If your business holds crypto — as treasury, as payment, as investment — and you do not have a documented custody plan, you have a problem you may not know about yet.
The gap nobody talks about
741 million people own crypto wallets globally (Crypto.com). A growing share of them are businesses: funds, treasuries, DAOs, startups accepting crypto payments, and companies holding Bitcoin on their balance sheet.
200+ public companies now disclose Bitcoin reserves totaling over $110 billion (Bitbo). Behind each one is a custody arrangement. Most of them were designed by engineers, not governance professionals.
The result: 61% of institutional crypto holders use multiple custodians, but manage them through spreadsheets and Slack messages (EY / Coinbase Institutional Investor Survey). No unified approval workflow. No single audit trail. No documented succession plan.
If someone at your company can move $500,000 in crypto by themselves, and there is no written policy governing who approves what — you do not have a custody solution. You have a liability.
Three questions your business needs to answer
Before evaluating any custody technology, answer these three questions. They determine everything else.
1. Who can move assets?
In traditional banking, this is straightforward. Authorized signatories are filed with the bank. Dual authorization is standard for large transfers.
In crypto, there is no bank enforcing your policies. If someone has the private key, they can move all assets instantly, irreversibly, at 3 AM on a Sunday. There is no reversal, no chargeback, no fraud department to call.
Your custody solution must enforce authorization thresholds — not as a guideline, but as a cryptographic guarantee. A 2-of-3 multisig means no single person can move funds, period. Not even the CEO.
2. What happens when someone leaves?
Employees leave. Co-founders fall out. Key personnel get hit by buses. If your crypto access depends on any single person, you have a single point of failure.
QuadrigaCX: The sole key holder died. C$215.7 million became permanently inaccessible (Ontario Securities Commission).
Your custody arrangement needs: key rotation when someone leaves, recovery procedures that do not depend on any individual, and a succession plan that is documented and tested — not stored in someone's head.
3. What happens when something goes wrong?
$3.4 billion in crypto was stolen in 2025 (Chainalysis). Recovery rate: approximately 8% (PeckShield).
If an employee's device is compromised, if a smart contract has a vulnerability, if a custodian goes bankrupt — what is your recovery plan?
FTX held $8 billion in customer assets with no segregation. When it collapsed, customers became unsecured creditors (CFTC). Your custody arrangement must guarantee asset segregation, and that guarantee must be independently audited.
Custody options for businesses — honest comparison
There are four practical approaches. Each makes sense at a different stage.
Consumer wallets (MetaMask, Coinbase, Ledger)
| Factor | Reality |
|---|---|
| Cost | Free to $150 |
| Setup time | Minutes |
| Multi-user approval | No |
| Audit trail | No |
| Key recovery if holder leaves | Manual (move assets to new wallet) |
| Regulatory compliance | Insufficient for most jurisdictions |
| Appropriate for | Testing, small petty-cash amounts under $10K |
Bottom line: Consumer wallets are designed for individuals. They have no concept of organizational roles, approval workflows, or access revocation. If your business relies on a MetaMask wallet controlled by one person, you are one compromised seed phrase away from losing everything.
Multisig wallets (Safe, Electrum, native Bitcoin multisig)
| Factor | Reality |
|---|---|
| Cost | Free to $100/month |
| Setup time | Hours to days |
| Multi-user approval | Yes (2-of-3, 3-of-5, etc.) |
| Audit trail | On-chain (public) |
| Key recovery if holder leaves | Replace signer, rotate keys |
| Regulatory compliance | Partial (audit trail exists, but no built-in compliance tools) |
| Appropriate for | $10K-$1M, teams of 2-5, DAOs, startups |
Bottom line: Multisig is the most accessible business-grade custody option. Safe (formerly Gnosis Safe) secures over $100 billion in digital assets (Safe). The limitation is that governance lives on-chain and is visible to everyone. For some businesses, this is fine. For others, it exposes operational details they would prefer to keep private.
MPC (Multi-Party Computation) platforms
| Factor | Reality |
|---|---|
| Cost | $1,000-$10,000/month (mid-market); $50,000-$100,000+/year (enterprise) |
| Setup time | Days to weeks |
| Multi-user approval | Yes, with policy engine |
| Audit trail | Off-chain (private) + on-chain |
| Key recovery if holder leaves | Re-share key fragments without moving assets |
| Regulatory compliance | Built-in compliance tools, SOC 2, ISO 27001 |
| Appropriate for | $1M-$100M+, regulated businesses, funds, family offices |
Bottom line: MPC splits private keys into fragments distributed across multiple parties. No single party ever holds the complete key. Key rotation and recovery can happen without moving assets on-chain. This is the institutional standard — but enterprise MPC platforms (Fireblocks, Cobo, BitGo) are priced for enterprises. The mid-market ($500K-$10M in holdings) is underserved. For a deeper technical comparison, see our guide on crypto custody solutions for institutions.
Third-party custodians (Coinbase Custody, Anchorage, Fidelity Digital Assets)
| Factor | Reality |
|---|---|
| Cost | 0.05%-0.50% of assets annually + transaction fees |
| Setup time | Weeks to months (KYC/KYB required) |
| Multi-user approval | Varies by provider |
| Audit trail | Yes (provider-managed) |
| Key recovery if holder leaves | Managed by custodian |
| Regulatory compliance | Full (regulated entities) |
| Appropriate for | $10M+, businesses requiring regulatory compliance, banks |
Bottom line: Third-party custodians are the closest model to traditional banking. You delegate key management to a regulated entity. The trade-off: you depend on the custodian's security and solvency. Verify asset segregation, insurance coverage, and what happens in bankruptcy. The crypto insurance market reached $9.49 billion in 2025 (Grand View Research), but coverage typically covers only a fraction of assets under custody.
The mid-market gap
If your business holds between $500,000 and $10 million in crypto, you are in the most underserved segment of the market.
- Consumer wallets are not enough — you need multi-user controls
- Enterprise platforms (Fireblocks, BitGo) start at $50,000-$100,000/year — too expensive
- Third-party custodians require $10M+ minimums for full service
- Multisig works but lacks policy enforcement, compliance reporting, and private governance
This is the "Fireblocks gap." You are too sophisticated for MetaMask, too small for enterprise MPC. The result: most mid-market businesses cobble together Safe multisigs + Google Sheets + manual Slack approvals. It works until it does not.
83% of institutional investors plan to increase their crypto allocations (EY / Coinbase Institutional Investor Survey 2025). The mid-market will grow. The tooling needs to catch up.
The governance checklist
Regardless of which custody technology you choose, your business needs documented answers to these questions:
Access control
- Who are the authorized signers?
- What is the approval threshold (e.g., 2-of-3)?
- Are there spending limits that require additional approvers?
- Is there a maximum single-transaction limit?
Key management
- Where are keys stored? (Hardware, cloud, MPC fragments?)
- Who has backup access?
- How often are keys rotated?
- What is the process when a key holder leaves the company?
Recovery and succession
- What happens if one key holder becomes unavailable?
- Is there a dead man's switch or time-locked recovery?
- Who is the backup signer?
- Is the recovery procedure tested regularly?
Compliance and reporting
- Is there a complete audit trail of all transactions?
- Can you produce transaction records for tax reporting?
- Does your custody arrangement meet the requirements of your jurisdiction?
- Are assets properly segregated from company operational funds?
Incident response
- What happens if a signer's device is compromised?
- Who do you contact? What is the response time?
- Is there a freeze mechanism for suspicious transactions?
- When did you last test your incident response plan?
If you cannot answer all of these questions, your custody arrangement has gaps. The technology does not matter if the governance is not there.
What regulations require
The regulatory landscape shifted dramatically in 2025-2026. Businesses holding crypto now face real compliance requirements in most major jurisdictions.
| Jurisdiction | Key requirement | Effective |
|---|---|---|
| United States | SAB 122 repealed accounting barriers for bank custody. OCC Letter 1183 authorized national banks for crypto custody. SEC No-Action Letter (Sep 2025) clarified broker-dealer obligations. IRS broker reporting starts 2026. | 2025-2026 |
| European Union | MiCA requires licensed custody providers, segregation of assets, and operational resilience standards. | Dec 2024 |
| Hong Kong | SFC licensing regime for virtual asset trading platforms. Stablecoin Ordinance (Aug 2025). | 2024-2025 |
| Singapore | MAS licensing under Payment Services Act. Upcoming custody-specific regulations. | 2024-2026 |
| UAE | VARA framework in Dubai. ADGM in Abu Dhabi. Comprehensive licensing for custody providers. | 2024-2025 |
The common thread across all jurisdictions: maintain a complete audit trail, ensure asset segregation, and have documented governance procedures. The era of informal crypto custody is ending.
For a detailed breakdown of regulatory requirements by jurisdiction, see our comprehensive custody solutions guide.
How to choose — a decision framework
Start with your situation, not with the technology.
| Your situation | Recommended approach | Monthly cost estimate |
|---|---|---|
| Solo founder, under $50K | Hardware wallet + documented seed phrase backup | $0 (after $150 hardware) |
| Small team (2-5), $50K-$500K | Multisig (Safe) with 2-of-3 threshold | $0-100 |
| Growing business, $500K-$5M | Multisig + MPC key management, or mid-market custody platform | $500-3,000 |
| Regulated entity, $5M-$50M | MPC platform with compliance tools | $3,000-8,000 |
| Institution, $50M+ | Enterprise MPC + third-party custodian | $8,000+ |
Notice: the recommendation is not based on technology preference. It is based on your business context — team size, asset value, regulatory requirements, and operational complexity.
As your business grows, your custody should evolve with it. A startup that begins with a Ledger and ends up with a full governance stack has done it right. The mistake is staying at a consumer-grade solution after you have outgrown it.
FAQ
Does my business need a crypto custodian?
If your business holds more than $50,000 in digital assets, or if more than one person needs to authorize transactions, a formal custody arrangement is strongly recommended. Below that threshold, a hardware wallet with documented key management procedures may be sufficient. The deciding factor is not the amount — it is the number of people and processes involved.
How much does crypto custody cost for a small business?
Self-custody with hardware wallets costs $150-500 upfront. Software-based multisig solutions are typically free or under $100/month. Third-party custodians charge 0.05%-0.50% of assets under custody annually, plus transaction fees. Enterprise MPC platforms start at $50,000-100,000/year. For businesses holding $500K-$10M, the sweet spot is usually a combination of multisig governance and MPC key management, costing $1,000-$5,000/month.
What happens to business crypto if the CEO leaves or dies?
Without a documented succession plan, assets may become permanently inaccessible. Every business holding crypto needs: a minimum 2-of-3 or 3-of-5 authorization threshold, documented key recovery procedures, and a time-locked recovery mechanism. This is the single most common point of failure for business crypto.
Can a business use a regular crypto wallet?
Technically yes, but it creates serious risks. Consumer wallets lack multi-user approval workflows, audit trails, spending limits, and role-based access. If an employee with wallet access leaves, there is no way to revoke their access without moving all assets. For any business with more than one person involved in crypto operations, a business-grade solution is necessary.
Do businesses need to report crypto holdings?
Yes, in most jurisdictions. In the US, businesses must report crypto on tax returns, with IRS broker reporting starting 2026. The EU's MiCA requires transaction records. Hong Kong's SFC requires proper custody arrangements. The key requirement everywhere: maintain a complete audit trail.
What is the safest custody option for business crypto?
There is no single safest option — safety depends on governance, not technology. A well-governed multisig is safer than a poorly-governed MPC system. The safest approach combines threshold authorization, documented recovery procedures, and regular security audits. Technology is the implementation detail. Governance is the foundation.
