Crypto treasury management is the set of rules and routines a company uses to hold, move and report the digital assets it owns. The job is the same as ordinary treasury work. Keep the money safe, keep enough of it available, and be able to prove where every unit went.
The mechanics are different. These assets sit on public blockchains, the markets never close, and a transfer sent to the wrong address cannot be recalled.
This guide is written for the finance lead, controller or operations manager who has just been handed the task. Maybe you need to hold stablecoins for supplier payments, park reserves in Bitcoin, or accept crypto from customers. It covers what belongs in policy, how to split holdings across wallet tiers, which US and EU rules bind in 2026, and what changed in the accounting.
No blockchain background is assumed. Terms are explained the first time they appear.
Key Takeaways
- Policy comes before software. The board approves what you may hold, where you may transact, and who signs.
- Split holdings across cold, warm and hot wallets so one compromise cannot reach everything.
- Under US accounting rules, in-scope crypto assets are now carried at fair value, with changes running through net income.
- Compliance deadlines have arrived. The EU transition period closed on 1 July 2026, and US stablecoin rules are being finalised.
- Evidence is the real deliverable. Approvals, transaction IDs and reconciliations decide how the audit goes.
What Crypto Treasury Management Actually Means
Most companies come to this with one of three needs, and each one calls for different limits.
The first is operating flow. You pay a supplier in stablecoins, meaning tokens designed to hold a steady value, usually one US dollar. Balances stay small and turnover is high.
The second is reserves. You hold Bitcoin or another asset as a long-term position on the balance sheet. Balances are large and movement is rare.
The third is product enablement. Your customers hold or transact in digital assets through your service. Here the assets are not yours, which changes both the controls and the reporting.
Name your case before designing anything. A treasury built for daily supplier payments looks nothing like one built to sit still for five years.
Why this became a normal finance question
Between 2023 and 2026, most of the ambiguity that kept finance teams away was resolved.
US accounting rules for crypto holdings were rewritten and took effect for fiscal years beginning after 15 December 2024. The Securities and Exchange Commission withdrew its restrictive custody guidance in January 2025, replacing Staff Accounting Bulletin 121 with SAB 122. The Office of the Comptroller of the Currency then acted twice in 2025. Its March and May letters confirmed that national banks may custody crypto assets and trade them at a customer’s direction. Banks may also outsource those activities, provided the controls hold.
The result is that holding digital assets is now a governance and control question rather than a legal grey zone. Our guide to blockchain adoption across business in 2026 covers the wider shift.
How It Differs From Ordinary Cash Management
Corporate cash teams have to rewire familiar playbooks, because almost every assumption behind them changes.
Markets that never close
Bank rails settle in batches during business hours. Blockchains settle continuously, often within minutes.
That removes the overnight pause in which most treasury teams do their checking. You need pre-authorised limits, an on-call rota, and escalation paths that work at 3am on a Sunday.
No chargeback, no deposit insurance
A bank transfer sent in error can often be recalled. A blockchain transfer cannot.
There is also no FDIC or SIPC-style protection standing behind a self-held wallet. If a key is lost or stolen, the loss is yours. That single fact drives most of the control design in this guide: allowlists, small test transfers, dual approval and tested recovery.
Rules that are still being written
Cash management rests on decades of settled regulation. Digital asset rules are still moving, in both directions and at different speeds by country.
The practical answer is to write down your interpretation of each rule, note who advised it and when, and review it on a schedule. A documented and dated position is defensible. An undocumented assumption is not. The same discipline applies to any fast-moving area, as our risk management framework guide sets out.
What Falls Inside Scope
Define the boundaries first. Clear scope tells your team which systems, wallets and reports matter each day, and stops the programme sprawling.
From custody to audit
A complete scope covers five things: where the assets are held, who can move them, which venues you trade on, how transactions reach the ledger, and what evidence you keep.
Write each one down as a named owner and a named system. Gaps show up quickly when you try to fill in the table.
Terms worth learning first
- Custody means who physically controls the private keys. A qualified custodian is a regulated firm that holds them for you.
- Self-custody means your own team generates, stores and uses the keys.
- Multisig requires several separate keys to approve one transaction, enforced by the blockchain itself.
- MPC, short for multi-party computation, splits one key into shares held by different parties and signs without ever reassembling it.
- An allowlist is a fixed list of addresses you are permitted to send to.
- A timelock delays a transaction by a set period so someone can cancel it.
Start With Policy, Not With Software
The board approves a short document that answers three questions: what you may hold, where you may transact, and who may sign. Everything after that is implementation.
A workable policy fits on a few pages. It lists permitted assets, approved venues, wallet tiers, spending limits by role, and activities that are explicitly forbidden.
Separating the request, the approval and the signature
This is the single most valuable control in the whole programme, and it costs nothing.
The person who requests a payment must not be the person who approves it, and neither should hold the signing key alone. In practice that means at least three roles, drawn from different teams.
Add step-up approval for larger amounts. A 2,000 dollar supplier payment and a 2 million dollar reserve movement should not pass through the same gate.
Change management and immutable logs
Decide in advance who can change a limit, add a signer, or edit an allowlist. Those changes are exactly what an attacker targets first.
Every change should land in a log that cannot be edited afterwards and that ties each action to a named person. External auditors will test both the design and the operation of this control, so build it to be examined.
- Policy matrix: spending limits by wallet, role, asset, counterparty and time window.
- Pre-trade checks: exposure, sanctions screening and available balance verified before execution.
- Approval matrix: value thresholds plus velocity caps, so many small transfers also trigger review.
- Attestation: a scheduled review that confirms signer lists and limits are still correct.
Custody: Who Actually Holds the Keys
Qualified custody places safekeeping with a regulated provider. You get segregation of assets, independent audit reports and an insurance conversation, at the cost of some speed and flexibility.
Self-custody keeps key generation, rotation and recovery in house. You get full control and lower ongoing fees, and you take on every operational risk that comes with them.
Most companies end up hybrid. A custodian holds the long-term reserve, while a smaller warm tier under your own control handles routine payments.
What changed for banks
Since the 2025 OCC letters, a national bank can offer crypto custody and execution as a permitted activity and can use sub-custodians. For a mid-sized company, this widens the field of providers well beyond crypto-native firms and may put the service inside an existing banking relationship.
Recovery you have actually tested
Ask any provider or internal team one question: show me the last recovery drill.
A recovery plan that has never been executed is a document, not a control. Run the restore with no value at stake, time it, and write down what broke. Keep encrypted backups under separate administrative control so one compromised account cannot reach them all.
Wallet Tiers: Cold, Warm and Hot
Splitting holdings across tiers limits how much a single failure can reach. It is the same logic as not keeping the whole payroll in the petty cash tin.
Cold vaults for reserves
Cold means offline. Keys are generated and used on devices that never touch a network, usually in a multi-person ceremony with a written checklist.
This tier holds the money you do not intend to move this quarter. Access is slow by design. Test the ceremony with worthless test assets so the procedure works when it matters.
Warm wallets for routine settlement
Warm wallets are reachable over the network but heavily constrained. Require quorum approval, allowlisted destinations, a timelock on new addresses, and a daily cap.
Send a small test transfer before any large movement to a new address. It costs a few cents and catches the mistake that would otherwise be permanent.
Hot wallets on a short leash
Hot wallets are automated and hold only what a few days of operations need. Cap the velocity, alert on any unusual destination, and sweep surplus balances back to custody automatically.
Keep signing separate from general operations. No shared laptops, no browser extensions on the machine that holds keys. Our guide to zero-trust architecture in 2026 covers the wider access model, and cybersecurity mesh explains how to distribute those controls.
Multisig or MPC: Choosing a Signing Pattern
Both patterns remove the single person who can move everything. They differ in where the rule lives.
Multisig enforces the approval threshold on the blockchain itself. Anyone can verify it, which auditors like, and it is simple to explain. Support varies by chain, so check coverage for every asset you hold.
MPC enforces the rule in software, across key shares held by different parties. It works across more chains and hides the policy from public view. That flexibility means the control is only as good as the vendor’s implementation and your own configuration.
Neither is universally better. Auditors care less about the choice than about the evidence: who approved what, how the signature was produced, and how you would recover from a lost share. Document the decision in a short risk memo and test the failure path.
Payments, Liquidity and Settlement
Daily operations become predictable when every transfer starts from a request and ends in a reconciliation.
Stablecoin working capital
Size your stablecoin balance against expected outflows plus a buffer for settlement lag. Anything above that belongs back in custody or in the bank.
Standardise the reference field on every transfer so each payment ties to an invoice or business identifier. Without that, reconciliation becomes manual detective work. Teams paying international contractors will find the same pattern in our crypto payroll guide and in global payroll solutions.
Request to settle, with checks in the middle
Build one workflow and route everything through it. The request captures amount, asset, destination and business reason. The checks confirm the limit, screen the counterparty against sanctions lists, and verify the balance. Only then does signing happen.
Record the venue chosen and the approvals given. That record is what turns a payment into evidence.
Three-way reconciliation
Reconcile three sources on a fixed schedule: what the blockchain shows, what your custodian or exchange statement shows, and what your own books show.
Any two agreeing is not enough. Breaks between the three are where errors and theft become visible. Log every break, its root cause and its fix. Broader finance automation tooling can carry much of this load once the process is stable.
Execution Quality and Venue Routing
Where you trade affects what you pay, and concentration in one venue is a real risk.
Onboard more than one venue: an exchange, an over-the-counter desk, or a custodian with trading built in. Test the withdrawal path on each one regularly, because the time to discover a frozen withdrawal is not during a crisis.
Track two numbers to know whether routing is working. Effective spread shows the gap between the price you saw and the price you got. Implementation shortfall shows the total cost of the decision, including delay. Both describe the past and guarantee nothing about the future.
For a practical guide to routing and business flows, see how decentralized finance is changing business transactions, and our overview of cryptocurrency in global business.
Risk Limits You Can Defend
A limit only counts if a system enforces it. Write numeric caps, then wire them into blocks and alerts rather than into a memo nobody reads.
Concentration and exposure caps
Set a maximum per asset, per wallet, per venue and per counterparty. Review the numbers quarterly, because both markets and providers change fast.
Stress scenarios worth running
Three scenarios cover most of the real damage: a sharp price gap, liquidity drying up so you cannot sell at a sensible price, and a venue that stops processing withdrawals.
For each one, write down who has authority to act and what they are authorised to do. Then run it as a tabletop exercise and record what the team actually did.
Operational hardening
- Allowlists, timelocks and velocity limits stop most rushed mistakes before they settle.
- Ceremony devices should be single-purpose, with tamper-evident storage and no extra software.
- Alerts should fire on policy breaches, new destinations and transfers at unusual hours.
- Keep a break-glass process for emergencies that still needs two approvers and still writes a log.
Compliance: What the Rules Require in 2026
The compliance layer stops an unlawful transfer before it leaves your systems. Three areas matter most.
The Travel Rule and sanctions screening
The Travel Rule requires that identifying details about the sender and the recipient travel alongside a transfer. It comes from the Financial Action Task Force, the global standard setter on money laundering, and applies above a threshold of 1,000 US dollars or euros under the FATF standard. In the United States the long-standing Bank Secrecy Act threshold is 3,000 dollars, and FinCEN has proposed lowering the figure for cross-border crypto transfers to 250 dollars.
Screen counterparties before execution, not after. Keep the screening result, the timestamp and the decision, because that record is what an examiner asks for. Compliance tooling is covered in our guide to RegTech solutions.
Stablecoins under the GENIUS Act
The GENIUS Act, the US federal framework for payment stablecoins, was enacted in July 2025. Its statutory effective date is the earlier of 18 January 2027 or 120 days after final rules are issued.
Treasury and the OCC published proposed implementing rules during 2026, so the detail is still settling. If stablecoins are part of your working capital, track which issuers intend to be authorised under the regime and what that means for your holdings.
MiCA and the end of the EU transition
In the European Union, the Markets in Crypto-Assets Regulation governs crypto-asset service providers. The transition period for existing firms closed on 1 July 2026 at the latest. Several member states finished earlier, including Germany and Ireland at the end of 2025.
A provider without MiCA authorisation may no longer serve those markets. If you use an EU-based exchange or custodian, confirm its authorisation status directly rather than assuming continuity. The broader picture sits in our review of 2026 data privacy rules and AI regulation.
Accounting, Tax and Audit
This is where the 2026 picture differs most from advice written a few years ago.
Fair value under US GAAP
Accounting Standards Update 2023-08 created a new subtopic, ASC 350-60, for crypto assets. In-scope assets are measured at fair value each period, with gains and losses recognised in net income. That replaced the old cost-less-impairment model, under which paper gains were invisible and only losses appeared.
The scope is narrower than people expect. An asset qualifies only if it is intangible, fungible, secured by cryptography and held on a blockchain. It must also carry no enforceable claim on other assets and must not have been issued by your own company or a related party. NFTs and self-issued tokens fall outside it, and so do some wrapped tokens.
In-scope holdings sit on their own balance sheet line, separate from other intangible assets. Each period you disclose the name, cost basis, fair value and units of each significant holding. The rules took effect for fiscal years beginning after 15 December 2024.
Where IFRS differs
IFRS has no equivalent standard. Tokens are usually treated as intangible assets, or as inventory when held for sale in the ordinary course of business.
If you report under both frameworks, document the classification difference and its effect on reported value and expense. That memo saves considerable time at year end.
Tax reporting and cost basis
US brokers now report gross proceeds from digital asset sales on Form 1099-DA. That applies to transactions on or after 1 January 2025, and the first forms went out in early 2026. Cost basis reporting starts with transactions on or after 1 January 2026.
Your own sub-ledger still has to hold lot-level detail: acquisition date, cost, fees and disposal method. When broker figures and your records disagree, the difference has to be explainable, so run the comparison during the year rather than at filing time.
Sub-ledgers and tie-outs
Map every transaction to an approval, an address and a transaction ID. Keep an address registry that records the business purpose and counterparty for each address you use.
That registry is the artefact auditors ask for first, and building it retrospectively is painful.
Vendor Risk and Assurance
Turn vendor promises into evidence you can check.
Ask for a SOC report, meaning an independent examination of the provider’s controls, and for ISO/IEC 27001 certification. Read the uptime history and at least one published incident report. How a provider writes about its own outage tells you a great deal about how it will handle yours.
Set a lifecycle for each vendor. Onboarding fixes the scope and the security responsibilities in writing. A periodic refresh collects new evidence. A termination playbook covers data export, key rotation and credential revocation before you need it. Similar sourcing discipline applies across the stack, as our guide to digital procurement describes.
Incident Response and Continuity
Write the playbooks while nothing is on fire.
Five situations deserve their own page: a suspected key compromise, a signer who is unreachable, a withdrawal that fails, a sanctions hit, and a venue outage. Each page names the decision maker, the escalation path and the expected timing.
Name an incident commander and at least one alternate with real authority to halt transfers. Keep an out-of-band contact list, so coordination still works if your normal chat and email are the compromised systems.
Run tabletop exercises against these scenarios and update the procedures afterwards. The exercise that changes nothing was probably too easy. Unapproved tools are a recurring weak point here, as our piece on shadow IT in remote teams shows.
Technology: Keys, Modules and Monitoring
Your technology choices turn policy into something that actually runs.
Key handling and a deadline in September 2026
Design key generation, rotation, storage and retirement against NIST SP 800-57, the standard reference for key lifecycles. Prefer hardware and libraries validated to FIPS 140-3 where the option exists.
There is a firm date attached to this. On 21 September 2026, the Cryptographic Module Validation Program moves all remaining active FIPS 140-2 certificates to its historical list. If a vendor’s validation is still FIPS 140-2, ask now about the FIPS 140-3 timeline. Validation typically takes well over a year, so the answer tells you whether to plan a replacement. Related migration pressure is covered in our guide to quantum-safe encryption.
Monitoring and change control
Build one dashboard that finance and engineering both use. It should show balances, limits, open exceptions and pending transactions across every wallet and venue.
Apply the same change discipline to platform updates as to wallet configuration: approval, testing, a rollback plan and an immutable log. Capture evidence automatically where you can, because manual evidence collection is where audit preparation quietly consumes a month.
A Practical Rollout Plan
Five phases, in order, with no phase skipped.
- Policy. Draft with counsel. Cover objectives, permitted assets, venues, wallet tiers, approvals, limits and counterparty onboarding.
- Architecture. Choose qualified custody, self-custody or hybrid, then choose multisig or MPC and design signer independence and backups.
- Pilot. Run small balances through the full loop: request, approve, sign, settle, reconcile, report. Measure how long each step takes.
- Scale. Raise limits only when reconciliations come out clean and controls hold. Tie every limit increase to control evidence.
- Drill. Run recovery exercises, vendor failovers and tabletops. Fold the lessons back into procedures and training.
Expect the pilot to take longer than planned. The value is in finding out which of your assumptions were wrong while the amounts are still small. Teams that pair this with disciplined cash flow management tend to size their operating balances more accurately.
The Short Version
Crypto treasury management works when governance, custody and daily operations form one loop that produces its own evidence.
Get the policy approved before any funds move. Split holdings across tiers so no single failure reaches everything. Reconcile three ways on a schedule, and keep the address registry current. Track the accounting and compliance dates, because several of them landed in 2025 and 2026.
None of this requires deep cryptography knowledge. It requires the same discipline any treasury function already applies to bank accounts, extended to a setting where mistakes are permanent and the market never closes.
Found this useful?
Make SmartKeys a preferred source on Google, and our articles will surface more often in your Top Stories, AI Overviews, and AI Mode.
Add as Preferred Source
