Custody Policy

Overview

The policy establishes eligible assets and networks, custody models, storage tiers, wallet limits, authorized roles, approval thresholds, destination controls, provider requirements, and segregation rules. It should connect legal ownership and risk tolerance to technical configuration.

Exceptions, emergencies, and recovery deserve explicit treatment because they often bypass normal processes. The policy should specify who can invoke them, what evidence is required, how authority is limited, and how post-event review occurs. Undocumented support practices should not override formal control.

Implementation requires procedures, platform settings, training, monitoring, and evidence that the rules operate. Periodic review should address new networks, staffing, incidents, provider changes, and transaction volume. A policy is effective only when actual signer permissions, wallet structures, and operational behavior match its approved requirements.

For Custody Policy, risks include key compromise, insider abuse, commingling, inaccurate books, unsupported tokens, provider insolvency, sub-custodian failure, blocked withdrawals, lost recovery material, and ambiguous liability. For Custody Policy, controls should combine least privilege, separation of duties, verified destinations, asset segregation, limits, monitoring, and continuity tests.

Records for Custody Policy should reconcile on-chain or provider balances with customer entitlements and the internal ledger by asset, network, account, and cutoff. For Custody Policy, pending deposits, locked assets, staking, fees, conversions, forks, unsupported transfers, and manual adjustments require separate treatment and review.

Custody Policy should be distinguished from investment ownership and from a software interface. For example, a provider may display an asset balance while holding pooled assets through another custodian; operations must verify contractual rights, segregation, withdrawal capability, and external evidence rather than rely on the screen alone.