Company bitcoin multisig: how it works

Who holds the keys is one of the biggest operational decisions for a company holding bitcoin. Multisig is a way to make sure no single person, and no single device, decides what happens to the treasury. This page explains how it works and the two common ways companies run it. It is general education, not advice, and it does not recommend any provider.

What multisig means

A multisig wallet needs M of N keys to sign a transaction. A common set-up for a company is 2 of 3: there are three keys, and any two can sign. Keys sit on separate devices, with separate people, in separate places.

That gives two protections at once. No single person can move funds alone, and losing one key does not lose access. The trade-off is more setup, more documentation and regular recovery tests (self-managed multisig).

Option 1: self-managed multisig

The company holds every key. It suits a team that is comfortable with hardware wallets, backups and recovery tests, and that wants to rely on no one else. The company owns every process, from setting up signers to testing recovery after someone leaves.

Option 2: collaborative multisig

A 2 of 3 multisig where the company holds two keys and a specialist provider holds the third. The provider can help with recovery or co-sign under agreed conditions, but cannot move funds alone. It suits teams that want shared control without running everything themselves. You depend on the provider's processes for the third key, so review them (collaborative multisig).

Before using any provider, ask the same two questions you would ask a custodian or broker: what is its regulatory status, and what protection applies if it fails (checking a provider).

Why not a single-signature wallet?

A single-signature wallet has one private key, usually on one device, with one recovery phrase. It is simple and common for individuals, but for a company treasury we do not recommend it. One device, one backup and usually one person control everything, so a lost backup, a departure, a mistake or a device flaw can block access or lose the funds, and there is no second check before funds move (why not single-sig).

Controls that apply to every set-up

Whichever model you choose, the custody guide lists practices that apply to all of them:

• Keep a key register: each key, its holder by role, its location and the date it was last tested.
• Separate duties: the person who sets up a transfer should not be the only one who approves it.
• Test recovery with a small amount at least once a year and after any change of signer.
• Never photograph a recovery phrase, type it into a computer or store it in a cloud service.
• Back up each key's recovery phrase separately, for example on steel, with a copy of the wallet descriptor alongside (steel backups for a 2 of 3 multisig).
• Avoid reusing receive addresses and keep the descriptor and xpubs private, which also limits exposure to any future quantum risk (Bitcoin and quantum computing).
• Keep device firmware up to date from the maker's official source.

Put it in the policy

The custody section of a treasury policy should record the model chosen, the key register and the recovery testing schedule, and the approvals section should set M of N approvers by role. The policy generator drafts both for your advisers to review.

Not sure which model fits? The free custody questionnaire asks seven questions and gives a starting point for discussion with your advisers. It runs in your browser, and it never suggests a single-signature wallet.

Sources

Primary sources only. Each link was checked on 21 October 2026. Rules change, so confirm the current version with your adviser.

1. Bitcoin BIPsBIP 11: M of N standard transactions (multisig)
2. Bitcoin BIPsBIP 174: Partially Signed Bitcoin Transaction format (PSBT)
3. NISTSP 800-57 Part 1 Rev. 5: Recommendation for Key Management
4. NCSCSmall organisations guide to cyber security
5. FCAFinancial Services Register

Read the full guides: sizing, custody and treasury policy.