Bitcoin Custody Agreements and Control of Business Funds

By Hank FasthoffSeptember 16, 2026

A business holding bitcoin can encounter a problem long before any funds are lost. A payment may require a signer who has left the company, a provider may demand additional verification, or two owners may issue conflicting instructions. The agreement and the company’s authorizations determine how those situations are handled and who bears the resulting loss.

Choosing a custody arrangement therefore involves decisions about the way your business will use its bitcoin. A company holding reserves may accept withdrawal procedures that would disrupt regular supplier payments. Before committing funds, you should compare the proposed terms with the access, approval, and recovery arrangements your business requires.

Which Company Is Responsible

The legal entity responsible for custody may differ from the company providing the software, arranging a trade, or extending a loan. Each relationship can involve a separate agreement, even when the services appear in one account. Identifying those entities establishes which company owes each obligation and which documents govern it.

Unchained’s terms, updated July 30, 2026, illustrate the distinction. Section 6.2 describes arrangements in which customers and designated users hold enough keys to transfer bitcoin without Unchained, with qualifications for delegated and shared key arrangements. Section 6.5 addresses qualified custodial accounts in which the customer holds fewer than the required keys and a separate agreement with the custodian governs. The terms also exclude Gannett Trust Company, LLC from the defined Unchained contracting group.

The agreement package includes incorporated policies, fee schedules, and any negotiated amendments. Those documents can contain conditions absent from a sales presentation, including processing restrictions and limits on recovery. You should confirm that commitments about access, recovery assistance, and service times appear in the applicable documents and identify which terms control if the documents conflict.

Who Can Authorize a Transfer

A signing key enables the creation of a digital signature authorizing a bitcoin transaction. In a multisignature arrangement requiring signatures from two of three keys, any qualifying pair can authorize a transaction. The company has to account for who controls each key and whether one person controls enough keys to sign without another participant.

Technical ability and company authority require separate analysis. An officer may possess a key while having permission to use it only after another officer approves the transaction. You should document who may initiate, approve, and sign transfers, then have the technical team explain how the proposed setup enforces those decisions. Authority to replace signers or change approved destinations belongs in the same analysis.

For a Texas limited liability company, Business Organizations Code § 101.254 governs when acts of specified company agents bind the company. An agent’s act apparently carrying out the ordinary course of business binds the company unless the agent lacks actual authority and the counterparty knows of that lack. Under subsection (c), an act that is not apparently within the ordinary course binds the company only if authorized in accordance with the applicable statutory title. Whether a treasury transfer falls within the ordinary course depends on the business and transaction.

The provider’s authorized person records and agreed instructions require comparison with those company authorizations. Departures, incapacity, and disputes among owners also require procedures for replacing signers and maintaining access. Removing an employee’s platform permissions addresses only one part of the problem because the employee may possess signing keys or recovery information outside the platform.

When the Business Can Access Its Bitcoin

A withdrawal right depends on the conditions for exercising it. The agreement may distinguish submitting a request, completing verification, and submitting the transaction to the Bitcoin network. Network confirmation is a separate event, so a business planning a payment has to account for both the provider’s processing obligations and the transaction’s confirmation.

For example, BitGo’s custody agreement, §§ 2.5–2.6, allows clients to configure video verification criteria while reserving discretion to require verification for any transaction. Its 24 hour processing period begins after any required video verification, excludes weekends and U.S. federal holidays, and permits additional time for security checks on large or suspicious transactions. The same section disclaims representations and warranties about asset availability or accessibility. Those provisions require interpretation together when assessing a delayed withdrawal.

For any provider, the practical question is what happens when a request stops progressing. Conflicting instructions, disputed authority, unpaid fees, and security concerns can require different responses. You should establish what notice the provider promises, how the company can resolve the objection, and who can authorize that response. The company also has to account for who can change the platform settings governing verification and approvals.

Ownership and the Provider’s Use of Assets

A custody agreement warrants examination for the ownership interest your company retains and any permission for the provider to lend, pledge, or otherwise use its bitcoin. Account titling and transaction records support the identification of company assets. An omnibus wallet combines holdings for multiple customers, making the provider’s records important to establishing each customer’s interest.

The New York Department of Financial Services’ September 30, 2025 guidance addresses custodians operating under its BitLicense regime or New York limited purpose trust charters. It expects separation of customer assets from corporate assets and permits individual or omnibus customer wallets with appropriate accounting. The guidance also addresses preservation of customer ownership, restrictions on the custodian’s use of assets, and arrangements with additional custodians. Those expectations apply within its defined regulatory scope.

If another custodian will hold the assets, the contractual analysis extends to that relationship. Relevant terms address which obligations the contracting provider retains, whether another entity claims a lien against the assets, and what happens if the provider changes custodians. A promise to safeguard company bitcoin requires examination alongside any permission to transfer it elsewhere.

If the Provider Fails

The provider’s legal status determines which insolvency rules apply. In a Bankruptcy Code proceeding, 11 U.S.C. § 541(d) limits the estate’s interest where the provider holds legal title without the corresponding equitable interest. Applying that rule requires examination of the legal relationship, records, and assets.

Uninsured national banks have a separate OCC receivership framework. Under 12 C.F.R. § 51.8(b), assets held in a fiduciary or custodial capacity, as designated in the bank’s records, are excluded from its general assets and from payment of unrelated creditor claims. In either setting, an ownership clause alone cannot establish the timing or outcome of recovery. How the provider holds and records the company’s assets is part of the analysis.

Responsibility for a Loss

A provider can accept an obligation while imposing a contractual limit on recovery for its breach. If the proposed cap is a few months of service fees, the amount recoverable under that provision could be far smaller than the bitcoin balance exposed to a loss. You should compare the cap with the amount the company intends to hold and identify the conduct and losses to which it applies.

Exceptions require examination alongside the cap. A contract may exclude specified misconduct from one limitation and impose another ceiling elsewhere. Provisions governing excluded damages, valuation dates, and the method for valuing lost bitcoin can also affect the amount claimed and the remedy available, subject to applicable law.

Indemnification provisions can require your company to defend the provider or pay specified losses arising from claims against it. Their effect depends on what triggers the obligation, who controls the defense, and whose consent a settlement requires. Any limit on the company’s indemnification obligations warrants comparison with the limits protecting the provider.

What Insurance Covers

The FDIC excludes crypto assets from deposit insurance, including when offered through an insured bank. Protection for bitcoin under a private policy requires a separate coverage analysis.

A provider’s statement that it has insurance leaves unanswered questions about the proposed account. Policy terms identify the insured parties, covered events, exclusions, deductibles, and limits. You should request documentation addressing whether the particular custody arrangement is covered, whether limits are shared across customers or incidents, and whether the company has rights under the policy or depends on the provider to pursue a claim.

Insurance and contractual liability can differ. If an insurer denies coverage, the company may have to pursue payment from the provider under the agreement. Evaluating both helps the business understand the remedies available after a loss and the possible sources of payment.

Leaving the Arrangement and Resolving Disputes

An exit plan addresses withdrawal of the bitcoin, access to transaction records, replacement of signing arrangements that depend on the provider, and account closure. Notice periods, final fees, and withdrawal conditions can affect completion. Any authority to deduct fees from assets or retain control pending payment warrants examination, particularly when an invoice is disputed.

The dispute provisions govern the agreed procedure for pursuing relief. Counsel examines the governing law, court or arbitration forum, notice requirements, filing deadlines, and provisions addressing emergency relief. Company authorizations, transfer instructions, transaction identifiers, and correspondence about a refused request can support the company’s position, making access to those records part of the agreement analysis.

Before signing, you should understand which terms require negotiation, which company authorizations require drafting, and which operational questions require answers from the provider or technical team. Counsel can assess the legal commitments and document the company’s decisions. The technical team can separately confirm how signing and recovery operate, allowing your business to evaluate the agreement against the system it will use.