For institutional treasury, security, and operations teams, reviewing crypto custody means mapping who controls signing authority, who approves transfers, and which processes keep access and records dependable. Treat custody as a control arrangement—not simply a wallet or a provider label—and require evidence for each responsibility and dependency before approval.

Institutional custody crypto: define the control boundary

Start with an inventory of the assets and processes under review. Identify the relevant wallets, signing systems, transaction workflows, records, and external services. The aim is to establish what the institution is relying on before judging whether its controls are adequate.

A crypto wallet generally manages private keys or passcodes used to access and authorize crypto assets; it does not store the assets themselves. That distinction matters because a wallet interface, a key-management service, a trading venue, and an accounting record may each play different roles. Document which component controls signing, which system presents or submits transactions, and which records the institution uses to monitor positions and activity. source

Draw a responsibility map that separates custody, transaction execution, settlement, and recordkeeping. For every function, name the institution’s accountable owner and any external provider or system on which that function depends. A provider’s description of its service is not a substitute for identifying what the institution itself must approve, monitor, or retain.

Record assumptions and unresolved dependencies alongside the map. For example, note whether approval depends on a particular service, administrator, credential, or record being available. Do not treat a label such as “custody” as evidence that all of these functions are covered.

Governance and accountability

Set policy ownership and decision rights before relying on technical safeguards. The institution should identify who may propose transactions, who may approve them, who can change access or policy, and who monitors activity and escalates exceptions. The review should make clear whether any single role can initiate and authorize a consequential change without a separate check.

Document how privileged access is granted, reviewed, changed, and removed. Separate routine operation from exceptional access, and specify who can approve an exception and how that approval is recorded. These are review questions, not claims that any particular organizational structure is sufficient for every institution.

Define a recurring review process for users, permissions, destinations, and operating assumptions. Specify how staff report suspected misuse or control failures, who assesses the report, and who has authority to pause or restrict activity while it is investigated. Keep exception records with an owner, rationale, approval, and follow-up decision so that temporary departures from policy do not become invisible operating practice.

Ask for evidence behind claims about security, compliance, or regulatory status. A general statement should not be treated as proof that a specific arrangement, service, or legal entity meets the institution’s requirements. Regulatory and compliance assertions need verification for the relevant location and arrangement; this review does not establish jurisdiction-specific legal duties.

Key management and transaction authorization

Key management covers the lifecycle of cryptographic keying material, including generation, storage, distribution, use, recovery, revocation, and destruction. Review each stage separately: a description of secure storage, for example, does not establish how access is approved, how a compromised key is revoked, or how recovery is controlled. source

For each stage, request a control description that identifies the responsible party, the permitted operators, the records produced, and the process for exceptions. Ask how the institution can determine who authorized a key-related change and whether access is still appropriate. Evaluate controls for credential compromise, insider misuse, and mistaken actions as distinct scenarios rather than assuming one safeguard addresses them all.

Review transaction authorization as a workflow. Establish who can prepare a transfer, who verifies its details, and who approves its release. Ask whether approval rules distinguish ordinary activity from higher-risk or exceptional transfers, and how changes to trusted destinations are reviewed. Confirm that the process leaves evidence of the requested action, the approvals, and any exception handling.

Recovery deserves its own review. Ask what materials or services recovery depends on, who may invoke them, what approval is required, and how the institution would verify that recovered access is appropriate. Do not infer that a recovery mechanism can reverse a completed transfer or restore access in every failure scenario. Require specific documentation for any recovery claim and record what remains unproven.

Operational resilience and incident handling

Map the operational dependencies needed to authorize, monitor, and record activity. Include the institution’s own people and systems as well as external services identified in the responsibility map. For each dependency, ask what happens if access is unavailable, a control produces an unexpected result, or a suspected compromise requires escalation.

Request written incident roles and communication procedures. The review should identify who receives an alert, who decides whether to restrict activity, who coordinates investigation, and who communicates with affected internal teams or providers. Ask how transaction errors and suspected unauthorized activity are documented and escalated. Avoid assuming that a reported incident will be reversible or that a service can recover access on a particular timetable without evidence.

Examine continuity and recovery plans for their stated scope and dependencies. Ask what procedures exist, who is expected to carry them out, and what records demonstrate that the relevant process has been exercised. Distinguish a documented plan from evidence that the plan has been tested under conditions relevant to the institution. Where tests or assurance evidence are unavailable, record that limitation rather than treating the claim as verified.

Also assess whether the institution can continue its own oversight if a provider or internal system is unavailable. The question is not whether every dependency can be eliminated, but whether the institution understands them, has assigned responsibility for monitoring them, and has a defined response when they fail.

Evidence to request before approving an arrangement

Make approval conditional on evidence that addresses the actual control boundary. Request current documentation describing responsibilities, access procedures, authorization workflows, incident escalation, continuity arrangements, and recovery dependencies. Seek independent assurance evidence where available, and check that its scope corresponds to the services and controls being assessed. Do not treat an assurance document as proof of controls it does not cover.

Verify statements about regulation, compliance, service availability, and geographic coverage for the specific arrangement and location. Those claims can depend on the provider, service, and jurisdiction; a general description should not be generalized into a conclusion about the institution’s situation. Obtain current written terms for fees and any limits or conditions relevant to the proposed arrangement rather than relying on an informal summary.

If a service involves asset use or a stated yield, assess that activity separately from custody. Request documentation explaining what the assets may be used for, which parties control that activity, and what conditions apply. A description of custody alone does not establish the risks or terms of a separate asset-use activity. Record unsupported or unclear claims as evidence gaps, not as established benefits.

Close the review with an evidence register: the claim or control being assessed, the document or other evidence reviewed, its scope and date, the responsible reviewer, and any unresolved gap. Assign each gap an owner and specify whether it blocks approval or requires follow-up. This turns a broad custody review into a traceable decision record without implying that any provider or arrangement is risk-free.

Sources and references