section below, access can be lost for years while title is never disputed.

Broker bankruptcy with clean records

The best case: the broker fails, records fully reconciled, no shortfall. The legal right keeps the entire portfolio out of the estate. The accounting fact confirms it. The procedure is nonetheless collective: an administrator or SIPA trustee must verify the records, resolve competing claims and either transfer accounts in bulk or distribute — and until then positions are in practice frozen, corporate actions are handled by the officeholder, and costs of the return process are deducted under the applicable regime. MF Global's SIPA liquidation, which began on 31 October 2011 with a customer funds shortfall of roughly $1.6 billion, still moved about 72% of account values to other brokers within weeks; returning 100% of commodities customer property took until late 2013, and general creditors reached near-full recovery only in 2015. Lehman's UK estate needed three and a half years merely to establish who shared the client money pool. Clean records shrink these timelines dramatically; they do not abolish the procedure.

Cash awaiting settlement

A client's money is mid-flight in a purchase or sale. Under the UK rules a firm settling delivery-versus-payment through a commercial settlement system may keep the money outside client money protection during the settlement window, but must bring it back inside if settlement has not completed by close of the third business day (CASS 7.11.14R); in the US the cash becomes a credit in a reserve computation that is trued up weekly, daily only for the largest firms. The legal right during the window is a bare contractual claim; the accounting fact may show the money at a settlement bank in neither the client pool nor the house account; the procedure on a failure inside the window is a claims process over which bucket the money belongs to. The residual risk is precisely this timing gap — small in duration, real in an insolvency that happens to land inside it.

What each event leads to

The scenarios condense into a single outcomes matrix — the reference point for every "is it protected?" question about custody.

The matrix also fixes the boundary of guarantee schemes: deposit guarantee schemes protect bank deposits — the cash rows — and never extend to securities in custody, which are not deposits. Investor compensation schemes (FSCS investment claims in the UK, up to £85,000 per person per firm for firms failing after 1 April 2019; SIPC advances in the US) respond to assets missing at a failed firm, within fixed limits, and never to a fall in market value. This distinction is the securities counterpart of the safeguarding-versus-deposit-guarantee boundary drawn for payment balances in correspondent banking and client money protection, and the same logic — the wrapper decides the right, not the interface — governs tokenised securities and the wind-down of a licensed firm.

Two cases that fix the boundaries

Pooled shares can be owned; pooled gold cannot. In Hunter v Moss [1994] 1 WLR 452 the English Court of Appeal upheld a trust over 50 of a shareholder's 950 shares in one company although no particular 50 had ever been identified: shares of one class are indistinguishable, so no segregation was needed for the beneficiary's proprietary interest to exist. In Re Harvard Securities Ltd [1997] 2 BCLC 369 Neuberger J applied that reasoning to the custody situation itself — a broker that bought blocks of shares, sold parcels to clients and kept legal title as nominee without allocating specific shares to anyone — and held that the clients had beneficial interests in the unallocated pool, shares falling to be treated "in the same way as a debt or fund rather than chattels". The contrast case is Re Goldcorp Exchange Ltd [1995] 1 AC 74, where the Privy Council denied any proprietary interest to customers of a bullion dealer who had paid for "unallocated" gold that was never set aside: they were unsecured creditors. That rule is the foundation of every nominee account in this guide, and its limit matters as much — an unallocated metal account at a bank is, absent specific allocation, the Goldcorp position, not the Harvard one.

A statement is not a position. In In re Bernard L. Madoff Investment Securities LLC, 654 F.3d 229 (2d Cir. 16 August 2011), customers argued that their SIPA net equity should be measured by their last account statements, which showed large securities positions. The Second Circuit upheld the trustee's Net Investment Method instead — cash deposited minus cash withdrawn — because the statements were fictitious, no securities had ever been bought, and net equity must be ascertainable from the books and records of the debtor; SIPA, the court added, "is not designed to insure investors against all losses" (opinion). In this guide's terms: a record is evidence of a position, and where the position never existed the record creates nothing — SIPC advances follow real money in, not printed balances.

Segregation and residual risk

What remains after all the machinery is a short list. Segregation, nominee registration, reconciliation and the return regimes convert "the firm failed" from a catastrophic event into a procedural one — for clients whose assets were where the ledger said they were. What segregation does not do: it does not accelerate access during a collective procedure, does not reach a shortfall that arose before failure, does not bind a foreign sub-custodian's jurisdiction, does not cover cash beyond the applicable guarantee or client-money regime, and does not insure market value at any point. A long sub-custody chain with omnibus accounting adds operational and legal risk at every tier — the price paid for cheap access to many markets through one account.

Geopolitical risk

Custody is subject to the law of the jurisdiction where the assets are physically and legally located. This was most clearly demonstrated by the immobilization of the Bank of Russia's assets: around €190 billion recorded at Euroclear were frozen after 2022. For a private owner, the lesson is simple—the choice of depository and country of custody determines not only convenience but also sanctions vulnerability.

Regulation

In the EU, the infrastructure is governed by CSDR (Regulation EU 909/2014): it licenses and supervises depositories and introduces settlement discipline. Since February 1, 2022, cash penalties have been charged for failed settlements. The mandatory buy-in mechanism has been suspended and, following the CSDR Refit reform (Regulation EU 2023/2845), is applied only as a last resort—if penalties fail and financial stability is at risk.

The safeguarding of client assets is also enshrined in sectoral regimes. The UCITS V and AIFMD directives impose on a fund's depositary liability for the loss of financial instruments: it must return the equivalent even in the event of a sub-custodian's bankruptcy. In the United States, a similar role is played by SEC Rule 15c3-3 (Customer Protection Rule), which requires a broker-dealer to segregate clients' securities and cash from its own. The same framework is subject to AML/KYC requirements and automatic data exchange under CRS.

Where custody is heading

The main vector is settlement acceleration. The United States, Canada and Mexico moved to T+1 on May 28, 2024; the EU, United Kingdom and Switzerland are synchronously targeting October 11, 2027. Compressing the window to one day leaves less time for reconciliation across the entire chain and raises the bar for automation for custodians and sub-custodians. In parallel, the infrastructure itself is being digitized: in the EU, the DLT Pilot Regime for settlement of tokenized securities has been in effect since March 2023, and major custodians are launching custody of digital assets and tokenized instruments, where the entitlement analysis of this guide meets control of a private key (crypto for private wealth).