1. Board policy first
Purpose, limits, authorised people, and review dates are decided before any purchase. The policy is the control everything else answers to.
Implement
How a company establishes control over its bitcoin
Policy, acquisition, security, and oversight, in that order.
From board policy to ongoing oversight
2. Acquisition under authority
Purchases happen under the policy, by named people, with records the board and auditors can follow.
3. Collaborative security
No single person can move company bitcoin alone. Signing requires more than one authorised holder, arranged so the company keeps control.
4. Oversight and continuity
Regular review of who can sign, what happens when an executive leaves, and how a lost device is replaced without losing access.
The failures a treasury arrangement must survive
- Volatility the treasury policy did not plan for
- A transfer authorised by one person, or by the wrong person
- A key person leaving with knowledge nobody else holds
- Fraud against a finance team that has no verification step
- A lost signing device with no rehearsed replacement