For institutional treasury, finance, security, and operations teams, evaluating Anchorage crypto custody should begin with a bounded control review—not an assumption about the provider’s current features. Identify which assets, entities, workflows, and custody functions are in scope; request current, scoped evidence; and record what remains unverified. The available evidence here supports general custody and key-management distinctions, but does not establish Anchorage-specific controls, terms, availability, or regulatory status.

What institutional custody due diligence must establish

First define the arrangement being assessed. List the legal entities involved, the digital assets and networks in scope, the accounts or wallets used, and the activities the institution expects to perform. Map each workflow from initiation through approval, execution, reconciliation, and exception handling. This scoping work is necessary because evidence about one product, asset, entity, or workflow does not automatically establish controls for another.

Separate provider statements from evidence that can be examined. A policy description, technical architecture document, contractual term, independent assessment, and operational record are different forms of evidence. For each item, note its source, review date, scope, limitations, and whether it is a provider representation or independently verifiable material. Do not treat a general description of custody as proof that a named service uses a particular control.

A third-party custodian generally manages access to private keys on behalf of customers; crypto exchanges are among the entities that may provide third-party custody. The actual custody structure, customer rights, segregation, insurance, regulation, and insolvency treatment vary by provider and jurisdiction. Those factors therefore need arrangement-specific verification rather than inference from the word “custody.” source

Create an open-issues register as part of the assessment. For each unresolved question, record the operational consequence, the person responsible for obtaining evidence, and the decision owner who will determine whether the gap is acceptable. This prevents an unknown from becoming an implicit assumption in a later approval.

Anchorage crypto custody: assess governance and authorization

The first governance question is who has authority to request, approve, and carry out each action. Build a responsibility map for actions such as granting access, changing instructions, initiating transfers, responding to exceptions, and handling suspected compromise. The review should distinguish the institution’s actions from those performed by the custody provider and any other service involved in the workflow.

Ask for current documentation showing how responsibilities are assigned and what approval paths apply to the services under review. Examine role separation, access review, escalation procedures, and how policy exceptions are authorized and recorded. These are questions for evidence collection, not claims that any particular control is present. If a document describes a control only at a high level, request the applicable procedure or evidence that shows how it operates in the institution’s actual arrangement.

The institution should also specify how it will resolve conflicting instructions, unavailable approvers, or a request that falls outside ordinary procedure. Record who is authorized to make an exception, what documentation is required, and which party must be notified. If the provider’s materials do not define these boundaries, identify the omission as a due-diligence gap and assign an owner to resolve it before relying on the workflow.

Do not infer current product features from general custody concepts or from the provider name. Confirm the precise service, entity, and terms under review using current authoritative provider materials and institutional review. This assessment does not establish current Anchorage authorization, permitted activities, jurisdictional availability, fees, or product terms.

Examine key management and transaction controls

Key management is the protection and lifecycle handling of cryptographic key material. Its lifecycle can include generation, storage, distribution, use, recovery, revocation, and destruction. This framework identifies questions to ask; it does not show which methods a particular provider uses. source

Request documentation that describes the arrangements for each lifecycle stage that matters to the institution. Clarify which party performs or controls each function, what evidence supports the description, and what happens when access must be changed or recovered. Avoid relying on a generic statement that keys are “securely managed” without understanding the scope and limitations of the statement.

Next, trace transaction authorization from the institution’s instruction to execution. Where relevant to the service, ask how approval thresholds, permitted destinations, and changes to those controls are configured and reviewed. Establish who can request or approve changes and how those changes are documented. These are assessment prompts; the available evidence does not establish whether Anchorage uses any particular threshold, allowlist, or change-control design.

Clarify shared responsibilities. The institution may have its own access-management, approval, recordkeeping, or incident-escalation tasks even when a third party manages key access. Request an explicit description of the boundary between institutional and provider responsibilities, and compare it with internal procedures. A responsibility left undefined can create an operational gap even when each party has documented processes of its own.

Test operational resilience and incident readiness

Assess what could disrupt the institution’s ability to carry out or verify its intended custody workflows. Request current documentation about relevant service dependencies, continuity arrangements, availability commitments, and recovery procedures. Record the covered service and the evidence date; a statement about one service or time period should not be generalized to other products or future performance.

Agree on incident expectations before an incident occurs. Ask what event types trigger notification, how escalation works, what information will be shared, and which party leads investigation or coordination. Confirm how the institution should respond to suspected compromise, access disruption, delayed transactions, or an instruction that cannot be completed. The available evidence does not establish Anchorage-specific notification timelines, incident procedures, or recovery capabilities, so these must be verified against current, applicable materials and agreed arrangements.

A practical tabletop review can expose gaps between written procedures: for example, whether the institution knows whom to contact, who can authorize an urgent response, and how it will keep an internal record of decisions. Treat this as a proposed assessment exercise, not as a report of a test or a claim that a provider has demonstrated performance. Document unresolved dependencies and the actions needed to address them.

Build an evidence-led decision record

For every material finding, capture the evidence source, date reviewed, scope, limitations, and outstanding questions. Distinguish confirmed facts from provider representations and from matters not yet established. Tie each gap to a responsible owner, a proposed mitigation or follow-up, and a review trigger. A decision record should make clear what the institution has and has not verified.

If the institution’s activities fall within virtual-asset service-provider expectations under the FATF standards, those standards describe preventive measures that include customer due diligence, recordkeeping, suspicious-transaction reporting, and handling originator and beneficiary information for applicable transfers. FATF standards are international standards; exact legal duties, thresholds, licensing, data handling, and permitted services depend on implementation in each jurisdiction. Escalate jurisdiction-specific questions to qualified advisers rather than treating this general description as a legal conclusion. source

Likewise, verify availability, fees, yields, security, recovery, and compliance claims against current authoritative materials before relying on them. The evidence available for this article does not support Anchorage-specific conclusions on those points. Qualified advisers should address relevant legal, regulatory, tax, and compliance questions for the institution’s jurisdictions and arrangements.

The result should be a bounded decision record: the arrangement assessed, evidence reviewed, limitations, unresolved risks, assigned owners, and any documented risk acceptance. This framework is for institutional due diligence, not investment advice, a vendor review, or a determination that a particular custody arrangement is suitable.

Sources and references