Bitcoin Custody Family Office: The Complete 2026 Guide

Home › Research › Bitcoin Custody for Family Offices Est. 30 min read

Custody is not a technical footnote in your Bitcoin strategy. It is your Bitcoin strategy — at least for the first ten years you own it. Every catastrophic Bitcoin loss in history — Mt. Gox, QuadrigaCX, FTX, countless individual wallet disasters — was not a Bitcoin failure. The protocol performed exactly as designed. They were custody failures: failures of who held the keys, how they were secured, and what happened when the original keyholder was unavailable.

For a family office, this distinction has direct, immediate consequences. A poorly structured custody arrangement exposes generational wealth to permanent, unrecoverable loss — with no insurance backstop, no legal recourse, and no second chances. A well-structured arrangement removes single points of failure, integrates with your governance framework, and survives the death of the original keyholder without a court battle or a frantic search through filing cabinets.

This guide is the decision framework for families navigating that choice. We cover the full spectrum from self-custody through institutional custody, the hybrid architectures sophisticated families actually use, succession integration, the compliance landscape for registered advisers and trustees, and a six-question rubric you can use to select the right structure for your situation.

Custody isn't about where you store Bitcoin. It's about who holds cryptographic authority over it — and what happens to that authority when circumstances change.

1. Why Custody Is the Most Important Decision a Bitcoin Family Office Makes

When you hold a stock certificate or a bond, ownership and access are separate questions. The certificate represents a legal claim; the brokerage or transfer agent manages physical access. Courts, regulators, and intermediaries can help you recover access even if you lose the original documentation. The legal system is, in effect, a fallback custody layer.

Bitcoin has no such fallback. Private keys are the asset. Not a claim on the asset — the asset itself. Whoever controls the private key authorizes transactions. If the key is lost, the Bitcoin is unreachable forever. If the key is stolen, the Bitcoin is gone and cannot be recalled. There are no chargebacks, no fraud departments, no bankruptcy trustees who can return "your" Bitcoin from an attacker's wallet. The protocol is designed this way deliberately, and the finality of Bitcoin transactions is part of what gives the asset its core properties.

This means three catastrophic scenarios apply to every Bitcoin position:

• Permanent loss. The private key is destroyed, lost, or becomes inaccessible without any surviving recovery mechanism. Common causes: hardware failure without seed backup, seed phrase lost in a fire, sole keyholder dies without informing heirs. The Bitcoin still exists on the blockchain — it just cannot ever be moved again.
• Theft. An attacker obtains the private key or seed phrase and drains the wallet before the owner notices. Common vectors: phishing, physical theft, malware, employee access, social engineering. Unlike bank theft, there is no recourse and no reversal.
• Inaccessibility. The Bitcoin is technically accessible but practically unreachable: the keyholder is incapacitated, institutional custodian is frozen by a regulator, multisig quorum can't be assembled due to key distribution errors, or technical documentation is insufficient for heirs to execute recovery. The Bitcoin exists and the legal right to it may be clear, but the cryptographic path to it is blocked.

Each of these failure modes demands a different design response. Single-signature self-custody eliminates counterparty risk but maximizes the loss and inaccessibility risk. Exchange custody eliminates loss and inaccessibility risk but maximizes theft and counterparty risk. Every custody architecture is a tradeoff along this three-dimensional surface.

The family office context adds further dimensions: governance (who has authority to authorize transactions), succession (how does custody survive the original principal), compliance (how does custody affect reporting, fiduciary duties, and trustee liability), and coordination (how do multiple family members and advisers interact with the custody system without creating confusion or conflict).

Designing for all of these simultaneously is why Bitcoin custody for family offices is a genuine discipline — not a checklist of hardware recommendations.

2. The Custody Spectrum

There is no single "correct" custody model for a Bitcoin family office. There is a spectrum — and the right position on that spectrum depends on the family's technical capacity, governance structure, compliance requirements, and time horizon. Here is how to think about each point.

Self-Custody: Maximum Sovereignty, Maximum Responsibility

In full self-custody, the family holds all private keys directly. No third party has any access. The Bitcoin is under the family's exclusive cryptographic control — accessible at any time, subject to no counterparty's consent, freezeable by no regulator acting against a custodian.

The tradeoff is that all security responsibility falls on the family. Key management, backup procedures, hardware security, geographic distribution, succession planning, and operational security must all be handled internally. The consequences of getting any of these wrong are permanent and unrecoverable.

Self-custody is not inherently simpler than institutional custody — it's simpler operationally but more demanding technically and organizationally. A well-implemented self-custody arrangement for a family office requires more planning, not less, than relying on an institutional custodian. We will elaborate on what that implementation looks like in Section 3.

Collaborative Custody: Sovereignty with Professional Support

Collaborative custody is the middle of the spectrum and, in our analysis, the optimal model for most family offices. In a collaborative arrangement, the family holds a controlling set of keys in a multisig structure while a professional third party holds one key as an operational partner — not as a custodian with unilateral authority.

The canonical structure is a 2-of-3 multisig where the family holds two keys and the collaborative partner holds one. The family can move Bitcoin at any time using their two keys without the partner's involvement. The partner cannot move Bitcoin on their own. If the family loses one key, the partner's key enables recovery. The partner's key also serves as an institutional anchor for succession: heirs can access the Bitcoin using the surviving family key plus the partner's key, without needing to reconstruct the entire original setup.

Unchained is the most established provider of this model. Their Vault product uses 2-of-3 multisig with hardware wallets from multiple manufacturers. The family's two keys are on separate hardware wallets in separate locations; Unchained's key is held in their institutional HSM infrastructure. For families evaluating providers, the key questions are: Does the partner hold a majority of keys (they should not)? What are their succession and key recovery protocols? What is their insurance model for their key infrastructure?

Institutional Custody: Professional Infrastructure, Counterparty Risk

At the far end: the family holds no keys directly. A regulated institutional custodian — qualified custodian under applicable securities law, or a trust company — holds all keys on the family's behalf. The family has a legal claim to the Bitcoin and the contractual right to receive it on request; they do not have cryptographic control.

Institutional custody is appropriate for families that lack the technical capacity for self-custody, require the compliance infrastructure that comes with a regulated custodian, or are holding Bitcoin within a structure — such as an IRA or trust — that requires a qualified custodian. The tradeoffs are real: counterparty risk, regulatory exposure (a regulator acting against the custodian can impair access), and fees.

The most sophisticated family offices rarely hold all Bitcoin at an institutional custodian. More commonly, institutional custody is used for one key in a hybrid structure, for a specific allocation within a regulatory wrapper, or for liquid operating reserves while the core position is in self-sovereign multisig.

3. Self-Custody Deep Dive: Single-Sig, Multisig, and Key Ceremonies

Single-Signature Custody

Single-signature self-custody is the simplest model: one private key, one hardware wallet, one seed phrase. To spend Bitcoin, you sign the transaction on that single device. It works — millions of people use it successfully — but it has a structural vulnerability that makes it unsuitable as the primary custody arrangement for family-office-scale wealth.

The vulnerability is that it is a single point of failure in both directions. Lose the key (hardware failure, fire, theft, death without documentation), and the Bitcoin is gone. The seed phrase backup is the safety net — but storing it introduces its own risk. If the seed is on paper in a safe and that safe is compromised, the Bitcoin can be stolen. If the safe is damaged or lost and there's no second backup, the Bitcoin is gone. The entire security model collapses to: "protect this one secret, perfectly, forever, across every conceivable scenario."

For amounts that matter, this model is insufficient. Single-signature custody should be reserved for operational liquidity wallets — amounts you're actively spending from — and for hardware wallets within a multisig structure.

Multisig Custody Architecture

Multisignature is the structural solution to the single-point-of-failure problem. A multisig wallet requires M of N keys to sign any transaction. The most common configurations for family offices are:

• 2-of-3: Any two of three keys can sign. One key can be lost without losing access; one key can be compromised without funds being at risk. Simple to coordinate, easy to explain to heirs.
• 3-of-5: Any three of five keys can sign. More resilient — two keys can be lost without losing access — but harder to coordinate for routine transactions. Better suited for cold storage vaults than for active spending wallets.
• 2-of-2: Both keys must sign. Maximum protection against unilateral action, but catastrophic if either key is lost. Rarely recommended unless a very specific governance requirement demands it.

For an in-depth treatment of multisig configuration options and the specific tradeoffs at each threshold, see our guide to multisig custody architecture for family offices.

Within a multisig structure, three principles govern good implementation:

Hardware diversity. Each key should be on a different hardware wallet manufacturer's device. If a critical vulnerability is discovered in one manufacturer's firmware, keys on other hardware remain unaffected. A 3-of-5 with all five keys on Coldcards is less secure than a 3-of-5 with Coldcard, Trezor, Passport, Jade, and Seedsigner. This is not hypothetical — firmware vulnerabilities have been discovered in every major hardware wallet at some point.

Geographic distribution. Keys should be in separate physical locations — ideally different cities, or at minimum different buildings that could not be simultaneously destroyed in the same event. For families with international exposure, placing one or more keys in a different jurisdiction adds an additional layer against localized legal risk. A family with a 3-of-5 that keeps all five keys in the same safe has the operational convenience of multisig with none of its security benefit.

Wallet descriptor backup. In multisig, the wallet descriptor — the configuration data that specifies which keys are part of the multisig and what the signing threshold is — must be backed up alongside each seed phrase. Without the descriptor, individual seed phrases are insufficient to reconstruct the wallet. This is the most commonly missed step in multisig implementation and has been the cause of genuine access failures.

Key Ceremonies

A key ceremony is the formal, documented process for generating and distributing private keys in a new custody arrangement. It sounds ceremonial — and it is deliberately so, because the decisions made during key generation have permanent consequences.

A properly conducted key ceremony for a family office multisig includes:

1. Air-gapped generation. Each key is generated on a hardware wallet that has never been connected to the internet, in a location with no active network connections. This eliminates the possibility that an observer could capture the key at the moment of generation.
2. Seed verification. After generation, each seed phrase is verified by having the hardware wallet recover from the seed and confirm the resulting Bitcoin address matches. This catches transcription errors or device failures during generation.
3. Multisig wallet construction. The public keys from each hardware wallet are assembled into the multisig wallet configuration using air-gapped coordinator software (Sparrow Wallet on an offline machine, or a similar tool). The resulting multisig address is verified on each hardware wallet's screen — confirming that each device has independently registered the correct multisig configuration.
4. Test transaction. A small test amount is sent to the multisig address, then a test transaction is constructed and signed using each key combination to verify the signing workflow functions correctly before any significant amount is deposited.
5. Distribution. Each hardware wallet and its corresponding seed backup are placed in their final, separate storage locations. The wallet descriptor is distributed to all storage locations and to any attorneys, trustees, or heirs who will need it for access.
6. Documentation. The entire setup — key identifiers, storage locations, software versions, hardware models — is documented in a custody manual. This document does not contain private keys or seed phrases, but it provides sufficient information for a technically competent person to reconstruct the custody setup in a recovery or succession scenario.

The ceremony should be conducted by the principals who will use the system — not delegated entirely to a consultant or service provider. The family needs to understand how the system works, not just that it was set up correctly.

Hardware Wallet Selection for Family Offices

For family-office-scale holdings, the hardware wallet selection criteria are: air-gapped capability (no USB for signing, transactions transferred via QR code or microSD), open-source firmware (auditable code, no trust-the-manufacturer-on-this), multisig support with on-device verification (each device confirms the complete multisig configuration before signing), and a multi-year track record without critical security incidents.

The devices that best satisfy all four criteria as of 2026: Coldcard Mk4 (best-in-class air-gap, fully open-source, excellent multisig support), Foundation Passport (fully open-source, QR-based air-gap, strong multisig tools), and Jade (open-source, active development). Trezor remains sound for non-air-gapped use. Ledger's closed-source firmware is a disqualifier for many security-conscious families.

4. Institutional Custody: Qualified Custodians, Providers, Insurance, and Audit

What "Qualified Custodian" Actually Means

The term "qualified custodian" has a specific legal meaning under the Investment Advisers Act of 1940 and SEC rules. It refers to banks and savings associations, registered broker-dealers, registered futures commission merchants, and certain foreign financial institutions meeting equivalent standards. Registered investment advisers managing client assets — including Bitcoin — are generally required to use a qualified custodian.

This matters for two distinct audiences. First, RIAs who manage Bitcoin on behalf of family office clients need to understand which institutional custodians qualify and how the SEC's interpretation of the custody rule applies to digital assets. The SEC has taken the position that digital assets are securities (a contested view, but the operative regulatory position for registered advisers), which means RIA-held Bitcoin should be with a qualified custodian. Second, family offices themselves — if their investment structure uses a trust or other vehicle with a trustee who has fiduciary obligations — may face qualified custodian requirements under trust law or the governing documents of the trust. Families should work with qualified securities counsel on this question; the regulatory landscape continues to evolve.

For single-family offices that are not registered investment advisers, the qualified custodian rule does not directly apply to their own Bitcoin holdings. But institutional custody may still be appropriate for compliance, reporting, or governance reasons.

Major Institutional Custodians

Coinbase Prime. Coinbase's institutional custody and prime brokerage offering for high-net-worth and institutional clients. Assets are held in qualified custodian structure (Coinbase Custody Trust Company, LLC, a New York-chartered trust company). SOC 1 Type II and SOC 2 Type II audited. Crime insurance policy (amount not publicly disclosed, but Coinbase represents it as "the largest cold-storage crime insurance policy held by any company in the digital asset industry"). Supports multiple digital assets. Well-suited for families that also want exchange execution through the same relationship and prefer a nationally-recognized compliance infrastructure. Primary risk: Coinbase is a publicly traded company subject to regulatory action; a major regulatory event could impair access temporarily even if the underlying Bitcoin remains segregated.

BitGo. Institutional crypto custodian and technology provider. Holds a South Dakota trust charter. BitGo pioneered multisig custody infrastructure — their custody product uses multi-key custody with keys held across geographically distributed HSMs. Offers segregated accounts (your Bitcoin is held under your own addresses, not commingled). Insurance coverage provided through Lloyd's of London syndicate. Strong audit trail and reporting infrastructure for family offices that need detailed transaction reporting for tax and estate purposes. BitGo also provides the key technology infrastructure for many other institutional custodians and wallets.

Anchorage Digital. The first federally chartered crypto bank (OCC national trust bank charter, 2021). Anchorage's custody model uses biometric multi-party authorization — transactions require multiple authorized signatories to approve using biometric verification — rather than purely hardware-key-based multisig. Strong compliance infrastructure for complex legal structures (trusts, LLCs, foundations). Well-suited for families with sophisticated governance requirements or those operating within regulated fund structures. Higher operational complexity but best-in-class compliance and legal structure flexibility.

Unchained (Collaborative Custody). Not a qualified custodian in the SEC sense, but a collaborative custody partner holding one key in a family-controlled 2-of-3 multisig. Unchained's model preserves the family's self-sovereignty while providing institutional key security for the partner key. Offers IRA custodianship through a partnership structure for families who want Bitcoin in a tax-advantaged account with self-sovereign characteristics. More appropriate for families that want to maintain direct key control than for families requiring a formal qualified custodian for regulatory compliance.

Evaluating any custodian: The due diligence questions that matter most are (1) What is the segregation model — are my Bitcoin addresses specifically mine, or am I an accounting entry on an omnibus wallet? (2) What exactly does the insurance cover — cyber theft? Employee theft? What are the sublimits and exclusions? (3) What are the withdrawal process and timing — can I get my Bitcoin on-demand, or are there advance notice requirements? (4) What is the bankruptcy treatment — in a custodian insolvency, would I be a secured creditor (against segregated assets) or an unsecured creditor (in the general estate)? (5) What is the audit framework — which firm conducts the SOC audits, and are they available for review?

For families conducting deep institutional due diligence, the 36-question institutional due diligence framework covers the key evaluation criteria.

Insurance Considerations

Bitcoin insurance is not the same as FDIC or SIPC coverage. It is crime insurance — specifically, coverage against theft, including employee theft and external cyber attack. Policy structures vary significantly by custodian:

• Coverage scope: Most policies cover theft of Bitcoin from cold storage. They typically do not cover loss from protocol failure, user error (sending to wrong address), or loss due to the customer losing their own keys.
• Coverage limits: Institutional custodians typically carry aggregate policies — a total coverage cap across all clients — not per-account coverage. If multiple clients are affected in a single incident, the policy is divided among them. The per-family effective coverage may be far less than the headline policy amount.
• Exclusions: Read the exclusions carefully. Many policies exclude coverage for losses arising from regulatory action (account freeze, court order), which is precisely the scenario where institutional custody adds risk relative to self-custody.

Families with very large Bitcoin positions may want to explore independent crime insurance coverage from specialized brokers (Marsh, Aon, and Lockton have digital asset practices) rather than relying solely on the custodian's policy.

5. Hybrid Architecture: How Sophisticated Family Offices Actually Do It

The binary framing of "self-custody vs. institutional custody" obscures how well-structured family offices actually operate. Sophisticated families almost universally use a tiered architecture that serves different functions at different security and accessibility levels. This mirrors traditional treasury management — the same principles that separate operating accounts from investment accounts from illiquid reserves apply to Bitcoin.

Tier 1: The Cold Storage Vault

The majority of the position — typically 80–90% — lives in a deep cold storage vault: a multisig arrangement (3-of-5 in most cases) where keys are distributed across multiple geographies, the signing process is deliberately slow and high-friction, and the vault is accessed only for major, pre-planned transactions. Keys are on air-gapped hardware wallets in fireproof storage in separate locations (home safe, bank safe deposit box, attorney's secure storage, trusted family member in another state).

Transactions from the vault require assembling the required number of signers, which by design takes time. This friction is a feature, not a bug. The cold vault should be slow to access — because most access requests to a vault-scale custody position should be scrutinized, not executed instantly.

The vault is designed for decades, not months. Its primary test is not "can we move Bitcoin quickly" but "can we move Bitcoin reliably in any scenario including death, incapacitation, disaster, or key loss."

Tier 2: The Operating Reserve

A medium-term reserve — perhaps 10–15% of the position — held in a more accessible multisig structure (2-of-3) with faster signing coordination. This is the layer that funds planned transactions: tax-loss harvesting events, charitable donations, distributions, or collateral for a Bitcoin-backed loan. Keys may include a collaborative custody partner's key for faster recovery workflows.

The operating reserve is refilled from the vault periodically through a planned, documented process — never spontaneously.

Tier 3: The Spend Wallet

A minimal allocation — 1–3% of the position — for near-term liquidity needs: routine transactions, exchange-based selling for fiat needs, operational expenses. This might be a single-signature hardware wallet, a well-secured mobile wallet, or a small position at an exchange. The defining characteristic of this tier is that its total loss would be a nuisance, not a catastrophe. It is sized accordingly.

The Rebalancing Protocol

Moving Bitcoin between tiers — from cold vault to operating reserve, or from operating reserve to spend wallet — should follow a documented protocol: who can initiate, who must approve, what documentation is required, and how the transaction is verified. This prevents ad-hoc decisions from bypassing security controls and creates an audit trail for tax and governance purposes.

6. Succession and Estate Planning Integration

Bitcoin custody and bitcoin estate planning are not separate problems. They are the same problem viewed from two angles: custody defines who has cryptographic access today; estate planning defines who should have cryptographic access when the original principals are unavailable. Getting custody right without integrating succession is building a vault without ever deciding what happens to the key when the owner dies.

What Happens When the Keyholder Dies

In a single-signature self-custody arrangement without succession protocols, the answer is: the Bitcoin becomes permanently inaccessible. Heirs may know the Bitcoin exists — they may even know approximately how much — but without the hardware wallet and seed phrase, they cannot access it. The estate may have a legal claim but no cryptographic path. This is not hypothetical; the self-custody inheritance risks already affecting early Bitcoin holders are a documented, growing problem.

In a well-structured multisig arrangement, succession is built into the custody design:

• Key holders are documented — each key's location, the identity of the person responsible for it, and the process for accessing it are recorded in legal documents held by the estate attorney.
• Heirs or trustees are pre-authorized to work with collaborative custody partners or institutional key holders to complete multisig signing in succession scenarios.
• The wallet descriptor is distributed to the attorney, the trustee, and a trusted heir — not buried in a drawer. Whoever is responsible for executing the estate plan knows not just that Bitcoin exists but exactly what is needed to access it.
• The estate plan explicitly names Bitcoin in the schedule of assets, specifies the custody structure, and designates who has authority to coordinate key assembly for inheritance transactions.

Dead Man's Switches and Time-Lock Mechanisms

Some families explore automated succession mechanisms: time-locked transactions that become valid after a certain date unless refreshed, or "dead man's switch" services that send key location instructions to heirs if the primary keyholder stops responding to periodic check-ins.

These mechanisms have legitimate uses in specific circumstances but come with significant operational risks. A time-lock that triggers prematurely because the keyholder is traveling or medically incapacitated (but alive) could create serious problems. A dead man's switch service that fails technically, is compromised, or goes out of business could either expose keys prematurely or prevent legitimate succession.

For most family offices, the better approach is simpler: a well-drafted succession protocol in the estate plan, known by the key advisers (attorney, trustee, CPA), with sealed key location instructions in escrow. The human-legal layer handles succession more reliably than automated cryptographic mechanisms in most scenarios. Automated mechanisms are worth considering as an additional layer for very specific risks (extended incapacitation, jurisdiction-specific concerns), not as a primary succession strategy.

Heir Protocols

The specific instructions heirs need to access Bitcoin after death are materially different from what they need day-to-day. A well-designed heir protocol specifies:

1. The existence of Bitcoin custody and which accounts exist
2. The custody structure (multisig configuration, tier architecture)
3. The location of each hardware wallet
4. The location of each seed phrase backup
5. The location of the wallet descriptor
6. The identity and contact information of any collaborative custody or institutional key partner
7. The identity of the technical adviser who can assist heirs in executing the recovery
8. The signing software to use and where to obtain it

This document should not contain the seed phrases themselves — that would be a security risk. It should contain everything needed to locate the seed phrases and execute the access process. The document itself should be in a secure location known to the attorney and at least one heir, but not so widely distributed that it creates a security liability.

7. The Compliance Angle: Custody, Trustees, and Adviser Liability

Custody architecture does not exist in a compliance vacuum. The structure you choose affects how Bitcoin is reported, how trustees meet their fiduciary duties, and how registered advisers satisfy their regulatory obligations.

Trust-Held Bitcoin and Trustee Duties

When Bitcoin is held in a trust, the trustee has fiduciary duties that extend to the custody arrangement. A trustee who places trust Bitcoin in an uninsured, single-signature cold wallet — without documented backup procedures, geographic distribution, or succession protocol — may be exposing themselves to liability if the Bitcoin is lost or becomes inaccessible. The same prudent investor standards that apply to traditional trust assets apply to Bitcoin custody: diversification of risk, documented procedures, periodic review, and appropriate professional assistance.

For trusts with professional trustees (bank trust departments, trust companies), the trustee will typically require institutional custody compatible with their own compliance obligations — which may limit the self-sovereign options available to the family. Families who want to maintain self-sovereign Bitcoin custody within a trust structure should discuss this carefully with trust counsel and ensure the trust document explicitly permits the chosen custody arrangement.

Estate Reporting and Tax Implications

Bitcoin in self-custody is reported on estate tax returns at fair market value as of the date of death, regardless of the ability of heirs to access it. A family that holds 10 BTC in a poorly designed custody arrangement that heirs cannot actually access still has a 10 BTC estate tax liability. The estate is taxed on what legally belongs to the decedent, not on what is practically recoverable.

This creates a strong incentive to get succession right: poor custody planning can result in heirs owing estate tax on assets they cannot access. Under the current estate tax regime (with the $15M permanent exemption following OBBBA), this risk is most acute for larger Bitcoin positions — but any family with estate tax exposure should treat custody succession as a tax planning issue, not just an operational one.

For families with mining operations or complex Bitcoin income streams, the interaction between custody structure and tax reporting has additional dimensions. Bitcoin mined to a family entity, held in institutional custody, and moved between tiers creates reportable transactions that require accurate documentation. The Bitcoin mining tax strategy framework addresses the specific planning opportunities available to mining families, including depreciation, bonus depreciation, and operational expense deductions that interact with custody and holding structure decisions.

RIA Custody Compliance

Registered investment advisers who exercise investment discretion over client Bitcoin holdings — or who have access to client Bitcoin accounts — are subject to the SEC custody rule. This rule requires client assets to be held at a qualified custodian, with specific notice and audit requirements. The application of the qualified custodian rule to digital assets has been an evolving area; advisers should be working with securities counsel on current guidance rather than relying on older interpretations that may not reflect current SEC positions.

For family offices that are not RIAs — including single-family offices relying on the family office exemption — the qualified custodian rule does not directly apply to the office's own Bitcoin holdings. But family offices that provide advice to others, or that have characteristics bringing them closer to the RIA definition, should assess their status carefully.

8. Decision Framework: Six Questions for Choosing the Right Structure

Every family office custody decision should begin with an honest assessment of six questions. The answers point toward the appropriate custody architecture — not by formula, but by illuminating the actual tradeoffs given the family's specific situation.

Question 1: What is the technical capacity of the family and its primary advisers?

Self-sovereign multisig custody requires genuine technical competence: the ability to generate keys on air-gapped hardware, construct and verify a multisig wallet, sign PSBTs, manage backup procedures, and troubleshoot software issues. This is learnable — but it requires time, practice, and ongoing engagement. A family or office with no one who has done this before should not implement complex self-custody without professional technical support and significant investment in understanding. The alternative is not institutional custody by default; it's collaborative custody with a partner who can provide both technical support and institutional key security while the family builds competence.

Question 2: What are the governance requirements for transaction authorization?

Does the family want any single person to be able to transact unilaterally? Or does governance require multi-party consent? A family that wants a single principal to move funds without coordination needs a simpler custody structure. A family that wants transaction authority distributed among multiple members — or among the family and advisers — needs multisig with keys in different hands, and clear documentation of who holds what authority and what the signing protocol requires. This is a governance question first; the custody design follows from it.

Question 3: What is the succession plan, and is it fully documented?

Before finalizing any custody architecture, the succession scenario must be fully specified. If the primary keyholder dies tonight, what happens? Who knows the wallet descriptor exists? Who knows where the hardware wallets are? Who knows where the seed backups are? Who has the authority and the technical capacity to execute the inheritance transaction? If any of these questions have unclear answers, the succession plan is incomplete and the custody architecture should reflect that by building in a collaborative partner or institutional key holder who can assist.

Question 4: Are there compliance requirements that dictate custody structure?

Is Bitcoin held within a trust, IRA, or other structure with a trustee who has fiduciary obligations? Is the family's investment adviser a registered investment adviser subject to the SEC custody rule? Are there foreign jurisdiction requirements that affect how Bitcoin can be held? These compliance requirements may constrain the custody options available. Identifying them early prevents the frustrating scenario of designing an elegant custody architecture that turns out to be non-compliant with the trust instrument or regulatory framework governing the assets.

Question 5: What is the time horizon and expected transaction frequency?

Bitcoin intended for generational transfer — decades-long hold, minimal transactions — optimizes for security and succession. Bitcoin that will be partially liquidated for distributions over a 10-year horizon optimizes for accessible multisig with documented withdrawal procedures. Bitcoin held as operating liquidity optimizes for accessibility. The tier architecture described in Section 5 allows different allocations to be held with different structures — but the allocation across tiers should reflect the actual expected usage pattern, not an idealized vision of how the family will behave.

Question 6: What is the realistic failure tolerance for each custody scenario?

Be honest about the scenarios that are most likely to go wrong, given this specific family's circumstances. A family with one technically sophisticated principal and no succession plan has extreme keyman risk — self-custody may be operationally elegant but succession-vulnerable. A family with multiple technically capable members but no coordination discipline may do better with collaborative custody where the partner enforces process. A family with elderly principals who cannot reliably manage hardware wallets may need institutional custody as the primary solution. The right custody structure is the one that survives the realistic failure modes for this specific family — not the theoretically optimal structure for an idealized Bitcoin family.

9. Frequently Asked Questions