How can teams tell whether crypto custody controls are actually working?

What “working” looks like in crypto custody

Crypto custody controls are only working if they create a verifiable barrier between possession, movement, and approval. That means custody is not just “wallet access exists”, it is a controlled process with role separation, explicit authorisation, and evidence that every sensitive action was both intended and recorded. In practice, the question is whether the controls would still hold under pressure, not whether the procedure sounds sound on paper.

A good test is whether the system can prove who could do what, who actually did it, and whether any single actor could bypass review. If the answer to any of those is unclear, the control set is incomplete.

Which control evidence should teams check first?

Start with the points that are hardest to fake after the fact: segregation of duties, dual approval, custody logs, and immutable or strongly protected audit trails. These are the control surfaces that reveal whether a custody process has real friction and accountability, or whether approvals are just a formality.

Look for a clean sequence from seizure or receipt to storage, then to any authorised transfer. The most useful evidence is not a policy statement but a traceable chain that shows the asset, the approvers, the timestamps, the destination, and the reason for movement. Where custody involves key material or signing authority, the control should also prove that access is tightly limited and that privileged steps are independently reviewed, consistent with ISO/IEC 27001:2022 Information Security Management and NIST SP 800-53 Rev 5 Security and Privacy Controls.

For teams using custody runbooks or technical safeguards, the practical question is whether the logged evidence would still stand up if an incident review asked, “Who had authority, who approved, and what prevented unilateral movement?” If that chain breaks, the custody control is not demonstrably effective.

How do failures show up in day-to-day operations?

Weak custody usually appears as convenience winning over control. A single operator can retrieve wallet material, approvals are granted after the fact, logs are incomplete, or transfers happen without an independent witness. In those cases, the process may be busy but it is not controlled.

Teams should also watch for slow drift: exceptions that become routine, emergency access that never gets cleaned up, or log review that only happens when something already looks wrong. These are signs that the custody model is losing its ability to detect misuse before it becomes loss. Good custody discipline is closer to an access-control problem than a storage problem, which is why controls around privilege, logging, and account governance matter as much as the wallet itself, as reflected in CIS Controls v8 and CSA Cloud Controls Matrix.

Risk and Threat Considerations

Crypto custody fails when a control is “present” but not enforced, because that creates an easy path for insider misuse, stolen credentials, or unauthorised transfer. The main risk is not just loss of assets, but loss of provable control, which makes recovery, investigation, and accountability much harder.

Failure mechanism: Excess privilege, missing dual control, or incomplete auditability lets one actor obtain, move, or conceal custody material without independent review. Once that happens, the control chain no longer proves that transfers were authorised.

Impact: Asset theft, fraudulent transfer, disputed ownership, and failed incident reconstruction can follow, especially when the custody record does not show a defensible chain of evidence from seizure to storage to release.

Practitioner Guidance

What to verify: Confirm that no production custody path allows a single person to both access wallet material and authorise its movement. If the control design depends on “trusted operators” rather than enforced separation, treat it as a gap, not a safeguard.

What good looks like: The best signal is a custody workflow where each sensitive step leaves a complete record, approvals are independent, and transfers can be reconstructed without relying on memory or informal chat logs. A control that cannot survive a challenge from an auditor or incident responder is not strong enough.

Practitioner takeaway: Effective crypto custody is measurable only when authority, access, and evidence are separated enough that no single actor can create an unauthorised transfer and later make it look routine.

Related resources from NHI Mgmt Group

• How can teams tell whether player protection controls are actually working?
• How can teams tell whether phishing controls are actually working?
• How can teams tell whether agentic access controls are actually working?
• How can teams tell whether ERP access controls are actually working?