Guides / Custody

Custody options for a company treasury

Who holds the keys is the most important operational decision. This guide compares the main models, including exchange-traded products, and gives a starting point based on your situation.

Last reviewed: 21 October 2026US and UK side by sideEducation only

Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.

The main models

There are four common ways for a company to hold bitcoin or get exposure to it: two kinds of multisig, a regulated custodian, or an exchange-traded product. A fifth, the single-signature wallet, is explained at the end of this section, along with why we do not recommend it for a company treasury.

Self-managed multisig

A wallet that needs M of N keys to sign, for example 2 of 3 (BIP 11 describes M of N transactions; BIP 174 defines the PSBT format many wallets use to pass a transaction between signers). Keys sit on separate devices, with separate people, in separate places. No single person can move funds alone, and losing one key does not lose access. It needs more setup, documentation and regular recovery tests.

Collaborative multisig

A 2 of 3 multisig where the company holds two keys and a specialist provider holds the third. The provider can help with recovery or co-sign under agreed conditions, but cannot move funds alone. It suits teams that want shared control without running everything themselves. You depend on the provider's processes for the third key, so review them.

Regulated custodian

A regulated third party holds the asset and the keys. The company relies on the custodian's controls, insurance and legal terms instead of managing keys itself. It is often the simplest route where auditors or lenders expect it. The trade-offs are counterparty risk, fees and less direct control.

Exchange-traded products: spot bitcoin ETFs and crypto ETNs

An exchange-traded product gives exposure to the price of bitcoin without the company holding bitcoin or any keys. The company buys shares or notes through a brokerage account, in the same way as other listed securities, and the bitcoin behind the product is held by a custodian appointed by the fund or issuer. That removes key management from the company's side, but it brings different trade-offs:

The company owns a security, not bitcoin. It cannot withdraw bitcoin from the product or send it on chain.
Shares and notes trade only when the exchange is open, while bitcoin markets run around the clock.
The product takes an ongoing fee, and its market price can differ from the price of bitcoin.
The company depends on the broker, the issuer and the product's custodian, and the accounting and tax follow the security, not the cryptoasset rules.

It can fit a company that only wants price exposure and has no need to hold or move bitcoin. It is not a way to hold bitcoin itself.

USUKUNITED STATES

What the company owns

On January 10, 2024 the SEC approved the listing and trading of shares in spot bitcoin exchange-traded products on US national securities exchanges. The SEC describes them as exchange-traded commodity trusts that hold bitcoin. Their offerings are registered with the SEC, but they are not investment companies under the Investment Company Act of 1940, so that Act's rules on valuation and custody of fund assets do not apply, even where a product calls itself an ETF. A shareholder owns shares in the trust, not bitcoin, and holds no keys.

Buying, selling and costs

A company buys and sells shares through a brokerage account during exchange trading hours. Only authorized participants, usually large broker-dealers, create or redeem shares directly with the trust. The sponsor fee, which works like an expense ratio, is paid from the trust's bitcoin, so the bitcoin represented by each share falls over time. Fees differ between products and are set out in each prospectus on SEC EDGAR, alongside the risk factors. Broker commissions and spreads may also apply.

Accounting and tax

ASU 2023-08 covers crypto assets that are intangible assets and reside on a blockchain or similar ledger. A share in a spot bitcoin product is a financial instrument held in a brokerage account, so it is outside that scope and is generally accounted for as an equity security. The tax treatment depends on how the product is structured, which its prospectus describes. Confirm both with your own advisers.

USUKUNITED KINGDOM

What the company owns

In the UK the listed route is mainly crypto exchange-traded notes (cETNs). HMRC describes them as debt securities designed to track the performance of referenced cryptoassets. The holder owns a note issued by the issuer, with rights set by its terms, not bitcoin, and holds no keys. Check the prospectus for how the note is backed and who holds any bitcoin. The FSCS does not cover cETNs, and the FCA retail ban on cryptoasset derivatives remains in place.

Buying, selling and the 8 October 2025 change

A company buys and sells notes through a broker during exchange trading hours. From 8 October 2025 the FCA lifted its ban on selling cETNs to retail clients, for notes on its Official List and admitted to trading on a UK Recognised Investment Exchange. The change is about retail investors. Firms must apply appropriateness checks and risk warnings, and which products a broker offers a company depends on how it categorises the company as a client. Check the issuer's ongoing fee in the prospectus and the broker's charges.

Accounting and tax

A note is a financial instrument, not a cryptoasset held directly, so under FRS 102 or IFRS it is generally accounted for as a financial instrument. HMRC treats cETNs as debt securities, so the Corporation Tax rules that apply follow the instrument and may differ from those for bitcoin held directly (CRYPTO41000). HMRC's cETN guidance covers ISAs and pensions, not companies. Confirm both with your own advisers.

Single-signature wallets: why we do not recommend them for a company

A single-signature wallet has one private key, usually held on one hardware device, with one recovery phrase (commonly a BIP 39 mnemonic). It is simple and cheap, which is why it is common for individuals. For a company treasury we do not recommend it. One device, one backup and usually one person control everything, so a lost or stolen backup, a departure, a mistake or a flaw in the device can block access or lose the funds, and there is no second check before funds move. This is general education, not advice about your company.

A recent example shows why one device should not be the only safeguard. In July 2026 Coinkite, which makes the COLDCARD hardware wallet, published a security advisory. A firmware bug in affected releases meant seeds generated on those devices had less randomness than intended, and Coinkite reports that attackers regenerated some of the weakened seeds offline and took funds. Coinkite states that the devices themselves were not hacked or remotely accessed. Fixed firmware was issued for every affected model. Coinkite advises that updating does not repair a seed already generated on affected firmware, so those seeds should be replaced and the funds moved to a new wallet. In a 2 of 3 multisig with keys generated on separate devices, one weakened key is not enough on its own to move funds.

Checking a provider

The same two questions apply in both markets, whether the provider is a custodian, a collaborative multisig key agent or a broker: what is its regulatory status, and what protection applies if it fails.

USUKUNITED KINGDOM

Regulatory status

The FCA has been the anti-money laundering supervisor for firms carrying on certain cryptoasset activity since 10 January 2020. On 30 June 2026 it published final rules for a new regime, applying to cryptoasset firms granted permission under the Financial Services and Markets Act on or after 25 October 2027. Check what the FCA Financial Services Register says about a firm, and what it is and is not permitted to do, before using it. We have not found a UK defined term that matches the US "qualified custodian".

Protection if a provider fails

The FSCS states that most cryptoassets are not regulated by the FCA, so it cannot protect you if a platform that holds or exchanges them fails. Do not assume the protections that apply to bank deposits apply here.

USUKUNITED STATES

Regulatory status

"Qualified custodian" is a defined term in the SEC custody rule for investment advisers (17 CFR 275.206(4)-2). It covers certain banks and savings associations, registered broker-dealers, futures commission merchants and certain foreign financial institutions. An operating company is not bound by that rule, but the definition is a useful reference point. SEC Staff Accounting Bulletin No. 122, effective January 30, 2025, rescinded SAB 121. Entities that safeguard crypto assets for others now apply the general loss contingency guidance, which may change what some custodians show in their financial statements.

Protection if a provider fails

The FDIC states that deposit insurance does not cover crypto assets and does not protect against the failure of a non-bank firm such as a crypto custodian, exchange or wallet provider.

The questionnaire

Answer seven questions. The result is a starting point for discussion with your advisers, not a recommendation of any provider or product. It never suggests a single-signature wallet.

The decision logic

Rules are checked in order. The first rule that matches decides the model. The matched rule is highlighted.

R1The company wants price exposure only (question 1): exchange-traded product, such as a spot bitcoin ETF in the US or a crypto ETN in the UK.
R2A regulated third party is required (question 2 is Yes): regulated custodian.
R3Team comfort is Low: regulated custodian.
R4Team comfort is Medium: collaborative multisig.
R5Comfort is High and any of: two or more approvers, a large holding, or key-person risk not acceptable: self-managed multisig.
R6Otherwise (High comfort, one approver, small holding, key-person risk accepted): collaborative multisig. The provider-held key means one unavailable person or one faulty device does not decide the outcome. This rule used to suggest a single-signature wallet. It no longer does.

Question 7 never changes the model. It adds a note about separating an operating balance from the reserve.

Practices that apply to every model

Keep a key register: each key or account, its holder by role, its location and the date it was last tested. For an exchange-traded product, record each brokerage account, who can trade and who can withdraw cash.
Separate duties: the person who sets up a transfer should not be the only one who approves it.
Do not let one device or one person be the only safeguard for the treasury.
Test recovery with a small amount at least once a year and after any change of signer.
Never photograph a recovery phrase, type it into a computer or store it in a cloud service.
Keep device firmware up to date from the maker's official source, and read its security advisories.
Apply general security basics to every device and account involved. NIST SP 800-57 on key management (US) and the NCSC small organisations guide (UK) are useful references.

Sources

Primary sources only. Each link was checked on 21 October 2026. Rules change, so confirm the current version with your adviser.

Coming next: a set of working documents for companies that decide to go ahead. See what is coming next.