Crypto in institutional portfolios: access, custody, regulation and risk budget

In depth12 min read · 24 sources

How much crypto in a portfolio can an institutional investor's risk budget take, and which route should it use to get in? Here you will learn how ETPs, futures and direct holdings work, what applies to custody, funds, banks and insurers (as of October 2026), and why even 2% Bitcoin in a 60/40 portfolio accounts for a much larger share of the risk. Crypto-assets are speculative; price crashes and the collapse of entire systems have happened.

Access routes: ETPs, futures, direct holdings

Crypto-assets are digital assets that are transferred and stored on a blockchain or another distributed ledger: Bitcoin, ether and thousands of other tokens. They can enter a portfolio by four routes, each with its own legal and default risk:

• Spot ETPs in the US: on January 10, 2024, the US securities regulator, the SEC, approved the listing of several exchange-traded products (ETPs) that hold Bitcoin itself, without thereby endorsing Bitcoin (SEC, bitcoin ETPs 2024). For ether, it approved the exchange rules for eight products on May 23, 2024 (SEC, ether ETPs 2024); they have been trading since July 23, 2024 (Troutman Pepper Locke 2024). Since September 2025, exchanges have been allowed to list qualifying digital asset ETPs under generic listing standards without individual review (SEC, listing standards 2025).
• ETPs in Europe: here there are exchange-traded debt securities on crypto-assets, usually called ETNs or ETPs. You have a claim against the issuer; whether and how it deposits the crypto-assets with a custodian is governed by the terms. A UCITS, the legal form of almost all European ETFs, may not buy crypto-assets directly; according to ESMA, UCITS eligible assets (2025), this would probably require an amendment to the UCITS Directive itself.
• Futures on regulated exchanges: Bitcoin and ether futures are traded on the CME (CME Group, TAS 2026). A future ties up only the margin, but has to be rolled before expiry; anyone who buys spot and sells the future earns the difference as a basis trade.
• Direct holdings with a custodian: the investor holds the crypto-assets itself, and a licensed service provider secures the keys. In the case of a fund, the depositary is added. This is the route with the lowest issuer risk, but the greatest effort for processes and controls.

Custody: keys, wallets, licenses

Owning a crypto-asset mainly means controlling a private key. It gives you power of disposal over the holdings; if it is lost, they are unreachable, and if it is stolen, a confirmed transfer usually cannot be reversed. Custody is therefore not a side issue but the core of the risk:

• Cold and hot wallets: in a cold wallet, the keys are stored without a connection to the internet. This is hard to attack, but slow. A hot wallet is online and is used for day-to-day trading.
• Multiple keys: with multi-signature schemes, a transfer requires, for example, two out of three keys, which are stored separately. Methods that split a key mathematically between several parties have a similar effect.
• Verify instead of trusting: what matters is the license, segregation of client holdings from the custodian's own assets, audit reports, insurance cover and tested emergency procedures, not a provider's well-known name.

In the EU, crypto-asset service providers have been subject to the Regulation on Markets in Crypto-Assets, MiCA or MiCAR for short, since December 30, 2024. Among other things, it covers the “custody and administration of crypto-assets on behalf of clients” (BaFin, MiCAR guidance notice 2025). Firms already licensed under national law were allowed to continue operating until a decision was made on their MiCAR application, but could only operate EU-wide with MiCAR authorization (BaFin, crypto-asset service providers 2025). MiCA allowed such transitional periods until July 1, 2026, and member states could shorten them (Freshfields 2024); they have since expired everywhere.

Regulation for funds, banks and insurers

UCITS (EU funds): derivatives on ineligible assets are already excluded today. In June 2025, the European securities regulator ESMA advised the European Commission to look through to the ultimate underlying; exposure to ineligible assets (for example via debt securities on Bitcoin) would then only be permitted within a limit of 10%, and larger investments in crypto-assets would belong in alternative investment funds (ESMA, UCITS eligible assets 2025). This is advice, not applicable law.

Banks: the Basel Committee on Banking Supervision sorts crypto exposures into four groups: 1a tokenized traditional assets, 1b stablecoins with an effective stabilization mechanism, 2a other crypto-assets that meet the criteria for recognizing hedges, and 2b all others. Bitcoin and ether belong to Group 2. For 2b, a risk weight of 1,250% applies (Basel Framework, SCO60 2024). With the minimum ratio of 8%, every dollar of exposure therefore needs one dollar of capital. All Group 2 exposures should generally not exceed 1% of Tier 1 capital, and at most 2%. The standard of December 2022, amended in targeted ways in July 2024, applies from January 1, 2026 under the Basel timetable (Basel Committee 2024); it only becomes binding through national or EU law. The Committee is currently reviewing individual elements and announced on October 1, 2026 that it would report on progress by the end of the year (Basel Committee 2026).

Insurers: on March 27, 2025, the European insurance supervisor EIOPA proposed that crypto-assets held directly or indirectly should be backed with a flat 100% own funds in the Solvency II standard formula; a stress of 80%, as for intangible assets, would underestimate the risk (EIOPA 2025).

Accounting: under US GAAP, since ASU 2023-08, companies measure crypto-assets that meet six criteria (e.g. fungible, on a blockchain, cryptographically secured and not issued by the company itself) at fair value with changes recognized in net income, instead of only writing them down as before. This is mandatory for fiscal years beginning after December 15, 2024 (FASB, ASU 2023-08 2023); the rule does not apply under IFRS.

Risks: volatility, correlation, platforms

• Volatility and drawdowns: crypto-assets fluctuate very strongly; the return history is short, and Harvey et al. (2022) consider data only from 2017 onwards to be meaningful. How much volatility alone costs is shown by volatility drag.
• Changing correlation: in calm times, crypto-assets are only weakly linked to equities, but in sell-offs of risky assets the correlation rises (Harvey et al. 2022). The diversification is missing when you need it; see correlation and diversification.
• Liquidity: trading takes place around the clock on many platforms, and prices sometimes differ significantly between exchanges (Makarov and Schoar 2020). An ETP is only as liquid as the market behind it.
• Counterparties and platforms: in November 2022, the trading platform FTX filed for bankruptcy protection. Conlon et al. (2026) show large risk and liquidity mismatches between its assets and its liabilities, and contagion through other crypto products. Holdings at a platform are a counterparty risk.
• Stablecoins: Terra, at the time the third-largest crypto ecosystem after Bitcoin and Ethereum, collapsed within three days in May 2022; around US$50 billion of market value vanished. The trigger was a run on a lending protocol offering high yields on the stablecoin UST (Liu et al. 2023).
• Manipulation: small tokens are vulnerable to pump and dump schemes; Li et al. (2025) document numerous such schemes with drastic price swings.

Allocation: risk budget rather than capital share

A crypto position of 2% of capital sounds small. What matters is how much it contributes to the volatility of the whole. The Euler decomposition splits a portfolio's volatility exactly among the positions (Litterman 1996); each contribution is the weight times the position's own volatility times its correlation with the portfolio (Menchero and Davis 2011). If you plan this way, you first set a risk budget and derive the weight from it; the basics are in the article risk contribution.

The share of risk is larger than the weight as soon as the marginal contribution exceeds the portfolio's volatility. For an asset that fluctuates four or six times as much as the portfolio, even a moderate correlation is enough.

Worked example: 2% and 5% Bitcoin in a 60/40 portfolio

For advanced readers: estimation error, stress, rebalancing

The figures above depend on Bitcoin's volatility and correlations, and on the assumption that they remain stable. With only a few years of history, the correlation in particular is uncertain and changes with the market environment. A more robust approach is to calculate a calm and a stress scenario and to base the weight on the unfavorable case. With short series, estimators that weight recent months more heavily or shrink the covariance matrix help (covariance estimation). Because crypto returns have fat tails, volatility underestimates extreme losses; value at risk and scenarios are part of the picture.

With rebalancing, a highly volatile position quickly drifts away from its target; bands around the risk budget rather than around the weight sell earlier after strong rises. According to Harvey et al. (2022), volatility targeting helped to limit risk, and trend following did well in their sample. That, too, is the past.

What the research shows

• Risk factors of their own: crypto returns depend on network factors that measure the growth in the number of users, not on production costs; in addition, there is strong time-series momentum and predictive power from investor attention (Liu and Tsyvinski 2021). A three-factor model of the crypto market, size and momentum explains the differences between cryptocurrencies and captures ten successful long-short strategies (Liu et al. 2022). The samples are short.
• A market with frictions: price differences between exchanges are large, recurrent and much larger across national borders than within a country; capital controls hamper arbitrage. According to Makarov and Schoar (2020), a common component of trading volume explains 80% of Bitcoin returns; the remaining components help to explain the arbitrage spreads.
• Stablecoins and prices: according to Griffin and Shams (2020), purchases with the stablecoin Tether during the 2017 boom followed price declines and lifted the Bitcoin price significantly. The flow came from a single entity; this is more consistent with unbacked digital money than with investor demand.
• Portfolio: according to Harvey et al. (2022), Bitcoin accounted for only 31% of crypto trading volume in June 2022; its correlation with risky assets is mostly low, but rises in their sell-offs.
• Runs: in the collapse of Terra, wealthier, more experienced investors withdrew first and lost less; less wealthy and less experienced investors followed later with larger losses (Liu et al. 2023).

Limitations and common mistakes

• One correlation for all time: if you calculate with the correlation of calm years, you underestimate the contribution under stress.
• Confusing the product with the underlying: an ETN is a debt security, a future needs rolling and collateral, and a spot ETP depends on the custodian and the issuer. Same price risk, different default risks.
• Underestimating custody: loss of keys, theft and platform failures are not price risks and do not show up in any volatility figure.
• Treating the rules as settled: much is new or only a proposal, such as the advice from ESMA and EIOPA.
• Taking a short history as proof: good results of individual strategies over a few years are prone to chance and hindsight bias; see backtest overfitting.

This article describes rules, risks and research. It is not investment, legal or tax advice, and not a recommendation to buy crypto-assets.

How Portfolio Lab calculates it

In the Backtest, you add crypto-assets via their ticker, e.g. BTC-USD, converted into the base currency. Asset classes has a “Crypto” group with Bitcoin (@BITCOIN, from 2014), Ethereum (@ETHEREUM, from the end of 2017), Solana (@SOLANA, from 2020) as well as Bitcoin miners and blockchain equities. For crypto-assets, the data checks only flag daily moves of 60% or more as possible outliers.

The Risk page decomposes volatility using Euler's method as in the example, only with an estimated covariance: monthly returns of completed months, by default the last 60, at least 24 in common, with a choice of sample, EWMA or Ledoit-Wolf. The table shows each position's weight, volatility, marginal contribution, risk contribution, share of risk and correlation with the portfolio; by asset class, crypto appears as a separate segment. The app does not model custody, defaults or regulation. More in the risk attribution methodology; Bubbles shows bubble signals, and Sentiment shows positioning in CME futures on Bitcoin and ether.

This article explains a method; it is not investment or tax advice. Worked examples are simplified and rounded. All terms in the glossary.