What Is a Custodian, and Why Your Manager Can’t Touch Your Money

In the simplest terms, a custodian is a SEBI-registered institution — almost always a bank or a dedicated custody business — whose entire job is to hold your securities and cash safely, settle your trades, and keep independent records of what you own. It doesn't pick your stocks. It doesn't design your strategy. It doesn't even have an opinion on whether your portfolio manager is any good at their job. Its role is narrower and, in a way, more important: making sure that whatever your portfolio manager decides, the actual movement of money and securities happens correctly, safely, and only in ways you've authorized.

The legal foundation for this is the SEBI (Custodian of Securities) Regulations, 1996, notified on 16 May 1996. Under these rules, any entity wanting to act as a custodian must register with SEBI and maintain a substantial minimum net worth — originally ₹50 crore, since raised to ₹75 crore under the SEBI (Custodian) (Amendment) Regulations, 2025, notified in September 2025. That net worth requirement isn't arbitrary; it exists so that the entity holding your assets is financially serious enough to carry institutional-scale responsibility, and it comes with its own compliance obligations — maintaining proper vaults and systems, running segregated accounts per client, and appointing a dedicated compliance officer.

The cleanest way to understand the split is to think of it the way any well-run organization separates duties: the person who decides what to buy shouldn't also be the person who controls the vault. Your portfolio manager is the decision-maker — they analyze markets, build a strategy, and instruct trades on your behalf. The custodian is the executor and record-keeper — it receives those instructions, verifies they're within the bounds of what you've authorized, settles the trade, and holds the resulting securities and cash in your name. The portfolio manager can instruct it to "buy 500 shares of X" or "sell this position." What the portfolio manager cannot do is instruct it to "transfer this cash to my personal account" — because that falls entirely outside what this arrangement is legally permitted to execute.

Custodianship as a financial concept isn't unique to India. Globally, custodian banks exist because large securities holdings became too dispersed to sit in every individual investor's own name — a regulated third party ends up holding assets in trust for the real owner instead. In the US, this industry took its current shape after a well-known pension failure in the 1960s convinced regulators that employers should never be allowed to hold their own employees' retirement assets — a principle later written into law in 1974. India's own path to making this arrangement mandatory, though, has a distinctly local and more dramatic origin story.

Before 1992, Indian equities largely settled through physical share certificates, in a market that lacked the kind of active, structural oversight investors take for granted today. That vulnerability was exposed catastrophically when stockbroker Harshad Mehta was found to have diverted interbank funds through forged bank receipts to pump stock prices — a fraud later estimated at ₹4,000–5,000 crore that surfaced in April 1992 and crashed the market almost overnight. The scandal didn't just wipe out wealth; it exposed exactly how fragile India's settlement and custody infrastructure really was, and it triggered a reform wave that reshaped the market for decades to come.

That reform wave produced the Depositories Act, 1996, which effectively ended paper-certificate settlement in India. The National Securities Depository Limited (NSDL) — India's first electronic depository — was incorporated in August 1996, followed by the Central Depository Services Limited (CDSL), which began operations in February 1999. Around the same period, the National Stock Exchange moved trading itself onto electronic, screen-based systems — its Wholesale Debt Market segment went live in June 1994, with the equity Capital Market segment following in November 1994. Squarely within this same window, SEBI notified the (Custodian of Securities) Regulations, 1996, formally creating the regulated custodian category that still governs the industry today. It's worth being precise here: no official source directly ties this specific regulation to the Mehta scandal as a stated cause. But it's unmistakably part of the same reform era, born from the same realization — that India's markets needed independent, structural safeguards around who actually holds an investor's assets, not just rules about who's allowed to manage them.

For years, the custodian requirement in Portfolio Management Services had a loophole: it only kicked in once a portfolio manager's assets under management crossed ₹500 crore. Smaller PMS providers could, in principle, operate without one at all. The SEBI (Portfolio Managers) Regulations, 2020 closed that gap, removing the AUM threshold and making this appointment mandatory for essentially every portfolio manager offering discretionary or non-discretionary services. Alternative Investment Funds followed a near-identical trajectory: this was once required only for Category III AIFs, or for Category I/II funds above a ₹500 crore corpus or those trading in credit default swaps. A SEBI circular dated 12 January 2024 removed that same corpus-based exemption, extending the custodian mandate to all Category I and Category II AIFs, with existing funds required to fall in line by 31 January 2025. In other words: the "your manager literally cannot touch your money" protection you get today as a PMS or AIF investor is a genuinely recent regulatory achievement, not something that's always been guaranteed.

This is the part worth sitting with, because it's the actual mechanism — not just a regulatory slogan.

When you sign up for a PMS, you typically grant your portfolio manager a Power of Attorney (PoA) — but it's a deliberately limited one. It authorizes the manager to place buy and sell instructions, operate within your investment mandate, and handle the operational mechanics of managing your portfolio. It does not authorize withdrawing funds to any account other than your own, and it does not authorize the manager to instruct the custodian to move your money anywhere the manager personally benefits from. The custodian's job includes checking that every instruction it receives actually falls within the scope of that PoA — which means the restriction isn't just written into a contract you signed and hoped would be honored. It's enforced at the point of execution, by a party who has no incentive to look the other way.

The second piece is account structure. Your PMS holdings sit in your own demat and bank sub-accounts, held by the custodian in your name — not commingled into one large pool alongside every other client's money. That segregation matters enormously in practice: it means a settlement instruction can only move securities or cash into or out of your own account, based on your own manager's instructions for your own portfolio. There's no shared pot for a manager to quietly dip into, and no ambiguity about whose money moved where.

Custody used to mean vaults and paper ledgers. It doesn't anymore, and the shift matters because it means safety and speed are no longer a trade-off.

Modern custodians operate on largely digital infrastructure. India's depositories expose machine-readable APIs — CDSL, for instance, offers API access covering account setup, electronic delivery instructions, and pledge processing — rather than relying purely on paper forms. Custodian platforms built on this infrastructure now offer cloud-based dashboards, real-time position and risk monitoring, and daily electronic holding and NAV reports, so both portfolio managers and investors can see an independent, up-to-date picture of exactly what's held, without waiting on a manager's own reporting cycle.

Settlement speed has compressed dramatically. SEBI phased in T+1 settlement — trades settling one working day after execution — starting January 2022, completing the rollout across all listed stocks by January 2023. Since March 2024, SEBI has also enabled an optional instant, T+0 settlement track for eligible stocks, expanded further by the end of that year. For investors, faster settlement means less time your assets or cash spend "in transit" between instruction and final custody — less of a window, in theory, for anything to go wrong along the way.

Technology has also become part of investor protection directly. From October 2025, SEBI mandated that fund-collecting registered intermediaries use exclusive, validated "@valid" UPI handles, paired with a "SEBI Check" tool that lets any investor verify a UPI ID, bank account, or QR code before paying money to anyone claiming to be a registered PMS, AIF, or broker. Separately, SEBI's Cybersecurity and Cyber Resilience Framework, introduced in August 2024, imposes real obligations on custodians, depositories, portfolio managers, and AIFs — security operations monitoring, vulnerability testing, and in the highest tiers, ISO 27001-grade certification. None of this replaces the custodian structure itself; it reinforces it, closing off the softer fraud vectors — fake payment collection, weak cybersecurity — that exist alongside the harder structural protection custodians already provide.

Put together, the custodian system gives PMS and AIF investors a set of protections that are easy to take for granted precisely because they work quietly in the background.

It gives you structural asset segregation — your securities and funds are legally held apart from your portfolio manager's own assets and from other clients' holdings, which is what actually prevents the classic "manager absconds with pooled client money" fraud pattern. It creates an independent transaction check — the custodian only settles trades against SEBI-compliant instructions, meaning every transaction has a second party verifying it, not just the manager's own word. It's mandatory rather than optional, so you don't have to hope your particular provider chose to add this safeguard voluntarily; since 2020 for PMS and 2024 for AIFs, it's simply the law. It produces independent reporting — statements from your custodian and depository exist entirely outside your portfolio manager's own reporting chain, which makes it much harder for a manager to present a misleading picture of your actual holdings. And thanks to the technology shift covered above, all of this now comes with modern operational speed — T+1/T+0 settlement and API-based dashboards mean the safety net no longer comes at the cost of a slow, paper-heavy process, which used to be the trade-off in earlier decades. Altogether, it gives individual investors access to the same institutional-grade segregation of duties that has protected large pension funds and pooled institutional capital for decades — just scaled down to an individual PMS or AIF account.

It would be dishonest to present the custodian structure as a complete safety net, and a good financial content platform shouldn't pretend otherwise.

A custodian doesn't guarantee your investment performance. It stops a manager from misappropriating your money; it says nothing about whether your manager is good at picking stocks, and a well-run PMS can still lose you money through entirely legitimate, badly-timed investment decisions. The structure also adds a real cost layer — safekeeping fees sit on top of management and performance fees in the overall PMS/AIF cost stack, and that cost is ultimately passed on to you, the investor. It adds friction, too: opening a PMS or AIF account typically involves executing a Power of Attorney and a separate account-opening process with this custodian, which is simply more paperwork than a more direct, unregulated arrangement would require. There's also a slower-moving structural risk worth naming honestly: as SEBI's net worth requirements in this space rise (from ₹50 crore to ₹75 crore most recently) and cybersecurity compliance obligations grow more demanding, smaller players may find it harder to stay in the business, which could mean fewer choices over time even as the protection itself stays strong. And finally, the protection is only as useful as investors' awareness of it — most PMS and AIF investors don't actually know who is holding their assets, or that they have the right to ask, simply because providers rarely volunteer the information without being asked.

None of this protection is worth much if you never actually check it. Before investing in any PMS or AIF, it's worth doing a short, five-minute round of due diligence. Ask the provider directly which custodian they use — a legitimate PMS or AIF should be able to name it immediately, without hesitation. Confirm that it is genuinely SEBI-registered, rather than taking the provider's word for it. Check that your account statements are being generated by, or independently corroborated by, this entity or the depository — not solely by the portfolio manager's own internal system. Use SEBI's own verification tools, including SEBI Check, before making any payment to a person or entity claiming to be a registered intermediary. And read the disclosure document every PMS is required to provide — the custodian's identity and the fee structure, including custody-related charges, should be spelled out there in plain terms. It takes a few minutes. It's the difference between trusting a pitch and actually verifying a structure.