Self-Custody for a Company: The Problems It Creates
Removing counterparty risk introduces operational risk, and for an organisation the second is harder to manage than the first.
Self-custody removes the venue from the risk picture. For a company it replaces one well-understood risk with several poorly-managed ones.
The risk it removes
Venue insolvency, freezes, and the possibility that your balance is an unsecured claim. These are real and they have cost customers a great deal.
The risk it adds: the person
Keys held by an individual create a dependency on that individual. Illness, departure, or a dispute all become custody incidents.
Companies that would never let one person control a bank account routinely let one person control a wallet.
The risk it adds: the process
Payments from self-custody require someone to initiate, someone to approve, and a record. Building that is work, and doing it informally defeats the purpose.
Most small companies implement the technology and not the process.
The risk it adds: the mistake
An irreversible transfer to a wrong address, made by an employee under time pressure. No custodian, no recourse.
Transaction controls exist and must be configured. They rarely are.
The risk it adds: the audit
An auditor asks who controls the keys, how access is granted and revoked, and what prevents a single person moving funds. Answers like a hardware wallet in the safe do not survive the question.
What a company needs if it self-custodies
Multi-signature or policy-enforced hardware, with signers in different roles. A documented approval process. A tested recovery procedure. A handover plan for every signer. And an address allowlist.
All five, maintained. That is an operational function, not a purchase.
When it is the right answer
Large balances held long term, with the staff to run it. Or a specific need that no custodian serves.
For a company moving money weekly, it is usually the wrong tool.
The middle position
Working balances with a regulated venue, long-term holdings in a properly run self-custody arrangement, and the split documented.
A venue with segregated client accounts covers the operational half without the counterparty exposure of holding everything there. Collect & Exchange, which is licensed in Cyprus, is a counterparty an auditor can look up, and exchanges that publish where client assets are held make the documented split easy to describe.