A crypto treasury policy should set out, before a business holds any crypto assets, which assets it may hold, how much, how much liquidity to keep, who custodies the assets, who has authority to initiate and approve transactions, and how accounting, tax and reporting are handled. The policy is not a one-off document; it should be adjusted as the business’s risk tolerance changes.
Why Set a Policy Before Holding Crypto Assets?
Because crypto asset risk touches many parts of a company. In its analysis for businesses, Deloitte notes that a treasury strategy must align with the company’s established policies, processes and risk tolerance, and requires coordination among the board, audit committee, risk, finance, tax, internal audit and operations. Writing the rules down first gives everyone a shared basis to work from.
Crypto assets also face a wider range of risks, including liquidity, concentration and counterparty, regulatory, operational, market and reputational risk. The role of the policy is to turn these risks into enforceable, verifiable rules in advance.
Which Assets Should the Policy Allow, and How Much?
Start by listing the permitted asset classes and stating the business rationale for each. For every candidate asset, understand its specific terms and characteristics, as well as the underlying blockchain and governance mechanisms, and commission a third-party technical assessment where needed.
Next, set allocation limits. Deloitte recommends that businesses first assess the asset’s risk profile and their own risk tolerance, then decide what share of cash, after operating costs, can be allocated to such assets, and notes that risk tolerance may need to be adjusted periodically. Businesses can also use multiple counterparties so that assets becoming inaccessible in one place does not disrupt the overall arrangement.
How Should Liquidity and Custody Be Arranged?
Crypto asset prices are highly volatile, so Deloitte recommends that businesses hold extra cash alongside their digital assets and, before investing, confirm that they can sell without paying a significant premium if they need to convert to cash.
The custody model should also be written into the policy. A business can choose to self-custody, use a third-party custodian, or combine the two, and third-party custody and self-custody each come with trade-offs. If a third-party custodian is used, Deloitte lists questions to confirm with the custodian: how private keys are protected, what happens to assets if the custodian goes bankrupt or is liquidated, whether it can provide SOC 1 or SOC 2 reports, whether client assets are segregated from those of other participants, and whether insurance coverage is in place. KPMG also cautions that businesses should assess whether custodied assets are kept separate from the custodian’s own assets and those of other depositors, and whether they would be protected from the custodian’s creditors in a bankruptcy; such questions may require advice from legal counsel.
Who Should Initiate and Approve Transactions?
Deloitte recommends segregation of duties, a clear chain of command and complete documentation, along with monitoring and automated alerts to verify transaction authorization. In policy terms, this means the same person cannot both initiate and approve a transaction. The specific process can be designed around a crypto transfer approval workflow, with transfer limits set for different amounts.
Should Accounting, Tax and Reporting Be Part of the Policy?
Yes. How assets are measured and disclosed once held depends on the standards the business applies. Accounting for crypto assets differs under US GAAP and IFRS, and the policy only needs to specify who is responsible and which treatment is used.
On tax, Deloitte notes that businesses need to choose a cost-basis method (such as specific identification or first-in, first-out), keep records by wallet and tax lot, and separate investment wallets from operating wallets, so that the tax treatment of every transaction is documented.
On reporting, Deloitte recommends that reports cover risk exposures, mitigation measures and their financial impact, and create an audit trail; businesses also need to dedicate resources to tracking ongoing regulatory and accounting standard changes.
Conclusion
A complete crypto treasury policy answers a few key questions: what to hold, how much, where to keep it, who can move it, and how to account for and report it. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.
Want to put your treasury policy’s approval and limit rules into your wallets?
Looking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.
Request a DemoLooking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.