Keyholder safety and privacy

Sources checked 10 November 2026. This page is about the people who hold a company's bitcoin keys: keeping them safe and keeping their details private. It is not security, legal or travel advice and not a recommendation to buy, sell or hold bitcoin. If anyone is in immediate danger, call the police on 999 in the UK or 911 in the US. If anything here conflicts with a linked source, the source wins.

Why keyholders can be targets

Bitcoin transactions are final, so criminals who learn that someone controls bitcoin may try to pressure that person directly rather than attack the technology. The controls below make that pointless and make the people harder to find.

Our judgement, not a rule: do not post about the company's holdings or who holds keys, and ask staff, advisers and family to do the same. Treat the key register as confidential.

Choose your country for the public register rules.

UK: addresses on the Companies House register

Companies House says a director must give two addresses: a service address, which appears on the public register, and the usual residential address, which is kept on a private register. The service address is a correspondence address for the public register. Companies House says it only provides home addresses to credit reference agencies and specified public authorities such as the police, and that if you do not want your home address to be publicly available you should choose a different address as your service address or the company's registered office.

Source: GOV.UK (Companies House): Your personal information on the Companies House register: service address and usual residential address.

Sections 240 to 242 of the Companies Act 2006 make a director's usual residential address protected information: the company must not use or disclose it except in limited cases, and the registrar must omit it from the public material where it is required to be stated. Section 790ZF applies the same protection to the usual residential address of a person with significant control.

Source: legislation.gov.uk: Companies Act 2006, section 240: protected information (directors' residential addresses), legislation.gov.uk: Companies Act 2006, section 241: restriction on use or disclosure by the company, legislation.gov.uk: Companies Act 2006, section 242: restriction on disclosure by the registrar, legislation.gov.uk: Companies Act 2006, section 790ZF: protection of a PSC's usual residential address.

If a home address has already been used as a service address or registered office, Companies House lets you apply to remove it from documents on the register, at £34 a document, and says that if the address is still the registered office of an active company, the registered office must be changed first. Separately, a director, LLP member or PSC at serious risk of violence or intimidation because of the company's activities can apply, for £100, to stop Companies House giving their home address to credit reference agencies, under section 243 or section 790ZF, with evidence such as a police incident number.

Source: GOV.UK (Companies House): Removing your personal details from the Companies House register (form SR01, £34 a document), GOV.UK (Companies House): Apply to protect your details on the Companies House register (risk of violence or intimidation), legislation.gov.uk: Companies Act 2006, section 243: permitted disclosure by the registrar (credit reference agencies).

Our judgement, not a rule: holding bitcoin on its own may not meet the risk test for credit reference agency protection, which is decided on the evidence. Using a service address and a separate registered office from the start costs little and avoids the problem.

UK: travel

Schedule 7 to the Terrorism Act 2000 lets an examining officer at a port or in the border area question a person entering or leaving the UK and examine goods they carry. Check the Foreign, Commonwealth and Development Office travel advice for each destination before a keyholder travels.

Source: legislation.gov.uk: Terrorism Act 2000, Schedule 7: port and border controls (questioning and examining goods), GOV.UK (FCDO): Foreign travel advice.

US: what LLC filings show

State rules differ. In Delaware, 6 Del. C. 18-201 says a certificate of formation must set out the LLC's name, the address of its registered office and the name and address of its registered agent, and any other matters the members choose to include. Other states may require members, managers or organisers to be named in formation documents or annual reports, so check the state you form in and the registered agent address you use.

Source: Delaware Code: 6 Del. C. 18-201: certificate of formation of a limited liability company.

FinCEN's beneficial ownership page says US companies are now exempt from beneficial ownership information reporting and no longer need to file reports, a position first introduced by an interim final rule published on 26 March 2025 and since made permanent by a final rule. That reporting was never public, but it is one less record to manage.

Source: FinCEN: Beneficial ownership information reporting: US companies exempt.

US: travel

CBP Directive 3340-049B, effective 1 January 2026, sets out how US Customs and Border Protection searches electronic devices at the border, inbound and outbound. The State Department's Smart Traveler Enrollment Program lets US citizens register trips abroad.

Source: US Customs and Border Protection: CBP Directive 3340-049B: border search of electronic devices (effective 1 January 2026), US Department of State: Smart Traveler Enrollment Program (STEP).

Travel plans for keyholders

• The company should be able to sign without the travelling keyholder. With a 2 of 3, the other two can sign if needed.
• Never travel with recovery words or steel backups. If a signing device travels, it should not be the only route to that key.
• Do not let two keyholders travel together with their keys, or both be away at once if the third key is with a provider that needs one of them to act.
• Tell the other keyholders the travel dates, and agree that unusual signing requests during the trip are checked by phone first.

A duress plan

Our judgement, not a rule: agree this as a board and write it into the policy.

• No keyholder is ever expected to resist a threat. Personal safety comes first, always.
• Because no single keyholder can move funds, a keyholder under pressure can truthfully say they cannot do it alone.
• Other keyholders do not sign any unplanned transaction, and confirm every request by a call to a known number.
• Provider withdrawal delays and allow lists stay switched on, so an unusual withdrawal can be stopped.
• After any incident, call the police, then follow if company bitcoin is lost or stolen.

Common questions

Does the company have to tell anyone who holds the keys?

The key register is an internal record for the board and, where needed, the auditor. Keep it confidential and share it only as the policy allows.

Can a director keep a home address off the public register?

Companies House says that if you do not want your home address to be publicly available, you should choose a different address as your service address or the company's registered office.

Is a collaborative custody provider a safety measure?

It can be one: a provider key with its own checks means a keyholder cannot complete a transaction without a second party. See collaborative custody.

Common mistakes

• A director's home address as the registered office from the day the company was formed.
• Two keys kept in the same home or office.
• Posting about the company's bitcoin, or naming keyholders, on social media.
• Travelling with recovery words.
• No agreed plan for what keyholders do if one of them is pressured.

Read next

• Securing the accounts, email, exchange logins and the domain.
• 2 of 3 multisig, why one key is not enough.
• Key ceremony, where each key goes.
• Continuity, when a keyholder cannot act.
• Security lessons, what past incidents teach.
• Directors' duties, the board's role.

Sources

Primary sources only. Each link was checked on 10 November 2026. Rules change, so confirm the current version with your adviser.

1. GOV.UK (Companies House)Your personal information on the Companies House register: service address and usual residential address
2. legislation.gov.ukCompanies Act 2006, section 240: protected information (directors' residential addresses)
3. legislation.gov.ukCompanies Act 2006, section 241: restriction on use or disclosure by the company
4. legislation.gov.ukCompanies Act 2006, section 242: restriction on disclosure by the registrar
5. legislation.gov.ukCompanies Act 2006, section 790ZF: protection of a PSC's usual residential address
6. GOV.UK (Companies House)Removing your personal details from the Companies House register (form SR01, £34 a document)
7. GOV.UK (Companies House)Apply to protect your details on the Companies House register (risk of violence or intimidation)
8. legislation.gov.ukCompanies Act 2006, section 243: permitted disclosure by the registrar (credit reference agencies)
9. legislation.gov.ukTerrorism Act 2000, Schedule 7: port and border controls (questioning and examining goods)
10. GOV.UK (FCDO)Foreign travel advice
11. Delaware Code6 Del. C. 18-201: certificate of formation of a limited liability company
12. FinCENBeneficial ownership information reporting: US companies exempt
13. US Customs and Border ProtectionCBP Directive 3340-049B: border search of electronic devices (effective 1 January 2026)
14. US Department of StateSmart Traveler Enrollment Program (STEP)