A two-of-three signing policy sounds resilient. It may not be.
If two signing devices are stored in the same office, one event can disable both. If the chief investment officer controls one key and can reset another signer’s access, the arrangement may still depend on one person. If the emergency procedure allows a single administrator to change wallet rules, the ordinary approval threshold can disappear precisely when the fund is under pressure.
Crypto fund transfer controls should be designed around authority and failure, not the number of signatures displayed in a wallet interface. The manager needs to show who can request a transaction, who can approve it, which technology enforces the decision, and how the fund continues operating when a person, device, provider, or network is unavailable.
Map authority before selecting the signing technology
Multi-signature wallets, hardware security modules, multi-party computation, and custodian approval platforms distribute control in different ways. None determines who should have authority for the fund.
The governance analysis should begin with roles:
- A requester prepares the transaction and business rationale.
- An approver determines that the transaction is authorized and within mandate.
- A signer uses a credential or key share to authorize execution.
- A releaser or service provider transmits the transaction where the system separates signing from broadcast.
- A reviewer confirms the completed transfer and reconciles it to fund records.
One person may perform more than one role in a small manager, but the combinations should be intentional. A person who can add a destination address, approve the transfer, and reconcile the result has end-to-end authority even if the wallet requires multiple clicks.
The access matrix should identify primary and backup personnel, transaction thresholds, permitted assets and networks, and authority to change the policy itself. It should include the custodian, administrator, outsourced operations provider, and technology vendor where their personnel can affect execution.
A quorum must be independent in practice
A two-of-three structure reduces risk only if the three credentials are meaningfully separate. Diligence should examine device location, recovery rights, authentication, employment relationships, and administrative privileges.
Suppose two founders and a finance lead each receive a signing share. Both founders store their devices in the same safe, and the finance lead’s access can be reset by one founder. The fund has three named signers but may have one operational point of control and one physical point of failure.
Independence can be improved by separating devices and recovery materials, limiting administrative overrides, using distinct authentication factors, and ensuring that no signer can impersonate or reset another without an additional approval. The right structure depends on transaction frequency, asset risk, staffing, and service-provider capabilities.
Institutional guidance treats private-key management as part of a wider control environment. The AIMA Digital Asset Custody Guide addresses key generation and management alongside governance, cybersecurity, operational risk, and insolvency. A manager should be able to explain those connections rather than cite the wallet’s technology as the control.
Address changes deserve stronger controls than routine transfers
Many losses begin with a validly signed transfer to the wrong destination. An attacker may compromise email, substitute an address in an invoice, alter copied text, or persuade an employee to add a new wallet during an urgent transaction.
An address-management process can require independent verification, allowlisting, a cooling-off period, and a small test transfer. Verification should use a communication channel established before the change request. Calling the number contained in the same compromised email does not provide meaningful independence.
The policy should also address:
- look-alike addresses and address poisoning;
- the selected blockchain and token contract;
- memo, tag, or destination requirements;
- smart-contract approvals and token allowances;
- bridge and cross-chain destinations;
- custodian or exchange deposit-address changes; and
- whether a test transfer actually validates the final route.
Allowlist changes should be logged with the same care as completed transfers. If a platform administrator can change an address and immediately approve a transaction, the allowlist may provide less protection than the policy suggests.
Approval should account for the transaction’s substance
A transfer policy based only on dollar value can miss the risk of the action. Sending a modest amount to an untested bridge, granting an unlimited token approval, changing validator withdrawal credentials, or moving governance tokens may have consequences beyond the displayed value.
The approval record should capture the purpose, asset, network, source and destination, valuation basis, counterparty or protocol, expected fees, applicable limit, and supporting documentation. Higher-risk actions may require legal, compliance, cybersecurity, or investment review in addition to the ordinary monetary threshold.
Urgency should not erase that analysis. The policy can define a faster process for margin, collateral, or market-protection transfers, but the alternative route should still identify authorized personnel, permitted destinations, limits, and after-the-fact review. “Emergency” should not mean that a senior employee can bypass every control by sending a message in a group chat.
Business continuity begins with realistic loss scenarios
A continuity plan should assume that the unavailable person is the one who normally solves the problem. It should also assume that the primary communication channel or service provider may be compromised.
Useful scenarios include:
- a signer is incapacitated or unreachable during a market event;
- a signer leaves the firm without completing an orderly transition;
- a device is lost while the credentials may still be valid;
- a custodian or wallet platform suspends withdrawals;
- the fund cannot access its office or primary backup site;
- the manager suspects an insider but does not know which credentials are affected;
- a blockchain is congested, reorganizes, or pauses; and
- a transaction is confirmed on-chain but not credited by the receiving venue.
For each scenario, the manager should know who declares the incident, which transactions stop, how credentials are revoked or rotated, what quorum remains, and how investors and service providers are informed. Recovery material should be geographically and logically separate from ordinary access, with controls against casual use.
The plan should distinguish continuity from recovery. Continuity keeps necessary operations functioning during disruption. Recovery restores the intended long-term architecture after the immediate problem. A temporary emergency signer should not remain embedded in the wallet indefinitely because no one scheduled the second step.
Personnel changes should trigger access changes automatically
Digital asset access should be part of onboarding, role changes, leave, and offboarding. Waiting for an annual user review is inadequate when a departing employee still holds a seed phrase or device.
The manager should inventory every credential and authority associated with the person, including custodian portals, exchanges, password managers, virtual private networks, cloud systems, governance forums, multisig wallets, key shares, developer repositories, and recovery contacts. The offboarding sequence may need to occur before the person is notified if misuse is a concern, subject to employment law and the facts.
Key rotation is not always simple. Moving assets to a new wallet can create network fees, tax or accounting questions, protocol lockups, and operational risk. A manager should determine in advance whether a signer can be replaced within the existing structure and what must occur if replacement is impossible.
Evidence matters as much as the policy
An institutional investor may request more than the written procedure. It may ask for the current access matrix, sample transaction approvals, wallet configuration, allowlist-change record, periodic access certifications, incident exercises, and evidence that a former employee’s access was removed.
A useful test selects one completed transaction and traces it from investment or treasury decision through request, approval, signing, broadcast, blockchain confirmation, custodian or venue credit, and ledger reconciliation. The reviewer can then compare the actual timestamps and users to the policy.
This test often reveals informal steps. An employee may have pasted an address into a messaging app, an approver may have relied on a screenshot rather than the source instruction, or the administrator may have reconciled only the custodian statement and missed the manager-controlled wallet. The correction should improve the process, not merely add a sentence to the policy.
A continuity plan should be rehearsed before assets are at risk
At least periodically, the manager should run a controlled tabletop or low-value exercise. The test might assume that the primary signer and custodian portal are unavailable while a permitted transfer must be completed. The team should retrieve the correct contacts, use backup authority, verify a destination, execute or simulate the transaction, and reconcile the result.
Findings should be assigned and closed. If the backup signer’s device has expired, the legal entity named on the account is wrong, or the custodian requires a form no one can locate, the test has done its job.
The SBAI operational-diligence framework for digital assets emphasizes custody, trade processes, valuation, verification, and conflicts. Transfer continuity connects all of them. A delayed or unauthorized movement can affect trading, pricing, collateral, reporting, and the fund’s ability to prove that assets exist.
The real control is the path no one person can rewrite
Strong crypto fund transfer controls do not depend on a claim that the wallet is secure. They create a transaction path in which authority is clear, sensitive changes receive additional review, technical settings match the written policy, and the fund can continue through foreseeable disruption.
Veritas Global advises digital asset managers on wallet governance, transfer policies, service-provider agreements, access matrices, and incident and continuity planning. If your signing structure has evolved faster than the fund documents and operating procedures, contact us to assess the full authorization path.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal, cybersecurity, tax, accounting, investment, or other professional advice. It does not create an attorney-client relationship. Appropriate controls depend on the manager, assets, technology, jurisdictions, and applicable law. Readers should consult qualified advisers before acting.
