Crypto Treasury Management: Policies, Custody and Controls
Crypto treasury management explained: how to write policies, choose custody, and set approval controls for company stablecoin balances and digital assets.
In this article
Crypto treasury management is the set of written rules, custody arrangements and approval controls a business uses to hold and move digital assets, including stablecoins. It answers four questions in advance: who may hold keys, who may approve a payment, where funds sit, and what happens when something goes wrong. Without those answers, a company is not running a treasury. It is running an informal wallet with a shared password.
For most finance teams, the practical scope is narrower than the phrase suggests. It rarely means trading. It usually means holding stablecoin balances for payroll and vendor payments, converting between fiat and stablecoins, and keeping records that survive an audit.
What a crypto treasury policy needs to cover
A crypto treasury policy is the written document that governs the above. It should be short enough that a new finance hire can read it in one sitting, and specific enough that a controller can apply it without asking for an exception. The sections below are the ones auditors and boards tend to ask about first.
Scope and approved assets
Name the assets the treasury may hold. Most businesses limit this to one or two stablecoins plus the fiat currency in the operating account. State the issuer or reserve standard you accept, and put anything outside that list behind a written exception approved by the CFO or board.
Roles and approval limits
Separate three roles: the person who initiates a payment, the person who approves it, and the person who holds custody access. No single person should hold all three. Set dollar thresholds in the policy, for example dual approval above a fixed amount, and keep the thresholds in the same document so they are easy to audit.
Counterparty and conversion rules
Define which exchanges, custodians or payment providers are approved, and what due diligence is required before adding a new one. Cover how conversions between fiat and stablecoins are priced, who may execute them, and how the rate is documented. Also state the rule for paying vendors in stablecoins: which chains are accepted, who absorbs network fees, and what happens if a payment is returned.
Recordkeeping and reporting
Every movement should produce a record that ties to the general ledger. That means a transaction ID, the wallet or account, the business purpose, the approver and the fiat value at the time of the transaction. Decide in advance how you value holdings at period end, and write it down, because the choice affects reported balances.
Custody models and how to choose one
Custody is where most crypto treasury failures actually happen. The choice is not binary. It is a trade-off between control, convenience and the size of the balance at risk.
| Model | Best fit | Main trade-off |
|---|---|---|
| Self-custody with multi-signature wallets | Firms with in-house technical capacity and larger balances | Full control, but key management and recovery are entirely your problem |
| Qualified third-party custodian | Teams that need segregation, insurance or an audit trail without running infrastructure | Counterparty and fee exposure; you depend on their withdrawal terms |
| Exchange or payment provider account | Small operating balances used for payroll and vendor payments | Fast to set up, but you hold a claim on the provider, not the asset itself |
| Hybrid: cold storage plus a hot operating float | Most businesses once volumes grow | Two systems to reconcile and two sets of controls to maintain |
A workable pattern for many teams is to keep only the next payroll cycle in a hot wallet and move the rest to a multi-signature or custodial account. The policy should state the maximum operating float and who may top it up. When you evaluate a custodian, ask where the assets are legally held, what happens in an insolvency, how withdrawals are authorized, and whether the arrangement has been independently examined.
Controls that matter in daily operations
Controls are the routines that make the policy real. They should be boring, repeatable and documented, because their value shows up during an audit or a dispute, not during normal weeks.
- Whitelisted withdrawal addresses, changed only through a dual-approval process.
- Hardware-backed keys for any wallet holding more than the operating float.
- A tested recovery plan: at least two people know how to restore access, and the process has been rehearsed.
- Daily reconciliation between the wallet balance, the payment provider and the ledger.
- Segregated duties so the person who prepares payroll cannot also release it.
- A log of every policy exception, with the approver and the reason.
Network selection is a control too. Choose one chain per payment run where possible, confirm the recipient's address format before sending, and require a small test transfer for new payees. These steps cost minutes and prevent the losses that are hardest to recover.
A worked example: one payroll cycle
The numbers below are illustrative, not benchmarks. Suppose a company runs a monthly stablecoin payroll of 120,000 for 40 contractors. Funds sit with a qualified custodian, and a hot wallet holds only the upcoming run.
- On day one, finance confirms the contractor list and total in the ledger.
- A treasury analyst initiates a transfer from custody to the hot wallet and a second approver releases it.
- Payroll is loaded as a batch; anything above the dual-approval threshold requires two signers.
- The batch is sent on the approved chain, and each transaction ID is logged against the contractor record.
- On day two, the controller reconciles the wallet, the batch report and the ledger, then documents any failed payments and their retry date.
- Any remaining hot-wallet balance above the float limit is swept back to custody.
The value is in steps two and five. The first removes single-person control over funds. The second creates the audit trail that makes the whole cycle defensible.
Common mistakes
Most problems trace back to a handful of gaps. A policy written once and never reviewed as volumes grow. Custody concentrated in one person who happens to understand wallets. No rule for who may approve a conversion, so rates go undocumented. Treating the exchange balance as cash without checking the provider's terms. And no rehearsal of what happens if a key holder leaves the company, which turns a staffing change into an access crisis.
Regulatory treatment of stablecoins and digital assets varies by jurisdiction and is still changing. In the US, for example, federal and state rules on custody and money transmission differ, so confirm the current position with the relevant regulator and a qualified adviser before finalizing your policy.
Practical takeaway
Start with one document. Write the crypto treasury policy first, even a two-page version: approved assets, roles, approval limits, custody model and reconciliation routine. Then implement the controls that support it, beginning with separation of duties and whitelisted addresses. Review the policy quarterly and after any incident. Teams that begin with a working float and a written rule set scale more safely than teams that begin with a large balance and good intentions. For teams running contractor payments, the same approval and recordkeeping discipline applies to any stablecoin payroll workflow.
This article is general information, not financial, legal or tax advice.
