As corporate treasuries explore adding bitcoin to their reserves, the conversation quickly lands on custody. The assumption is straightforward: if a federally regulated bank can hold the private keys, the security problem is solved. In 2020, the Office of the Comptroller of the Currency (OCC) clarified that federally chartered banks and thrifts may provide custody services for crypto assets, including holding the unique cryptographic keys that control bitcoin. That move was widely heralded as a milestone—an institutional safe harbor for digital asset safekeeping. But as treasurers dig deeper, it becomes clear that qualified custody is only one piece of a much larger risk puzzle.
The Safekeeping Promise: What the OCC Custody Framework Actually Delivers
Bank-qualified custody for bitcoin does offer a real, tangible improvement over self-custody or unregulated third-party solutions. Federally supervised custodians must adhere to operational controls, audit standards, and cybersecurity protocols that dramatically reduce the risk of external hacks, lost keys, or rogue employees. When a treasury entrusts its bitcoin to an OCC-regulated bank, it can expect robust key-management infrastructure, multi-signature schemes, and possibly insurance wraps that cover certain operational failures. In essence, qualified custody makes it far harder for a hostile actor to steal the raw private keys.
However, the OCC’s guidance was deliberately narrow. It did not classify crypto custody as traditional bank deposits nor extend FDIC insurance coverage to digital assets. A custodied bitcoin still sits off the bank’s balance sheet as a non-liability asset that, in a bank insolvency, falls outside the depositor preference hierarchy. So while a custodian can prevent the digital equivalent of a bank heist, it cannot offer the legal and financial backstops that treasurers are accustomed to with cash deposits.
Bearer Assets and the “Singleness of Money” Problem
Even technically perfect custody does not change the nature of bitcoin itself: it is a bearer instrument. Possession of the private key is possession of the asset. This quality aligns bitcoin with physical gold or stablecoins that circulate peer-to-peer, a characteristic that the Bank for International Settlements recently examined. In a BIS Bulletin on stablecoins and tokenised deposits, the authors warn that private tokenised monies that circulate as bearer instruments may trade away from par, violating the “singleness of money.” Tokenised deposits, by contrast, settle in central bank money and are more likely to retain par-value fungibility.
Bitcoin, which has no issuer and no par-value anchor, takes this bearer-instrument risk to an extreme. No matter how securely a bank vault holds the keys, the asset’s value can swing violently against the treasury’s functional currency. Qualified custody cannot guarantee exchange value, enforce a peg, or provide a claim on a central bank liability. For a corporate treasury managing working capital, debt obligations, or shareholder expectations, that distinction matters enormously. The safety of the keys is not the same as the safety of the purchasing power.
Beyond the Vault: Balance-Sheet and Strategic Risks
Focusing solely on custody risk also risks overlooking two larger threats that are inherent to holding bitcoin on a corporate balance sheet.
First, there is balance-sheet BTC risk. Bitcoin is classified as an indefinite-lived intangible asset under current accounting standards. That means even small price drops can trigger impairment charges that flow directly through the income statement, reducing reported earnings. A treasury may have perfect custody and still see its quarterly results battered by a 20% drawdown that never involved a security breach. Qualified custody does nothing to dampen that accounting volatility.
Second, broad treasury-company risk emerges when a corporate cash-management strategy becomes concentrated in a single volatile asset. If a large portion of cash reserves is shifted into bitcoin, the enterprise may face sudden liquidity crunches or damaged credit metrics during a market downturn—regardless of how safely the keys are held. Strategy risks of this magnitude can ripple into supplier relationships, debt covenants, and even equity valuations. No custodian, however well-regulated, can insulate a treasury from the strategic consequences of asset allocation decisions.
Qualified custody is an essential building block. It addresses the fears that kept many corporate treasurers away from bitcoin in its early years—outright theft, key mismanagement, and operational chaos. Yet it leaves untouched the deeper layers of risk: the bearer-instrument volatility that defies par-value conventions, the accounting quirks that translate price swings into income-statement impacts, and the governance challenge of putting a company’s financial resilience at the mercy of an uncorrelated digital asset. Treasuries that ignore these dimensions, lulled by the comfort of a bank-branded vault, may find that the greatest risk was never about where the keys were stored at all.
