Institutional digital asset custody should be assessed by mapping who controls the keys, who can authorize transactions, how access is governed and recovered, and how activity is overseen. Treat those as separate control questions: a custody description alone does not establish that controls operate effectively or determine legal status. Institutions should document evidence for operational claims and obtain jurisdiction-specific advice for legal, compliance, and tax conclusions.

Define the custody model and control boundaries

Start with a control map for each asset and custody arrangement. Identify the institution, any service provider, internal teams, and technology involved in key access, transaction authorization, and asset records. For each role, record what it can do, what approval it needs, and which other party or system it depends on. This is a governance exercise, not a determination of legal ownership or regulatory classification.

A crypto wallet generally manages private keys or passcodes used to access and authorize crypto assets; it does not store the assets themselves. That distinction makes it important to separate control of key material from the records used to track assets and transactions. Ask who can access the relevant keys or signing functions, who can initiate instructions, and who can approve or execute them. Do not assume that a party described as a custodian has every one of these powers, or that a technical arrangement settles the legal characterization. source

For third-party arrangements, document what the provider does and what remains with the institution. For example, a centralized exchange customer typically transfers assets into the exchange’s custody before using its internal trading system, but this general operating model is not a description of every service or contract. Examine the specific arrangement rather than treating a trading account, wallet interface, or service label as a complete account of control. source

A useful control-boundary record names the responsible party for each function, the evidence available to verify it, and any unresolved dependency. Include internal ownership for policy, approvals, exception handling, and provider oversight. If the arrangement’s legal status or obligations matter, send that question to qualified counsel rather than inferring an answer from the technical map.

Institutional digital asset custody: assess key and transaction controls

Key management covers the protection and lifecycle of cryptographic keying material, including generation, storage, distribution, use, recovery, revocation, and destruction. Use that lifecycle as a review structure: for each stage, ask who is accountable, what process governs it, and what evidence shows the process is followed. source

For key creation and storage, request documented procedures and identify the people, systems, and service dependencies involved. For access and use, ask how authorization is granted, reviewed, and withdrawn; whether responsibilities are separated; and how exceptions are recorded. For backup and recovery, establish what material is covered, who can invoke the process, and what approvals apply. For revocation and destruction, ask how former access is removed and how completion is documented. These questions identify evidence gaps; they do not establish that a particular control is secure or effective.

Assess transaction authorization independently from key storage. Map who can propose an instruction, who can approve it, and who or what can sign or submit it. Review whether documented limits and approval requirements apply to ordinary and exceptional transactions. Pay particular attention to changes in authorized personnel and destination details: require a defined approval path, evidence of review, and a record of the change. The applicable thresholds and approval design should be set by the institution’s governance process, not assumed to be universal.

Request evidence of both control design and operation. Design evidence may describe policies, assigned responsibilities, and approval steps; operating evidence should show how those steps are performed and exceptions handled. A written description is not proof that a control was consistently used. Keep the assessment specific to the arrangement, and do not infer compromise resistance from the presence of a named control or technology.

Test operational resilience and recovery assumptions

Map the dependencies that could interrupt access or signing, including the teams, services, and technology identified in the custody model. For each dependency, ask what happens if it is unavailable, who receives an escalation, and which decision-makers can authorize a response. Request documented incident and continuity procedures, then check whether they identify accountable roles and escalation paths. Avoid turning a procedure’s existence into a claim that operations will continue uninterrupted.

Review recovery as a governed process, not merely a stored backup. Ask what recovery covers, who may initiate it, which approvals are required, and how access is restored or revoked afterward. Confirm any stated recovery capability and limitation against attributable documentation and relevant contractual terms. If documentation does not establish a specific outcome, record that uncertainty rather than promising that assets or access can be restored.

The key-management lifecycle includes recovery and revocation, but it does not prescribe a single recovery design or guarantee a successful result. For an institution, the practical due-diligence record should connect each recovery assumption to an owner, supporting evidence, and a clearly stated limitation. Escalate unresolved assumptions to the teams responsible for risk acceptance and provider oversight.

Set governance, reconciliation, and oversight

Assign accountable owners for custody policy, access reviews, transaction exceptions, and provider oversight. Record who approves policy changes, who monitors exceptions, and who is responsible for escalating a discrepancy or incident. Keep these operational responsibilities distinct from investment decisions; a custody assessment evaluates controls, not whether an institution should acquire or hold an asset.

Define how the institution compares its asset records with available transaction and custody records, who investigates differences, and how resolution is documented. The evidence library for this assessment does not establish a universal reconciliation method or reporting frequency, so set those requirements for the specific arrangement and document the rationale. Do not treat a service report or assurance document as a guarantee: identify its scope, the period and controls it addresses, and any limitations before relying on it.

Provider oversight should remain ongoing. Maintain a record of the provider’s responsibilities, internal dependencies, documented incident-notification arrangements, and unresolved control questions. Where an arrangement changes, revisit the control map rather than assuming the prior assessment still applies. Require evidence before describing an operational capability, and keep the institution’s own accountability visible even when a third party performs key functions.

Before assessing legal or compliance obligations, identify the jurisdictions, entities, assets, and services involved. The evidence available here does not establish which licensing, safeguarding, reporting, or other requirements apply to a particular institution or custody arrangement. Obtain current primary-source materials and qualified jurisdiction-specific advice before reaching those conclusions; do not generalize from one location or service model to another.

Tax treatment also requires jurisdiction-specific analysis. This framework does not establish tax consequences, reporting duties, or a universal treatment for digital assets. Use appropriate tax-authority sources or qualified tax advice for the relevant entities and circumstances, and keep those conclusions separate from the technical control assessment.

Likewise, do not state that a service is available, supports a particular asset, charges a particular fee, offers a yield, or meets a compliance requirement unless current, attributable evidence supports that exact statement. These are arrangement- and time-sensitive questions, not properties that can be inferred from a general custody model. A disciplined due-diligence record therefore ends with three things: a mapped control boundary, evidence and limitations for operational claims, and a list of legal, compliance, and tax questions referred to appropriate jurisdiction-specific review.

Sources and references