Prerequisites
- Documented custody model (e.g., 2‑of‑3 or 3‑of‑5) and defined roles.
- Hardware wallets provisioned and registered with fingerprints/xpubs.
- Coordinator wallet/app set up; address book initialized.
Policy templates
Signer quorum: e.g., Treasury 2‑of‑3 for payouts; Board 3‑of‑5 for treasury moves.
Limits: per‑transaction, daily, and monthly caps; tiered approvals above thresholds.
Address allowlists: verified destinations for routine payouts.
Change control: PR‑style approvals for policy/address edits with independent review.
Separation of duties: initiator ≠ final approver; independent auditor verifies receive addresses.
Address verification
- Verify receive addresses on‑device for each signer; compare against coordinator.
- Use test sends for new addresses/beneficiaries before large transfers.
- Maintain signed address attestations for auditors.
Spend workflow
- Initiator drafts payout (recipients, amounts, fee target) and selects an approved address or requests verification.
- Coordinator constructs PSBT; signers verify outputs and change address on‑device, then sign.
- Final approver broadcasts; txid recorded with purpose tag and approver list.
- Receipt archived (txid + signed message) and shared with accounting.
UTXO management
- Consolidate during low‑fee windows; avoid address reuse; prefer Taproot/bech32.
- Label UTXOs with source/purpose; avoid mixing hot and cold funds.
Backups & recovery drills
- Quarterly restore from seed backups into a spare coordinator; spend a small UTXO to a known address.
- Keep encrypted metadata (derivation paths, multisig map) offline in multiple locations.
Emergency playbooks
- Lost or compromised signer → revoke, rotate, and move funds with remaining quorum.
- Compromised coordinator → rebuild policy on clean machine; verify addresses with hardware displays.
- Facility risk → relocate backups; move treasury to an emergency vault setup.
Audit & reporting
- Monthly proof‑of‑reserves snapshot with signed messages from current addresses.
- Export transaction logs with txids, approvers, and purpose tags for accounting.
- Track device lifecycle: firmware versions, rotations, and decommissions.
Recommended tooling
- Hardware wallets with on‑device address display and secure elements.
- Multisig coordinator compatible with your devices; exportable policy files.
- Password manager for non‑seed secrets; offline storage for seed metadata.
Note: Pair this with our article Self‑custody for teams for governance context, and consider Plan B Vault to codify limits and time‑locks.