Moving company Bitcoin to a professional custodian can reduce the chance that one lost device, exposed seed phrase or unauthorized signer causes a permanent loss. It does not turn a volatile asset into cash, settle questions about legal ownership or replace treasury governance. A sound review separates those problems instead of treating “institutional custody” as a complete answer.
Start with the control model
The first question is who can authorize a transfer. The US Office of the Comptroller of the Currency said in Interpretive Letter 1170 that a national bank may provide cryptocurrency custody, including by holding the cryptographic keys. The letter also describes more than one model: a customer may retain a copy of a key, or the bank may take control and create new keys on the customer’s behalf.
Those arrangements create different failure paths. Treasury staff should document who holds each signing credential, how many approvals a withdrawal needs, which destinations are allowed and what happens if an approver leaves the company. The policy should also distinguish routine transfers from emergency recovery. For the underlying trade-offs between connected and offline storage, CryptoNeb’s hot-wallet and cold-storage guide provides a useful starting point.
Read the custody agreement, not the label
OCC Letter 1170 says custody agreements should define duties and responsibilities and may need to address cryptocurrency-specific events such as forks. It also calls for controls including separation of client assets from the custodian’s assets, dual control, segregation of duties and specialized audit procedures.
A treasury review should therefore ask where assets are recorded, whether a subcustodian is involved, how transaction records are reconciled and which events trigger client notice. Insurance should be checked against the actual policy rather than assumed from a marketing page: covered causes, exclusions, limits and the party entitled to claim all matter. Any answer about insolvency treatment or asset ownership should come from counsel reviewing the signed agreement and the relevant jurisdiction.
Keep asset risk in a separate column
Secure keys do not prevent Bitcoin’s market price from falling or guarantee that a large position can be sold at a desired price. Before buying, the company needs limits for position size, approved venues, execution authority and the amount of working capital that must remain outside Bitcoin. It also needs accounting and tax advice suited to its reporting period and jurisdiction.
The custody decision should fit the exposure the company actually wants. A spot fund, direct ownership and a custodial account produce different combinations of control, fees and operational work; the choice should follow the company’s stated goals rather than the custodian’s convenience.
Test the process before funding it
A tabletop exercise can expose gaps without moving the full position. Test a small deposit and withdrawal, an unavailable approver, a rejected destination and an incident-notification path. Record who made each decision and whether the custodian’s evidence supports the treasury ledger. Repeat the exercise after personnel, policy or custody-provider changes.
The practical conclusion is narrow: custody can improve key security and operational discipline when the controls and contract are specific. It cannot choose an acceptable Bitcoin allocation, guarantee liquidity or make governance decisions for the company.
Adapted from Bitcoin Custody Risk for Treasuries: What Qualified Safekeeping Does—and Does Not—Solve.