What a digital asset treasury policy should cover

Companies and family offices usually start holding digital assets informally: a wallet, a small position, an exchange account opened by one person. A written policy turns that into a managed treasury exposure. It is also the first document an auditor, a banking partner or an insurer is likely to ask for. Our outline has eight sections.

Purpose and scope

State why the organization holds or uses digital assets, for example as a treasury reserve, to settle payments in stablecoins or to support a product. Say which entities, wallets and accounts the policy covers, and that activity outside it is not permitted, so that nobody opens an account or moves funds on the organization's behalf without approval.

Objectives and risk appetite

Say what the holdings are for and how much volatility the organization can tolerate. Tie the limits in the next section to a risk appetite approved by the board or the investment committee, not to a number proposed in a meeting.

Eligible assets and limits

List the assets that may be held and the criteria for adding one: liquidity, the quality of the issuer or protocol, regulatory status in the relevant jurisdictions, and the availability of qualified custody. Set limits by asset, by counterparty and in total, either as a share of the treasury or as an absolute amount. For stablecoins, look at the issuer, how the reserve is held and how redemption works, not only the price.

Custody and counterparties

Describe where assets are held and how. Name the approved custodians, exchanges and payment partners, record how each was assessed, and set the share of holdings that may sit with each. State who controls the keys or signing authority, how access is protected and how assets would be recovered if a provider failed. Review each approved counterparty on a set schedule, using criteria such as these.

• Segregation of client assets from the provider's own assets
• Independent assurance reports, where available
• Insurance, and exactly what it covers
• Jurisdiction, and the legal treatment of assets if the provider becomes insolvent
• Operational resilience and incident history

Authorities and approvals

Set out who can propose, approve and execute each type of transaction, with thresholds. Require at least two people for any movement of funds, and separate the person who initiates a transaction from the person who approves it. Where the technology allows, enforce this in the signing set-up, for example with multi-party approval, and not only in a procedure. Say who can change the policy and who can pause activity.

Valuation, accounting and reporting

Accounting depends on the framework applied. Under IFRS Accounting Standards, holdings of crypto assets have generally been analysed under IAS 38 (intangible assets) or, where held for sale in the ordinary course of business, IAS 2 (inventories), following a 2019 agenda decision of the IFRS Interpretations Committee. Under US GAAP, ASU 2023-08 requires fair value measurement, with changes recognized in income, for in-scope crypto assets in fiscal years beginning after December 15, 2024. This area continues to develop, so the policy should name the framework applied, the valuation source and the reconciliation process, and these should be confirmed with your auditors.

Define the reporting that goes to management and the board: positions by asset and custodian, limits and any breaches, realized and unrealized results, and open exceptions.

Liquidity and stress scenarios

Say how quickly holdings can be converted to cash in normal and stressed conditions, and what the organization would do if a counterparty froze withdrawals or an asset lost its peg or its market. A short list of scenarios, with the trigger, the owner and the first action for each, is more useful than a long general statement.

Exceptions, incidents and review

Define how limit breaches and incidents are escalated and recorded, who decides on exceptions, and how often the policy is reviewed: at least annually, and after any significant incident or regulatory change. Keep a log of exceptions. Auditors will ask for it.

Testing the policy

Choose one recent transaction and trace it from request to audit file. Who asked for it? Who approved it, and against which limit? Where was it executed, and who saw the confirmation? How was it recorded, reconciled and reported? Every gap in the trail is a clause the policy needs, or a control that does not yet operate.