A treasury wallet can hold operating capital, customer assets, token reserves, or collateral worth far more than the company’s bank account. Yet many businesses treat custody as a technical setup rather than a governance, contracting, and regulatory decision. This digital asset custody guide is designed for founders and operators who need to make custody decisions that support growth without creating avoidable control failures.
Custody is not simply about where private keys sit. It determines who can move assets, what happens when a decision-maker leaves, whether a vendor can freeze access, how assets may be treated in insolvency, and whether the company can demonstrate appropriate controls to investors, lenders, auditors, and regulators.
What Digital Asset Custody Actually Covers
Digital asset custody is the control, safeguarding, and authorized transfer of crypto assets and related credentials. Depending on the business model, it may involve company treasury assets, customer assets, protocol-controlled assets, token inventory, NFTs, stablecoins, staking positions, or assets held as collateral.
The central question is straightforward: who has the practical and legal ability to control the asset? A company may own assets on its balance sheet but still lack effective control if one employee holds the only recovery phrase, an exchange account is registered to a founder personally, or a third-party custodian has broad contractual discretion to suspend withdrawals.
For a business, custody has three connected layers. The technical layer concerns keys, wallets, signing rules, and recovery. The operational layer concerns approvals, records, reconciliations, and incident response. The legal layer concerns ownership, customer agreements, vendor terms, regulatory classification, and authority under the company’s governing documents. A strong program aligns all three.
Choose a Custody Model That Fits the Business
There is no universal right answer. The appropriate model depends on asset volume, transaction frequency, customer exposure, staffing, jurisdiction, and the company’s ability to operate controls consistently.
Self-Custody
In a self-custody model, the company controls its own private keys or signing infrastructure. This can provide direct control, reduce dependence on a vendor, and allow customized approval workflows. It can also be appropriate for a holding company, protocol treasury, or operating business with limited transaction volume and sophisticated internal controls.
The trade-off is responsibility. Lost credentials, poor key backup, compromised devices, and unclear employee authority can create permanent loss or a dispute over access. Self-custody should not mean a founder storing a seed phrase in a personal note-taking application. It should be implemented through documented wallet ownership, multi-signature or multi-party approval where appropriate, secure backups, and a tested recovery process.
Third-Party Custody
A qualified or institutional custodian may offer secure storage, policy controls, reporting, insurance arrangements, and operational support. For companies holding customer assets, pursuing institutional capital, or managing substantial treasury positions, third-party custody can reduce certain operational burdens and support more formal compliance expectations.
But outsourcing custody does not outsource diligence. The company still needs to understand how the custodian holds assets, whether assets are segregated, the custodian’s withdrawal and suspension rights, applicable fees, security procedures, service-provider dependencies, and what happens in a custodian insolvency or enforcement event. “Institutional grade” is marketing language, not a legal conclusion.
Exchange or Platform Custody
Keeping assets on a trading platform can be efficient when the business needs frequent execution, liquidity, or market access. It is rarely the right default for long-term reserves. Exchange terms may limit withdrawals, impose broad compliance holds, or treat assets differently from a purpose-built custody arrangement.
A practical approach is often to separate functions: maintain only the amount needed for near-term trading or settlement on a platform, while holding reserves through a more controlled custody structure. The right allocation depends on liquidity needs and risk tolerance.
Start With Ownership and Authority
Before selecting technology or signing a custodian agreement, establish who owns the assets. This sounds basic, but it is frequently missed in fast-moving businesses.
The legal entity should open and control custody accounts whenever the assets belong to the business. Avoid using a founder’s personal exchange account, personal wallet, or personal email address for company assets. Those shortcuts complicate accounting, tax reporting, investor diligence, divorce or creditor issues, succession, and disputes among co-founders.
Company records should also identify who is authorized to initiate, approve, and review transfers. Board resolutions, manager consents, treasury policies, and delegated authority schedules should match the actual wallet configuration. If a wallet requires two signers but the company’s internal policy assumes one, the business has created friction at best and a control gap at worst.
For customer-facing businesses, the ownership analysis is more demanding. The company must clearly distinguish company assets from customer assets in its records, account structures, disclosures, and internal procedures. Commingling creates legal, operational, and reputational risk, particularly if the business faces insolvency, a regulatory inquiry, or a customer claim.
The Controls That Matter Most
A custody policy should be proportionate to the business, but it should address the decisions people will need to make under pressure. A one-page policy copied from the internet will not solve a compromised-wallet incident at 11 p.m. on a weekend.
For most operating companies, the following controls deserve direct attention:
- Clear wallet inventory identifying each wallet, chain, purpose, owner, and authorized signers.
- Multi-person approval thresholds based on transaction size, asset type, and business purpose.
- Secure key generation, storage, backup, rotation, and recovery procedures.
- Segregated roles for transaction initiation, approval, reconciliation, and administrative access.
- Regular reconciliations between on-chain activity, custody records, accounting records, and authorized transactions.
- A written incident-response plan for lost devices, compromised credentials, unauthorized transfers, vendor outages, and employee departures.
Not every company needs the same threshold structure. A two-person startup with a modest treasury may use a simpler multi-signature arrangement and a monthly reconciliation. A platform receiving customer assets or managing a large token reserve may need formal access reviews, daily reconciliations, specialized insurance analysis, and independent control testing. The key is to make the process real, not ceremonial.
Read Custody Agreements Like a Risk Allocation Document
A custody agreement is often where the business learns who bears the loss when something goes wrong. Founders should focus less on promotional security claims and more on the terms governing control, liability, and access.
Review how the provider describes the relationship. Does the agreement characterize the arrangement as custody, a custodial account, a trading account, or something else? Does it state whether assets are held on a segregated or omnibus basis? Does the provider retain rights to use, pledge, lend, stake, or otherwise deploy assets? If the business expects assets to remain idle and fully available, the contract should support that expectation.
Pay close attention to withdrawal restrictions, compliance holds, indemnities, limitation-of-liability provisions, dispute-resolution clauses, governing law, and notice requirements. A provider may have legitimate obligations to screen transactions or respond to legal process. The company should understand the process before a time-sensitive transaction is blocked.
Insurance also requires precision. Ask what event is insured, who is insured, what exclusions apply, and whether coverage applies to the company’s assets or only to the provider’s loss. Insurance is not a substitute for disciplined key management and approval controls.
Regulatory Exposure Depends on What the Business Does
Holding a company’s own digital assets is different from holding or transferring assets for others. A business that takes custody of customer assets, facilitates transfers, operates a trading venue, or offers staking or lending-related services may trigger federal and state compliance questions that do not apply to a company simply holding bitcoin or stablecoins in treasury.
The analysis can involve money-transmission laws, FinCEN considerations, securities and commodities issues, state virtual-currency rules, sanctions screening, consumer protection, privacy, and recordkeeping. The facts matter. Asset type, customer location, transaction flow, fees, control over keys, and promotional statements can all change the assessment.
For businesses organized in Delaware, Florida, Nevada, Wyoming, or operating across state lines, entity formation does not resolve custody compliance. The operating model must be evaluated where customers, counterparties, and activities are located. Build the custody structure around the actual flow of assets, not a simplified diagram prepared for a pitch deck.
Treat Custody as a Board-Level Operating Decision
Digital asset custody should be reviewed when the company raises capital, adds a new product, changes wallets or vendors, hires a finance leader, enters a material commercial agreement, or begins holding assets for customers. These are moments when old assumptions tend to break.
The strongest custody framework gives the business speed with accountability: authorized people can execute legitimate transactions, while no single individual can quietly place critical assets beyond the company’s reach. That balance is not accidental. It comes from deliberate legal structure, clear internal authority, and controls the team can follow every day.
If your business is building or revising a digital asset custody program, make the first question less about which wallet to use and more about what control the company needs to preserve when the stakes are highest.