As alternative managers take on digital asset exposure, the decisive operational risk is not where assets are held but who can move them. This article argues that the next stage of institutional maturity in digital assets depends on separating operational authority from investment discretion, and proposes a governance standard, the Independent Counterparty Control Framework, for doing so.

The institutionalisation of digital assets has been told as a story about custody, regulation, and market structure. Each has advanced. Qualified custodians now hold substantial client crypto, regulatory frameworks have begun to replace improvisation, and execution and settlement have matured. Yet a fourth element, less discussed and arguably more important, has not kept pace. It is operational governance: the question of who, inside a fund, can actually move assets, approve counterparties, and control the accounts through which capital flows.

Custody answers where assets are held. Regulation answers what a fund may do. Market structure answers how trades settle. None of them answers the question that has historically destroyed the most investor capital: who holds the keys, and what stops one person from misusing them. This is increasingly relevant beyond crypto-native managers. Hedge funds, alternative credit managers, and funds of funds are taking on digital asset exposure, and funds of funds in particular are being asked to diligence operating models they have not previously encountered.

The layer the industry skipped

An allocator evaluating a digital asset strategy will probe the custodian in detail, and rightly so. But a custodian can be impeccable while the fund’s own arrangements remain dangerously concentrated. Assets held by a qualified custodian still require someone to initiate withdrawals, approve destination addresses, administer the exchange accounts used for trading, and control the email and authentication credentials behind all of it. If those functions collapse into one person, the quality of the custodian becomes secondary. The weakest point is not the vault. It is the set of human permissions that can instruct the vault to act.

Traditional asset management learned this the hard way. Over decades, a series of frauds taught the industry that no individual should simultaneously control investment decisions and the machinery that executes, holds, and accounts for them. The response was structural. The investment manager decides but does not hold assets or strike net asset value. The administrator values independently. The custodian holds. The auditor verifies. The board oversees. The lifecycle is deliberately fragmented so that no single party controls it end to end. The principle is segregation of duties, the same idea banking formalised long ago through maker-checker workflows and the four-eyes rule.

What digital assets changed

Digital assets have quietly recreated the concentration that traditional finance spent decades dismantling. Not through carelessness, but because the technology makes concentration easy. Creating a wallet, whitelisting an address, and authorising a withdrawal can be done by one person in an afternoon. The friction that once forced responsibilities apart does not exist by default; separation must be engineered, and where it is not, it does not happen. The consequences are also sharper, because a confirmed transfer is final. There is no wire to recall and no settlement window in which to catch an error.

The operational permissions that deserve scrutiny are numerous: ownership of exchange master accounts; control of registered email and multi-factor authentication; wallet creation, whitelisting, and address approval; transfer and withdrawal authority; the scope of programmatic interface keys; security settings and recovery procedures; and the monitoring alerts that would warn an independent party. In a fund without a deliberate design, a meaningful number of these can sit with the same person, frequently the person who also makes the investment decisions.

A proposed standard

The Independent Counterparty Control Framework can be defined in one sentence: the structural separation of investment discretion from operational authority over counterparties, wallets, exchange administration, and digital asset movement. Investment managers keep complete discretion over investment decisions; that is their craft and their value. What they should not hold, as a matter of structure rather than trust, is sole authority over the accounts, credentials, counterparties, and wallets through which assets move.

It is a governance framework, not a technology. Multi-signature wallets and policy engines are useful instruments, but tooling alone does not prevent concentration. The framework is about who holds which powers and what independent check sits between intention and irreversible action. Its contribution is framing rather than novelty: most of the individual controls already exist in banking and in well-run funds. Gathering them under one heading lets allocators compare managers, lets managers demonstrate maturity, and gives the market a standard to converge on.

The case is practical, not theoretical. Concentrated operational authority is the common denominator of digital asset loss, whether through fraud, key-person dependency, irreversible error, cyber compromise, insider abuse, or social engineering. Global standard-setters have extended anti-money-laundering and counterparty information requirements, including travel-rule obligations, to virtual asset transfers, and institutional allocators are developing operational due diligence built specifically for the asset class.

That diligence is where the framework becomes usable. The questions are simple and revealing. Who owns the exchange accounts? Who controls the registered email and authentication factors? Can any single person move assets, or whitelist a wallet, without a second approver? Who onboards counterparties? Who receives security alerts, and are they independent of the people being monitored? A manager who answers each with a version of “I do” is describing a single point of failure, however capable and honest.

The next evolution of institutional digital asset investing will be driven not solely by better custody or clearer regulation, but by better governance: the deliberate separation of operational authority from investment discretion, as traditional finance separated them long ago. The principle is not new. It is simply overdue in this asset class.

This article is general thought leadership and does not constitute legal, regulatory, tax, or investment advice.
 

Assets held by a qualified custodian still require someone to initiate withdrawals, approve destination addresses, administer the exchange accounts used for trading, and control the email and authentication credentials behind all of it. 

If those functions collapse into one person, the quality of the custodian becomes secondary. The weakest point is not the vault. It is the set of human permissions that can instruct the vault to act.