Bank Core Providers Are Building Their Own Settlement Rails: Crypto Brokerages Still Using Exchange Custody Should Pay Attention
This week, CSI, a core banking provider serving over 3,000 U.S. financial institutions, acquired Qolo, a treasury and payments fintech that unifies card issuing, ledger management, and multi-rail money movement into a single programmable control layer. The deal, which follows CSI's October 2025 acquisition of digital banking platform Apiture, signals something larger than a product expansion: it reflects a deliberate move by infrastructure providers to collapse the vendor stack and own the settlement layer outright.
The strategic logic is straightforward. As Qolo's co-founder Patricia Montesi put it in the acquisition announcement, financial institutions increasingly face "fragmented vendors, disconnected payment rails and manual workarounds that limit growth." By embedding treasury-grade plumbing directly into the core banking platform, CSI is eliminating the gaps between where money sits and how it moves, giving its bank clients real-time visibility and direct control over funds at every stage of a transaction.
For community and regional banks, this is a competitive necessity. Businesses now benchmark their bank's treasury tools against the software they use everywhere else. The institutions that can offer instant visibility into balances, transactions, and authorizations, without routing through third-party systems, will retain commercial relationships. Those that cannot will lose them to fintechs.
But the implications extend beyond traditional banking. The pattern CSI is executing, vertical integration of settlement infrastructure to eliminate third-party dependency, is the same structural gap that crypto brokerages face when they settle OTC flow through exchange custody.
Consider the operational reality. A brokerage running bilateral OTC trades through exchange-based settlement is, by definition, placing client assets and firm capital on infrastructure it does not control. The exchange holds the custody keys. The exchange determines withdrawal timing. The exchange makes compliance decisions that can freeze funds with little notice. This is not a vendor relationship in any meaningful sense, it is a structural dependency that compounds during precisely the conditions when control matters most.
The risks are not theoretical. When FTX collapsed in November 2022, it exposed an $8 billion hole in customer accounts. The bankruptcy filing revealed that FTX.com held only 0.1 percent of the bitcoin that customers believed they had deposited. Institutional investors, including major funds and pension plans, were caught off guard because traditional credit agencies do not cover digital asset counterparties, leaving risk managers to rely on reputation and regulatory status. The failure cascade. BlockFi suspending operations within days, billions in claims trading at twenty cents on the dollar, demonstrated how quickly exchange custody becomes exchange exposure when solvency assumptions fail.
The custody problem runs deeper than counterparty credit risk. Exchanges can freeze user assets for reasons that have nothing to do with firm-level distress: incomplete KYC documentation, sanctions screening triggers, compliance reviews, law enforcement requests, or internal risk controls. A freeze may affect one transaction, one asset, the whole account, or only withdrawals. The practical effect is the same, access to client funds depends on the platform's rules, compliance obligations, and operational discretion.
For a brokerage settling OTC trades, this creates a compounding exposure. Between trade execution and final settlement, both counterparty default risk and exchange custody risk run simultaneously. If settlement takes hours or days, common in bilateral OTC workflows, the window of vulnerability extends accordingly. During periods of market volatility, when trading volumes spike and liquidity becomes precious, that window stretches precisely when the probability of problems increases.
The parallel to what CSI is solving for its bank clients is exact. When a community bank relies on fragmented treasury vendors and disconnected payment rails, it loses visibility into where funds sit and how they move. It cannot respond quickly to client needs. It is operationally dependent on systems it does not own. The acquisition of Qolo is designed to collapse that dependency by embedding treasury functionality directly into the core platform.
Crypto brokerages face the same structural problem with higher stakes. The settlement layer is not merely an operational convenience, it is the control surface for client asset protection. When that layer sits on exchange infrastructure, the brokerage has outsourced a critical risk management function to an entity whose interests, compliance obligations, and operational stability may diverge from its own.
This is not a call to action. It is an observation about where institutional infrastructure is heading. The CSI-Qolo acquisition is one data point in a broader pattern: the Federal Reserve Bank of Kansas City has documented how the "Big Three" core providers. Fiserv, FIS, and Jack Henry, have expanded into adjacent verticals including card networks, payment processing, and banking-as-a-service. The strategic direction is consistent: own more of the stack, control more of the settlement layer, reduce dependency on third parties.
For brokerages running OTC flow through exchange custody, the question is whether that model represents a temporary convenience or a structural misalignment with where institutional standards are heading. The traditional finance infrastructure providers have concluded that owning the settlement layer is worth acquiring. The institutions evaluating custody arrangements for digital assets will eventually apply the same logic.
The moment to reconsider exchange custody dependency is not during a crisis, it is before one. The brokerages that treat custody and settlement as core infrastructure, rather than vendor relationships, will be better positioned when market stress tests the assumptions embedded in their operating model. Those that continue outsourcing these functions to exchanges may find, as FTX's creditors did, that third-party dependency compounds rather than distributes risk.
References
[2] CSI Completes Acquisition of Digital Banking Provider Apiture, CSI, October 22, 2025
[3] Bankruptcy of FTX, Wikipedia
[4] Failed crypto exchange FTX will repay billions to customers, CBC News, October 8, 2024
