Guides / Glossary / Key register
Glossary

Key register: the company record of its keys

A company record of each key, its holder by role, its location and when it was last tested. It never contains the key or recovery words.

Education only

Definition. A company record of each key, its holder by role, its location and when it was last tested. It never contains the key or recovery words.

What goes in it

A key register is an internal document, kept by the company secretary, finance lead or board, that describes the company's bitcoin keys without revealing them. A typical entry lists the key's label, the role that holds it (for example, finance director), the device make and serial number, firmware version, the location of the device and its backup, seal or bag numbers, the date it was created, the date of the last successful test and the next review date. It also records where copies of the wallet descriptor are kept.

It should never contain recovery words, passphrases, PINs or photographs of backups. If the register leaks, an attacker should learn where to look but not have what they need.

Why it matters for a company

People leave, fall ill and die. A company that relies on one person's memory of where the keys are has a continuity problem. The register turns custody into a documented process that a successor, the board or an executor can follow. NIST's key management guidance treats an inventory of keys, their owners and states as basic hygiene for exactly this reason.

It also supports the books and the audit. GOV.UK says a limited company must usually keep its records for six years from the end of the last financial year they relate to, and the IRS says records that verify basis should be kept for as long as they are needed. A dated register of who controlled which key, and when, is part of that trail.

Example only, fictional. After a key ceremony, the company secretary records three keys by role, notes the tamper evident bag numbers and storage places, and files the register with the board minutes that approved the set up. The next board meeting after any change of director includes a register review.

Common mistakes

Sources

Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.

  1. NISTSP 800-57 Part 1 Rev. 5: Recommendation for key management
  2. NISTSP 800-84: Guide to test, training and exercise programmes for IT plans and capabilities
  3. GOV.UKRunning a limited company: company and accounting records
  4. IRSHow long should I keep records?
Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.