Counterparty due diligence for Bitcoin providers

Counterparty due diligence on a Bitcoin liquidity provider, custodian or other service provider is the process of confirming that the firm is who it says it is, is properly authorised, is financially sound, and runs controls the company can rely on. The best approach is a single framework applied to every provider, scaled to the exposure each one creates, and repeated after approval. This article sets out that framework.

What to look for in a specific provider type is covered elsewhere: see choosing a Bitcoin liquidity provider and choosing a Bitcoin custodian. Here we focus on the process.

Why one framework for every Bitcoin liquidity provider and custodian

Companies often run thorough checks on their custodian and lighter checks on everyone else. But a Bitcoin treasury typically relies on several firms:

• one or more liquidity providers;
• one or more custodians;
• banks that send and receive fiat payments;
• a pricing or data source used for month-end valuation;
• a blockchain analytics or screening service, directly or through a provider.

Each can cause loss or disruption. A shared framework makes the comparison consistent and the decision easier to defend to auditors and the board.

Step 1: tier providers by exposure

Not every provider needs the same depth of review. Tier them by what the company stands to lose.

A provider can move tiers. A liquidity provider that also offers to hold assets after a trade becomes Tier 1 for that service.

Step 2: request and verify documents

Questionnaires are useful but self-reported. Ask for documents that can be checked. A core request list:

• Identity and structure. Certificate of incorporation, group structure chart, ultimate beneficial owners, directors.
• Authorisation. Licences or registrations held, with the issuing authority and licence number, and the entity that will contract with you.
• Financial standing. Audited financial statements for at least two years, the auditor's name, and any qualifications in the audit opinion.
• Controls assurance. Independent assurance reports on controls, such as a SOC 1 or SOC 2 report, with any exceptions noted.
• Client asset terms. The contractual terms on how client assets and money are held and segregated.
• Insurance. Policy summaries, including what is excluded.
• Compliance. AML and sanctions policies, and confirmation of how the Travel Rule is applied.
• Continuity. Business continuity and incident response arrangements.

Then verify independently. Check licences on the regulator's public register. Confirm the auditor exists and is suitably qualified. Search for enforcement actions, litigation and adverse press.

Check that the entity on the licence, the entity in the audited accounts and the entity on the contract are the same. Where they differ, ask why, and understand which one actually owes you the assets.

Step 3: assess and score

Score each area on a simple scale and record the reasoning. Typical areas:

• legal and regulatory standing;
• financial strength and transparency;
• client asset protection and segregation;
• operational controls and assurance;
• security practices;
• compliance controls;
• service quality and responsiveness;
• exit and portability.

Set minimum scores for Tier 1 and Tier 2 providers in critical areas. A strong price or service cannot offset a failing score on client asset protection.

Hold at least one call with senior staff at the provider, including someone responsible for operations or risk. How they answer difficult questions is part of the assessment.

Step 4: approve with conditions

Approval should be specific. Record:

• the services approved, and any that are not;
• exposure limits, such as maximum pre-funding or maximum share of holdings;
• conditions, such as delivering an updated assurance report within a set time;
• the next scheduled review date.

The approval then feeds the approved provider list in your treasury policy.

Step 5: monitor and re-review

Due diligence does not end at signing. Monitor continuously and re-review on schedule.

Scheduled reviews. Annually for Tier 1 and Tier 2, every two years for Tier 3.

Triggers for an early review:

• change of ownership, control or senior management;
• regulatory action, licence changes or enforcement;
• a qualified audit opinion or late financial statements;
• a security incident or service outage;
• unusual delays in withdrawals or settlement;
• significant adverse news about the provider or its group.

Warning signs between reviews: reluctance to share updated documents, changes to client asset terms, pressure to keep more assets on the platform, or offers of yield on deposited assets.

Track these as key risk indicators in your Bitcoin risk register.

Keep an exit route ready

Every Tier 1 and Tier 2 approval should have a documented alternative. If a provider fails a review, the company should be able to move to another approved provider without waiting for a new due diligence cycle. This is one reason many companies approve more than one provider for each service. See settlement and counterparty risk for how exposure is managed during trades.

Companies should take their own legal advice on contractual terms and client asset protections.

How The Bitcoin World helps

We design due diligence frameworks, document request lists and scoring models, and help finance teams assess providers as part of our OTC liquidity and custody architecture work. Execution and custody are carried out by licensed third-party institutions; we do not hold client assets.