Custody Controls

Overview

Context and purpose

Controls span key generation, storage, access, transaction approval, destination verification, wallet tiers, balance limits, monitoring, reconciliation, backups, recovery, and incident response. Legal and recordkeeping controls establish ownership and ensure client instructions are properly authorized. Multisignature can fail through correlated signers, cold storage can fail through poor recovery, and strong authentication can fail if an administrator can change policies without review. Preventive, detective, and corrective controls should reinforce one another across the full transaction lifecycle. Organizations should assign owners, document evidence, test configurations, review exceptions, and measure control performance. Independent assurance can examine whether stated controls operate in practice. Controls must evolve when assets, networks, staff, providers, or transaction volumes change, while emergency procedures remain limited, auditable, and regularly rehearsed. Custody Controls works through controlled onboarding, asset receipt, internal attribution, storage-tier assignment, authorization, signing or provider instruction, monitoring, withdrawal, reconciliation, reporting, and return or migration.

How it works

Custody controls are the policies and technical mechanisms that govern who can access, authorize, recover or transfer customer or treasury assets. They cover people, systems and evidence, not only cryptographic key storage.

Practical checks and failure points

Document roles, approval thresholds, key rotations, emergency access, reconciliation and segregation of duties.

Related concepts

Custody Incident · Address Ownership Verification