The incumbent US custodian clears ~94% of tokenized US equity volume per its own December 2025 disclosure. Ondo, Dinari, Backed all route through it. Single-custodian dependency is fine for an MVP. It's a structural risk for the next phase.
I get nervous when I read pitches that say "multi-custodian" without showing the runbook. Every fintech founder I've sold infrastructure to in the last three years has a story about a payments processor, a BaaS vendor, or an issuer-processor going down for a day. They don't have to be told that single-vendor risk is real. They just need to see whether the vendor in front of them has actually built around it.
Every tokenized US equity in production today routes through the same incumbent US custodian. Ondo Global Markets, Backed Finance's xStocks, Dinari, and most newer entrants. Same custodian underneath. That custodian reports holding ~94% market share of tokenized US stocks and ETFs, with ~$480M in tokenized assets under custody (December 2025).
That's not a knock on the incumbent. They shipped the first developer-friendly custodian API for global fintechs and then layered an Instant Tokenization Network on top. They built the picks and shovels. Everyone else, sensibly, bought them.
The next phase isn't going to look like this. Concentration is fine when the category is small. It becomes a structural risk when the category becomes systemically important, and I think tokenized US equities are on a path to systemic importance much faster than most builders are pricing in.
Operational. Custodians have outages. Ledger reconciliation issues. Software releases that break webhook delivery. The 2024 to 2026 era has been quiet on custodian-side incidents because the volume is still small. At $1B+ tokenized AUC across the ecosystem, a single-custodian outage takes the entire tokenized US equity market offline simultaneously. There is no failover.
Commercial. A single upstream custodian is a single counterparty in the pricing negotiation. As the custodian's market power grows, the take rate moves in their favor. Every fintech that built on top of a single payments processor learned this lesson. Every fintech that built on top of a single payment-orchestration vendor learned the next-order version of it.
Regulatory. A single custodian is a single regulatory exposure. If FINRA flags a clearing relationship for any tokenized-stock-specific reason, every downstream tokenizer freezes simultaneously. Concentration risk becomes regulatory contagion risk in this category, and that's the version that's hardest to recover from because nobody can engineer their way out of it.
Two institutional custodians is harder to build than it sounds. Surface-level "we have multiple custodians" claims are usually empty in this category, and I think the implementation reality is worth describing because it tells you which vendors actually mean it.
At the order-routing layer, every buy or sell has to route to the custodian with better execution for that specific security at that specific moment. That's not load balancing. It's smart-order-routing with custodian-specific quirks. One custodian's fractional handling. Another's market-hour constraints. Settlement-cycle differences for less-liquid names. Fee schedules that vary by ticker.
At the reconciliation layer, a token issued against one custodian's share and one issued against the other need to be fungible from the user's perspective. That requires a unified ledger that abstracts the underlying custodian, with sell logic that can fulfill from either side. Most multi-custodian claims fall apart here. They're really "we have a primary custodian relationship and a backup account we don't actually use."
At the corporate-actions layer, dividends, splits, mergers, and tender offers are handled differently by every custodian. A unified corporate-actions engine that normalizes events across both custodians is non-trivial to build. It's also the only way to give downstream developers a consistent API surface.
At the regulatory layer, each custodian imposes different KYC pass-through requirements, different jurisdictional permissions, and different reporting cadences. A two-custodian stack absorbs the complexity instead of pushing it onto the fintech.
The custodian-to-exchange leg of any tokenized US equity transaction settles T+1 against DTCC, regardless of which custodian holds the underlying. Tokenization changes how the user experiences settlement. It doesn't change how DTCC settles. The broader category sometimes muddles this, and I think the credibility of every tokenizer depends on the distinction holding up under scrutiny.
What the user sees is instant. What the fintech sees on its books is instant. The broker-to-exchange leg is industry standard. None of those claims contradict each other. All of them require careful language.
If you're evaluating tokenized US equity infrastructure, I think single-custodian dependency is fine for an MVP. It's a real risk for a production stack you intend to scale to millions of users or hundreds of millions in AUC.
The custodian-redundancy question isn't "do you have two custodians." It's "what happens when custodian A has an outage at 2pm on a Tuesday." If the answer is "we degrade to a backup we haven't tested," you have one custodian.
Settlement claims should be tested the same way. Ask any infrastructure provider exactly which leg is instant and exactly which leg follows DTCC timelines. The vendors that can answer crisply on the first ask are the ones whose architecture is real.
Note on figures: the incumbent custodian's market-share number is self-reported as of December 2025. Verify against current sources before quoting.
The two-custodian architecture is harder to build, harder to operate, and the differentiator I'm most interested in stress-testing with early customers.
