Bitcoin custodian due diligence is the structured process a company uses to test whether a custody provider can be trusted with its Bitcoin. It covers regulation, legal structure, segregation, insurance, independent audit reports, operational controls and exit terms. A well-known name is not a substitute for doing this work and keeping a written record of it.
Why a structured list matters
Choosing a custodian is one of the most consequential decisions in a corporate Bitcoin custody setup. If the provider fails, is breached, or freezes withdrawals, the company may have little recourse. Bitcoin transfers are final.
A written due diligence list does three things. It makes comparisons between providers consistent. It gives the board and auditors evidence of a considered decision. And it creates a baseline for annual review.
The due diligence list
1. Regulatory status
- Which entity will actually hold the assets, and where is it incorporated?
- What licences or registrations does that entity hold, and with which regulators?
- Is the custody activity itself within the scope of that regulation?
- Has the entity faced enforcement action or material regulatory findings?
Check registrations directly with the regulator where possible.
2. Legal structure and bankruptcy remoteness
- Are client assets held under a trust, bailment or similar arrangement that keeps them outside the custodian's estate?
- What does the custody agreement say about ownership and insolvency?
- Which law governs the agreement, and which courts have jurisdiction?
- Can the custodian lend, pledge or rehypothecate client assets? Under what conditions?
These are questions for the company's legal counsel. Ask the provider for a legal opinion on insolvency treatment if one exists.
3. Segregation
- Are the company's holdings in segregated on-chain addresses, or in an omnibus pool?
- If omnibus, how is the company's entitlement recorded and reconciled?
- Can the company verify its own balance on the blockchain?
- Are client assets ever mixed with the custodian's own assets?
4. Insurance
- Who is the insurer, and what is the policy type?
- What events are covered: external theft, internal theft, loss of keys, operational error?
- What are the limits, and are they shared across all clients?
- What are the main exclusions and conditions?
- Does cover differ between offline and online storage?
Ask for a summary of terms or a broker letter, not just a headline figure.
5. Independent assurance
- Does the provider have current SOC 1 Type II and SOC 2 Type II reports?
- Which firm issued them, and what period do they cover?
- Were there exceptions or qualified opinions? How were they remediated?
- What complementary user entity controls does the company need to operate?
- Does the provider publish proof of reserves, and does it include liabilities?
- Are audited financial statements available?
6. Key management and signing controls
- How are keys generated, stored and distributed geographically?
- What share of assets is held offline, and what is the process to move it?
- Can the company configure its own signing quorums and dual control in the platform?
- Are address whitelists supported, and how are changes approved?
- How are the provider's own staff prevented from moving funds alone?
These controls should align with the company's key management and signing policy.
7. Operations and service
- What are withdrawal processing times, cut-offs and service levels?
- How are incidents communicated, and how quickly?
- What business continuity and disaster recovery testing is performed?
- Does the provider support the reporting your auditors need, such as balance confirmations?
8. Exit and portability
- How does the company move all its assets to another provider?
- What notice, fees and timelines apply?
- What happens to assets if the provider is acquired, winds down or loses a licence?
Practical tip: before signing, run a small test deposit and withdrawal, and time it end to end. Then write down what a full exit would take. The answer often says more than the brochure.
Scoring and recording the result
A simple scoring grid helps the board see the comparison at a glance.
| Area | Weight | Provider A | Provider B | Notes |
|---|---|---|---|---|
| Regulatory status | High | |||
| Legal structure | High | |||
| Segregation | High | |||
| Insurance | Medium | |||
| Independent assurance | High | |||
| Signing controls | High | |||
| Operations | Medium | |||
| Exit terms | Medium |
Weights are illustrative. Each company should set its own, consistent with its treasury policy and risk appetite. Record open issues and how each was resolved.
Ongoing monitoring
Due diligence is not a one-off. We suggest:
- Annual refresh of SOC reports, insurance certificates and regulatory status.
- Quarterly reconciliation of the custodian's statements to the company's ledger and, where possible, to the blockchain.
- Prompt review after any incident, ownership change or regulatory event.
- A trigger in the policy that requires board review if the holding grows past a set threshold.
Many companies also use more than one custodian, or a shared-control model, to reduce reliance on any single provider. See qualified custodian vs self-custody.
How The Bitcoin World helps
We run structured custodian due diligence for corporates and present the findings in board-ready form, as part of our custody architecture work. We do not hold client assets and do not recommend providers on commission. Custody and execution are carried out by licensed third-party institutions.