A custody model is struggling when compliance teams repeatedly block transactions, operational workflows require too much manual approval, or institutions avoid staking and other network functions because the process feels too risky. Another warning sign is when teams cannot clearly explain who can access keys, how access is approved, or how the reporting trail is maintained.
How to read the warning signs of a custody model that is breaking down
A custody model is not working when it stops producing clear, repeatable decisions about who can act, when approval is needed, and how evidence is captured. The first signal is usually friction, but the more important signal is inconsistency: the process behaves differently across desks, assets, or workflows, which tells you the model is no longer governing risk in a predictable way.
Another practical sign is that custody controls become compensating controls for poor design instead of a stable operating model. If teams routinely depend on manual exceptions, side agreements, or informal knowledge to move assets, the custody structure is absorbing complexity rather than reducing it. That is a governance failure as much as an operational one.
For crypto custody specifically, the model should make access boundaries, approval paths, and reporting trails easy to explain and hard to bypass. When those basics become hard to describe, the model is usually too dependent on people remembering the process rather than on a control environment that enforces it.
- Ultimate Guide to Non-Human Identities is a useful reference for the lifecycle and visibility problems that emerge when access paths are not governed clearly.
- NIST Cybersecurity Framework 2.0 helps frame custody as a govern, identify, protect, detect, respond, and recover problem rather than only an operations issue.
Where the control model usually fails in practice
The most common failure modes are approval bottlenecks, overreliance on manual review, and unclear segregation of duties. If every movement requires human intervention, the model may be safe on paper but brittle in practice, because latency encourages workarounds and exceptions. If the process is so restrictive that people avoid legitimate actions like staking or rebalancing, the model is overcorrecting for risk instead of managing it.
Weak custody models also show up in the reporting layer. If teams cannot reconcile who approved access, who used it, and whether the event trail is complete, then governance is effectively incomplete even if the underlying wallet or key infrastructure is technically intact. In mature custody environments, the audit trail is not a nice-to-have, it is part of the control itself.
Operationally, a custody model should be judged by whether it supports the intended business use case without forcing constant exception handling. If the system cannot support routine transactions, permissions reviews, or network participation without bespoke handling, the model is not aligned to the institution’s operating reality.
- NIST SP 800-57 Key Management is useful for thinking about lifecycle discipline around cryptographic material and approval boundaries.
- Microsoft Azure Key Breach illustrates how key exposure can undermine trust in a custody or signing model when the control boundary is not resilient.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV — Govern | Custody breakdown is a governance and accountability problem. |
| ID — Identify | The answer depends on knowing who can access keys and how the trail is maintained. | |
| PR.AA — Identity Management, Authentication, and Access Control | Custody failure often appears as unclear or excessive access to signing material. | |
| Recommendation — Define custody ownership, approval authority, and exception handling under governance. Inventory custodial assets, access paths, and accountable parties. Enforce access control and approval boundaries for custodial key use. | ||
| CIS Controls v8 | 6 — Access Control Management | The signs involve excessive manual approvals and unclear access enforcement. |
| 8 — Audit Log Management | The reporting trail is a core indicator of whether custody is working. | |
| Recommendation — Limit and review custodial access paths and remove informal exceptions. Record and retain custody approvals, key use, and transaction evidence. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Custody governance depends on reliable assurance about who is authorized to act. |
| AAL — Authenticator Assurance Level | Custody paths rely on strong authentication before sensitive actions proceed. | |
| Recommendation — Set assurance requirements for users who can approve or execute custodial actions. Use strong authenticators for custodial approval and signing workflows. | ||
Practitioner Guidance
What to verify: Test whether an ordinary transaction can be executed, approved, and evidenced without a human having to “know the system” beyond the documented process. If the model only works for a small group of insiders, it is already too fragile.
Decision rule: If approvals are blocking more legitimate activity than they are preventing unsafe activity, the custody design is too coarse. Tighten the approval policy where exposure is material, but simplify the path where the risk does not justify repeated manual intervention.
What practitioners underestimate: A custody model can be technically secure and still fail commercially if it pushes users away from core network functions. The right question is not whether the model is strict, but whether it is strict in the places that actually change loss exposure.
Practitioner takeaway: The best custody model is one that makes safe action straightforward and risky action visible; once teams need tribal knowledge to explain access, approval, or evidence, the control model has started to break down.
