Crypto platforms should separate customer assets from company operating funds, use properly governed custody arrangements, and publish proof of reserves with independent verification. The core control is simple: never treat customer deposits as working capital. Segregation, reconciliation, and transparent reporting reduce the chance that hidden losses, proprietary trading, or liquidity stress turn into customer harm.
How to Structure Deposits So Customer Money Cannot Be Treated as Operating Capital
The first control is legal and operational separation. Customer deposits should land in accounts and custody structures that are isolated from the platform’s own treasury, trading, and expense accounts, with explicit rules that prevent internal teams from using customer balances as liquidity. That separation needs to be enforceable in systems, reconciliations, and governance, not just stated in policy.
In practice, segregation only works when the platform can prove that customer balances map one-to-one to protected holdings and that any movement of funds requires a defined customer event, not a discretionary treasury decision. For platforms evaluating custody and account design, a structured vendor and control review such as NHIMG’s CIAM Buyer's Guide is useful because it frames how identity, access, and operational controls should be assessed before scale.
Segregation also changes the failure mode. If the platform suffers a loss, a trading error, or a short-term liquidity squeeze, customer deposits are not supposed to be part of the solvency buffer. That does not remove all risk, but it sharply reduces the chance that an internal problem becomes immediate customer harm.
What Proof of Reserves Must Actually Show Before Deposits Are Accepted
Proof of reserves is only useful if it is paired with liabilities, independent verification, and a clear reporting cadence. A simple balance snapshot is not enough, because it can hide encumbrances, borrowed assets, or mismatches between what the platform claims to hold and what customers are entitled to withdraw. Before deposit acceptance, the platform should be able to show that reserve reporting is timely, reproducible, and tied to customer liabilities.
Independent verification matters because the control is about trustworthiness, not marketing. If the platform controls the entire evidence chain, customers and counterparties cannot tell whether the reported reserves are complete or just selectively presented. External assurance should test both assets and the liability side of the equation, especially where the business model includes custody, lending, or proprietary activity.
Practically, the strongest proof of reserves programs are the ones that connect treasury, custody, and reconciliation data into a single operating view. That is where standards such as ISO/IEC 27001:2022 Information Security Management help, because they reinforce control ownership, evidence retention, and repeatable assurance over the systems that support reserve reporting.
Which Operating Controls Stop Hidden Losses From Becoming Deposit Fraud
Deposit fraud usually emerges when internal controls are too weak to detect commingling, fictitious balances, stale reconciliations, or unauthorized treasury movement. The platform needs daily or near-real-time reconciliation between customer ledger balances, on-chain or custody holdings, and internal settlement records. If those records do not match, deposits should not be accepted until the break is understood and contained.
Governance around access is just as important as accounting. The people who can move funds, adjust ledgers, or approve exceptions should have tightly bounded authority, strong approval separation, and auditable actions. In a cloud or custody environment, the relevant control families are access control, auditability, and configuration discipline, which is why NIST SP 800-53 Rev 5 Security and Privacy Controls remains a strong reference point for funding, ledger, and administrative control design.
Good operations also require clear triggers for pausing onboarding. If reconciliations are late, reserve attestations are stale, or there is unexplained movement between custody and treasury, the safer decision is to stop taking deposits until the discrepancy is resolved. That is the right choice even when it creates short-term business friction.
Risk and Threat Considerations
The main risk is that a platform can appear solvent while customer funds are already exposed through commingling, hidden liabilities, or unauthorized use. Once deposits are accepted into a weak control environment, customers may face delay, shortfall, or loss if internal losses, fraud, or liquidity stress surface later.
Failure mechanism: control failures in segregation, reconciliation, or access governance allow customer balances to be overstated, reused, or encumbered before anyone detects the mismatch.
Impact: customers may be unable to withdraw funds on demand, and the platform may face run risk, legal exposure, and loss of trust that can outlast the immediate incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Deposit segregation depends on controlled access to custody and treasury systems. |
| A.8.24 — Use of Cryptography | Reserves and custody attestations rely on protecting financial records and signing material. | |
| Recommendation — Restrict fund movement and ledger changes to approved, auditable roles. Protect reserve records and signing workflows with strong cryptographic controls. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limits who can move customer funds or alter reserve records. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Independent reserve verification depends on reviewable reconciliation and activity logs. | |
| IA-5 — Authenticator Management | High-risk treasury and custody actions depend on secure credential lifecycle control. | |
| Recommendation — Limit fund-transfer and ledger privileges to the minimum necessary. Review custody, ledger, and exception logs to detect mismatches quickly. Rotate and protect privileged credentials used for reserve and treasury operations. | ||
Practitioner Guidance
What to prioritise: require hard separation between customer balances and operating funds before the first deposit is accepted, then verify that the separation is enforced in systems rather than only in policy language. The control should fail closed if the reserve picture is incomplete.
What to verify: look for daily reconciliation, independent reserve confirmation, and a clear owner for exceptions. If any of those are missing, treat the platform as not ready for customer deposits, even if the product is otherwise launch-ready.
Practitioner takeaway: the real test is not whether a platform says customer assets are protected, but whether its accounting, custody, and access controls make misuse difficult, visible, and hard to sustain.
Related resources from NHI Mgmt Group
- How should crypto platforms reduce fraud risk when onboarding volumes spike during major market events?
- How should businesses reduce identity fraud risk before it reaches customer accounts?
- How should teams reduce the risk from overprivileged NHIs?
- How should delivery platforms reduce fraud without hurting customer conversion?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
