From custody to capital management: Building a robust digital asset treasury

The forward-thinking Digital Asset Treasury is no longer a "fringe consideration," but a crucial evolution for modern enterprises seeking to optimize operational efficiency, enhance yield, and mitigate macro-financial risks.

Recent advancements in regulatory clarity, coupled with a landmark accounting rule change by the Financial Accounting Standards Board (FASB), have provided the foundational confidence needed for broader institutional adoption. This shift empowers treasuries to move beyond traditional cash management, evolving into proactive engines of growth and value creation.

This comprehensive guide delves into the three core pillars essential for constructing a resilient and future-proof Digital Asset Treasury:

1. Strategic imperative - Why digital assets belong on balance sheets.
2. Fortified foundations - Security architecture and custody frameworks.
3. Masterful management - Risk frameworks, governance, and operational excellence.

By embracing these principles, financial professionals can confidently integrate digital assets, transforming potential risks into strategic advantages.

The strategic Imperative: Why digital assets belong on your balance sheet

The decision to incorporate digital assets into a corporate or institutional balance sheet is a testament to their growing strategic value, offering compelling benefits in operational efficiency, yield enhancement, and macro-financial risk mitigation.

For years, digital assets were often associated with speculative trading. Today, their practical applications are proving transformative for treasury functions:

• Optimizing payments and working capital: Stablecoins like USDC enable near-instant, low-cost cross-border payments, reducing settlement times and FX overhead. In 2024, stablecoins processed $35 trillion in transaction volume—surpassing Visa—underscoring their importance in global finance.
• Enhancing yield on Idle cash: Idle cash reserves can be deployed into U.S. Treasury-backed stablecoins or tokenized bonds, offering 4–5%+ yields with sovereign-grade security. By mid-2025, tokenized Treasuries in circulation exceeded $7.5 billion, up from just $100 million in 2023.
• Hedging against inflation and currency devaluation: Bitcoin and gold were the top-performing assets of 2025, both seen as hedges against inflation and currency devaluation. Allocating a portion of treasury reserves into Bitcoin provides diversification and convex return potential.

A significant catalyst for institutional and corporate adoption of digital assets has been the progression towards clear regulatory frameworks and favorable accounting standards:

• FASB's fair market value accounting: Previously, crypto holdings were often treated as intangible assets subject to impairment, which was a disincentive for corporate treasuries. A pivotal rule change by the Financial Accounting Standards Board (FASB) now permits corporations to use fair market value accounting for crypto holdings. This allows for assets to be revalued each reporting period, providing a more accurate reflection of their value on the balance sheet and transforming the treasury function into a growth enabler.
• Evolving regulatory landscape: The regulatory environment, while still maturing, is providing increasing clarity. Initiatives like the Responsible Financial Innovation Act (RFIA) in the U.S. and the Markets in Crypto-Assets Regulation (MiCAR) in Europe are establishing clear legal frameworks for digital assets. These developments, coupled with pending legislation like the US GENIUS Act for stablecoins, are building confidence for institutional engagement. This regulatory evolution ensures that a Digital Asset Treasury can operate within defined legal boundaries, mitigating uncertainty.

Fortifying the foundation: Essential security & custody for digital assets

At the heart of any successful digital asset treasury lies an impenetrable security architecture and a robust custody strategy. Given the irreversible nature of blockchain transactions and the constant threat landscape, safeguarding cryptographic private keys is paramount.

Enterprises face a fundamental choice: in-house (self-custody) or outsourced (third-party custody).

• Self-custody offers maximum control and privacy, as the company directly manages its private keys, often using hardware security modules (HSMs) or Multi-Party Computation (MPC) systems. However, this places the entire burden of security, compliance, and disaster recovery squarely on the firm, demanding deep internal expertise and significant operational resources.
• Outsourced custody leverages specialized, regulated third-party custodians (e.g., trust companies, banks) that provide institutional-grade security, audited controls, and often insurance coverage. This approach significantly reduces the operational complexity and cyber risk for the enterprise, offering peace of mind and accelerating time-to-market.

For most mid-to-large enterprises, a hybrid operating model is the recommended best practice. This involves maintaining a small, highly skilled internal team for strategic oversight, governance, and policy setting, while entrusting the core technical responsibility of custody to a qualified, regulated third-party custodian. This model balances the desire for control with the necessity for professional security and compliance, ensuring assets are protected without stifling agility.

Within the chosen custody model, the account structure is critical:

• Segregated accounts are considered best practice, ensuring each client’s assets are held in a separate, dedicated wallet with distinct cryptographic keys. This provides irrefutable on-chain proof of ownership and significantly mitigates counterparty risk – a crucial lesson learned from failures like the FTX exchange, where user funds were commingled.
• Omnibus accounts, where funds from multiple customers are commingled, may offer marginal operational efficiencies but introduce substantial legal and financial risks.

Robust security for digital assets relies on a multi-layered approach, employing advanced cryptographic techniques and disciplined operational procedures.

Multi-Party Computation (MPC) vs. Multi-Signature (Multisig): Both technologies are designed to eliminate single points of failure in private key management.


• Multisig wallets require a predetermined number of distinct private keys (e.g., 3-of-5) to sign a transaction. This process is transparent on-chain and highly auditable, but can be slower due to the manual coordination required between multiple individuals. It’s well-suited for critical, strategic reserves where deliberation is prioritized.
• MPC cryptography, by contrast, splits a single private key into encrypted shares, where the complete key never exists in one location. Transactions are signed through a coordinated computation that requires a threshold of shares, offering superior speed, flexibility, and scalability for high-volume, automated operations. Leading custody platforms widely leverage MPC to enhance security and streamline workflows. A dual approach, using multisig for infrequent, large-value strategic transactions and MPC for high-frequency operational flows, can provide an optimal balance.

Tiered Liquidity Model (T0/T1/T2): Effective Digital Asset Treasury management necessitates segmenting assets based on liquidity needs, risk tolerance, and time horizons.


• Tier 0 (T0) - Operational liquidity: Minimal funds for immediate, same-day operations, such as instant cross-border payments. These reside in hot wallets (online and highly accessible) with strict spending limits and 24/7 monitoring due to their higher exposure to cyberattacks.
• Tier 1 (T1) - Active reserves: Funds needed for near-term liquidity (e.g., 1–2 weeks), covering working capital, payroll, or topping up hot wallets. These are held in warm wallets (semi-offline or MPC-protected, requiring multiple approvals) that balance security with same-day accessibility.
• Tier 2 (T2) - Strategic reserves: The vast majority of assets (e.g., 80%) are allocated for long-term holdings or strategic investments. These are secured in cold storage (fully offline, air-gapped devices or physical vaults) for maximum protection, with access potentially requiring days of lead time through formal key ceremonies. Regular rebalancing between these tiers is crucial to optimize for both security and liquidity, ensuring that sufficient funds are available for operations while minimizing exposure for larger reserves.

Additional security controls:


• Hardware Security Modules (HSMs): Tamper-resistant physical devices that generate and store cryptographic keys in an isolated environment, preventing private keys from ever leaving the device during signing requests.
• Key ceremonies: Highly disciplined, auditable procedures for securely generating, distributing, and backing up keys, often involving multiple participants and independent witnesses.
• Allow-lists and quorum policies: Enforcing whitelists for outbound transfers ensures funds can only be sent to pre-approved addresses, while quorum policies (multi-party approvals) for any policy changes provide an additional layer of defense against unauthorized activity.

While robust technical controls are paramount, insurance serves as a crucial backstop for digital asset custody, albeit with specific nuances in a still-maturing market.


• Types of coverage: The primary policy types are Specie insurance (covering physical loss or damage of private key materials, like theft of a hardware module) and crime insurance (covering digital asset theft via hacking, fraud, or insider electronic fraud). Errors & omissions (E&O) insurance is also relevant for service providers or those managing crypto for others.
• Limitations and exclusions: It’s critical to understand that insurance capacity in the crypto space is limited, with policy limits typically representing only a fraction of assets held. Policies often exclude losses from market fluctuations, Ponzi schemes, state-sponsored hacks, or catastrophic systemic events. No policies exist to protect individuals or firms that retain private keys themselves without a robust internal program. Treasury professionals must conduct thorough due diligence on a custodian's insurance, verifying underwriters, exact coverage/exclusions, and the custodian’s continuous insurance track record. Insurance is a vital layer of risk mitigation but should never be a substitute for strong technical controls and diligent oversight.

Masterful management: Risk frameworks and operational excellence

Integrating digital assets introduces a unique and complex spectrum of risks that demand sophisticated management frameworks. A proactive Digital Asset Treasury requires a bespoke risk taxonomy, structured operational controls, and quantitative analysis to navigate this evolving landscape.

An effective risk taxonomy, often overseen by a Board Risk Committee, is crucial for identifying and assessing threats:

• Market risk: The risk of asset price volatility, encompassing price risk, volatility risk, and interest rate risk for yield-bearing tokens. This also includes depegging risk for stablecoins, where a stablecoin could lose its 1:1 peg to its underlying fiat currency due to reserve concerns or market panic.
• Liquidity risk: The risk that the company cannot liquidate digital assets or obtain funds in time to meet obligations without significant slippage. This includes lock-up periods for staked assets or the risk of frozen markets during crises.
• Counterparty risk: The risk of loss from a third party (e.g., exchange, custodian, lending platform) failing to fullfill its obligations. The collapses of major exchanges and lenders in 2022–2023 starkly highlighted this risk, emphasizing the need for rigorous due diligence and exposure limits.
• Custody/operational risk: The existential risk of loss or theft of private keys, or failure of a custodian. This extends to procedural errors, inadequate backups, human error (e.g., sending funds to the wrong address irreversibly), and insider threats.
• Cybersecurity risk: The risk of hacks, malware, phishing, or unauthorized system access leading to theft or disruption. This can target keys, trading systems, or API access.
• Smart contract and technical risk: If using decentralized protocols, there's a risk of smart contract bugs, exploits, or blockchain outages. Bridge risk, often considered a subset of smart contract risk, is particularly significant due to the history of large exploits.
• AML/sanctions risk: The risk of regulatory or legal consequences if digital asset flows are associated with money laundering, terrorist financing, or sanctioned entities. Compliance with regulations like the FATF Travel Rule and OFAC sanctions lists is vital, requiring robust blockchain monitoring.
• Regulatory/legal risk: The risk that changing laws or regulations adversely affect the operations or value of digital assets, including asset classification uncertainty (e.g., a token being deemed a security) or new licensing requirements.
• Concentration risk: The vulnerability of a treasury being over-exposed to a single asset, a single blockchain network, or a single custody provider. A 2022 study noted that 85% of decentralized autonomous organizations (DAOs) stored their entire treasury in a single crypto asset, illustrating this risk.

Operationalizing controls: The three lines of defence and SoD

To manage these diverse risks, a comprehensive control library and a clear organizational structure are indispensable. The "Three Lines of Defence" governance model, adapted for digital assets, defines clear roles and responsibilities:

• First line of defence (operations): The treasury and engineering teams are responsible for the day-to-day execution of digital asset strategies, including managing liquidity, initiating trades, and operational security of wallet infrastructure. They are accountable for adhering to established risk limits.
• Second line of defence (oversight): The risk management, compliance, and security teams set the rules and provide oversight. This includes developing the crypto risk framework, monitoring risk metrics, conducting due diligence on new assets/platforms, ensuring regulatory compliance (e.g., Travel Rule), and enforcing cybersecurity controls. They provide independent challenges to the first line.
• Third line of defence (assurance): Internal audit provides independent assurance that controls and policies are effective and being followed. They conduct periodic reviews, test incident response plans, and report findings to the Audit/Risk Committee of the Board.

A core tenet within this framework is Segregation of Duties (SoD), ensuring no single individual can unilaterally control an entire transaction. This means separating roles for initiating, approving, and executing transactions, and ensuring the person reconciling transactions is distinct from those who executed them. This greatly mitigates fraud and error.

• Board-approved governance & policy framework: Defines approved asset types, risk limits (e.g., max % allocation, VaR limits), and authorized activities.
• Approval flows and multi-party authorization: All transactions should require multi-party approval, with tiered limits for different transaction sizes, technically enforced via M-of-N wallet policies.
• Whitelists/address restrictions: Maintaining an allow-list of pre-approved addresses for outbound transfers acts as a critical preventive control against misdirected funds or malicious attacks.
• Anomaly detection & continuous monitoring: Real-time monitoring of blockchain transactions and system logs, coupled with automated alerts (e.g., via Chainalysis or TRM), is crucial for catching suspicious activity and responding quickly.
• Break-glass procedures: Predefined emergency access protocols that override normal processes to protect assets in extreme scenarios, such as a confirmed key compromise.
• Travel rule compliance & AML controls: Implementing solutions to transmit required sender/receiver information for large transfers between financial institutions and utilizing blockchain analytics for source-of-funds screening are essential for regulatory compliance and mitigating illicit finance risk.
• Operational runbooks: Detailed, step-by-step checklists for crypto-specific events like wallet policy changes, key compromises, chain migrations, and forks/airdrops. These ensure rapid, consistent, and effective responses during high-pressure situations.

Quantitative risk management: VaR, stress testing, and liquidity ladders

Beyond qualitative controls, the Digital Asset Treasury must employ quantitative techniques adapted from traditional finance to measure and manage crypto risks:

• Value-at-risk (VaR): Calculating VaR for the digital asset portfolio helps understand potential losses under normal market conditions. Given crypto's extreme volatility (average 30-day volatility for some assets can be 96%), this often requires fat-tail aware models and shorter horizons. While useful for trend analysis, VaR models should be complemented by stress tests due to the unique market dynamics.
• Stress testing: Developing stress scenarios is paramount for modeling portfolio behavior under extreme but plausible conditions. Scenarios like a "Crypto Winter Crash" (e.g., major coin prices drop 60%, a stablecoin depegs to $0.80, a major exchange halts withdrawals) or a "Cyberattack Scenario" help forecast losses, liquidity needs, and operational impacts. Stablecoin stress testing is particularly important, assessing a treasury's ability to meet obligations if a stablecoin temporarily breaks its peg.
• Liquidity ladder & coverage ratios: A liquidity ladder maps future cash needs against available liquid assets over various time buckets, integrating crypto treasury forecasts with overall cash flow projections. The Liquidity Coverage Ratio (LCR) for crypto (high-quality liquid crypto assets divided by projected short-term outflows) ensures the treasury is not overextended and maintains sufficient liquidity buffers. This analysis should incorporate potential slippage for larger liquidation events.

Charting your course in the digital asset economy

The journey to establishing a mature and effective Digital Asset Treasury is a multi-phased endeavor, beginning with foundational custody and progressing to full-spectrum capital management. The current environment—marked by increasing regulatory clarity, innovative accounting standards, and compelling operational benefits—presents a unique opportunity for institutional investors, family offices, UHNWIs, and asset managers to strategically integrate digital assets.

By focusing on the three insights explored: recognizing the strategic imperative of digital assets for efficiency and yield, building a fortified foundation with hybrid custody and multi-layered security, and implementing masterful management through comprehensive risk frameworks and disciplined operations, your organization can confidently navigate this evolving landscape.

The shift from a back-office compliance function to a growth enabler is a core trend in modern treasury management. A well-structured Digital Asset Treasury not only safeguards capital but also unlocks new revenue streams, optimizes global payments, and provides crucial diversification against macro-financial risks. This journey requires a disciplined, incremental implementation approach, allowing for the mitigation of risk while building internal expertise and trust.

Are you ready to transform your treasury into a strategic advantage in the digital asset economy? Engage with our experts to develop a bespoke roadmap, ensuring your institution is prepared to capitalize on the opportunities that digital assets offer, driving both resilience and long-term value.