Determine your custody and security model

Custody is one of those topics that sounds technical but is really about a very human question: who has the keys? Bitcoin ownership doesn't work like a bank account. There's no customer-service line that can reset your access if you lose the keys. Whoever holds them, controls the coins.

Think of it like storing valuables. You can keep them in a safe in your basement (self-custody), rent a safety deposit box at a bank (third-party custody), or set up a vault where multiple people need to be present to open it (distributed / multi-signature). Each has real advantages. None is universally best.

Model 1 — Self-custody

In self-custody, the company holds its own private keys. No third party is involved. This gives maximum control — and matching operational responsibility.

• Advantage — Full control. No one else can freeze, seize, or restrict access to the Bitcoin.
• Advantage — Lower fees. No custodian is charging you for the service.
• Advantage — Sovereignty. No dependence on third parties that could fail, be hacked, or run afoul of regulators.
• Challenge — Operational burden. The company has to build the internal capability: hardware wallets, cold storage, backup procedures, physical security.
• Challenge — Key management. Lose the keys, lose the Bitcoin. Poor procedures create legal and compliance risk.

Self-custody is a fit for companies with strong internal IT and security teams that value sovereignty and are willing to invest in the discipline it requires.

Model 2 — Third-party custody

Third-party custody is what most institutions default to. The company outsources storage to a regulated, insured custodian — Coinbase Custody, BitGo, Fidelity Digital Assets, and similar. They handle the vaults, the security protocols, the compliance, and the audit trail.

• Advantage — Regulated and insured. Institutional-grade security backed by real insurance policies.
• Advantage — Simpler operations. No need to build internal custody capability.
• Advantage — Compliance-ready. Custodians usually meet industry security standards and can produce audit-friendly documentation.
• Challenge — Custody fees. You pay for the service, and fees vary widely.
• Challenge — Trust in the custodian. If they fail, you're exposed. Reputable ones are very reliable, but the risk is real.
• Challenge — Less direct control. You don't hold the keys yourself.

Model 3 — Distributed custody (multi-signature)

Distributed custody is the middle path. Bitcoin is held in a multi-signature (or 'multisig') arrangement, where multiple keys — held by different parties — must all sign off before any Bitcoin can move.

A common setup is two-of-three: three keys exist, held by three different parties (say, the internal finance team, a third-party custodian, and a legal partner), and any transaction requires two of the three to sign. No single party can move the Bitcoin alone. It's the same idea as the two-key launch procedure in a movie missile silo — a deliberate barrier against a single point of failure.

• Advantage — No single point of failure. Losing one key doesn't lose the Bitcoin. One party going rogue doesn't move the Bitcoin.
• Advantage — Governance built in. The multisig itself enforces multi-party approval — it's not just a policy, it's cryptographic.
• Challenge — Complexity. Setting up and maintaining a multi-signature vault requires expertise and careful coordination.
• Challenge — Recovery is slower. If a key is lost, recovering takes coordination and time.

The key management policy

Whichever model you pick, none of it works without a written key management policy. The policy defines:

• Key generation — how private keys are generated (offline, on air-gapped hardware, using verified tools).
• Access control — who can access which keys, under what conditions, and with what approvals.
• Recovery protocol — what happens if a key is lost, damaged, or a keyholder leaves the company. Where are backups stored, and who can recover?
• Rotation and audit — when keys are rotated, how access is logged, and who reviews the logs.