Public companies should separate custody from trading, use regulated institutional custody where possible, and enforce multi-party approval, segregation of duties, and tightly scoped key access. Private keys and recovery material should be held in hardware-backed or offline controls, with formal rotation, backup, incident recovery, and named accountability for every wallet and signing authority.
Why custody design matters more than treasury yield assumptions
For public companies, the custody decision is not just an operational choice, it is a control boundary. If trading, execution, custody, and wallet administration sit in the same hands, one failure can become both a market loss and a key compromise event. The safest structure makes custody an independently governed control layer, with clear ownership over keys, approvals, recovery, and exception handling.
That separation is easiest to defend when treasury policy treats custody as a risk function rather than a convenience feature. Use an institutional model where possible, but make the control objective explicit: no single person, desk, or vendor workflow should be able to move assets and alter signing authority without review.
Separating execution from custody is also where the chain of accountability starts. When a wallet or account can be signed, moved, recovered, or reconfigured by the same group that decides trades, incident response becomes much harder because the evidence trail and authority trail are merged.
How to reduce key management risk in practice
The strongest control pattern is layered: hardware-backed or offline key storage, multi-party approval for sensitive actions, segregation of duties across treasury and operations, and documented ownership for each wallet and signer. That structure reduces both external compromise risk and internal misuse, because it makes a single credential or a single insider decision insufficient on its own.
Key management should follow a formal lifecycle, not an ad hoc vaulting approach. Keys and recovery material need controlled issuance, storage, rotation, backup, revocation, and destruction rules, with clear thresholds for when a wallet must be rekeyed after compromise, personnel change, or custody-provider change. For the key lifecycle itself, NIST SP 800-57 Key Management is the most direct external reference for lifecycle, cryptoperiods, and key handling discipline.
When companies need a practical implementation lens, use a policy that spells out who may act as key custodian, what dual control means for the treasury process, and how recovery material is protected. NHIMG’s Cryptographic Key Management Policy Template maps that operating model into day-to-day governance, while the Cryptographic Key Management Guide covers hardware-backed storage, rotation, and compromise handling in more depth.
Public-company treasury teams also need to think beyond the happy path. Recovery procedures should be tested before a crisis, and backup material should be protected with the same seriousness as production keys, because the backup often becomes the weakest route into the wallet structure. If a signer can be replaced or restored too easily, the recovery design itself becomes an attack path.
Where counterparty and access risk usually concentrates
The main concentration points are custody-provider dependency, overprivileged signers, and weak offboarding. A regulated custodian can reduce operational burden, but it also creates concentration risk if the company has no clear fallback, no exit plan, or no internal evidence that the custodian’s controls match the company’s own risk tolerance.
Key exposure often becomes visible only after something changes, such as an employee leaving, a signing workflow being reconfigured, or a provider relationship being reset. NHIMG’s Coupang Signing Key Breach is a reminder that delayed revocation and poor credential lifecycle control can turn routine offboarding into large-scale exposure. The operational lesson is simple: if a wallet, recovery path, or signing authority is tied to a person or role, its removal must be immediate and provable.
That same principle applies to treasury systems that depend on cloud vaults, exchange accounts, or third-party signing services. The more the organisation relies on external control planes, the more important it becomes to verify segregation, logging, approval gates, and recovery independence before capital is committed. For a custody-specific perspective on wallet keys, multisig, and institutional controls, Crypto Exchange Identity and Key Security Guide is useful even outside exchange environments because it focuses on signing authority, transaction verification, and custody segregation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management Recommendations | Directly governs cryptographic key lifecycle and recovery discipline for treasury custody. |
| Recommendation — Apply key lifecycle rules for generation, storage, rotation, backup, and destruction. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle control for signing credentials and recovery material used to authorize treasury actions. |
| AC-6 — Least Privilege | Supports tightly scoped signing authority and reduced counterparty blast radius. | |
| Recommendation — Enforce rotation, protection, and revocation rules for wallet-related credentials. Limit wallet and recovery privileges to the minimum required for treasury operations. | ||
| CIS Controls v8 | CIS-5 — Account Management | Addresses ownership, offboarding, and privileged access lifecycle around signing authorities. |
| Recommendation — Maintain named ownership and promptly remove stale wallet access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Supports governed access boundaries for custody operations and wallet administration. |
| Recommendation — Define and enforce formal access rules for custody administration. | ||
Practitioner Guidance
What to verify: Confirm that no production wallet can be both initiated and approved by the same actor, that recovery material is separately protected, and that every signer has a named business owner. If the company cannot prove who can move funds, who can restore access, and who can revoke authority, the custody design is not mature enough for public-company use.
Decision rule: If the organisation cannot enforce multi-party approval and offline or hardware-backed key protection, reduce the scope of assets under that custody model until the control gap is closed. Do not compensate for weak custody with extra monitoring alone, because detection does not undo irreversible signing.
What to measure: Track the percentage of wallets with documented owners, the number of privileged signers per wallet, the age of unreconciled recovery material, and the time required to revoke or rotate a compromised signer. Those measures show whether governance is real or merely documented.
Practitioner takeaway: The key question is not whether custody is outsourced, it is whether the company can still prove segregation, recovery, and revocation when the money or the signer path is under stress.