Bitcoin Wallets for Companies: Technical Requirements

A bitcoin wallet for a business has to do more than a private one: no single person may be able to move money alone, and no single person may be able to go missing without the company losing access. Every payment needs a traceable approval, every balance a record for the accountants, and the emergency plan has to work even when the managing director cannot be reached. Technically, that almost always means multisig with fixed roles, a written policy, a complete log and a clean export for the year-end accounts.

Whether holding bitcoin in a company pays off tax-wise is covered in Bitcoin in a GmbH. How it appears in the balance sheet is explained in Accounting for bitcoin in a company, and why CFOs consider it at all in Bitcoin as a treasury asset. This article is about the technology behind it: what a company wallet must do so that management, accounting and auditors can sleep at night.

Why a personal wallet is not enough

A personal wallet is built for one human. One seed phrase, one device, one person who knows everything. For a company, that is exactly the problem:

• A single key holder is a concentration risk. If they resign, fall ill or die, the holdings may in the worst case be gone. If they are in debt or being blackmailed, they become the target.
• Management is liable. In Germany, § 43 GmbHG requires the care of a prudent businessperson; in Switzerland, Art. 717 of the Code of Obligations requires the board's diligence. A holding that one person controls alone, without oversight and without an emergency plan, is hard to defend as diligent.
• Accounting needs evidence. A personal wallet shows balances. An auditor wants to know who owns the addresses, who approved which payment and why.

The solution is not a better hardware wallet but a different architecture.

Multisig with roles: the basic framework

A multisig wallet requires several signatures for every payment. The linked article explains how that works technically. A company adds one question: who holds which key, and in which role?

Separating creator and approver is the same four-eyes principle as in bank payments. Accounting prepares, two authorised signatories approve. The only new thing is that the signature is cryptographic rather than in online banking.

Which quorum for which company?

• 2 of 3 suits small companies with two managing directors: one key per director, the third as an emergency key in a separate place or with a service provider. If one person drops out, the emergency key co-signs.
• 3 of 5 suits larger holdings or more people involved: three approvers from management and finance, two emergency keys in separate places. Two keys may be lost and two may be stolen without any money being gone.

More keys do not automatically mean more security. Every extra key is another device, another backup and another person who has to be trained.

A timelock as a built-in emergency path

With Miniscript you can build a wallet whose rules change over time. An example: normally, every payment needs 2 of 3 keys. But if a coin has not moved for a year, a single emergency key, say with a notary, is enough in addition. Wallets such as Liana build exactly these recovery paths. The advantage: day to day, the emergency key is worthless, and a thief can do nothing with it as long as the company moves its coins regularly. The catch: someone has to remember to send the coins to themselves once before the period runs out.

What gets signed: the policy in the device

In February 2025, the exchange Bybit lost about 1.5 billion dollars from a multisig wallet. Several signers approved a transaction that their screens showed as routine. The web interface had been manipulated, and nobody checked on the devices what was actually being signed. The FBI attributed the attack to North Korea.

The lesson for any company wallet: several signatures protect only if every signer checks independently. Technically, that means:

1. The wallet description is registered on every device. For bitcoin multisig, hardware wallets such as Coldcard, BitBox02, Jade or Ledger store the complete wallet description: which keys, which quorum. BIP 388 describes a standard format for this. The device can then show whether the change address really belongs to the company wallet, and it cannot silently send change to someone else's multisig.
2. Recipient and amount are read on the device, not on the computer. The creator takes the recipient address from a second source, such as the contract or a phone call to the recipient. The approver compares it with the device display.
3. The devices are with different people in different places, ideally from different manufacturers. A bug in one firmware then does not hit all keys.

What belongs in the policy

A written wallet policy, adopted by management or the board, sets out:

• Quorum, key holders and their deputies.
• Amount limits: up to what sum the normal quorum is enough, and from when a board resolution is needed as well.
• Approved recipients: the company's own exchange accounts, customers, suppliers, each with a verified address.
• How a payment runs: who creates it, who checks, through which channel the address is confirmed.
• Change of key holders: when someone leaves the company, the wallet is moved to new keys, not just a device collected.
• Emergency plan: who fetches which key if someone drops out, and how recovery is rehearsed.

Audit trail: every movement traceable

The blockchain shows every movement, but not who initiated it or why. The company fills that gap itself.

A log for every payment. For each transaction, record who created the payment, when, for what purpose and with which invoice, who approved it and when, and the final transaction ID. Many companies keep this as a simple spreadsheet or in their ticket system, with the PSBT file attached to the record.

Watching without access. The extended public key (xpub) or the output descriptor of the wallet lets you see all addresses and movements without being able to move anything. Accounting, tax advisers and auditors get such a watch-only wallet. Anyone who knows the descriptor does see all of the company's payments, though. It does not belong in an email to third parties.

Balance confirmation at the reporting date. On 31 December, the holdings are exported from the watch-only wallet with block height and price. If the company has to show that it really controls the keys, it signs a message with one of its addresses. That proves control without moving money.

Accounting export: what the year-end needs

For the balance sheet, every inflow and outflow counts with its value in euros or francs. A usable export contains for each transaction:

Wallet software such as Sparrow exports transactions as CSV. Labels for addresses and transactions can be exported in the BIP 329 format and imported into another wallet or an accounting tool. The price comes from the exchange used to buy, or from a price service. What matters is choosing one source and sticking to it.

Retention periods apply to these data too: in Germany, eight years for accounting records since the Fourth Bureaucracy Relief Act, ten years for books and annual accounts (§ 147 AO, § 257 HGB). In Austria seven years (§ 132 BAO), in Switzerland ten years (Art. 958f CO). A wallet file that only exists on the managing director's laptop does not meet that.

Custodian, shared custody or yourself?

A company does not have to hold the keys itself. Three routes are open, each dividing the work differently.

Regulated custodian. A crypto custodian holds the keys for the company. In the EU, since the transition periods ended on 1 July 2026, it needs authorisation under the MiCA regulation. Examples from the German-speaking region are Boerse Stuttgart Digital Custody and Tangany, both of which report a MiCA licence from BaFin; in Switzerland, the FINMA-supervised banks Sygnum and AMINA, among others, offer custody. The company gets audit reports, roles and approvals in a web portal, and a contact person. It pays ongoing fees for this and carries the risk that it can only reach its bitcoin through the custodian. What happens in a collapse is shown by the cases from Mt. Gox to FTX. So check whether the bitcoin are held separately from the custodian's own assets and can be claimed back in its insolvency.

Shared custody. The company holds two of three keys, a service provider the third. The provider cannot move anything alone but helps if a key is lost. Such services exist mainly in the US, Unchained for example. What matters is that the company owns the wallet description itself and can pay with its two keys in any compatible wallet, without the service.

Self-custody. The company holds all keys itself, spread over people and places. This is the cheapest and most independent route, but it demands discipline: rehearsed recovery, key rotation when staff change, physical security at every location.

For small companies with holdings in the five-figure to low six-figure range, a 2-of-3 multisig of their own with three hardware wallets is often the right fit. It costs about €500 once for devices. Companies with large holdings, nobody technically skilled in-house, or an auditor who expects a custodian are better served by a regulated custodian.

Distributing keys and backups safely

Each key of a company wallet has two parts: the device and the backup of the seed phrase. Both belong in places different from the other approvers' keys. The wallet description (descriptor) belongs with every backup, because without it even a complete set of seed phrases will not find the multisig addresses.

What has proven itself:

• Seed phrases on metal, not on paper, in a safe or bank deposit box, not in the same building as the device. What a complete backup looks like is shown in Bitcoin backup setup.
• No copies in the cloud, no photos, no password managers for seed phrases.
• A recovery drill once a year with a small amount: one approver and the emergency key restore the wallet on new devices and send a test amount. The record of the drill goes into the files.
• Key rotation when staff change. When a key holder leaves the company, a new multisig with new keys is set up and the holdings are moved. That costs one transaction fee and is safer than hoping nobody kept a copy of the seed phrase.