Custody of Crypto-Assets in a Company: Risks and Duties of Care

Why custody is the real question

A business occasionally accepts payments in bitcoin, a shareholder bought a small holding years ago as a reserve, a customer paid with a stablecoin that has not yet been exchanged. In all three cases, the company holds an asset that works differently from a bank balance. It exists only as an entry on a blockchain, and who can dispose of it is determined solely by possession of a key.

Put simply, the question is: What risks arise when a company holds crypto-assets in custody, and what care does management owe in doing so? To answer it, we first clarify the terms, look at how losses occur in practice, and compare the ways of custody with a thinking model. Then we weigh self-custody against a custodian and derive rules for the business. Bitcoin on the balance sheet covers whether crypto-assets belong on the balance sheet at all, and Accepting crypto payments in business whether accepting them as payment pays off.

Key, wallet, custody: the terms

A private key is a secret string used to sign transactions. Whoever knows it can dispose of the holdings. A wallet is the software or device that manages keys. The keys are often derived from a sequence of 12 or 24 words, the recovery phrase. Whoever has these words has the holdings.

• Hot wallet: The keys are on a device connected to the internet. Quick to use, but vulnerable.
• Cold wallet: The keys are stored offline, for example on a special hardware device. More secure, but slower to access.
• Multi-signature (multisig): A transaction requires the signatures of several keys, for example two of three. This is the technical counterpart of the four-eyes principle.
• Custody: A service provider holds the keys on the client's behalf. The client then has a claim against the custodian, not the key itself.

An analogy makes the difference tangible. Self-custody is like cash in your own safe: nobody else can get at it, but if the safe is broken open or the combination is forgotten, nobody helps. A custodian is like a bank safe deposit box: protection is professional, but you depend on the bank, its opening hours, and its solvency.

How losses occur in practice

The analytics company Chainalysis evaluates thefts and fraud involving crypto-assets every year. For 2025, with data up to early December, it counted more than 3.4 billion US dollars in stolen crypto-assets. The losses were highly concentrated.

For a small business, spectacular attacks on trading platforms are only part of the risk. More frequent are errors in-house: a recovery phrase stored as a photo on a mobile phone, an employee who is the only one who knows the access and leaves the business, a fake email that leads to a payment to the wrong address. Because blockchain transactions cannot be reversed, there is no complaint after such a mistake.

The second major risk lies with the provider. In November 2022, the crypto exchange FTX collapsed. Customer funds had not been held separately but used for the business of an affiliated trading firm. The founder was convicted of fraud in the US in 2023 and sentenced to 25 years in prison in 2024; an appeals court upheld the verdict in June 2026. FTX: how missing controls brought down a crypto exchange recounts the case.

With crypto-assets, custody is not a side issue of ownership. It is ownership.

What MiCA regulates for custodians

Since December 30, 2024, crypto-asset service providers in the EU have needed authorization under the Markets in Crypto-Assets Regulation, MiCA for short. The longest possible transitional periods ended on July 1, 2026, as Stablecoins and MiCA describes. In Germany, the financial regulator BaFin is responsible. For custody, MiCA sets out several obligations.

Two limitations belong to this. First, separation only protects if it is actually observed, which supervisors check but cannot guarantee. Second, there is no deposit guarantee for crypto-assets as there is for bank balances. Authorization is a necessary condition for a custodian, not a quality seal for its business model. Whether a provider is authorized can be checked in the regulator's register, as Business partner due diligence describes for financial service providers.

The thinking model: the custody triangle

Brand and Karhu (2023) describe the choice of a custody solution for institutional investors as a trade-off between security, efficiency, and reliability. Their basis is an analysis of the available solutions and an interview with a Nordic fund, a narrow empirical basis. The model, however, transfers well to a business if you read efficiency as availability.

• Security: How well are the holdings protected against theft, attacks, and errors?
• Availability: How quickly and easily can the business access the holdings in everyday use, for example for a payment or an exchange?
• Reliability: Does access remain if a person drops out, a device fails, or a provider collapses?

No solution is strong on all three sides. If you want maximum security, you lose availability. If you rely on a provider, you exchange the risk of your own error for the risk of the provider. In an overview of digital asset custody, Parry (2024) also stresses that supposed certainties such as instant and irreversible settlement do not hold in every case and that risk management begins with awareness of these differences.

Self-custody or custodian? Two perspectives

Experience with FTX and other collapses speaks for self-custody. What speaks for the custodian is that the most frequent errors in small businesses are organizational: one person, one device, no deputy. Brand and Karhu (2023) also point out that for institutional investors, local law often already prescribes the use of a third-party custodian.

For most small businesses, I consider the authorized custodian the better route, for a simple reason: a business whose core activity is not crypto-assets will rarely muster the care that secure self-custody requires over years. Self-custody with multi-signature can make sense if at least two people understand it and the procedures are documented. A single hardware wallet in the managing director's drawer does not.

Duties of care: rules for the business

Managing directors of a German GmbH must exercise the care of a prudent businessperson. What this means specifically for crypto-assets is not regulated in detail by law. From the general principles of proper management, however, rules can be derived that I consider the minimum.

1. Set a ceiling

   Define in writing how much may be held in crypto-assets and how long incoming payments may remain before exchange. Hold only what the business can lose without getting into difficulties.

2. Choose the custody approach

   Decide using the custody triangle and check the custodian's authorization, contract, separation of holdings, and liability.

3. Establish four eyes

   No person may move holdings alone. With a custodian via approval rights, with self-custody via multi-signature. Deputies for vacation and illness belong to this.

4. Plan for emergencies

   Record where recovery phrases and access credentials are stored, separately from each other, and who gets access in an emergency. This includes the owner dropping out.

5. Check addresses and payments

   Take destination addresses only from the system, make a small test transfer before larger amounts, and never accept address changes by email. Cyberattacks on small businesses describes how attackers use fake messages.

6. Document and reconcile

   Reconcile holdings with accounting monthly, file the custodian's statements, and classify unusual incoming payments according to the rules in Anti-money laundering duties.

Scope and limits

The custody of crypto-assets is a clear example of a general principle of corporate control: an asset is only as secure as the process that protects it. The same rules of ceiling, four eyes, and emergency plan apply to bank access, payment approvals, and credentials for important systems. The only difference is that with crypto-assets, nobody reverses a mistake.

The limits of this analysis are clear. The model by Brand and Karhu rests on a single interview and a market description. The Chainalysis figures are based on observed transactions and are revised continuously. How supervisors and courts will apply MiCA's liability rules in an emergency has hardly been tested yet. Tax and accounting questions depend on the individual case and belong with the tax advisor.

Conclusion: what secure custody in a business requires

To the guiding question: a company holding crypto-assets bears two risks, the risk of its own error and the risk of the provider. Losses arise from attacks, from organizational gaps such as missing deputies, and from providers that do not separate client funds. MiCA requires authorized custodians to separate holdings and be liable, but does not protect against every failure. The custody triangle shows that no solution maximizes security, availability, and reliability at the same time.

For most small businesses, this results in a simple rule of care: hold little, exchange quickly, use an authorized custodian, and no movement without a second person. Whatever cannot be regulated in writing beyond that, the business should not hold.

• Set a written ceiling for crypto-assets held.
• Justify and record the custody approach using the custody triangle.
• Check the custodian's authorization, separation of holdings, and liability.
• Establish the four-eyes principle for every movement.
• Write an emergency plan with separately stored access credentials and test it annually.
• Reconcile holdings with accounting monthly.