Firstly I am not a lawyer, secondly I am not providing legal advice. Always consult with a lawyer before taking any actions.
In my view of the way bitcoin works you are not a custodian unless you have access to spend the bitcoins in question, so it may depend upon which implementation of multisig is implemented. If you are using a 2 of 3 multisig and the web service in question only stores one key then they are not capable of spending the bitcoin in question thus not a custodian. If you implemented a 2 of 3 system and were in control of 2 of the keys then you would be considered a custodian. NYSDFS has not clarified the definition of custody as it relates to multisig today, but perhaps an organization that has gone through the bitlicense process could question the DFS as it relates to this matter.