Thirty Percent of What? Reading the Ripple-BCG Custody Study With the Marketing Stripped Out

There is a number moving through the institutional crypto conversation right now, and it is moving faster than its footnotes. Thirty percent. Thirty percent of digital assets, the story goes, are already held in institutional custody. I have seen it screenshotted, quoted in pitch decks, and dropped into panel discussions with the confident finality of a number that nobody expects to be questioned.

So I did what I always do when a number arrives with too much confidence. I went and found the actual document underneath it.

The number comes from a Boston Consulting Group study, announced on October 22 and commissioned by Ripple, examining how banks should think about digital asset custody. It is a genuinely useful piece of work in one narrow, unglamorous way, and it is a marketing artifact in another, and the gap between those two things is where almost everyone reading it will get lost. Because the thirty percent figure, as it appears in the study, is not what it becomes once it leaves the study. In the original, it means something like this: roughly thirty percent of digital assets held outside centralized exchanges sit in institutional custody models, and that bucket includes enterprise self-custody and wallet-as-a-service, not just third-party custodians. By the time it reaches a conference stage, it has become "institutions hold thirty percent of all crypto." Those are not the same sentence. They are not even close.

I spent a weekend with the PDF, a notebook, and a growing irritation. What follows is what I found when I stopped reading the study the way it wants to be read and started reading it the way a person who has actually shipped custody-adjacent infrastructure reads it. The real value of this report is not the market size it sketches. It is the decision framework it accidentally reveals, and the governance layer it keeps circling without naming.

What Custody Actually Is, and What the Industry Pretends It Is Not

Let me start with the thing that custody is, because the industry has spent years confusing the noun with the verb.

Custody is a verb, not a noun. It is not a vault. It is a set of ongoing decisions about who is allowed to do what, under which conditions, with which approvals, and with what consequences when the instructions conflict. The vault is the easy part. The vault has been the easy part since hardware security modules became a commodity and multi-party computation matured into something you can buy off a shelf.

This matters because the BCG study, whatever its commercial intentions, actually gets this right in a way most custody marketing does not. It locates the difficulty not in the cryptography but in the operations. "Cryptographic security," the study's framing implies, cannot by itself answer the question of who is authorized to instruct a payment. That is not a cryptographic question. It is a governance question dressed in technical clothing, and the industry has been embarrassingly slow to admit it.

I learned this the hard way, though not in the way you might expect. Back in 2024, when I was building out the glossary and value-mapping work I called the Ethical Bridge, my job was to translate "rollup validity" and "key management" into language a regional bank's risk committee could actually act on. I remember the moment the room went quiet. We were fifteen institutional partners deep into a workshop, and someone from compliance asked a question that had nothing to do with zero-knowledge proofs or threshold signatures. She asked: if two authorized officers issue contradictory payment instructions at the same second, who wins, and who is legally responsible for the loss if the wrong one executes?

Nobody in the room could answer. The engineers wanted to talk about nonces and replay protection. The bankers wanted to talk about fiduciary duty. And in that silence, I understood something that has shaped every custody conversation I have had since: the technology was already solved. The hard part was the constitution. Who has authority, how authority is delegated, how it is revoked, how conflicts resolve, how the whole thing survives a bad actor who happens to be an insider with legitimate credentials.

That is the question the BCG study is actually about, even if it dresses the answer in market sizing. And that is why, for all my suspicion of commissioned research, I think this document deserves more careful reading than the tweets it spawned.

The Context: Why Banks Are Suddenly Interested in Keys

To understand why this study exists now, you have to understand three converging pressures, none of which are about crypto prices.

The first is regulatory. In July 2025, the US banking regulators issued a joint statement clarifying that banks may engage in crypto asset custody, provided that custody satisfies existing safety, soundness, and legal requirements. The most important phrase in that statement, and the one almost nobody quoted, is that it "does not create new regulatory expectations." Read that again. It is not a green light carved out for a new asset class. It is the opposite. It is the regulators saying: you may do this, but you do it inside the walls we already built, with the same capital, the same risk management, the same fiduciary standards, and no special sandbox to hide in. That is simultaneously permissive and terrifying, and it is exactly why banks are now paying consultants to tell them how to proceed.

The second pressure is commercial. Banks are watching stablecoin payment volumes grow, watching tokenized treasuries and money market funds find product-market fit, watching their corporate clients ask why settlement still takes two days and costs what it costs. The bank that cannot custody the asset cannot settle the payment cannot issue the tokenized product. Custody is the front door. If you do not control the front door, you do not get to sell anything in the house.

The third pressure is competitive, and it is the one the study is least honest about. Banks are not the only ones who want to hold these assets. Third-party custodians like Fireblocks, Copper, BitGo, Anchorage, and Coinbase Custody have been doing institutional-grade key management for years. Wallet-as-a-service providers are selling custody infrastructure to payments companies and retail fintechs who want to offer crypto without building a vault. And the centralized exchanges, whatever you think of them, have been the default institutional custodian for most of the asset class's history. The study's most interesting move is that it quietly excludes exchange-held assets from its thirty percent statistic. That exclusion is not a footnote. It is the whole argument. It is saying: the interesting custody market is the one outside the exchanges, because that is the market banks can actually win.

And here is where I have to plant a flag that will annoy some people. The custody study is, at bottom, a document about who gets to be the intermediary. Ripple commissioned it. Ripple sells custody infrastructure. The study concludes that banks need sophisticated, multi-provider, orchestration-capable custody. You do not need a decoder ring to see where this is going. But that does not make the study wrong. It makes it interested. And an interested document can still be accurate. The trick is separating the two.

The Decision Framework Nobody Screenshots

Here is the part of the study I actually think is worth your time, and it is the part that will never go viral because it does not contain a big number.

The study argues that custody is not a single decision but a decision tree, and that the choice of custody model constrains what services a bank can offer. This sounds obvious until you realize how many banks are approaching it backwards. They are asking "which custodian should we use" before they have asked "what do we want to be able to do for our clients." The study flips the order. It says: start from the services, work back to the custody model, because the model determines the services.

And the sharpest version of this insight, the one that made me put down my coffee, is this: the same key management technology can support both long-term holding and payment settlement, but the approval policies and operational workflows are completely different. That single sentence is worth more than the entire market-sizing section, and almost nobody quoted it.

Think about what it means. A bank that wants to hold bitcoin for a client as a long-term store of value needs one thing: absolute security, low operational tempo, deep cold storage, deliberate multi-signature approvals, and a governance model built around patience. A bank that wants to use stablecoins to settle a cross-border payment needs something almost opposite: fast approvals, programmable spending limits, real-time conflict resolution, integration with treasury systems, and a governance model built around speed. Same cryptographic primitives. Same HSM. Same threshold signature scheme. Completely different institution on top.

This is where I want to bring in my own scars. In 2020, during the DeFi Summer madness, I forked three yield-farming strategies in a matter of weeks and treated five thousand dollars of savings as a laboratory. I lost forty percent of it to impermanent loss, which taught me humility, but I also learned something about workflow that has stayed with me. The strategies that looked elegant in a whitepaper fell apart in practice because the approval logic was wrong. The smart contract could do the math perfectly. The smart contract could not decide when a human needed to intervene, and every failure I had came from that gap, not from the arithmetic.

Custody has the same gap, scaled up to bank size. The cryptography is the arithmetic. The governance is the human intervention. And the study, to its credit, keeps pointing at the intervention and calling it by its real name: who can instruct a payment, how limits apply, how conflicting instructions are handled. These are not technical problems. They are constitutional problems, and they are the actual reason a bank's custody project fails or succeeds.

Where the Cryptography Ends and the Argument Begins

I want to be precise about the technical layer, because this is where I earn my keep and where I see the most nonsense repeated.

The custody technology stack that a bank will actually deploy, if it goes the self-custody route, is almost certainly some combination of multi-party computation with threshold signatures and a cluster of hardware security modules, wrapped in a policy engine. MPC-TSS lets you split a private key into shares so that no single machine or person ever holds the whole thing, and a threshold of shares must cooperate to sign. HSM lets you store key material in tamper-resistant hardware. The policy engine is the software layer that decides whether a given signing request is allowed to proceed based on rules about who requested it, how much it is for, which destination it is going to, and what approvals have been collected.

The study does not name these technologies. That is fine; it is a strategy document, not an architecture spec. But the omission matters, because it lets the reader imagine that the hard part is the cryptography. It is not. MPC-TSS is mature. HSM is mature. These are solved problems that you can license from a dozen vendors tomorrow. The unsolved problem, the one that keeps bank CIOs awake, is the policy engine, because the policy engine is where governance becomes executable, and executable governance is where institutions discover that their governance was never as clear as they thought.

Here is what I mean. A bank's policy engine has to encode rules like: payments above a threshold require two approvals from different roles; transfers to a new address require a time delay; a single officer cannot both initiate and approve; the treasury system's instructions take precedence over a trader's ad hoc request. Every one of these rules sounds simple until you try to write it down precisely enough for a machine to enforce it, and then you discover that the bank has never actually agreed on the answers. The policy engine is a mirror. It shows you the constitution you thought you had and the one you actually have.

This is the layer where the study's phrase about "governance, integration, and the ability to collaborate across multiple providers" becomes concrete. Governance is the policy engine. Integration is the APIs into the treasury, the settlement, the reporting, and the risk systems. And the ability to collaborate across multiple providers is the admission that no single custodian will satisfy a bank's full range of needs, which means the bank will end up with custody relationships across several vendors and will need a way to control them all as one.

The Orchestration Prize

That last point is, I think, the real thesis of the study, and it is buried under market sizing because the people who commissioned it are the people who want to sell it.

If a bank ends up using three custodians, it does not want three control panels. It does not want three sets of approvals, three reporting formats, three audit trails, three definitions of who counts as an authorized officer. It wants one control plane that sits above all of them and presents a unified view. That control plane is the orchestration layer, and whoever owns it owns the bank's relationship with the entire custody stack.

I have watched this movie before, in a different theater. The whole OP Stack versus ZK Stack debate, which the industry loves to frame as a technical contest between optimistic rollups and zero-knowledge validity, is not actually a technical contest at all. The real difference is who can convince more projects to deploy chains first. The winner is not the better cryptography. The winner is the better ecosystem, the better tooling, the better standard, the better ability to make a hundred small teams choose your stack because it is the path of least resistance. Standards win. Standards always win. And the orchestration layer in custody is a standards play in exactly the same way.

If one provider's control plane becomes the default way banks manage multiple custodians, then that provider does not need to be the best custodian. It needs to be the standard. It needs to be the thing every other custodian integrates with, the thing every bank's treasury system connects to, the thing that becomes invisible infrastructure. That is a far more valuable position than being one vault among many, and it is exactly the position Ripple is signaling it wants by emphasizing cross-provider control in how it frames the study's conclusions.

The prize is not the vault. The prize is the console that controls the vaults. And the study, perhaps unwittingly, perhaps not, is an argument for why that console should exist.

The Eighty Million That Exists Only in a Spreadsheet

Now let me be the wet blanket, because someone has to be, and because the study's own author was admirably careful about this and the people quoting it are not.

The study models a scenario in which a regional bank with two hundred to three hundred billion dollars in assets, offering a combination of five digital asset use cases, could see eighty to one hundred million dollars in profit and loss upside. That is a genuinely exciting number. It is also, and I cannot emphasize this enough, a modeled number. It is a spreadsheet exercise, not a reported result, not a forecast that the study's authors stand behind as a prediction, and certainly not something that has happened anywhere yet.

I have built these models. I have sat in rooms where we projected revenue from use cases that did not exist yet, using adoption curves borrowed from adjacent industries, and I have watched those projections meet reality and lose. The model is not lying. The model is doing what models do: it assumes the use cases work, the clients want them, the regulators allow them, and the bank can execute. Every one of those assumptions is doing enormous work, and every one of them can fail independently.

The number is not worthless. It is a useful way to size the opportunity so a board will take a meeting. But the moment it becomes "banks will make a hundred million dollars from crypto custody," it has stopped being analysis and become a sales pitch. The study's own careful language gets stripped away in transmission, and what is left is the same kind of number that has preceded every disappointment in this industry's short history.

And this is the moment to bring up the conflict of interest directly, because pretending it does not exist would be dishonest. Ripple sells custody infrastructure. Ripple commissioned the study. The study concludes that banks need sophisticated, multi-provider custody infrastructure. These facts are not independent, and you should discount the study's optimism accordingly. That does not mean you throw the study out. It means you read it the way you read a research report from a brokerage that also does investment banking: with respect for the work and full awareness of who paid for it.

The Contrarian Turn: The Bottleneck Was Never the Technology

Here is where I want to push against the framing of the entire conversation, including the framing of the study.

Everyone in this industry, when they talk about institutional custody, talks about it as a technology problem that is being solved. Better key management, better MPC, better policy engines, better orchestration. And there is truth to that, as far as it goes. But I think the real bottleneck is elsewhere, and the study keeps gesturing at it without naming it plainly.

The real bottleneck is that banks are being asked to become software organizations, and most of them are not.

Read the study's description of how banks are entering this space. They are "licensing self-custody technology and building client products on top of it." That phrase, "building client products on top of it," is doing a lot of hidden work. It means the bank's own internal development teams have to integrate the custody technology, build the products, wire up the treasury and reporting systems, and maintain all of it. The custody vendor provides the vault and the SDK. The bank has to build the bank.

I have been on the vendor side of that relationship, sort of. When I led the Ethical Bridge workshops, the thing that struck me over and over was how much of the difficulty was not technical translation but organizational translation. The bank did not lack engineers. It lacked engineers who understood both the custody stack and the bank's own risk appetite, and it lacked a governance structure that could make decisions fast enough to matter. The technology was the easy conversation. The hard conversation was always about who owned the integration, who signed off on the policy engine rules, and who would take responsibility when something went wrong.

This is why I think the wallet-as-a-service trend the study mentions, growing in popularity among payments and retail fintechs, is the more interesting signal than the bank self-custody story. WaaS exists precisely because most organizations cannot or will not build the custody stack themselves. They would rather rent it. And banks, for all their resources, are not that different. The ones that succeed will be the ones that honestly assess whether they are building a custody capability or renting one, and then commit to the choice instead of doing a confused hybrid of both.

And here is the part that makes me uncomfortable, and I think should make the industry uncomfortable. If banks mostly rent custody through WaaS, they are not really becoming custodians. They are becoming front-ends. The control plane belongs to the vendor. The bank owns the customer relationship and the regulatory license, but not the infrastructure. That is a perfectly viable business model, but it is not the same as the sovereign custody capability that the narrative implies, and the industry should stop pretending otherwise.

I have a related worry, and it comes from a place of genuine frustration with this industry's tendency to rebrand rather than build. Consider the so-called Bitcoin Layer 2 space. A huge fraction of what markets itself as a Bitcoin L2 is, functionally, an Ethereum project that has decided the Bitcoin label is worth more than the Ethereum one. The real Bitcoin community does not acknowledge most of them, and for good reason: they inherit none of Bitcoin's security model, they introduce trust assumptions Bitcoin was designed to eliminate, and they are essentially sidechains with better branding. Custody risks the same fate. A lot of "institutional custody" will turn out to be a repackaged wallet with a compliance veneer, and the banks that buy it will discover the difference only when something breaks.

The test is always the same, and it is the test the study implicitly provides: can you answer the governance questions? Who instructs, who approves, who wins a conflict, who is liable, how does the asset survive the custodian's insolvency? If a custody offering cannot answer those, it is not custody. It is a vault with a logo.

The Blind Spot: Bankruptcy Remoteness and the Question the Study Forgot

Let me name the omission directly, because I think it is the most important thing the study leaves out and the most important thing a bank should ask.

The study does not meaningfully discuss bankruptcy remoteness and asset segregation. These are the legal questions of what happens to client assets if the custodian fails. In traditional custody, this is settled law with well-understood structures: client assets are held in segregated accounts, legally separate from the custodian's own balance sheet, so that in insolvency the client's assets are not part of the estate. In crypto custody, this is messier. Where exactly does the asset live? Who controls the key? Is the key the asset, or is the on-chain balance the asset? If the custodian holds the key in an omnibus wallet, what is the legal status of a client's claim against that wallet if the custodian goes under?

These are not academic questions. They are the questions that determine whether a bank's custody offering is a fiduciary product or a credit exposure, and the study basically skips them. I suspect this is because the answers are hard and depend on jurisdiction-specific legal analysis that a consulting report cannot provide. But it means the report is incomplete in a way that matters, and a bank reading it should treat the omission as a to-do list rather than a reassurance.

The same is true of asset segregation at the operational level. If a bank uses a third-party custodian and that custodian commingles client assets, the bank's own fiduciary duty to its clients is compromised, and the bank's regulatory standing is at risk. The study's framing of custody categories as involving "different degrees of control and outsourcing" gestures at this without resolving it. The degrees of control matter enormously precisely because they determine who bears the legal risk when the structure fails.

This is where my finance training, the part of me that sat through risk management courses before I dropped out to read Ethereum whitepapers, earns its keep. The reason traditional custody is boring and safe is that the legal structure has been litigated for a century. Crypto custody is exciting and dangerous for the same reason: the structure is new, the precedents are thin, and the failure modes are untested. The study gives banks a map of the services they could offer. It does not give them a map of the legal exposures those services create. And the second map is the one that determines whether the bank survives a custodian failure.

What This Means for the Rest of the Stack

I want to zoom out, because custody does not exist in a vacuum, and the study's implications ripple through the whole industry in ways its authors may not have intended.

Start with the exchanges. The study's decision to exclude exchange-held assets from its thirty percent statistic is, as I said, the whole argument, but it also reveals a competitive thesis. Institutional custody and exchange custody are substitutes. Every asset that moves from an exchange into a bank or a professional custodian is a marginal loss for the exchange's institutional business. The study is quietly predicting, or advocating for, a migration of institutional assets out of exchanges and into bank-adjacent custody. Whether that happens depends on whether banks can actually deliver the service, but the direction of the thesis is clear, and it is a long-term structural headwind for centralized exchanges' institutional revenue.

Now, I have strong views about exchanges, so let me be precise. I do not think orderbook DEXs will ever beat centralized exchanges for institutional flow, and the reason is latency. Market makers will not leave quotes on-chain where they can be front-run by anyone with a faster connection, and the institutional order flow that depends on tight spreads and reliable execution will stay where the matching engine is fast and the market makers are protected. So the exchange is not going to lose its trading business to decentralization anytime soon. But custody is a different business. Trading needs speed. Custody needs trust. And trust is exactly what banks have spent a century building and what exchanges have spent the last decade fumbling. So the migration the study implies is not exchanges losing trading to DEXs. It is exchanges losing custody to banks, which is a slower, quieter, more consequential shift.

Then there is the stablecoin and tokenized asset layer. The study uses stablecoin payment as its example of why custody decisions are complex, and I think that is the most commercially important part of the whole document. Stablecoin settlement is the use case where custody and payment collide, where the governance model has to support both holding and moving, and where banks have the clearest path to a real product. A bank that can custody a tokenized treasury and settle a stablecoin payment has a product its corporate clients will pay for. A bank that can only hold bitcoin in cold storage has a novelty. The study points at this without fully committing to it, but the logic is unmistakable: stablecoin payment is where bank custody becomes a business rather than a compliance exercise.

And then there is the Layer 2 world, which I live in. Custody and scaling are more connected than people realize. As banks build products on rollups and tokenized asset networks, the custody layer has to integrate with the settlement layer, and the choice of settlement layer becomes a custody decision. If a bank builds its tokenized product on one rollup and its custody control plane only supports that rollup, it has created a lock-in that will be painful to unwind. The orchestration layer has to be chain-agnostic in the same way it has to be custodian-agnostic, and the study's emphasis on cross-provider collaboration applies just as much to cross-chain collaboration. This is the part of the future that the study does not see, and it is the part that will matter most in five years.

The Marketing Layer Nobody Audits

I want to spend some time on the meta-problem, because it is the one I care about most and the one this industry is worst at.

The most dangerous thing about the BCG study is not its content. Its content is mostly careful, mostly qualified, mostly honest about its own limitations. The most dangerous thing is what happens to the content after it leaves the study. The thirty percent becomes thirty percent of everything. The eighty to one hundred million becomes a guaranteed revenue stream. The five use cases become a proven playbook. The qualifications that the author added, the exclusions, the caveats about modeling, all of it evaporates in the compression of a tweet or a slide.

I have watched this happen to every good piece of research in this industry. The original is nuanced. The derivative is a headline. The derivative of the derivative is a meme. And by the time the idea reaches the people making decisions, it has been stripped of every condition that made it true.

This is why I keep coming back to the idea that decentralization is a verb, not a noun, and why I think the same is true of custody and of research itself. None of these things are states you achieve. They are practices you maintain. Custody is a practice of continuously asking who has authority and whether the answer still holds. Research is a practice of continuously checking whether the claim still matches the conditions under which it was made. The moment you treat either as a noun, as a thing you have rather than a thing you do, you have already lost the thread.

The study is a good piece of work because it maintains the practice, at least within its own pages. It qualifies its numbers. It flags its modeling. It admits its conflicts, sort of. The problem is that the practice does not survive transmission. And in an industry where transmission is everything, where the tweet travels a thousand times further than the PDF, the practice is the only thing that matters and the first thing that gets lost.

So if you take one thing from the study, take the discipline of it, not the numbers. Take the habit of asking what the thirty percent excludes. Take the habit of asking whether the eighty million is modeled or realized. Take the habit of asking who paid for the research and what they sell. Those habits are portable. The numbers are not.

The Part Where I Admit My Own Bias

I should be honest about where I am coming from, because I have spent this whole article asking you to be suspicious of interested parties, and I am one.

I believe in decentralization as a values proposition, not just a technical one. I believe that the point of this technology is to move authority away from institutions that have failed to protect people and toward structures that are transparent and verifiable. I believe that a world where banks become the primary custodians of digital assets is a world where the technology has been absorbed into the very system it was supposed to challenge, and I am genuinely ambivalent about whether that is a victory or a defeat.

On one hand, banks becoming custodians is adoption. It means more people have access to these assets through familiar, regulated channels. It means the technology matures and the infrastructure hardens. It means the speculative casino gets a serious institutional wing.

On the other hand, it means the promise of self-custody, the radical idea that you can hold your own assets without trusting anyone, gets quietly deprioritized in favor of convenience and compliance. It means the custody layer becomes another place where power concentrates, where a few orchestration providers become the chokepoints through which all institutional flow passes. It means the decentralization revolution, at least for institutional money, ends with a better-branded version of the same intermediaries.

I do not have a clean answer to this tension, and I distrust anyone who claims to. What I have is a preference for structures that preserve the option of exit. A bank custody product that lets clients withdraw to self-custody at will is different from one that traps them. A custody stack that uses open standards is different from one that locks clients into a proprietary control plane. The technology can support either. The governance decides which. And that is the same lesson the study teaches about payment instructions, applied one level up: the constitution is the thing that matters, not the vault.

The Takeaway: Watch the Console, Not the Vault

So where does this leave us, at the end of a long weekend with a PDF and a growing suspicion?

The Ripple-BCG custody study is a useful document and a dangerous one, and the difference between those two things is entirely in how it is read. Read carefully, it gives banks a decision framework that flips the order of the custody conversation, from "which custodian" to "which services," and in doing so it reveals that the hard problem is governance, not cryptography. Read carelessly, it gives the industry two big numbers and a permission slip to hype.

The thing to watch over the next twelve to thirty-six months is not the vault. It is the console. The custody market will not be won by the best key management, because key management is a commodity. It will be won by whoever becomes the default control plane through which banks manage their multiple custodians, their multiple chains, and their multiple products. That is a standards fight dressed as a technology fight, and the winner will be the one who convinces the most institutions to build on their console first, exactly the way the Layer 2 wars were never about validity proofs and always about who got the most projects to deploy.

And the thing to watch over the next five years is whether the custody layer preserves the option of exit or forecloses it. If the orchestration standard is open and the withdrawal path is real, then bank custody is a bridge to a more decentralized future. If the console is proprietary and the assets are trapped, then it is a wall around the old system, built with new bricks.

I know which one I am betting on, and I know I could be wrong. But I have learned to hold that uncertainty as a practice rather than a failure. Decentralization is a verb. So is custody. So is reading. The only way to get any of them right is to keep doing them, in public, with the footnotes attached, and to never let a number travel faster than the conditions that made it true.

The console is coming. The question is who builds it, who controls it, and whether you can walk out the door when you want to. That is the only question that has ever mattered, in custody and in everything else.