Collaborative Custody

Overview

A common design uses multisignature or threshold signing so no single party holds complete unilateral authority. The client may approve ordinary transactions, while another party contributes policy enforcement, backup, recovery, or emergency assistance.

Collaborative custody differs from full third-party custody because the user may retain a key or veto, and differs from simple self-custody because external parties participate in control. Actual rights depend on quorum: if the provider can combine other shares without the client, the arrangement may still permit provider-led movement.

The agreement should specify signer combinations, key ownership, recovery paths, service outages, inheritance, fees, privacy, and exit procedures. Participants should use independent devices and communication channels. Collaboration improves resilience only when authority distribution is understandable and the client can verify or migrate the arrangement.

For Collaborative Custody, risks include key compromise, insider abuse, commingling, inaccurate books, unsupported tokens, provider insolvency, sub-custodian failure, blocked withdrawals, lost recovery material, and ambiguous liability. For Collaborative Custody, controls should combine least privilege, separation of duties, verified destinations, asset segregation, limits, monitoring, and continuity tests.

Collaborative Custody works through controlled onboarding, asset receipt, internal attribution, storage-tier assignment, authorization, signing or provider instruction, monitoring, withdrawal, reconciliation, reporting, and return or migration. For Collaborative Custody, each handoff needs stable identifiers and an authoritative record of who approved and executed it.

The operating model for Collaborative Custody should map legal ownership, beneficial entitlement, technical control, account structure, asset segregation, supported networks, signing policy, provider roles, contractual duties, and insolvency treatment. For Collaborative Custody, these dimensions can belong to different parties and must not be inferred from a wallet label.