A charcoal box between two separate geometric forms, with a third circular component resting nearby.

The family office can see a cryptoasset balance in its reporting, but the person who set up the wallet is the only one who can explain how to move it. The principal believes the office controls the holding; the office knows whose phone receives the approval request. Ask what happens if that person is unavailable, and the answer may depend on a recovery arrangement nobody else has examined.

Treat that as a custody question before treating it as a technology question. For cryptoassets, the office needs to establish who can authorize a transfer, who can carry it out, and who can change those permissions or restore access. Those powers should match the family’s intended authority, including when the normal arrangements cannot be used.

What holding the keys means

A private key is secret information used to authorize transactions involving cryptoassets. A wallet is the hardware or software used to manage access; it is not a container holding coins in the ordinary sense. The distinction matters because possession of a device, ownership of an asset, and authority to move it are different questions.

The US Securities and Exchange Commission’s custody bulletin distinguishes self-custody, where the holder manages the private keys, from third-party custody, where a provider controls access to them. Neither description tells the office enough about its own arrangement. A family may retain the keys while relying on someone else to maintain the equipment or explain recovery; with a custodian, the office may control withdrawal instructions without ever handling a key.

Start by asking who could cause assets to move, not whose name appears on a dashboard. Then ask who could give that power to someone else. Record both answers alongside the legal owner, which may be a person, trust, or company, and have counsel resolve any uncertainty about ownership or representation.

Choose the responsibility the family can sustain

Self-custody leaves the family responsible for the security and availability of its signing and recovery arrangements. Third-party custody transfers key-management responsibilities to a provider but creates dependence on that provider’s controls, contracts, and continued operation. The SEC warns that a custodian’s compromise, shutdown, or bankruptcy may leave customers unable to access their assets.

Choose between those responsibilities based on what the family can maintain through absence, staff turnover, and an urgent request. We recommend against self-custody of material holdings where the only operating plan is that one technically confident person will remain available. A third party deserves equally close scrutiny if the office cannot establish who it is contracting with or how withdrawals are controlled.

Storage terminology should not decide the question. Hot wallets are connected to the internet; cold storage keeps the private keys offline. As the SEC explains, both are available within self-custody and third-party custody. An offline arrangement still needs a workable authority model, protected recovery material, and a process for legitimate use.

Where a family uses more than one arrangement, give each a defined purpose. Set a ceiling for assets needed for frequent transactions, distinguish them from longer-term holdings, and identify who approves movement between the two. Do not let convenience in the frequently used account become the default custody policy for everything the family owns.

Map the powers behind an approval

A two-person approval rule is useful only to the extent that the arrangement supports it. Consider a hypothetical policy requiring the principal and an executive to approve a transfer. If another person can use the signing material directly, or an administrator can remove the approval requirement alone, the written rule does not describe all the ways the assets can move.

Build a control record for each custody arrangement. Keep secret keys and recovery words out of it; record roles, dependencies, and the location of protected procedures instead.

  • Business approval: who may request a transfer, who approves it, and what limits apply.
  • Execution: which people or provider processes can sign a transaction or release a withdrawal.
  • Control changes: who can add a recipient, replace an approver, raise a limit, or change the account’s security settings.
  • Recovery: who can restore access or replace an unavailable participant, and whose cooperation that requires.
  • Review: who receives evidence of transfers and changes independently of the person carrying them out.

For material holdings, require independent approval not only for transfers but also for changes that would defeat the transfer controls. Ask the custodian or technical specialist to demonstrate where that requirement is enforced and identify any exception. If the arrangement cannot enforce it, document the gap and decide whether to accept it, limit the exposure, or choose a different arrangement.

Do not infer independence from the number of devices or named roles. Examine whether the same person can operate both, or restore both through a shared recovery route. The relevant question is how many independent decisions are needed, including outside the normal process.

Make recovery part of the custody design

Recovery is an alternative way to regain control, so evaluate it alongside the ordinary transfer path. A recovery process that allows one person to bypass a two-person arrangement changes the effective authority over the assets.

Loss of a phone or wallet device does not necessarily mean the assets are lost. The SEC describes recovery phrases, sequences of words that can restore supported wallets. Whether recovery is possible depends on the arrangement and on what usable material remains; losing every usable signing and recovery route can make access permanently unavailable.

The US National Institute of Standards and Technology’s key-management guidance frames recovery policy around questions including who may receive recovery information, under what conditions, and who can change that policy. These are general cryptographic governance questions, not a prescription for a particular cryptocurrency wallet.

Have a qualified custody specialist document the arrangement-specific answers without exposing the secrets in a general office file. Distinguish an unavailable authorized person from a suspected compromise: restoring legitimate access and responding to someone else gaining control are different problems and should have different procedures.

The principal’s incapacity also requires a legal and operational distinction. Counsel should establish who may act for the owner, while the custody arrangement should specify how that authorized person is recognized and enabled. Possessing recovery material is not a substitute for legal authority, and legal authority should not be assumed to provide a working technical recovery route.

Read the custody agreement for control and ownership

A provider’s security presentation cannot settle what happens to the assets under its contract. Ask which legal entity holds them, whether another custodian is involved, and whether the arrangement permits lending, pledging, or other use of customer assets. Separate the custody decision from any decision to earn a return by making assets available for another purpose.

New York’s Department of Financial Services provides a useful, jurisdiction-specific example in its September 2025 custody guidance. Directed to covered New York virtual-currency custodians, it addresses separation of customer and corporate assets, preservation of customers’ beneficial interests, and disclosure of material subcustody arrangements and risks.

The guidance permits customer-only pooled wallets with records identifying customers’ interests. Accordingly, an answer that assets are segregated does not necessarily mean the family has its own separate wallet. Ask what segregation means in the proposed arrangement, how the family’s holding is recorded, and what evidence the office receives.

Have counsel assess the agreement’s ownership provisions, applicable law, and treatment in insolvency, including any cross-border complications. A regulatory framework or a contractual promise is not an assurance that assets will be returned promptly or in full if the provider fails.

Verify authorization for the actual contracting entity and service. In the European Union, the European supervisory authorities’ October 2025 warning specifically advises checking which services a firm is authorized to provide, because authorization may cover only some activities. Apply the same diligence principle wherever the provider operates, using the relevant jurisdiction’s official records rather than a badge on its website.

Ask for evidence of the controls you will use

Make the provider demonstrate your intended arrangement rather than describe its strongest available configuration. Ask how a withdrawal is initiated and released, how a new destination is approved, and what happens when an authorized person requests an exception. Include administrative and recovery actions in that demonstration.

For every material control, record the evidence, its scope, and any unresolved limitation. An independent assurance report may be useful, but check whether it covers the legal entity, custody service, and period relevant to the engagement. Ask what the office must configure or operate itself for the control to work.

The SEC’s custody bulletin also identifies insurance, access to keys, and subcontracted custody as diligence subjects. Ask what an insurance policy covers, who can claim under it, and which exclusions or limits matter to the proposed arrangement. Have the appropriate insurance and legal advisors evaluate the answer rather than treating the word insured as protection against every loss.

Agree how the family will be notified of a security incident, a material custody change, or a restriction on withdrawals. Establish an independently verified contact route for urgent questions. Before funding the arrangement, document the process and conditions for moving assets elsewhere, including who must cooperate and what fees or restrictions apply.

Test an unavailable-person scenario safely

Before relying on the design, rehearse a situation in which the usual participant cannot act. The exercise should establish whether the remaining authorized people can follow the documented route, obtain the required approvals, and recognize when they must stop.

Start with a discussion using the actual roles and provider contacts. Where a technical demonstration is needed, have the custody specialist design a controlled test using a suitable test environment or an explicitly approved nonmaterial amount. Do not expose live recovery words in a meeting, circulate screenshots of secrets, or move material holdings merely to prove that a procedure works.

Test the control-change route as well as a normal transfer. If a replacement approver can be added, identify who approves the change and who is told. Where recovery depends on an outside party, confirm its participation rather than assuming an internal rehearsal proves the whole process.

Record what worked, what failed, and who will resolve each gap. Repeat the relevant checks after a change in signers, ownership, provider, or recovery design; retaining a successful test from an obsolete arrangement proves little about the current one.

Give the office a custody decision it can defend

For each holding, assemble a concise record of the owning entity, custody model, actual control holders, recovery dependencies, and the evidence supporting the arrangement. Include counsel’s unresolved questions without placing privileged advice or recovery secrets in a broadly accessible register.

Name an executive responsible for keeping that record current. The person or governing body authorized to act for the owner should approve the intended authority and any material exception, including a deliberate decision to allow one person to act alone. The office should not discover that exception only when it tries to enforce a different rule.

Begin with the holding whose control arrangements are least clear. Trace an ordinary transfer, a change of authority, and loss of the usual participant through the people and procedures that would handle them. Where the answers diverge from the family’s intended control, resolve the difference before increasing the holding or relying on the arrangement for continuity.

Sources