As more companies look at Bitcoin as a treasury asset, the conversation is starting to move beyond market volatility and regulation to a more practical issue: how firms control and safeguard it once it sits on the balance sheet.

Here, Kevin Loaec, CEO at Bitcoin security provider Wizardsardine, examines why the next stage of corporate Bitcoin adoption may depend less on access and more on getting custody governance right.

As more companies begin exploring Bitcoin as part of their treasury strategy, much of the conversation still revolves around familiar topics: price volatility, regulation, and the role of institutional investment products.

These are important questions. But they are not the ones that will ultimately determine whether corporate Bitcoin adoption succeeds. The issue that deserves far more attention, particularly among CFOs and treasury leaders, is custody governance.

For many organisations entering the space, the default instinct is to rely on an external custodian. It feels like the safest option. Regulated providers offer insurance coverage, compliance certifications, and operational structures that resemble the financial infrastructure companies already use for traditional assets.

Yet Bitcoin does not behave like a traditional financial asset, and that difference changes the nature of custody risk.

Unlike securities or bank deposits, Bitcoin is not ultimately controlled through accounts maintained by financial institutions. It is controlled through cryptographic private keys, and transactions settle directly on the network with no central authority capable of reversing them. Once funds move, they move permanently.

This technical detail has significant implications for how corporate treasuries should think about custody. When a company holds Bitcoin on its balance sheet, the real question is not simply where the asset is stored. It is how control over that asset is structured, enforced, and defended under scrutiny.

In other words, Bitcoin custody is fundamentally a governance problem.

The difference between storage and control

In traditional finance, custody and governance are often treated as separate layers.

A company might hold assets through a custodian bank while maintaining internal controls over approvals, segregation of duties, and transaction authorisation. Those controls sit within corporate policy frameworks and internal processes rather than within the asset itself. But Bitcoin collapses these layers together.

Control is determined by whoever can produce the cryptographic signatures required to move funds. The rules governing those signatures are enforced by the Bitcoin network itself. If those rules are poorly designed, no contractual agreement with a third party can override them.

This is where many early discussions about institutional custody have been incomplete. The focus tends to be on whether a provider is regulated, insured, or widely trusted. Those factors may matter, but they do not answer the more fundamental question: how is control actually enforced?

For finance leaders, the practical concerns are straightforward.

Who can authorise a transaction? How many approvals are required before funds move? What happens if an employee leaves the company or a device holding a key is lost?

If the answers to those questions rely primarily on operational processes or vendor policies, the organisation may still carry significant risk.

The limits of institutional custodial models

Institutional custodians have undoubtedly played an important role in Bitcoin’s growth. By providing services that resemble familiar financial infrastructure, they made it easier for institutions to gain exposure to the asset class.

But many custody models still replicate the architecture of traditional finance around an asset that behaves very differently.

Assets may be pooled or held within platforms where the client ultimately depends on the provider’s internal systems and operational security. Governance policies are often implemented through off-chain controls rather than through the Bitcoin protocol itself.

Insurance is frequently presented as an additional layer of protection. In practice, those policies tend to cover a narrow set of operational risks and rarely extend to systemic failures or governance breakdowns.

For corporate treasurers, this means that outsourcing custody does not necessarily eliminate risk. In many cases, it simply shifts that risk to another part of the system.

And when something goes wrong, the liability still sits with the company whose assets are at stake.

Designing custody around governance

A more resilient approach begins with a simple observation: Bitcoin allows governance rules to be enforced directly within the asset’s security architecture.

Multi-signature wallets, for example, require multiple independent approvals before funds can move. Access roles can be distributed across different teams within an organisation. Recovery paths can be designed so that assets remain accessible even if devices fail or key holders change roles.

When designed properly, these structures begin to resemble the internal control systems companies already use to manage treasury operations. The difference is that the rules are enforced cryptographically rather than procedurally.

Instead of relying on policy documents and internal approvals alone, the approval structure itself becomes part of the security model. The network simply will not accept a transaction that does not meet the predefined conditions.

For organisations holding significant digital assets, this kind of architecture changes the nature of custody from a trust-based service into a verifiable governance framework.

Why boards and auditors will care

As Bitcoin increasingly appears on corporate balance sheets, governance scrutiny will inevitably follow. Boards, auditors, and regulators will want to understand how these assets are controlled and what protections exist against operational failure or internal misuse.

They will ask who holds signing authority, how approvals are structured, and what recovery mechanisms exist if access is lost.

Infrastructure that makes these answers clear and verifiable makes that conversation easier. Systems that depend heavily on opaque internal processes or vendor assurances create the opposite effect.

For finance leaders accustomed to robust internal controls, clarity is rarely optional. It is a prerequisite for accountability.

The next phase of institutional Bitcoin adoption

The first wave of institutional Bitcoin adoption focused primarily on access. Exchanges, custodians, and investment vehicles made it possible for institutions to buy and hold the asset within familiar frameworks.

The next phase is likely to focus on governance.

As more companies begin to hold Bitcoin directly as part of their treasury strategy, the conversation is shifting away from convenience and toward infrastructure design. The key question is no longer simply where assets are stored, but how control over them is structured and enforced.

For CFOs and treasury leaders, that distinction matters. Because ultimately, Bitcoin custody is not a crypto decision but a foundational treasury decision.

And like any piece of financial infrastructure, it deserves the same level of scrutiny as the systems used to manage cash, payments, and capital allocation across the organisation.