Ignoring the law for a moment... as a business you should not want custody just because we're dealing with hot wallets... customer funds WILL be stolen or otherwise lost because software isn't perfect. WHEN (not if) that happens, it could end your business or worse, your reputation.

Custodial is in the end, and the only business in it is regulatory arbitrage based on faulty risk assumptions.

Everything about the service they were running was bad, he's probably lucky he was spooked off of it before something really bad happened.