An online business may receive digital assets from customers, partners, refunds, token programs, or earlier investments, but holding them is not a treasury policy. Before using any wallet, exchange, custodian, or crypto savings platform, the company needs written rules that answer a more basic set of questions: why the balance exists, how much can be exposed, when funds must remain liquid, who can move them, how performance is measured, and what happens if a provider or network becomes unavailable.
For DTC brands, marketplaces, agencies, and digital-goods companies, treasury decisions are operational decisions. Inventory orders, ad spend, payroll, tax, refunds, and supplier payments all have dates. A balance that cannot be converted or withdrawn when one of those dates arrives can disrupt the business even if its value looks attractive on a dashboard.
The phrase “company crypto” can hide several economically different balances. A useful policy divides them by purpose before dividing them by asset.
| Balance bucket | Business purpose | Typical time horizon | Liquidity expectation | Core control |
|---|---|---|---|---|
| Transactional balance | Receive customer payments or fund approved payouts | Hours to days | Immediately accessible | Low limits and frequent sweeping |
| Operating reserve | Cover near-term expenses and refunds | Weeks to months | High and predictable | Conservative asset and provider limits |
| Strategic holding | Long-term exposure approved by leadership | Multi-year | Not required for routine operations | Board-level limit and periodic review |
| Experimental balance | Pilot a new provider, rail, or workflow | Short, predefined test | Fully disposable within risk budget | Small cap and documented exit criteria |
The first two buckets should be designed around obligations, not yield. If a store expects a supplier invoice in 30 days, the relevant question is whether the required amount will be available in the required currency on that date. A return quoted over a year does not solve a one-month liquidity mismatch.
Strategic and experimental balances need explicit risk budgets. Without them, a pilot can quietly become a permanent allocation simply because no one owns the decision to exit.
Before assigning funds to any product, build or update a rolling 13-week forecast. This period is long enough to capture many inventory, payroll, marketing, refund, and tax cycles while remaining concrete enough for weekly review.
At minimum, include:
Translate digital-asset balances into the planning currency using a documented price source and timestamp, but retain the native units as well. The forecast should show what happens if conversion is delayed, a provider limit is reached, or the asset moves sharply before an expense is due.
Only the balance remaining after protected obligations and contingency needs should be considered for longer lockups or higher-risk activities.
Digital-asset products may describe rewards, earnings, APR, APY, flexible terms, or fixed terms. These labels do not explain the underlying economic activity.
Ask the provider:
If these questions cannot be answered in plain language, the company cannot meaningfully compare the return with the risk.
APR generally expresses a simple annual rate, while APY generally includes an assumption about compounding. Neither figure automatically includes price changes, fees, taxes, conversion costs, withdrawal delays, or losses.
For treasury review, calculate several results:
The purpose is not to predict a market price. It is to reveal which assumptions drive the outcome. A modest reward can be overwhelmed by asset volatility, while a nominally stable balance can still face counterparty, access, and conversion risk.
Calling a product “high risk” or “low risk” is too vague for a company policy. Evaluate at least five categories.
What can cause the asset’s market value or redemption value to change? For a stablecoin, examine the issuer, reserve and redemption arrangements, concentration, and market liquidity rather than assuming the name guarantees stability. For other assets, plan for substantial price movement.
What happens if the provider, custodian, borrower, exchange, bank, or another material party cannot meet its obligations? Identify the legal entity providing the service and the law governing the agreement.
How quickly can the business regain usable funds under normal and stressed conditions? A “flexible” label should be tested against actual withdrawal rules, account limits, network congestion, and conversion availability.
Who controls credentials, approval devices, wallet keys, allowlists, and recovery information? What happens if an employee leaves, a device is lost, an email account is compromised, or an address is changed?
Is the product available to the company’s entity and jurisdiction? What records are required? How are balances, rewards, fees, disposals, and impairment or valuation handled? Professional legal, tax, and accounting review may be necessary.
Scoring each category separately prevents a familiar interface or stable-looking price from masking a weakness elsewhere.
Diversification is a control only when limits are defined. Opening several accounts without exposure caps can create more credentials and reconciliation work without reducing concentration.
A treasury policy can set:
Review limits in the company’s planning currency after material price moves; appreciation alone can create a concentration breach.
Temporary exceptions need an owner, reason, expiry date, and plan to return to policy. Otherwise, exceptions become the real policy.
Treasury security is not solved by enabling multifactor authentication and moving on. The business needs a complete authority map.
The person who proposes a transfer should not be the sole approver. The person who administers user access should not be able to conceal activity. Reconciliation should be performed by someone who can compare provider records with accounting and bank data.
Give each user only the permissions required. A support agent may need transaction visibility without withdrawal access. A bookkeeper may need exports without the ability to add beneficiaries. Remove inactive users promptly and review access on a schedule.
Use allowlists where appropriate, require a delay or additional approval for new addresses, and verify address changes through a separate channel. Record the asset and network with the address. A visually correct address on the wrong network can still create loss.
Document how access is restored if a device is lost, an approver is unavailable, or credentials are compromised. Store recovery material securely and separately from everyday credentials. Test the process without exposing sensitive secrets in the test record.
Many payment attacks begin in email or messaging rather than the wallet itself. Use verified contact details, known approval channels, and explicit escalation rules for urgent requests. “The supplier needs it today” should trigger more verification, not less.
An ecommerce company should be able to follow value from the commercial event to the financial record.
For a customer crypto payment, retain:
For a treasury transfer, retain the proposal, purpose, source and destination accounts, asset, network, amount, rate timestamp, approvals, transaction identifier, provider status, fees, and accounting entry.
Do not treat a block explorer screenshot as the authoritative record. Screenshots are difficult to search, can omit context, and do not connect naturally to invoices or journal entries. Use structured exports and stable identifiers.
Daily or weekly reconciliation is more effective than waiting for month-end. Exceptions are easier to investigate while the people and systems involved still have fresh context.
A product review should include conditions that lead the company to reduce or close exposure. Possible triggers include:
An exit plan should identify where funds will move, who can approve the action, and how the team will operate if the normal interface is unavailable.
Review the policy at least quarterly and after a material event. A rapidly changing product or legal environment may require more frequent review.
Digital assets can be part of an ecommerce company’s payment and treasury infrastructure, but a product feature is not a policy. The business must first protect near-term obligations, classify balances by purpose, understand the source of any return, set exposure limits, and build controls that survive employee turnover and market stress.
The most important treasury metric is not the highest displayed annual rate. It is the company’s ability to meet obligations on time while keeping risk visible, authorized, and recoverable. A well-designed policy turns that principle into specific limits, approval steps, records, and exit triggers that the team can follow long after the initial product decision.
