A digital asset manager may use three exchanges and two custodians while remaining exposed to one point of failure.
Two platforms may rely on the same subcustodian. Several accounts may settle through the same bank or stablecoin. A prime service may route execution to venues the fund did not select. Wallet infrastructure may depend on a common cloud provider or key-management vendor. During stress, the fund may discover that its apparent diversification exists only at the brand level.
Digital asset counterparty concentration risk should be measured by legal entity, asset location, operational dependency, and exit path. Account count is a poor substitute.
Begin with the legal entity that owes the fund
Platform groups often contain exchanges, custodians, brokers, lenders, technology companies, and offshore affiliates. The name displayed on the interface may not be the entity that holds the asset or owes the contractual obligation.
For each relationship, the manager should identify:
- the contracting entity and governing law;
- the entity holding cash and each type of digital asset;
- any subcustodian, affiliate, or omnibus arrangement;
- rights of setoff, lien, lending, or rehypothecation;
- the fund’s status in an insolvency;
- the entity responsible for withdrawals and complaints; and
- the regulator, license, or charter relevant to the service.
This analysis distinguishes asset exposure from credit exposure. A token held in a legally effective segregated custody arrangement presents a different insolvency question from a balance that is merely an unsecured claim against a trading venue. The result depends on the documents, records, law, and facts, not the platform’s marketing terminology.
The SEC’s 2024 Galois Capital enforcement release states that approximately half of the advised fund’s assets under management were lost in connection with FTX’s collapse. The SEC also found custody-rule violations involving certain crypto asset securities held on trading platforms that were not qualified custodians. The order is a direct example of legal compliance and concentration risk meeting in the same account structure.
Measure exposure in more than one dimension
A daily counterparty report should show the amount and percentage of net asset value exposed to each legal entity. That is the starting point, not the complete measure.
The manager should also look through to shared dependencies:
| Concentration dimension | Example | Why it matters |
|---|---|---|
| Legal entity | Custody and trading contracts with the same affiliate | Failure or setoff may affect both services |
| Subcustodian | Two platforms using the same underlying wallet provider | Operational diversification may be illusory |
| Settlement asset | Most liquidity held in one stablecoin | A depeg or redemption interruption affects several venues |
| Banking rail | Multiple providers relying on one bank | Fiat subscriptions, redemptions, and margin may stop together |
| Technology | Common cloud, MPC, oracle, or API vendor | One outage can disable otherwise separate accounts |
| Liquidity | Alternative venues lack real depth for the fund’s size | Assets cannot be moved or sold on assumed terms during stress |
Concentration should be considered gross as well as net. A fund with offsetting positions at one venue may show limited market exposure while maintaining a large credit and collateral exposure to the operator.
The calculation should include pending deposits and withdrawals, posted margin, borrowed assets, unsettled trades, staking positions, and claims against affiliates. An exposure report that counts only the wallet balance can understate the amount at risk.
Limits need a trigger and a response
A policy that caps exposure at 20 percent of net asset value is incomplete if no one knows when it is measured or what happens after a breach. Prices move continuously, and a counterparty can exceed the limit because another asset falls in value even when the manager makes no new deposit.
The framework should define:
- the exposure numerator and denominator;
- measurement frequency and data source;
- normal, warning, and hard limits;
- temporary exceptions and approving authority;
- the period allowed for remediation;
- whether trading, deposits, or only new exposure must stop; and
- escalation to senior management, compliance, or investors.
Limits may differ by service and risk. Assets in qualified third-party custody, assets on an execution venue, unsecured stablecoin balances, and lending exposure should not necessarily receive identical treatment. The manager should be able to explain the distinctions.
Withdrawal capacity is part of diversification
An alternative account provides little resilience if it cannot receive the asset, support the network, or handle the required trade size. The fund should know how it will move or liquidate positions if a primary provider becomes unavailable.
Periodic low-value withdrawal tests can confirm address accuracy, approval rights, expected timing, network support, and receipt by the destination. Larger contingency planning should consider daily limits, whitelisting delays, market liquidity, transfer fees, compliance holds, and whether the fund needs prepositioned collateral.
The manager should not wait for a rumor to begin onboarding a replacement. Know-your-customer review, legal negotiation, wallet setup, banking, and technical integration can take longer than the event that makes the alternative necessary.
Some strategies cannot diversify every function. A particular token, derivative, or protocol may be available through one credible provider. In that case, the manager should decide whether to accept the concentration, reduce position size, obtain additional protections, change the strategy, or disclose the dependency. Calling a single-provider market “diversified enough” does not resolve the risk.
Counterparty monitoring must move beyond annual diligence
An onboarding review can become stale quickly. Digital asset counterparties may change ownership, banking, subcustodians, jurisdictions, products, terms, or financial condition during the fund’s investment period.
Ongoing monitoring can include financial statements where available, capital and liquidity information, proof-of-reserves materials and their limitations, regulatory status, insurance, control reports, service incidents, withdrawal performance, legal proceedings, adverse media, and changes to account terms. No single item proves solvency or asset protection.
Proof of reserves is a useful example. A cryptographic or third-party report may provide evidence of specified assets at a point in time. It may not establish all liabilities, legal ownership, asset encumbrance, control of keys, or the customer’s insolvency rights. The manager should describe what the report proves and what it does not.
The AIMA 2025 Digital Asset Forum summary notes that institutional investors continue to identify counterparty and liquidity risk as concerns despite improved custody and prime-brokerage infrastructure. The SBAI digital-asset operational-diligence framework similarly places counterparties, custody, trade processes, and asset verification within the same review.
Stress testing should assume correlated restrictions
A useful stress test does not assume that one provider fails while every alternative remains fully functional. The same market event may produce withdrawal queues, network congestion, stablecoin stress, margin calls, and reduced liquidity across several counterparties.
Scenarios might include:
- the largest exchange suspends withdrawals for 72 hours;
- the primary custodian blocks a token after a protocol incident;
- a settlement stablecoin falls below its reference value while redemption slows;
- two venues sharing a bank lose fiat access;
- the prime broker increases margin and limits transfers simultaneously; or
- rumors cause the fund and market to seek liquidity at the same time.
The test should estimate accessible cash, asset availability, margin needs, investor liquidity, and the time required to move or close positions. It should identify who has authority to exceed normal limits or suspend trading.
Disclosures should describe material dependencies
Generic language stating that exchanges and custodians may fail is unlikely to explain a known operational concentration. If a strategy depends on one venue, one settlement asset, or one custodian for an important class of tokens, the fund should consider whether its offering and diligence materials accurately describe that dependency and its consequences.
The documents should also match the policy. A DDQ claiming that no more than ten percent of assets remain on trading venues should be supported by the measurement method and records. A PPM that permits rehypothecation through a prime service should not be paired with a pitch stating that assets are never used by counterparties.
Institutional investors may request the counterparty map, exposure report, limit history, exception log, withdrawal tests, diligence files, and contingency accounts. They may ask the manager to explain the largest exposure on a stressed rather than ordinary day.
Diversification is the ability to keep operating
The purpose of counterparty diversification is not to maximize the number of logos in a data room. It is to prevent one legal, financial, or technical failure from immobilizing a material part of the fund.
Veritas Global advises digital asset managers on exchange and custody agreements, counterparty disclosures, operating limits, and institutional diligence. If your fund uses multiple providers but has not mapped their underlying dependencies, contact us to review where concentration remains.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal, investment, financial, cybersecurity, insolvency, or other professional advice. It does not create an attorney-client relationship. Counterparty rights and risks depend on applicable agreements, assets, jurisdictions, and facts. Readers should consult qualified advisers before acting.
