Risk warning: This article is education and advisory only. Nothing here is investment, tax or legal advice, and we make no price predictions. Crypto-assets are volatile, largely unregulated, and you can lose everything. Rules differ by country. Take professional advice before acting.
Boring is a feature, not a bug
The operators who last in crypto have one thing in common: their custody setup is dull. No drama, no 3am panics, no screenshots of an empty wallet. Boring means the money is where it should be and only the right people can move it.
Most losses aren't clever hacks. They're process failures — a key in the wrong place, a rushed transfer, a counterparty nobody vetted. Fix the process and you fix most of the risk.
Here's the checklist we walk clients through when crypto touches their operations.
Custody: decide who holds the keys — and mean it
The first question is deceptively simple: who can move the funds? Get this wrong and everything downstream is theatre.
Self-custody vs custodial
- Self-custody means you hold the private keys. Total control, total responsibility. Lose the keys, lose the funds — there's no support line.
- Custodial (an exchange or regulated custodian) means someone else holds the keys. Convenient, but you inherit their solvency and security risk. "Not your keys, not your coins" exists for a reason.
Most operators land somewhere in the middle: a custodian for working liquidity, self-custody for reserves.
Hardware wallets and multisig
For any meaningful balance, a hardware wallet is the baseline. The keys never touch an internet-connected machine.
Go one better with multisig — say, two of three keys required to sign. Now no single person, and no single stolen device, can drain the account. Split the keys across people and locations. This is the closest crypto gets to a proper dual-authorisation control, the kind any finance team already understands.
Key management: the part everyone skips
A seed phrase written on a sticky note in a drawer is a business continuity failure waiting to happen.
Treat keys like you'd treat the master password to your payroll:
- Never store a seed phrase digitally — no photos, no cloud notes, no password manager for the raw phrase.
- Use steel backups, not paper. Fire and water happen.
- Store copies in separate physical locations.
- Write down what happens if a keyholder is unavailable. If only one person can access the funds, you don't have a business asset — you have a liability with a pulse.
This is exactly the kind of dull, documented control we help embed when we advise operators — the same discipline that shows up in our international work across regions where banking is unpredictable.
OTC liquidity: size matters
Trying to move a large sum through a retail exchange order book will move the price against you and flag every compliance system in the building. That's what OTC (over-the-counter) desks are for.
What to check before you use one:
- Regulation and registration in their jurisdiction.
- Settlement terms — who sends first, and what's the escrow arrangement? "You send, then I'll send" from a stranger is how people get robbed.
- Track record and references you can actually verify.
- Clear fee structure — a good desk quotes a spread, not a mystery.
A reputable desk gives you a firm quote, a settlement window, and a paper trail. Anything less, walk.
Fiat on/off-ramps: the friction is the point
Getting money in and out of the banking system is where deals stall. Plan the off-ramp before you accept the on-ramp.
- Keep KYC documentation ready and consistent across providers.
- Use ramps that suit your corridor — the right rail for the UK isn't the right rail for Lagos or São Paulo.
- Expect banks to ask questions about crypto flows. Have your source-of-funds story clean and documented.
- Don't concentrate everything through one provider. If they freeze your account, you want an alternative.
Spotting the scams built for operators
The cons targeting business users are more sophisticated than the "send me one Bitcoin" spam.
Fake and 'flash' USDT
"Flash USDT" is a con where a sender appears to transfer tether that later vanishes or was never real — a spoofed transaction, a fake token contract, or a screenshot dressed up as a confirmation. Rule: never release goods, cash or countervalue until funds are confirmed on-chain, at the correct contract address, with enough confirmations. Verify the token contract yourself. Don't trust a block-explorer link someone hands you.
Honeypot tokens
A honeypot lets you buy but not sell — the contract blocks your exit. If a counterparty insists on settling in an obscure token you've never heard of, that's a red flag. Stick to well-established assets and known contract addresses.
The general tells
- Urgency and time pressure.
- Requests to move to a "special" wallet or app.
- Guaranteed returns (there are none).
- Anyone who benefits from you not verifying on-chain.
Make the checks automatic
The strongest defence is a repeatable process that doesn't rely on someone being sharp at 3am. We help operators build that — from documented settlement workflows to forms and workflow automation that force the right checks before any transfer is released, and AI agent systems that flag anomalies in real time.
More on our approach on the crypto page.
Talk to an operator
If crypto is part of how your business moves money and you want the custody and process built properly — dull, documented, hard to break — book a call or get in touch. We've done it in hard corridors and we'll tell you the truth, not the hype.