Key findings
- Secure keys do not guarantee correct organizational decisions.
- Signature thresholds do not prove independent people, devices or meaningful review.
- Recovery should be demonstrated in controlled exercises, not only described in a document.
The gap in a custody-only treasury plan
Key storage is an important first question, but incorrect requests, changed addresses, absent approvers and reconciliation breaks can occur without stolen keys. Custody is one part of an operating system.
The FSC’s 2025 roadmap concerns corporate participation. It does not supply the company-specific controls required after account opening. Market access and internal operating readiness must be designed separately. [1]
| Role | Responsibility | Separate from |
|---|---|---|
| Request | Purpose, recipient and amount | Final approval |
| Validate | Address, contract and evidence | Request preparation |
| Approve | Limits, purpose and exceptions | Sole execution authority |
| Execute | Submit the approved transaction | Post-transaction reconciliation |
| Reconcile | Ledger, chain and custody records | Changing the original transaction |
Adapt to organizational size. Where roles overlap, document compensating controls.
Independence behind a multisignature threshold
Two signatures out of three provide limited independence if everyone uses a shared account or device. Separate people and equipment still do little if approvers do not inspect the request. The threshold does not substitute for review quality.
Safe documents module-based execution paths as well as owners and thresholds. Reviewing only the ordinary signature process can miss enabled modules or configuration authority. Separate available product capabilities from the organization’s actual setup. [2]
An address needs context
A syntactically valid address is not necessarily the right destination. Network, asset, recipient purpose and authority must also align. An allowlist with weak change controls is not reliable; registration and later changes both need verification.
New counterparties or larger amounts can warrant a separate procedure, potentially including a small test. Successful receipt of a test does not guarantee receipt of every later amount or asset. Record what the test establishes and what it leaves open.
| Situation | Rehearsal |
|---|---|
| Absent signer | Replacement approval and authority changes |
| Lost device | Recovery and revocation of old access |
| Recipient error | Stopping point, contact and correction |
| Reconciliation mismatch | Classification, escalation and suspension criteria |
| External outage | Asset location, pending items and alternatives |
These procedures can first be rehearsed without moving real funds.
Automation should make exceptions clearer
Automated recurring payments reduce manual work while also repeating bad policy quickly. Amount, recipient and frequency limits need controls; policy changes deserve attention comparable to transaction approval.
NIST’s governance and measurement principles are useful where AI classifies requests. Spending authority and exception handling can remain constrained by narrower rules. This is an application of risk-management principles, not certification of a system. [3]
Authority changes matter as much as transfers
Requiring multiple approvals for large withdrawals is insufficient if one person can replace signers or add an execution module. Configuration changes alter future capabilities even before assets move. Classify them separately from routine transactions.
Keep the request, rationale, application time and post-change verification, and compare old and new configurations. Emergency privileges need activation, expiry and revocation rules so they do not become a permanent shortcut. Inspect executable paths, not only documented job titles.
| Control | Review |
|---|---|
| Signer change | Identity, devices, independence and handover |
| Threshold change | Bypass potential and approving authority |
| Module or automation change | New execution paths and spending scope |
| Emergency authority | Activation, expiry and revocation records |
CBK analysis. This is an analytical framework, not observed customer performance or a market benchmark.
Do more controls always mean slower work?
Applying identical approvals to every payment can create delay and ceremonial sign-off. Distinguish repeated low-value tasks from large transfers to new counterparties. Preapproved boundaries can allow routine work to proceed quickly while exceptions receive scrutiny.
The objective is appropriate placement, not the maximum number of controls. Institutional digital-asset operations require connected responsibilities and evidence across normal and exceptional workflows, beyond purchasing a secure wallet.
Scope & limitations
Not an audit of any institution, or legal, accounting or security certification. The role model requires adaptation to the organization and product. No actual keys or funds were accessed.
CryptoBridge Korea analysis based on public materials. Source facts are distinguished from interpretation and hypothetical calculations. References to organizations or projects do not imply their sponsorship or review of this paper.
Sources & scope
- FSC, Roadmap for Phased Corporate Participation in the Virtual Asset Market ↗Roadmap as announced. Plans are not treated as completed implementation.
- Safe, How do Safe Smart Accounts work? ↗Owners, thresholds, modules and guards; not certification of any individual configuration.
- NIST, AI Risk Management Framework Core ↗Govern, Map, Measure and Manage are applied here to payment-authority design.