Who controls the private keys for cryptocurrency associated with an account?

Private-key control is defined in the applicable account or custody terms. It depends on whether the approved service uses client self-custody, Bank custody or an authorized third-party custodian.