Cactus Custody launches Swiss custody; the audit stays in Asia

Cactus Custody announced on September 30, 2026 that it had launched a Swiss custody service, with private keys and client data held in Switzerland. OneDegree insurance and the audit reports still cover only the Hong Kong and Bhutan entities. An extension is planned, and will be confirmed separately once complete.

Law, keys and the client record are meant to sit in one country. The control reports have not moved. The gap matches a custody announcement that is still a memorandum, not a live rail.

What September 30 actually launched

ChainTech AG operates it. Cactus Custody's announcement calls ChainTech a Swiss company and a member of VQF, the Financial Services Standards Association, a self-regulatory organisation (SRO) recognised by the Swiss Financial Market Supervisory Authority (FINMA). The BIT press room repeats that text. Cactus Custody is BIT group's custody arm. The release claims no banking or securities-firm licence. SRO membership is anti-money-laundering supervision, not prudential supervision, which is why FINMA lists SROs apart from banks and securities firms.

Related:Ether.fi moves neobank payments onto MoonPay's stack

HELP.CH's compilation of the Zug register, citing the official record and not a certified extract, shows an active company at Gotthardstrasse 26, 6300 Zug, UID CHE-189.838.755, entered on April 6, 2018, with capital of CHF 100,000, for blockchain hardware, software and related services. A May 6, 2024 mutation names Jihan Wu, a Singapore citizen resident in Singapore, as board president, signing jointly with Christian Meisser. The dateline is Zurich. The seat is Zug.

At launch the entity supports 132 digital assets on 18 networks, including Bitcoin (BTC), Ethereum (ETH), Solana (SOL), TRON (TRX), Avalanche (AVAX) and Sui (SUI). Accounts are segregated warm or cold addresses, Decentralised Finance (DeFi) access via Cactus Link, and ETH staking. The offer excludes residents of the European Union and the European Economic Area.

Keys here, certificates there

Keys are generated and held in Swiss data centres on modules certified to Federal Information Processing Standards (FIPS) 140-2 and FIPS 140-3, with no foreign backup, and client data stays in Switzerland. That is more specific than a bank product that adds bitcoin without naming the key holder, and it does not move the audit. ISO 27001, ISO 27701, ISO 9001 and the SOC 1 and SOC 2 reports are stated to cover Hong Kong and Bhutan only, as is OneDegree. The Hong Kong reports sit beside Hong Kong's 2026 dealer and custodian regime.

Bitcoin News Switzerland reported on October 5, 2026 that insurance and the audit were still open. A sponsored item on The Block, dated October 7, 2026, repeats the launch headline. No report names a fund, miner or family office on the Swiss entity.

What the statute actually segregates

Article 242a of the Debt Enforcement and Bankruptcy Act, in force since August 1, 2021, allows surrender of crypto-based assets only if the firm has undertaken to keep them ready for the client at all times and the assets are either individually assigned or held for a community whose share is clear. A rejected claim is lost unless the client sues within 20 days. The unofficial English text, as at January 1, 2026, has no legal force. Cactus Custody says ChainTech segregates client assets in law and in operations, on those conditions. That is not CASS 7 client money, a conduct rule for cash rather than a bankruptcy surrender. CHF 100,000 of share capital is the company's equity, not a client buffer.

"Some international VASPs assume that establishing a Swiss entity and joining an SRO is primarily an administrative exercise. In practice, we place significant importance on ensuring that the Swiss entity is not merely a legal shell. The relevant activities, management functions and decision-making processes must actually be carried out from Switzerland."

Tobias Eberle, chief executive of the VQF, and Felicitas Sicardi, its legal counsel, told 21 Analytics on August 25, 2026. They were not discussing this launch. They also said "More than 150 of our 600+ supervised entities are VASP-related," VASP meaning a virtual asset service provider. A Zug company whose board president lives in Singapore still has to meet that substance test if the release's VQF membership is current.

Cactus Custody says a later notice will confirm when insurance and an independent audit cover the Swiss entity. Until then the option rests on where the keys sit and on Article 242a, not on a SOC report naming ChainTech AG. The audit notice, and the first asset-list change after September 30, will show whether this Swiss custody service is an operating stack or a label on the Asian one.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.