A corporate Bitcoin treasury carries eight main risks: market, liquidity, custody, counterparty, operational, accounting, regulatory and reputational. Price volatility is the most visible, but losses that could have been avoided usually come from weak custody, poor counterparty choice or broken processes. Each risk can be reduced with a specific control, an owner and regular review.
Market and liquidity risk
Market risk
Bitcoin's price can fall a long way, quickly, and stay lower for extended periods. It has done so several times in its history. This cannot be controlled, only sized.
Controls
- Concentration limits based on the loss the company can absorb.
- A cash floor that Bitcoin cannot replace.
- Pre-agreed drawdown triggers with named owners.
- No borrowing against Bitcoin without specific board approval.
See concentration limits and drawdown planning.
Liquidity and execution risk
Large orders can move the price against the buyer or seller. Liquidity can also thin out in stressed markets, when a company might most want to act.
Controls
- Use OTC request-for-quote or scheduled execution for large orders, rather than placing them on a single exchange order book.
- Obtain multiple quotes and keep them as best-execution evidence.
- Set maximum single-trade sizes in policy.
Execution cost is easy to underestimate because it does not appear as a separate line item; it is buried in the price paid.
Custody and counterparty risk in a corporate Bitcoin treasury
Custody risk
Bitcoin is controlled by private keys. If keys are lost, the Bitcoin is lost. If keys are stolen, transfers cannot be reversed. This makes custody the single most important operational decision.
Controls
- A custody model chosen through formal due diligence.
- Multi-party approval for any transfer, with no single person able to move funds.
- Withdrawal whitelists and time delays for new addresses.
- Clear legal terms on how client assets are held and segregated.
- Tested recovery procedures.
See corporate Bitcoin custody for the options.
Counterparty and settlement risk
Between paying for Bitcoin and receiving it, the company is exposed to its counterparty. The failure of several large digital asset firms in past years showed how real this risk is.
Controls
- Due diligence on every liquidity provider and custodian, repeated annually.
- Caps on the amount pre-funded or left with any one provider.
- Settlement methods that shorten the exposure window.
- Prompt transfer of purchased Bitcoin to the company's own custody arrangement.
Our article on settlement and counterparty risk goes into more detail.
Operational risk
Mistakes happen in any process. With Bitcoin, a wrong address or an unauthorised transfer is usually final.
Controls
- Segregation of duties between those who approve, execute and reconcile.
- Small test transfers before large ones.
- Documented procedures for each step.
- Monthly reconciliation of holdings against custodian statements and on-chain records.
- Cover for key staff so the process does not depend on one person.
Run a "lost person" test once a year: if the treasurer were unavailable tomorrow, could someone else complete a transfer safely using only the written procedures?
Accounting, regulatory and reputational risk
Accounting, tax and reporting risk
Under US GAAP, FASB ASU 2023-08 requires fair value through net income for fiscal years beginning after 15 December 2024, which can make reported earnings volatile. Under IFRS, holdings are generally intangible assets under IAS 38. Tax treatment varies by country and can differ from the accounting.
Controls
- Early engagement with auditors on accounting treatment and valuation source.
- A documented cost basis method and month-end close process.
- Specialist tax advice before the first purchase.
Companies should take their own accounting, tax and legal advice.
Regulatory and reputational risk
Rules on digital assets continue to develop in many countries. For banks, the Basel Committee's prudential standard (December 2022) places unbacked assets such as Bitcoin in its higher-risk Group 2, which can affect how lenders view related activity. Some stakeholders may also hold strong views on Bitcoin, positive or negative.
Controls
- Use only licensed providers, and monitor regulatory developments relevant to the company.
- Check banking relationships and financing documents for restrictions.
- Communicate the rationale and governance clearly to investors and staff.
A simple risk register
A one-page register is usually enough for board reporting. The ratings below are illustrative; each company should assess its own.
| Risk | Illustrative likelihood | Illustrative impact | Main control | Owner |
|---|---|---|---|---|
| Market | High | Medium | Concentration limit and cash floor | CFO |
| Liquidity and execution | Medium | Low | OTC execution, multiple quotes | Treasurer |
| Custody | Low | High | Multi-party approval, due diligence | Treasurer |
| Counterparty | Low | High | Exposure caps, prompt settlement | Treasurer |
| Operational | Medium | Medium | Segregation of duties, test transfers | Finance controller |
| Accounting and tax | Medium | Medium | Auditor engagement, documented methods | Financial controller |
| Regulatory | Medium | Medium | Licensed providers, monitoring | General counsel |
| Reputational | Low | Medium | Clear disclosure | CFO and investor relations |
Review it quarterly and record any changes in rating. Add new risks as the holding grows or the operating model changes, for example when a second custodian is added. The register then feeds directly into the Bitcoin treasury policy review.
How The Bitcoin World helps
We help companies identify and control these risks through treasury policy, execution planning and custody architecture design. Execution and custody are carried out by licensed third-party institutions; our role is to design the process and controls that surround them.