Joint Wallet

Overview

A joint wallet can use multisignature, smart-contract policy, provider roles, shared custody, or a single credential shared informally. Only the first approaches establish explicit technical rights; sharing one password or seed gives each holder uncontrolled individual authority.

Joint ownership and joint authorization are different. A wallet may require two approvals while assets legally belong to one entity, or allow either person to spend jointly owned funds. Death, incapacity, separation, dispute, and loss of one signer can expose weaknesses in the arrangement.

Participants should document ownership, approval threshold, contribution records, spending limits, recovery, replacement, and exit. Credentials should remain individual and auditable. The wallet design should address deadlock and unauthorized unilateral action. Transactions and policy changes need records that identify who approved them and under which rule.

The Joint Wallet workflow operates through several distinct states: request creation, user or policy approval, signature generation, network submission, execution, confirmation, balance recognition, and accounting. For Joint Wallet, a wallet interface or provider response can report progress, but it cannot replace verified transaction and ledger evidence.

Material risks for Joint Wallet include credential compromise, malicious destinations, unsupported assets, wrong-network transfers, stale balances, compromised software, provider outage, privacy leakage, and inaccessible recovery material. For Joint Wallet, controls should reflect value, automation, reversibility, and whether the organization or a third party controls signing.

Records for Joint Wallet should preserve account and address identifiers, asset and network identity, policy version, requester, approvers, signed payload or transaction reference, fees, timestamps, status history, confirmations, exceptions, and final balance and accounting effects. For Joint Wallet, corrections must remain linked rather than overwrite the original event.