Custody Migration

Overview

The migration may replace a custodian, move from self-custody to managed custody, adopt multisignature or threshold signing, change storage tiers, or reorganize wallets and policies. It affects keys, addresses, approvals, records, integrations, and operating responsibilities.

Some components can be reconfigured, while others require new keys and on-chain transfers. Smart contracts, staking, token permissions, NFTs, pending deposits, and unsupported networks may need separate plans. Changing technical control without updating legal agreements or accounting maps leaves the migration incomplete.

A controlled program inventories assets and dependencies, validates the target design, runs recovery and test transactions, stages movement, and reconciles every balance. Old addresses remain monitored for late activity, and legacy records stay accessible. The transition should preserve enough liquidity and signer availability to continue critical operations throughout the change.

For Custody Migration, risks include key compromise, insider abuse, commingling, inaccurate books, unsupported tokens, provider insolvency, sub-custodian failure, blocked withdrawals, lost recovery material, and ambiguous liability. For Custody Migration, controls should combine least privilege, separation of duties, verified destinations, asset segregation, limits, monitoring, and continuity tests.

Records for Custody Migration should reconcile on-chain or provider balances with customer entitlements and the internal ledger by asset, network, account, and cutoff. For Custody Migration, pending deposits, locked assets, staking, fees, conversions, forks, unsupported transfers, and manual adjustments require separate treatment and review.

The operating model for Custody Migration should map legal ownership, beneficial entitlement, technical control, account structure, asset segregation, supported networks, signing policy, provider roles, contractual duties, and insolvency treatment. For Custody Migration, these dimensions can belong to different parties and must not be inferred from a wallet label.