Writing a crypto treasury policy: what it should cover
The sections a board-approved digital asset treasury policy needs, from custody and signing limits to stablecoin and DeFi rules.
A treasury policy turns your appetite for digital asset risk into rules people can follow and auditors can test. If you hold crypto or stablecoins and do not have one, the gaps usually show up first as unclear signing authority and untracked wallets.
No single standard prescribes the content of a crypto treasury policy. The outline below draws on control guidance, regulator custody conditions and stablecoin law, and leaves the thresholds for your board to set.
1. Scope and approved assets
List the assets and chains the entity may hold, and the purpose of each (operating cash, reserves, payroll, investment). Anything not on the list needs a documented exception. For each asset, record who decides it is approved and what evidence is needed, for example liquidity, legal review and whether your auditor can obtain reliable pricing. PCAOB staff have flagged that third-party pricing information must be evaluated for reliability [2].
2. Custody model
State whether assets are self-custodied, held with a third-party custodian, or both, and why. If you use a custodian, set due diligence criteria. A useful benchmark is the conditions SEC staff attached when allowing registered advisers to treat certain state trust companies as custodians: authorization by the state banking regulator, a written agreement that bars lending or rehypothecation without consent and requires segregation, written policies on private key management and cybersecurity, audited financial statements, and an internal control report from an independent accountant [3]. That letter applies to registered advisers and funds; for an operating company it is a reference point, not a rule.
PCAOB staff note that auditors look at custody terms, including side arrangements and whether assets are commingled at shared addresses [2]. Your policy should require those terms to be reviewed before an account is opened.
3. Wallet tiers, limits and signing authority
COSO's blockchain paper describes key controls the policy should embed: manage key access based on hot or cold storage, consider multi-signature or key sharding, and keep people who approve on-chain transactions separate from those who record them in the books [1]. PCAOB staff add that key access alone does not prove sole ownership, so controls over key generation and maintenance matter [2].
| Tier | Use | Example controls |
|---|---|---|
| Hot | Day-to-day payments | Low balance cap; 2-of-3 signing; daily sweep of excess to warm |
| Warm | Weekly operations, payroll | Higher cap; 3-of-5 signing incl. finance lead; allow-listed destinations only |
| Cold or custodian | Reserves | Board-set threshold; signers from at least two functions; time delay on withdrawals |
4. Counterparty limits
Set maximum exposure per exchange, custodian, market maker and stablecoin issuer, as a share of total digital assets. Require approval before adding a counterparty and a periodic review of each one's licensing, audit reports and incidents.
5. Stablecoin rules
Define which stablecoins you may hold and on what criteria, such as the issuer's regulatory status, reserve disclosures and redemption terms. In the US, the GENIUS Act requires permitted payment stablecoin issuers to hold reserves at least one to one in listed assets, publish their reserve composition monthly with examination by a registered public accounting firm, disclose redemption procedures, and not pay interest or yield to holders [4]. The Act takes effect on the earlier of 18 months after enactment (18 January 2027) or 120 days after final regulations [4]. As of mid-October 2026 the OCC had said it expected to finalize its rule by November [5]; check whether it has been published before you rely on a date.
In the EU, MiCA lets only credit institutions and electronic money institutions issue e-money tokens, gives holders a right to redeem at par at any time, and bars interest on those tokens [6]. ESMA has stated that from 1 July 2026 any provider offering crypto-asset services to EU clients without a MiCA licence is in breach of EU law [7]. Your policy should require you to confirm that EU exchanges and custodians you use are authorized.
6. DeFi permissions
Say whether DeFi activity is allowed at all. If it is, list approved protocols and actions (for example lending supply but not borrowing), exposure caps, required smart-contract review, and who may approve token allowances. Treat each new protocol as a new counterparty.
7. Accounting policy elections
Record the elections finance has made so they are applied consistently: cost-basis method (Deloitte notes FIFO, specific identification and average cost as examples, and that the method must be disclosed under ASU 2023-08), treatment of transaction costs, the principal-market and cut-off approach for fair value, and how you classify stablecoins [8]. Changes should go through the same approval as the policy itself.
8. Governance and review
Name the owner (usually the CFO), the approving body (board or a committee), the review cadence (at least annually and after any major incident or regulatory change), and the reporting the board receives, such as holdings by tier and counterparty, limit breaches and exceptions granted.
What to do
- Inventory current holdings, wallets, signers and counterparties before drafting; the policy should describe reality, then tighten it.
- Set tier caps and signing thresholds as figures the board approves, not ranges.
- Write custodian and stablecoin issuer criteria you can check from documents.
- Record GENIUS Act and MiCA status for each stablecoin and provider, and recheck when the US final rules land.
- Attach your accounting elections as an appendix so treasury and accounting use the same rules.
- Schedule the first review date in the approval minutes.
Sources
- Blockchain and Internal Control: The COSO Perspective (COSO)
- Spotlight: Inspection Observations Related to Public Company Audits Involving Crypto Assets (PCAOB staff)
- Simpson Thacher & Bartlett LLP, no-action letter (September 30, 2025) (SEC Division of Investment Management)
- Public Law 119-27, Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act) (U.S. Government Publishing Office)
- Comptroller: GENIUS Act final rule will be out by November (ICBA)
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) (EUR-Lex)
- Statement on the End of Transitional Periods under MiCA (ESMA75-113276571-1679, 17 April 2026) (ESMA)
- Frequently Asked Questions About Implementation of the FASB's New Crypto Assets Standard (Heads Up, Vol. 31, Issue 7) (Deloitte)
General information for finance teams, current as of publication. Not legal, tax or accounting advice.