Financial institutions are fundamentally risk management machines. Their entire business model is dependent on compliance and risk management. So I think that despite the enormous potential of cryptocurrencies, the larger institutions must move cautiously.” By Taylor (Source: News BTC)
Risks in Digital Assets
Understanding the financial risk landscape is critical. Every time, digital assets introduce new, and sometimes amplified, risks compared to more established asset classes. The following are categorised as the key risks:
| Category | Impact |
| Private Key Loss or Leakage | The private key is the equivalent of a custodial title. If lost, you may lose access permanently. If leaked, assets can be stolen with no recourse. |
| Cybersecurity Breaches & Hacks | Exchanges, platforms, or wallets may be hacked. Weak security configurations, insider threats, or insufficient separation can lead to large losses. |
| Operational Errors / Human Error | Mistakes in address entry, wrong transaction parameters, misconfiguration, and poor backup practices. These errors are often irreversible. |
| Regulatory & Legal Risk | Regulatory ambiguity or changing rules: AML/KYC, securities law, licensing. Legal enforceability of digital asset ownership in different jurisdictions. |
| Custodian / Counterparty Risk | If using third‐party custody, risk that the custodian may be insolvent, mismanage assets, be subject to fraud or operational failures. |
| Jurisdiction & Cross-Border Risk | Laws differ by country: property rights, enforcement, and capital controls. Custody in one jurisdiction may create exposure if another jurisdiction acts. |
| Insurance | Even if a custodian claims to have insurance, many policies exclude certain types of loss (insider collusion, certain chain issues, smart contract bugs). |
| Technology | Protocol vulnerabilities & quantum risk in the future. |
Checklist to Follow in Safeguarding Digital Assets
Safeguarding doesn’t simply mean “don’t get hacked.” Below are the different dimensions/components that require protection, each with its own unique challenges.
- Private Keys & Backup
- Key generation environment (must be secure, auditable).
- Key storage (hardware security modules, cold storage, multi-party computation, multi-sig).
- Backup, redundancy, geographic dispersion.
- Access Controls & Identity Management
- Who can initiate or approve transactions?
- Role-based access control; separation of duties.
- Multi-factor authentication; physical security for devices.
- Custody Model
- Self-custody vs third-party custody vs hybrid models.
- Hot wallets, warm wallets, cold/offline storage.
- Hardware security modules (HSM), air-gapped systems.
- Operational Processes & Governance
- Transaction workflows, approval chains, transaction policies.
- Key generation, audits, and change management.
- Incident response planning and business continuity.
- Legal & Regulatory Safeguards
- Legal status of digital assets in relevant jurisdictions.
- Custody agreements: who is legally the owner or trustee; what happens on the insolvency of the custodian.
- Compliance with AML / KYC / CFT, securities regulation, and tax laws.
- Insurance & Financial Safeguards
- Making sure insurance is appropriate, with clear coverage, including for insider events, theft, and smart contract risks.
- Financial reporting: how digital assets are reflected on the balance sheet; what happens in the event of loss.
- Technology Risk & Protocol
- Protocol risk: smart contract bugs, chain consensus vulnerabilities.
- Dependency on third-party software (wallet software, APIs).
- Future risks: quantum computing, cryptographic deprecation.
- Transparency, Auditability & Reporting
- Proofs or attestations of asset holdings.
- Regular internal and external audits.
- Clear reporting to boards, investors on custody risk and controls.
Key Principles to Follow
Putting all the above together, here are the key principles which every CFO should insist upon:
- Key Custodian Independence & Minimum Trust
Design custody such that no single point of failure or single actor can compromise assets. Use multi-party computation, multi-sig, or HSMs where possible. Reduce trust placed in any one person or external party.
- Security Layers
Layers of security: physical, network, application, process, human. Cold storage + warm/hot storage separation; role separation; strict access policies; backups. Assume failures and plan mitigations.
- Least Privilege & Separation of Duty
Only grant permissions that are strictly needed. Transaction signing, key access, backup retrieval, etc., should involve separate roles and multiple approvals.
- Regulatory & Legal Clarity
Custodian agreements must clearly define legal title, responsibilities, liability in case of loss, what happens under custodian insolvency, and jurisdiction conflicts. Stay aligned with emerging regulations in all jurisdictions where you operate or your assets reside.
- Resilience & Business Continuity
Plans in case of cyber-attack, natural disaster, political or legal disruption. Regular drills; backup systems; redundant sites; tested recovery procedures.
- Transparency & Auditability
Use independent audits, attestations, proof-of-reserves or holdings, clear disclosure of custody practices, insurance, counterparty risk, etc. Reporting to stakeholders must be timely and reliable.
- Technology & Cryptographic Soundness
Use up-to-date, tested cryptographic protocols. Vet and monitor wallet software, use safe and battle-tested libraries. Keep abreast of developments (quantum resistance, chain forking, etc.).
- Alignment of Costs and Risk
High security often comes at a higher cost (slower access, more manual processes). CFO must assess trade-offs: liquidity vs safety; cost of downtime vs cost of breach; insurance cost vs residual risk. Always do a risk-adjusted cost-benefit analysis.
Key Takeaway: For CFOs, safeguarding digital assets means going beyond just storing private keys. It requires building a holistic custody framework that balances security, compliance, operational efficiency, and cost. By adopting multi-layered controls, legal clarity, and regular audits, finance leaders can turn custody from a risk into a source of trust, resilience, and competitive edge.
Conclusion
In summary, for CFOs navigating the evolving landscape of digital assets, custody is not just a technical or IT issue; it is a core financial, legal, operational and reputational risk. A robust custody strategy is foundational to preserving value and ensuring long-term trust from investors, regulators, the board, and partners.
- Understand and map the full risk spectrum around digital assets (keys, cyber, regulatory, operational, market).
- Decide on what you need to safeguard: keys, custody relationships, processes, legal frameworks, and tech risk.
- Regularly review and adapt to the evolving new threats that emerge.
For more information, contact us at info@anankai.com.