# Outsourcing Rules When a Platform Uses a Foreign Custodian

> Outsourcing a function does not outsource the obligation. Four requirements that follow a platform wherever it sends the work.

- Source: https://kzcryptorules.com/outsourcing-rules/
- Published: 2026-10-11
- Author: Dinara Yesimova
- Publication: KZ Crypto Rules — The requirement, then what it means
- Topic: custody
- Tags: custody, outsourcing, obligations

---

Platforms commonly use third parties for custody, technology and screening. The rules on this are consistent across frameworks.

## Requirement one: responsibility is retained

The authorised firm remains responsible to its customers and to the supervisor for an outsourced function, exactly as if it performed the function itself.

In plain terms: the platform cannot point at its custodian when something goes wrong.

## Requirement two: due diligence on the provider

The firm must assess the provider's competence, capacity and financial soundness before appointing it, and keep that assessment current.

This is a documented process, not a commercial judgement.

## Requirement three: a written agreement

Specifying the service, performance standards, access rights, confidentiality, and termination. In particular the supervisor's right of access to the provider's records.

A supervisor unable to examine an outsourced function cannot supervise the firm.

## Requirement four: notification and material outsourcing

Material outsourcing arrangements generally require notification to, or approval from, the supervisor. Custody of client assets is material by any reasonable test.

## What this means in a chain

Where a custodian itself outsources, the obligations follow. A firm that cannot say who ultimately holds client assets has not met the first requirement.

## What a customer can ask

Who holds the assets, whether they are held directly, and whether the supervisor has been notified. The third question is unusual and informative.

## Where the law is less clear

The treatment of technology providers whose failure would halt the service without touching client assets. Materiality tests differ and practice is still forming.

## Why the rules exist in this form

Because outsourcing was historically used to move activity beyond a supervisor's reach, and the rules are written to prevent exactly that.

## What to look for

A platform that names its custodian and can describe the arrangement. [Platforms that collect the documents the regulator expects](https://collectnexchange.com/services/crypto-custody) are generally the ones that have documented the outsourcing too.

[A licensed exchange under a named supervisor](https://collectnexchange.com/compliance/cysec-licensed) has filed these arrangements whether or not it publishes them, and [Collect & Exchange](https://collectnexchange.com/) operates inside a framework that requires it.

---

This article explains how something works. It is not financial advice.
Canonical HTML version: https://kzcryptorules.com/outsourcing-rules/