Corporate Crypto Custody Policies: Controls Boards Should Require

Corporate Crypto Custody begins at board level, not in the IT department. When a company holds bitcoin, ether, or stablecoins on its balance sheet, the board is responsible for the same duties it owes over cash: safeguarding assets, preventing fraud, and ensuring accurate reporting. Yet many companies adopt crypto faster than they adopt the controls around it, leaving treasury teams to improvise with personal wallets, shared passwords, and undocumented procedures. A written custody policy closes that gap by stating, before any holding grows large, who may move assets, how much, under what approvals, and with what oversight.

The policy also protects the people running the operation. Clear rules remove ambiguity for treasury staff, give auditors something concrete to test, and give directors evidence that they exercised care. In October 2026, with bitcoin near $79,600 to $80,150 and ether near $2,310 to $2,330, even a mid-sized corporate holding represents serious money, and the Federal Open Market Committee meets October 27 to 28, which may move prices sharply. A company holding crypto through that meeting needs controls that work under volatility, not only in calm markets. For the mechanics of moving assets between venues, see cross-exchange arbitrage and triangular arbitrage.

What a Custody Policy Must Cover

A useful policy starts with scope: which assets the company may hold, which chains and venues are approved, and what purposes holdings serve, whether treasury reserves, customer payments, or trading. It should state maximum holdings per asset and per venue, so a single position cannot quietly grow into a concentration risk. It should also define the storage model: what share sits in hot wallets, what share in cold storage, and what share with a custodian, with thresholds that trigger rebalancing. Without these limits, a policy is a statement of intent rather than a control.

The policy must also assign roles. Trading, custody approval, and reconciliation should sit with different people, so no one person can initiate, approve, and hide a transfer. It should name the officers authorized to approve transfers at each size tier, require dual approval above a threshold, and set a process for emergency transfers that still leaves an audit trail. Companies often resist this formality when holdings are small, but controls are cheapest to install before holdings grow, and retrofitting them after a loss is both expensive and embarrassing.

Segregation, Wallets, and Key Management

Segregation is the first principle of corporate custody. Company assets must never mix with employee assets, customer funds must never mix with company funds unless a documented and lawful structure allows it, and each business purpose should have its own wallets. Mixing creates accounting confusion, legal exposure, and a single compromised wallet that endangers everything. The policy should require separate wallets per venue and purpose, with an inventory that maps every wallet to its owner, purpose, signers, and approval rules.

Key management rules should specify how keys are generated, stored, backed up, and retired. Generation should happen in a controlled environment, never on a personal device; backups should be encrypted and stored in at least two separate locations; and access to backups should require the same dual approval as a transfer. The policy should also cover key-person risk: what happens if the treasurer resigns, is incapacitated, or becomes unavailable. A company whose crypto access depends on one employee's memory has a governance failure, not a technology problem, and the board should treat it as such.

Custodian Selection and Ongoing Oversight

If the company uses an external custodian, the policy should set selection criteria and oversight duties. Before signing, management should verify whether client assets are segregated or held in omnibus wallets, what insurance covers and excludes, how quickly withdrawals can be made, and what happens if the custodian fails. These answers belong in the board pack, not only in a sales deck. The policy should also require a second custody option, because reliance on a single custodian is a concentration risk that the board should consciously accept or mitigate.

Oversight must continue after onboarding. The policy should require daily reconciliation of custodian balances against internal records, periodic review of the custodian's audit reports and regulatory standing, and a test withdrawal of meaningful size before large balances are committed. It should also set triggers for escalation: a delayed withdrawal, a change in the custodian's ownership, or a downgrade in its audit opinion should reach the board promptly. A custodian relationship that nobody reviews is an assumption, not a control, and assumptions are what fail in a crisis.

Accounting, Reporting, and Audit

Custody policy and accounting policy must agree. The policy should state how holdings are valued, which price sources are used, how often valuations are updated, and who may override a price. With bitcoin below $80,000 on October 26, 2026, after a roughly 1 percent daily decline, valuation timing can change a reported position materially, so the company needs a consistent, documented approach rather than ad hoc picks. It should also define how transfers are recorded, so every on-chain movement maps to an internal journal entry that an auditor can trace.

Internal audit should test custody controls directly: sample transfers for approvals, verify wallet inventories, confirm custodian balances independently, and check that terminated employees lost access promptly. External auditors will ask the same questions, and a company that cannot produce wallet inventories, approval logs, and reconciliation records will face a difficult audit. The board's audit committee should receive a custody report at least quarterly, covering holdings, movements, exceptions, and any control failures, in plain language that non-technical directors can challenge.

Incident Response and Policy Review

No policy prevents every incident, so the policy must define what happens when one occurs. It should name the incident team, set the first-hour actions for freezing wallets and preserving logs, and define who notifies exchanges, custodians, insurers, auditors, and regulators. It should also set decision authority for exceptional transfers during an incident, because a team that must improvise approvals during a theft will either move too slowly or bypass controls entirely. A tabletop exercise at least once a year, involving directors as well as staff, keeps the plan realistic.

Finally, the policy itself needs a review cycle. The board should reapprove it annually and after any material change: a new asset class, a new custodian, a new jurisdiction, or a significant incident. Each review should ask whether limits still fit the company's holdings, whether roles still match the org chart, and whether the policy reflects current technology and regulation. A custody policy written once and forgotten is worse than no policy at all, because it creates false confidence. The board's job is not to write perfect rules once, but to keep asking whether the rules still protect the assets.

• Separate trading, approval, and reconciliation across different people
• Require dual approval above a set threshold, with an auditable trail
• Keep company, customer, and employee assets in separate wallets
• Reconcile custodian balances daily and review audits annually
• Rehearse incident response with a tabletop exercise every year

AI Help: Muse AI

Muse AI is Meta's personal AI assistant. It can explain board-level custody concepts like segregation of assets and dual approval in plain language, helping directors ask sharper questions about a policy draft.

Join Muse with invite code LTGSWD — in the Muse app, go to Settings > Redeem token and enter the code.

Disclosure: LTGSWD is the author's Muse invite code.

Muse AI is not a trading tool and does not give financial advice.