What Institutional Due Diligence Actually Covers

An allocator considering crypto exposure works through a structured assessment before committing. The items are not secret and most of them apply at any scale.

Custody

Who holds the assets, under what licence, and are they bankruptcy-remote from the custodian’s own balance sheet.

What does the insurance cover, with what limits and what exclusions. The usual exclusions are losses involving an employee with legitimate access, which is a meaningful gap.

How many parties must approve a movement.

Counterparty

For every venue and service provider: regulatory status, financial condition where disclosed, ownership, and jurisdiction.

Whether client assets are segregated, and what the terms say happens in an insolvency. The terms of service are the governing document and they are frequently less favourable than the marketing.

Valuation

Which price source is used for reporting, and how it handles divergence between venues.

For illiquid holdings, whether the quoted price could be realised. This is where market capitalisation stops being an acceptable answer and depth becomes the question.

Liquidity

How long it would take to exit the position, at what cost, under normal and stressed conditions.

This is assessed against depth rather than reported volume, and it is the question that eliminates most smaller assets from institutional consideration regardless of their notional valuation.

Operational

Who can initiate a transaction, what approvals are required, how addresses are verified, and how the process is audited.

Address allowlists with delays on additions are standard practice, and they are available to individuals at many venues and rarely enabled.

Regulatory and tax

Whether the institution is permitted to hold the asset. Classification, reporting obligations, and treatment of staking income.

Technology

For assets held directly: key generation, storage, signing controls, and the recovery procedure.

For protocols: audit history, upgrade key arrangements, and the concentration of block production.

The template for an individual

Most of this reduces to five questions that anyone can apply.

1. Who holds the keys, and what happens if they fail?
2. Could I actually exit this position, at what cost?
3. Is the venue regulated where I live, and what do its terms say about insolvency?
4. Who can move my assets, and what would have to go wrong?
5. What are my reporting obligations?

Answering the third requires reading the terms and checking a regulatory register, and answering the second requires looking at depth rather than market capitalisation. Both are published: depth by venues including a crypto OTC trading platform, and registration status by the regulator.

Neither takes long. Almost nobody does either.