01
Name the control owner
Provider custody can reduce internal key-management work. Self-managed wallets can increase control. Either model can fail when roles, approval policies, recovery, and monitoring are vague.
02
Design for the bad day
Document what happens when an approver is unavailable, credentials are compromised, an address is wrong, a provider is inaccessible, or a transfer is flagged. Recovery procedures should be tested before funds depend on them.
- Who can initiate, approve, and cancel?
- What transaction limits and destinations are permitted?
- How are new addresses allowlisted and independently verified?
- What evidence enters the audit trail?
- How are keys, devices, and recovery materials protected?
03
Match security to the workflow
A merchant that immediately settles to dollars has a different custody surface from a platform holding customer balances or an enterprise managing treasury across multiple blockchains.