Multi-Signature Arrangements That Survive an Employee Leaving
Most company multi-signature setups fail on staff turnover rather than on cryptography. Five provisions that prevent it.
A three of five arrangement holds up against key loss and is fragile against personnel change. The fragility is procedural and fixable.
The failure
Two signers leave over a year. Nobody rotates the keys because it is inconvenient and nothing has broken. A third leaves and the threshold can no longer be met.
The assets are not lost. They are unreachable, which for an operating company is the same thing for as long as it lasts.
Provision one: rotation is part of offboarding
Key rotation belongs in the leaver checklist beside returning a laptop. Not as a task to schedule later.
Later does not happen. This is the single most important provision.
Provision two: signers are roles, not people
Document the arrangement by role, with the current holder named separately. A change of holder then updates one line rather than requiring an archaeology exercise.
Provision three: more signers than the threshold needs
Three of five survives two departures. Two of three survives one. Build in slack proportional to turnover.
Provision four: a documented rotation procedure
Written, tested once, and stored where the people who will need it can find it. A rotation performed for the first time under pressure is where mistakes enter.
Test it with a small balance before relying on it.
Provision five: an external signer where appropriate
A lawyer, an accountant or a custody provider holding one key. This survives the departure of the entire finance team, which is the scenario nobody plans for and which does happen.
The documentation that must exist
Who holds which key, where each is stored, what the threshold is, how to rotate, and who to contact. One page, reviewed annually, stored with the company’s other critical documents.
What this is competing against
A regulated custodian, where personnel change is their operational problem rather than yours. That is a genuine alternative rather than a lesser one.
A venue with segregated client accounts handles key management continuously, with staff turnover absorbed internally. Platforms that name their custodian let you assess who is doing that absorbing.
The honest comparison
Self-managed multi-signature exchanges counterparty risk for governance risk. For a company with stable staff and a documented process it is sound. For one without, Collect & Exchange, which is licensed in Cyprus, is the lower-risk option rather than the lazier one.