Multisig Bitcoin custody means a company's Bitcoin can only be moved when a set number of separate keys sign together, for example any two of three. It turns a single point of failure into a quorum, which is the digital equivalent of requiring two authorised signatories on a bank payment. For companies, it is one of the most effective tools for enforcing dual control.
How multisig works
A standard Bitcoin address is controlled by one private key. A multisig address is controlled by several keys and a rule, written into the address itself, about how many must sign.
The rule is usually expressed as "m-of-n":
- n is the total number of keys.
- m is the number of keys required to authorise a transaction.
In a 2-of-3 arrangement, any two of the three keys can move funds. Losing one key does not lose the funds. Stealing one key does not let a thief move them.
The rule is enforced by the Bitcoin network. No company policy, custodian or bank sits in between. That is both the strength and the responsibility.
Why multisig suits corporate governance
Boards already understand quorums. Multisig maps neatly onto controls that finance teams use every day.
- Dual control: one person cannot both initiate and complete a transfer.
- Segregation of duties: different keys can sit with different functions or organisations.
- Resilience: the loss of one key, device or person does not freeze the treasury.
- Evidence: each signature is recorded on the blockchain, which supports audit.
It also allows shared-control custody, where some keys sit with the company and others with independent providers. Our comparison of qualified custodians and self-custody explains where that middle path fits.
Choosing a quorum
| Quorum | Keys that can be lost safely | Keys a thief needs | Typical use |
|---|---|---|---|
| 2-of-3 | 1 | 2 | Common default for corporate reserves |
| 3-of-5 | 2 | 3 | Larger holdings or more distributed governance |
| 2-of-2 | 0 | 2 | Rarely suitable: loss of either key freezes funds |
More keys add resilience and make collusion harder, but they also add coordination effort and cost. The quorum should reflect how the company actually makes decisions. If the treasury policy requires CFO and one other director to approve, the key design should make that the only route to a signature.
Where to place the keys
Key placement is where most of the governance work sits. Good designs separate keys across several dimensions:
- People: no individual holds more than one key.
- Locations: keys and backups are held in geographically separate, secure sites.
- Organisations: in shared-control models, at least one key sits with an independent party.
- Device types: using hardware from more than one manufacturer reduces exposure to a single flaw.
A common corporate pattern for 2-of-3 is one key held by the company's treasury function, one held by a second internal function or director, and one held by an independent key agent or custodian as a recovery key.
Practical tip: map every key to a named role, a backup location and a replacement procedure in one table. If you cannot fill every cell, the design is not finished.
Governance controls around multisig
Multisig enforces the quorum on-chain. It does not, on its own, decide who should sign or why. Companies still need written controls.
Signing policy
Who may propose a transaction, who may approve, what limits apply, and how destination addresses are verified. This sits in the company's key management and signing policy.
Address verification
Every signer should independently verify the destination address on a trusted device screen, not just in an email or spreadsheet. Address substitution is a known attack.
Recovery and succession
What happens if a key holder leaves, becomes unavailable, or a device fails? Recovery procedures should be written, rehearsed with small amounts, and reviewed when personnel change.
Insurance
Insurance for self-managed multisig may be limited or expensive. Where independent providers hold keys, check what their policies cover and whether cover applies to keys they hold for you.
Independent assurance
If a third party holds one or more keys, ask for its SOC 1 Type II or SOC 2 Type II reports, and read the exceptions. If the company holds all keys, its own internal controls will need to satisfy the auditor. See our audit readiness checklist.
Limits and trade-offs
Multisig is not a complete answer.
- Complexity: more parties and devices mean more ways for procedures to drift.
- Collusion: a quorum protects against one bad actor, not against enough of them acting together.
- Operational speed: gathering signatures takes time, which matters if funds are needed for settlement at short notice.
- Bankruptcy remoteness: in shared-control setups, the contracts with key providers should make clear that they hold keys, not ownership. Take legal advice.
Many companies address the speed issue by keeping a small operational balance under a lighter quorum and the reserve under a stricter one, each with its own limits in the treasury policy.
How The Bitcoin World helps
We help companies design multisig and shared-control custody: quorum choice, key placement, signing policy and recovery procedures, documented for the board and auditors. We do not hold keys or client assets. Custody and execution are carried out by licensed third-party institutions. See our custody architecture service.