Assessing Operational Risk in Crypto Custody: Lessons from Kraken's Banking Circle Gateway Challenges

In the rapidly evolving landscape of digital asset custody, operational risk remains a critical concern for investors and institutions alike. The recent disruptions to Kraken's Banking Circle funding gateway in 2025—marked by delays in GBP and EUR transactions—highlight the fragility of payment infrastructure in the crypto sector. While these incidents were attributed to operational glitches rather than cybersecurity breaches, they underscore broader vulnerabilities in third-party dependencies and system resilience. This analysis examines Kraken's challenges through the lens of operational risk frameworks, contextualizing them within industry trends and regulatory expectations.

Kraken's Banking Circle Gateway Issues: Operational vs. Cybersecurity Risks

In July and September 2025, Kraken reported delays in deposits and withdrawals via its Banking Circle funding gateway, a licensed payment service provider for European Economic Area and UK clients, according to an IsDown incident page dated 27 Sep 2025. The July 2025 issue affected GBP deposits through Faster Payment Services (FPS), while the September 2025 incident impacted EUR and GBP transactions, per a separate IsDown incident page. Kraken resolved these disruptions within hours to days, emphasizing that the root cause lay in Banking Circle's systems rather than Kraken's internal infrastructure, as noted on another IsDown incident page.

Notably, no evidence of cybersecurity vulnerabilities—such as hacking, data breaches, or system exploits—was reported in these cases. However, Kraken's broader exposure to cyber threats is evident. In May 2025, the exchange thwarted a sophisticated infiltration attempt by a North Korean hacker who applied for an engineering role, leveraging social engineering tactics and compromised credentials, according to a Cybersecurity News report. Separately, Kraken and Binance repelled social engineering attacks targeting customer service agents, mirroring tactics used in the Coinbase breach, as described in a CoinDesk report. These incidents illustrate that while the Banking Circle issues were operational, the crypto sector remains a prime target for adversarial actors.

Operational Risk in Digital Asset Custody: Industry Insights

Operational risk in crypto custody encompasses technical, regulatory, and third-party challenges. A 2025 industry survey by CoinLaw reveals that 75% of institutional investors prioritize custodial risks—including private key theft and loss—as a top concern. To mitigate these risks, institutions are adopting advanced solutions such as multi-party computation (MPC), hardware security modules (HSMs), and multi-signature wallets, according to a Digital Finance News report. Kraken itself has achieved SOC 2 Type 2 compliance for its institutional custody services, demonstrating adherence to security, availability, and confidentiality standards.

Third-party risks, however, remain a persistent challenge. Banking Circle's role as a critical node in Kraken's payment infrastructure exemplifies the vulnerabilities introduced by external dependencies. The 2025 Operational Risk Horizon, highlighted in an ORX report, identifies third-party and fourth-party risks as top concerns for financial institutions, emphasizing the need for rigorous due diligence. For Kraken, this means not only vetting partners like Banking Circle but also implementing failover mechanisms to minimize service disruptions.

Regulatory and Market Implications

Regulatory scrutiny of crypto custody is intensifying, particularly under frameworks like the EU's Markets in Crypto-Assets (MiCA) regulation. Institutions must now align with traditional finance standards, including insurance coverage and business continuity plans, as noted in an Observer article. Kraken's pursuit of banking licenses and its expansion into tokenized stocks and staking further complicate its risk profile, necessitating robust compliance frameworks, according to a CCN article.

From a market perspective, the 2025 surge in institutional spending on custodial solutions—from $9.2 billion in 2023 to $16 billion—reflects growing confidence in secure custody models (CoinLaw). However, this growth also highlights the sector's susceptibility to systemic shocks. For instance, AI-powered phishing attacks and geopolitical tensions have elevated the frequency of state-sponsored cyber threats, according to a LinkedIn post.

Investor Considerations

For investors, assessing operational risk in crypto exchanges requires a nuanced approach. Key metrics include:
1. Custodial Security: Adoption of MPC, HSMs, and multi-sig wallets.
2. Third-Party Resilience: Diversification of payment gateways and contingency planning.
3. Regulatory Alignment: Compliance with MiCA, SEC custody rules, and international standards.

Kraken's recent challenges with Banking Circle suggest that even well-regarded platforms are not immune to operational hiccups. However, its proactive cybersecurity measures—such as thwarting infiltration attempts and achieving SOC 2 Type 2 compliance—demonstrate a commitment to risk mitigation (Kraken completes SOC 2 Type 2 compliance report). Investors should weigh these factors against broader industry trends, including the rising cost of cyber insurance and the shift toward institutional-grade custody solutions.

Conclusion

The crypto sector's operational risk landscape is defined by a delicate balance between innovation and vulnerability. Kraken's Banking Circle gateway issues, while non-cybersecurity in nature, serve as a reminder of the systemic risks inherent in third-party dependencies. As institutions and regulators push for higher standards, the ability of exchanges to navigate these challenges will determine their long-term viability. For investors, due diligence must extend beyond price volatility to encompass the robustness of custody frameworks, cybersecurity postures, and regulatory preparedness.