Institutions participate in crypto in different ways: some use networks or services for payments, settlement, or infrastructure, while others manage digital-asset holdings as part of treasury activity. The practical distinction is that treasury decisions concern an organization’s financial exposures and processes, while a crypto service or network may involve separate operational, custody, and counterparty responsibilities. The right questions depend on what the organization actually does; participation does not automatically mean holding crypto assets.

What institutional participation in crypto means

“Institutional participation” is a broad description, not a single operating model. An organization might interact with crypto networks or services without keeping digital assets on its own balance sheet. Another might hold assets, use a service that handles them, or combine several activities. The label alone does not identify who controls assets, who processes transactions, or which team is accountable.

It is useful to separate the activity from the asset position. Using a service to make or receive a payment, or relying on a network for settlement, raises questions about transaction processing and the service relationship. Holding a digital asset raises additional questions about authorization, records, exposure, and how access is managed. These categories can overlap, but one does not establish the other.

The distinction matters because service arrangements can place important functions with an intermediary. For example, a centralized crypto exchange commonly maintains an internal order book, and its customer typically transfers assets into the exchange’s custody before trading there. This describes a general model, not every venue or product; custody and legal ownership arrangements vary by platform and jurisdiction. A business evaluating such an activity would need to identify the actual arrangement rather than infer it from the word “exchange.” (source )

A wallet is also not the same thing as the asset itself. In the technical explanation cited by SEC staff, a crypto wallet generally stores private keys or passcodes used to access and authorize crypto assets, rather than storing the assets themselves. This distinction helps identify what a system manages: an organization may need to understand the assets, the credentials or signing process that authorizes their use, and any service provider involved. The statement is educational, not a legal determination about a particular arrangement. (source )

How crypto treasury activity fits into an institution

Treasury is the organizational function concerned with cash, liquidity, and financial exposures. Crypto-related activity can create treasury questions when an organization holds digital assets or when its payment or settlement flows affect funds it manages. But treasury is only one part of institutional participation: an organization may use a network or service without making digital-asset holdings the focus of its activity.

A useful starting point is to map the flow, not assume a product category. Ask what value enters or leaves the organization, whether the organization holds an asset or uses a third party, and which records document the activity. If an intermediary holds assets during an activity, the organization should distinguish its own internal account records from the intermediary’s custody and account arrangements. The details cannot be inferred from the fact that a transaction occurred through a crypto service. (source )

Policy, approvals, accounting, and risk ownership are separate questions to assess internally. This explainer does not establish accounting treatment or prescribe how an organization should allocate assets. Instead, the organization needs to determine which internal decision-makers own each question and obtain applicable professional review where required. For detailed treasury processes and management approaches, see the separate coverage of crypto treasury management.

Operating responsibilities across teams

An operating model is the way an organization assigns decisions and tasks. The specific structure varies, but a high-level review can ask which functions need to participate:

  • Finance and treasury: Identify the intended financial activity, the flows that affect organizational funds, and the records needed to understand exposures.
  • Security and technology: Clarify which systems, credentials, and service relationships are involved in authorizing or processing activity. A wallet’s role in managing access credentials should not be confused with the asset or with the provider operating an application. (source )
  • Legal and compliance: Identify the organization’s relevant activities, counterparties, and jurisdictions, then determine what specialist review is needed. This article does not state jurisdiction-specific legal or compliance requirements.
  • Executive or delegated oversight: Establish who can approve activity, who monitors it, and how exceptions are escalated. The appropriate decision rights depend on the organization and its activity; this article does not prescribe a governance structure.

Teams should make responsibilities explicit rather than assume that a single department owns the entire process. For example, treasury may describe the financial purpose, while technology teams explain the systems involved and legal or compliance teams assess questions within their remit. The evidence available here does not establish a universal segregation-of-duties design, recordkeeping rule, or approval sequence. Those are operating decisions to resolve for the organization’s actual circumstances.

Risks and controls institutions need to assess

A risk map should reflect the activity. Operational and cybersecurity questions concern the systems and processes used; key-management questions concern how access and authorization are handled; counterparty questions concern organizations that provide services or hold assets; and liquidity questions concern whether funds are available when needed. Governance questions include who may authorize activity and who is responsible for oversight. These are categories to investigate, not findings that a particular control is effective or that a particular arrangement is safe.

Where a third party is involved, examine the actual custody and account arrangement rather than relying on a general label. A centralized exchange may take custody of customer assets for trading on its internal system, but arrangements differ across platforms and jurisdictions. The general model does not establish a particular customer’s rights, segregation, recovery options, insurance, or treatment in insolvency. Those details require current, arrangement-specific evidence. (source )

Likewise, a wallet’s role in handling keys does not by itself answer who controls those keys or how access can be recovered. The available evidence supports the distinction between keys and assets, but it does not establish a security assessment for a specific system, custody model, or threat. Do not treat a provider description or a technical label as proof of recovery effectiveness. (source )

Some stablecoin designs use overcollateralized smart-contract positions, price oracles, collateral-ratio rules, and liquidation processes. That is one model, not a description of all crypto assets or all institutional activity. The design can still face oracle, contract, governance, liquidity, collateral-price, and bad-debt failures. If this type of exposure is relevant, its mechanics and risks need to be assessed specifically rather than generalized from the term “stablecoin.” (source )

Questions to resolve before defining an operating model

Before deciding how an activity will be organized, an institution can clarify the following:

  1. What is the intended activity? Distinguish network or service use from holding digital assets, and map the flow of value and the parties involved.
  2. Who owns each decision? Identify internal approval, execution, monitoring, escalation, and record responsibilities. Avoid assuming that treasury alone owns every related risk.
  3. What is the actual service and custody arrangement? If an intermediary is involved, verify who holds assets or controls access, what the account relationship says, and which recovery or exception processes apply. Do not infer these details from a service label. (source )
  4. Which questions require specialist review? Determine the applicable jurisdictions and obtain qualified, current review for legal, regulatory, tax, accounting, and reporting matters. This article does not provide conclusions in those areas.
  5. What evidence is needed before relying on a control or provider? Verify current service terms, fees, availability, security arrangements, recovery procedures, and any applicable requirements directly for the activity and arrangement under consideration. The evidence used here does not establish those details for a specific provider or institution.

These questions provide a framework for organizing due diligence, not a recommendation to adopt crypto or select a particular service. Institutional participation covers a range of activities; treasury responsibilities are one connected part of that range, and the operating model must be assessed against the organization’s actual activity and circumstances. For custody-specific questions, see the separate coverage of institutional crypto custodians; for institutional trading services, see the separate coverage of crypto prime brokerage.

Sources and references