
The Sarbanes-Oxley Act of 2002 was created in the wake of high-profile corporate fraud and financial mismanagement cases like the Enron scandal.

<a href="https://www.investor.gov/introduction-investing/investing-basics/role-sec/laws-govern-securities-industry#sox2002" target="_blank">Sarbanes-Oxley</a>, often shortened to Sarbox or SOX, brought in reforms that required United States public companies to adhere to a set of standards for accounting and corporate responsibility.

SOX principles are now well-established in the corporate sphere. But what about when it comes to emerging financial technologies?

This article will look at how SOX measures can be applied to digital asset treasury management, using the specific example of Bitcoin.

_Please note: this article is intended for general informational purposes and does not constitute financial advice._

## SOX compliance: an overview

The SOX Act covers several key areas of corporate responsibility, from enhanced financial disclosures to leadership oversight. We will cover some of these in more detail below.

### Who does SOX apply to?

There are some exceptions, but SOX primarily applies to:

- US publicly listed companies
- Non-US companies that have registered debt or equity with the US Securities and Exchange Commission (SEC)
- Accounting firms that carry out SOX audits.

Companies that are not required by law to comply with SOX requirements should nonetheless consider it, for two main reasons.

- Firstly, if they are <strong>considering an IPO</strong>, or may become public through a purchase process, then laying the groundwork for a SOX-compliant approach in advance will save time, expense, and complication in the future.
- Secondly, SOX requirements are widely considered to be <strong>best practice</strong>. Adhering to the principles of the SOX Act is an investment in corporate responsibility and building a culture of financial transparency.

### Futureproofing

Finally, when it comes to digital assets, the evolving nature of the regulatory landscape and recent events such as the collapse of FTX have put compliance issues in the spotlight.

The US Institute of Internal Auditors has recently <a href="https://www.theiia.org/en/content/communications/press-releases/2022/december/the-iia-calls-upon-congress-to-require-cryptocurrency-exchanges/" target="_blank">called for more robust governance requirements</a> for cryptocurrency exchanges, while the Securities and Exchange Commission (SEC) has <a href="https://blockchaintipsheet.com/policy/sec-chair-talks-sarbanes-oxley-sox/" target="_blank">issued interpretive guidance</a> on accounting in the crypto custody sphere.

Companies holding or operating with digital assets can lay the groundwork for any future regulatory changes by following SOX guidelines wherever possible.

## SOX compliance and digital assets

![alt Bitcoin transaction on a spreadsheet](/images/posts/bitcoin-transaction-spreadsheet.png)

Digital asset treasury operations is still considered a new field where industry standards continue to evolve.

The underlying technology, such as decentralized finance (DeFi) and blockchain, may seem very different to established financial processes in the fiat world.

However, the “transparency by design” of blockchain-based digital assets such as Bitcoin, which runs on an immutable public ledger, can help a SOX-informed approach to treasury management.

Before we explore this in more detail, let’s look at which parts of the SOX legislation are most relevant when it comes to digital asset treasury management.

### Relevant sections of SOX

SOX is <a href="https://www.soxlaw.com/" target="_blank">divided into 11 parts</a>, which are called “titles” in the wording of the legislation. These titles are further broken down into sections.

Some sections are particularly relevant when it comes to treasury operations because they relate to <strong>internal controls</strong> and <strong>reporting</strong>. These include:

- Section 302: Corporate Responsibility for Financial Reports
- Section 401: Disclosures in Periodic Reports
- Section 404: Management Assessment of Internal Controls

Let’s cover these one by one.

<strong>Section 302</strong>

This section is focused on <strong>financial reporting</strong> and stresses the personal accountability of the officers (ie the CEO and CFO) who sign off on a company’s financial disclosures. Specifically, during the quarterly and annual reporting period.

<strong>Section 401</strong>

Again, the focus of this section is on <strong>financial disclosures</strong>. It states that any information provided to the public or the SEC must not contain untrue statements or omit any facts.

In keeping with the financial transparency goals of SOX, financial statements must comply with Generally Accepted Accounting Principles (GAAP). Off-balance sheet transactions must also be reported on.

<strong>Section 404</strong>

This section concerns <strong>internal controls</strong> and requires that the CFO and CEO take responsibility for this. Specifically, the responsibility for establishing and maintaining controls over financial reporting.

As Deloitte notes in its <a href="https://www2.deloitte.com/content/dam/Deloitte/us/Documents/audit/us-audit-sox-compliance-are-you-ready.pdf" target="_blank">SOX compliance readiness guide (PDF)</a>, contributions to financial reports come from across the business, so controls are needed over processes and systems that feed into the reports as well as the reports themselves.

## Challenges of SOX compliance

Let’s now look at some of the challenges faced by organizations when applying these principles to digital asset treasury management.

### Difficulty in implementing internal controls

One the main challenges in creating systems for financial disclosures of digital assets is the <strong>incompatibility of the raw data</strong> with legacy financial systems.

This can result in labor-intensive manual processes for finance teams, who must reconcile data from, for example, the Bitcoin blockchain with financial reports structured for fiat currency.

Not only are such manual processes time-consuming, but they can also lead to inaccuracies caused by human error.

Furthermore, there can be a significant cost to the business when key staff are involved in activity that peaks around reporting periods, rather than being able to focus on tasks that generate value or relate to business functions such as risk management.

### Lack of understanding among stakeholders

SOX is clear about the personal responsibilities of CFOs and CEOs when it comes to management oversight of internal controls. However, there can be a steep learning curve when it comes to operating with digital assets.

Unfamiliarity with the underlying technology can cause additional complications for leadership, internal audit teams, and external auditors alike.

A recent <a href="https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/sox-compliance-automation.html" target="_blank">PwC survey</a> found that many compliance teams are already struggling to keep pace with the escalating complexity of external requirements.

### Risks around third-party contractors

SOX requires that any third-party providers that a business uses are SOX compliant in their own processes.

This can create additional headaches for compliance teams when it comes to procurement of digital asset custodial services, exchange platforms or payroll providers.

## Treasury operations with Fortris

[Fortris](/) is a digital asset treasury management platform that supports the reporting and security requirements of enterprise business and financial institutions.

The Fortris platform works in harmony with existing financial systems such as enterprise resources planners (ERPs) and accounting software.

Here are some of the ways Fortris delivers a compliance-ready solution for finance teams and C-suite leadership alike.

### No single point of failure

When it comes to authorizing payments, Fortris divides the responsibility between multiple users.

These roles can be configured at a team and individual level to exactly mirror the existing access controls of the business.

### GAAP-compatible reporting

Fortris creates [detailed journal reports](/blog/bitcoin-journal-entries) that translate raw blockchain data into a user-friendly format.

Finance teams get the best of both worlds – the inherent transparency of blockchain, and a tailored subledger that is compatible with legacy financial systems.

This also means CEOs and CFOs can have a single view of the company’s complete financial position, rather than having to decode complicated raw blockchain data.

### User actions are logged

Fortris has been built to support a culture of financial transparency. The system records which individuals created and signed off on each transaction made within the system.

![alt Screenshot of a spreadsheet with 7 columns showing](/images/posts/bitcoin-journal-entry-guide-01.png)<center><strong><small>An example of a Fortris journal entry.</small></strong></center>

### Minimize counterparty risk

Companies that wish to avoid exposure to third-party custodians and exchanges can use the Fortris PSP and self-custody tools to securely manage their own digital assets.

Fortris also has an inbuilt account recovery tool that means no business is reliant on the Fortris system to access its digital assets.

<div id="table-menu">

- [SOX compliance: an overview](#sox-compliance-an-overview)
- [SOX compliance and digital assets](#sox-compliance-and-digital-assets)
- [Challenges of SOX compliance](#challenges-of-sox-compliance)
- [Treasury operations with Fortris](#treasury-operations-with-fortris)

</div>


SOX compliance for digital asset treasury management


Receiving small amounts of unsolicited Bitcoin (BTC) is called a dusting attack.

To find out exactly how a dusting attack works, and why it poses a threat to a Bitcoin wallet’s security, read our article [What is a dusting attack?](/blog/what-is-dusting-attack/)

The key thing to know is that it’s important not to spend any Bitcoin dust by inadvertently including it in a payment.

The [Fortris](/) team recently worked with a customer to deflect a Bitcoin dusting attack. The steps that we took are summarized below.

## Quick recap: What is Bitcoin dust?

But first, a recap: What exactly is Bitcoin dust? To really understand this, we first need to consider how Bitcoin works.

Units of Bitcoin are measured in UTXOs, or unspent transaction outputs. For an in-depth explanation of what a UTXO is and why Bitcoin works this way, read our article on [UTXO management](/blog/utxo-management/).

The key thing to know is that UTXOs are <strong>irregular and indivisible</strong> amounts of Bitcoin.

Bitcoin dust is simply a small-value UTXO or UTXOs that can be worth the equivalent of just a few cents.

This video shows an example of how UTXOs work:

<iframe src="https://www.youtube.com/embed/Shu5ztlb4aI?controls=0" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

UTXOs are also traceable, since every UTXO’s transaction history is recorded in the immutable public database of the Bitcoin blockchain.

## Harmless dust vs a dusting attack

Not all Bitcoin dust is harmful.

Sometimes wallets accumulate dust as a result of “change” received from creating a transaction, as shown in the video above, or for other reasons such as receiving lots of small payments.

Think of it as like walking around with a regular wallet filled with small change.

The key difference between small change in the fiat world, and UTXOs, is that the more UTXOs are required to create a payment, the larger the file size of the transaction.

The larger the file size, the higher the fees paid to the miner who adds the transaction to the Bitcoin blockchain.

For more on the relationship between transaction size and fees, read our article [How long does a Bitcoin transaction take?](/blog/bitcoin-transaction-time/)

Therefore, depending on what a wallet is used for, it can make sense to minimize the number of small-value UTXOs. Here are some of the ways that this can be done:

- Some crypto exchanges allow dust to be <strong>converted into other crypto tokens</strong> that can be used in trades.

- Some wallet providers have a <strong>coin control</strong> feature, letting you automatically combine multiple small-value UTXOs into larger ones.

<strong>Warning:</strong> since both these methods involve combining multiple UTXOs together, they should not be considered as a solution for dealing with unsolicited, suspicious dust.

Combining UTXOs and spending them is exactly the outcome that dusting attackers are looking for.

## Three steps to neutralize an attack

Here are three steps that enterprise users can take to deflect a dusting attack. The key objective is to make sure that <strong>dust UTXOs are not spent</strong>.

<iframe src="https://www.youtube.com/embed/jmB6fgpkgUs?controls=0" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

### 1. Locate the dust

As we have seen, it is important that users have a way to identify the contents of their Bitcoin wallets at a UTXO level.

If you or organization uses multiple wallets, make sure that you or your wallet provider can trace any unsolicited dust-size UTXOs so you can identify which wallet they are in.

In large wallets with a high volume of payments in and out, it can be hard to identify the origins of individual UTXOs.

This is why good UTXO management is an important consideration for enterprise business and institutions using Bitcoin.

### 2. Freeze the dust

Bitcoin wallets often have default settings that determine which UTXOs they use to create a payment.

If your wallet software allows it, set up a rule so that any Bitcoin UTXOs under a certain value are automatically frozen and cannot be spent.

Although this has the effect of freezing all dust, including harmless dust that has naturally accumulated, a side benefit is that it can save money in fees.

At times of high transaction volumes, the fees required for Bitcoin miners to process multiple-UTXO transactions may even cost more than the value of the transaction itself.

### 3. Isolate the dust

Finally, once you have identified the location of the dust and are sure it is frozen, you may wish to remove all other UTXOs from the wallet in question and “archive” it to be extra safe.

This provides an extra layer of confidence that the dust UTXOs cannot be inadvertently combined with other UTXOs and spent.

<div id="table-menu">

- [Quick recap: What is Bitcoin dust?](#quick-recap-what-is-bitcoin-dust)
- [Harmless dust vs a dusting attack](#harmless-dust-vs-a-dusting-attack)
- [Three steps to neutralize an attack](#three-steps-to-neutralize-an-attack)

</div>


How to deflect a Bitcoin dusting attack in three steps


Keeping detailed general ledger records is an essential part of digital assets bookkeeping at enterprise level. Journal reports are a key step in this process. 

In this article, we’ll take a close-up look at what a Bitcoin journal entry looks like in the Fortris digital asset treasury management platform.

## What is a Bitcoin journal entry?

The main difference between a journal entry in traditional finance and a Bitcoin journal entry is that the latter should contain key information from the Bitcoin blockchain - the "on-chain" transaction.    

For more background on this, read our [Bitcoin bookkeeping best practice guide](/blog/bitcoin-bookkeeping-best-practice).

Recording this data presents a fundamental integration problem, because most bookkeeping and accounting platforms cannot “read” blockchain entries.

Furthermore, it is important for accounting and audit reasons that any journaling of a Bitcoin transaction should contain more than the raw data included in the blockchain record.

Luckily, there are now software solutions that can bridge the gap between the worlds of traditional finance and blockchain.

Not only does this provide data for accounting, tax, and audit requirements, it also means businesses can categorize their Bitcoin transactions and assign internal reference codes for better reporting and analytics.

## Bookkeeping with Fortris

Digital asset bookkeeping is one of the core functions of the [Fortris](/) platform.

With Fortris, finance teams can generate journal reports that can be imported directly into existing treasury management systems or enterprise resource planner software.

The process is automatic, removing the need for time-consuming and potentially inaccurate manual reporting.

It also allows each transaction to be journaled in detail, with contextual information around the purpose of the transaction, where it originated, which category of business operations it falls into and many more relevant data points.

In essence, Fortris creates an off-chain record of all on-chain transactions.

How would this work in practice? Let’s find out.

## Anatomy of a Bitcoin journal entry

Here’s what a single journal entry could look like for a hypothetical business that processes Bitcoin incomings and outgoings.

Imagine that this business is trialing an affiliate marketing scheme that involves paying out [commissions to creators in the form of Bitcoin](/crypto-creators).

The finance team decide to generate a journal report for the first week of the trial to check its progress.

The report is an Excel sheet with two tabs:

- The <strong>summary tab</strong>, which contains the start and end date of the report period, and the opening and closing balance of the Bitcoin wallet in question.
- The <strong>report tab</strong>, in which individual journal entries are recorded. Each journal entry has 25 columns of data.

Now let’s break the report tab into sections and look the data included in a single journal entry for an affiliate payment.

The journal entry in question is highlighted and the rest of the report is obscured.

<strong>Columns A-G:</strong>

![alt Screenshot of a spreadsheet with 7 columns showing](/images/posts/bitcoin-journal-entry-guide-01.png)

<strong>Order ID</strong> is a unique alphabetical code generated by the Fortris system.

<strong>Order status</strong> shows the state of the transaction at the time the report was generated. We can see that in this case, the order has been completed.

The <strong>Created by</strong> and <strong>Final approver</strong> fields record who in the organization carried out each of these functions.

<strong>Account name</strong> refers to the specific Bitcoin wallet this payment has been made from.

The <strong>Category</strong> and <strong>Order code</strong> are both customizable depending on the business model and requirements of the company. In this case, the order code “Commission” describes the nature of the payment being made.

<strong>Columns H-N:</strong>

![alt Screenshot of a spreadsheet with 7 columns showing](/images/posts/bitcoin-journal-entry-guide-02.png)

<strong>Confirmed date</strong> shows the date that the transaction was confirmed on the blockchain. See our article [How long does a Bitcoin transaction take?](/blog/bitcoin-transaction-time) For more information on this.

<strong>Internal reference</strong> is another customizable field. In this case, it shows that the payment is part of the affiliate scheme.

<strong>Crypto address</strong> is the specific Bitcoin address that the payment has been sent to.

<strong>Hash</strong> is the unique identifier for this transaction on the Bitcoin blockchain. Copying and pasting this string of code into a blockchain explorer such as blockchain.com will show the public record of this transaction.

To see an example of a blockchain record, read our [Bitcoin bookkeeping best practice guide](/blog/bitcoin-bookkeeping-best-practice).

<strong>Transaction ID</strong> is the unique alphabetical code generated by the Fortris system.

You may be wondering why there is an order ID (see column A) and a transaction ID. This is because the fee for the transaction (the commission paid to the miner who adds the transaction to the blockchain) is listed as a separate journal entry in the Fortris system.

This payment and its fee will share the same order ID but have separate transaction IDs.

Journaling fees separately can be useful for data and analytics purposes, for example tracking fee expenditure over time.

<strong>Transaction type</strong> has several options including payment sent, payment received, and fee.

<strong>Order type</strong> shows whether the order was sent or received to an external address (outside your organization) or internal address (inside your organization) and whether it is a debit or credit.

<strong>Columns O-U:</strong>

![alt Screenshot of a spreadsheet with 7 columns showing](/images/posts/bitcoin-journal-entry-guide-03.png)

<strong>Debit (BTC)</strong> shows the size of the transaction.

We can see the <strong>exchange rate</strong> (1 BTC/fiat) at the moment the transaction was confirmed (for incoming funds) or broadcast (for outgoing funds). In this case, the fiat currency is USD.

We can also see the equivalent <strong>amount of this transaction in USD</strong>, and the remaining <strong>USD balance</strong> of the account once the payment has been sent.

<strong>Columns V-Y:</strong>

![alt Screenshot of a spreadsheet with 7 columns showing](/images/posts/Bitcoin-journal-entry-guide-04.png)

The final columns of the journal entry have not been used for the purposes of this trial.

<strong>GL distribution</strong>, <strong>GL name</strong> and <strong>GL project</strong> are all customizable fields that can be used for enhanced integration with the GL (general ledger) of the organization.

<strong>Fee priority</strong> only applies when the journal entry in question is a fee – the commission paid to the miner who adds the transaction to the Bitcoin blockchain. There are three categories: low, medium, and high. This reflects a core function of the Fortris system that allows businesses to decide whether they want to pay a lower fee for a low priority transaction or a higher fee for a more urgent transaction.

<div id="table-menu">

- [What is a Bitcoin journal entry?](#what-is-a-bitcoin-journal-entry)
- [Bookkeeping with Fortris](#bookkeeping-with-fortris)
- [Anatomy of a Bitcoin journal entry](#anatomy-of-a-bitcoin-journal-entry)

</div>


What does a Bitcoin journal entry look like?


Before Bitcoin transactions can be accounted for, they need to be accurately recorded. Find out more in our guide.

## Bitcoin bookkeeping: the big picture

When it comes to accounting for digital assets such as Bitcoin, there are challenges from the outset.

On the one hand, all Bitcoin (BTC) transactions are recorded in a decentralized public ledger – the Bitcoin blockchain – that provides a high level of transparency.

On the other hand, the raw data that exists on the blockchain does not contain enough business information to satisfy audit and accounting requirements (and there would be [privacy and security implications](/blog/is-bitcoin-anonymous) if it did).

Accounting for a limited number of BTC transactions may be manageable enough for a consumer or small business. This could involve manually cross-referencing blockchain records with other financial statements. But a time-consuming system like this is difficult to scale.

The more that businesses rely on manual processes, the more room there is for inconsistencies and human error.

So where does that leave businesses that want to integrate Bitcoin into their day-to-day business operations?

This article will compare typical journal reports from the world of traditional finance (TradFi) with a blockchain transaction record, and look at how to “bridge the gap” between the two.

## Introduction to journal reports

In bookkeeping, a journal report is a summary of transactions that have taken place in a specific timeframe. Journal reports are used to supply the raw data for the general ledger.

This is the principal book of accounts when it comes to a company’s finances.

![alt Three journal reports stacked in a vertical row on the left, each with an arrow showing they feed into the general ledger, a single spreadsheet that is larger and shown on the right.](/images/posts/journal-reports-general-ledger.png)<center><strong><small>Journal reports are typically a chronological record of transactions. They may represent a particular department, business function, or geographic region.</small></strong></center>

In effect, a journal report is a sub-ledger that acts as the first step in the bookkeeping process.

Thanks to advances in accounting software technology, journal reports are increasingly auto generated, removing the risk of human error, and streamlining financial reporting.

A journal report is typically formatted as a spreadsheet with multiple columns for standard data such as transaction date, reference, category of payment, debit/credit, and net balance for the account in question.

## How is a Bitcoin transaction recorded?

All Bitcoin transactions are recorded on the Bitcoin blockchain, a decentralized public database that contains the history of every Bitcoin transaction that has ever taken place.

In Bitcoin, there is no system of accounts and balances. Units of Bitcoin (which on a technical level are referred to as UTXOs) are exchanged on a peer-to-peer basis.

The Bitcoin blockchain is updated in real time to reflect the changing ownership of the total amount of Bitcoin in existence. This includes new Bitcoins as they are mined and added to the blockchain.

You can read more about how this works in our article on [UTXO management](/blog/utxo-management#introducing-unspent-transaction-outputs).

### Finding a Bitcoin transaction online

The transparent nature of the blockchain means that any individual transaction can be located on the blockchain.

One way that transactions can be tracked is via block explorers. A block explorer is a website that aggregates all the raw data from the blockchain in a user-friendly, searchable database.

### How to read a Bitcoin transaction record

Let’s take a random example of a real BTC transaction on a block explorer and look at some of the information it contains.

![alt Screenshot from blockchain.com showing a BTC transaction entry](/images/posts/block-explorer-screenshot.png)<center><strong><small>Source: <a href="https://www.blockchain.com/explorer/transactions/btc/f7d0c3471cb288fa54ab425d8a2838abc12032b335c5caefda84016d899203da" target="_blank">blockchain.com</a></small></strong></center>

<strong>Hash:</strong> The unique identifier of the transaction. The hash can be entered in any block explorer to locate the transaction and check its status.

<strong>Age:</strong> How much time has elapsed since the transaction was broadcast to the blockchain.

<strong>Inputs:</strong> We can see that there are two different inputs (UTXOs) which together make up the amount broadcast in the transaction, less the fee (which is also shown).

<strong>Outputs:</strong> It is common for a Bitcoin transaction to include more than one output. That’s because spending more than one UTXO and generating “change” that gets returned to the sender is a key part of [how UTXOs work in Bitcoin](/blog/utxo-management#introducing-unspent-transaction-outputs).

Other information includes:

- A timestamp of when the transaction was broadcast
- Its size in bytes (the more inputs/UTXOs, the larger the size)
- The price of BTC in USD at the time the transaction took place.

## What should a Bitcoin journal report contain?

As we have seen, Bitcoin is not a system that uses accounts and balances. But TradFi does.

Businesses that work to widely recognized accounting standards (such as GAAP in the United States or IFRS in many other countries) will likely need to reconcile raw blockchain data with the rest of their accounts in the form of journal reports.

This is in order to:

- Provide the raw data needed for the general ledger, for purposes such as preparing financial statements, taxation, and audit.
- Import into existing TMS (treasury management system) and ERP (enterprise resource planner) software, such as Oracle Netsuite, in a format compatible with those systems.

A Bitcoin journal report should contain as much information as possible about the business function of a Bitcoin transaction as well as its blockchain data.

This includes, but is not limited to:

- Showing whether a transaction is internal or external, an essential requirement for audit purposes.
- Itemizing fees as separate journal entries for simplified reporting and analytics
- Including internal references such as payment category or type
- The debits and credits to the relevant accounts
- Indicating who created and approved the transaction.

In order to compile all this information, companies may choose to operate multiple different spreadsheets, and manually update these to include blockchain data alongside TradFi bookkeeping information.

As mentioned above, this can be both time-consuming and prone to human error.

An easier option is to use a specific digital assets treasury operations platform to create automated journal reports.

Platforms such as [Fortris](/) create a bridge between the world of digital assets and TradFi, allowing companies to hold and use digital assets without the need to replace their existing systems.

<strong>To find out more, read our article [What does a Bitcoin journal entry look like?](/blog/bitcoin-journal-entries)</strong>

<div id="table-menu">

- [Bitcoin bookkeeping: the big picture](#bitcoin-bookkeeping-the-big-picture)
- [Introduction to journal reports](#introduction-to-journal-reports)
- [How is a Bitcoin transaction recorded?](#how-is-a-bitcoin-transaction-recorded)
- [What should a Bitcoin journal report contain?](#what-should-a-bitcoin-journal-report-contain)

</div>

Bitcoin bookkeeping best practice guide


Self-custody is a [growing trend](/blog/self-custody-institutions-guide) in the world of digital assets management. Here are five essential requirements that any self-custody solution should provide for treasury teams.

## 1. No single point of failure

Bringing custody in-house means removing the counterparty risks associated with exchanges or custodians.

It protects against losing funds through an incident like the Mt Gox hack or the collapse of FTX, but it also means an increased responsibility for operational security.

One way to do this is to make sure that account access is securely distributed across the organization.

With Bitcoin, for example, this could mean using a secure multi-signature wallet system. Under such a system, a set of private keys are created, and a pre-determined number of these keys are required to sign transactions.

![alt A multi-sig wallet showing a "2-of-3" signing arrangement.](/images/posts/multi-sig-transaction-updated.jpg)<center><strong><small>A Bitcoin wallet with a "2-of-3" signing arrangement.</small></strong></center>

That way, even if a minority of keys are lost, stolen, or otherwise compromised, the assets remain secure.

<strong>Background reading: [What is a multisig wallet?](/blog/multi-sig-wallet)</strong>

## 2. UTXO management

In the case of Bitcoin and other similar blockchain systems, UTXOs are the essential building blocks of the network – the discrete units that each individual transaction consists of.

Being able to trace, store and spend Bitcoin down to the level of individual UTXOs brings benefits ranging from enhanced security to fee optimization and tax efficiency. Find out more in our article on [UTXO management](blog/utxo-management).

The beauty of self-custody is that organizations needn’t fear losing track of UTXOs because of a third-party comingling different client funds in an omnibus account.

But further to this, any digital asset management platform used for Bitcoin should be set up to allow an organization to track, freeze or spend individual UTXOs according to their business requirements.

## 3. Operational controls

Having established a system that prevents a single point of failure, the governance of said system needs to be customized to the specific needs of the organization and its existing business rules.

Payroll is one example. If employees are to receive payment in digital assets, whether that is a bonus system or part of a monthly salary, such payments will likely need to be set up by the payroll or human resources team and authorizing by at least one other team or executive member.

Finance teams may also wish to determine how many approvals a transaction needs based on its value, as in the example shown below.

![alt An example of requiring a specific number of approvals for transactions over a particular amount](/images/posts/operational-control.png)<center><strong><small>Organizations can create business rules requiring that transactions above a set threshold must have X number of authorizations.</small></strong></center>

## 4. No vendor lock-in

Building a complete self-custody digital asset management system in-house would be a massive undertaking. For this reason, it is common for institutions to partner with an infrastructure provider.

Acquiring a software license or integrating an API is a more convenient and scalable solution than building something from scratch, but it’s important that any such arrangement is reversible.

Since self-custody offers organizations complete control and sovereignty over their digital assets, it would be paradoxical to be locked in to using proprietary software.

Finance and technical teams should check there is a mechanism such as an account recovery tool that lets them switch to do a different vendor without requiring the involvement of the current vendor to do so.

That way, their data and assets are protected in the event of any unforeseen circumstances.

## 5. Systems compatibility

To be of maximum benefit to an organization, digital assets should not exist in a silo.

The infrastructure needed to manage them should be compatible with existing treasury management systems (TMS) and enterprise resource planners (ERPs).

Fully integrating digital assets in this way means enterprises can reap their benefits as an operational asset as well as on the balance sheet.

A digital asset operations platform such as [Fortris](/), which [generates journal reports](/blog/bitcoin-journal-entries) compatible with GAAP and IFRS accounting standards, removes the need for laborious manual processes when it comes to business functions such as conciliation and reporting.

## Additional integrations

Finally, to truly reap the benefits of a self-custody model, organizations may wish to cut out intermediaries when it comes to the flow of digital assets into and out of their business.

There are many third-party payment services providers (PSPs) that allow companies to take crypto payments, but if organizations wish to “be their own bank”, one of the foundational principles of Bitcoin, then the most frictionless way to do so is via their own PSP.

<div id="table-menu">

- [1. No single point of failure](#1-no-single-point-of-failure)
- [2. UTXO management](#2-utxo-management)
- [3. Operational controls](#3-operational-controls)
- [4. No vendor lock-in](#4-no-vendor-lock-in)
- [5. Systems compatibility](#5-systems-compatibility)
- [Additional integrations](#additional-integrations)

</div>


Checklist for digital asset self-custody


Recent events in the digital assets sphere have seen a surge in demand for self-custody by consumer cryptocurrency holders. But what about institutional users? Let’s explore some of the challenges and benefits for large organizations.

## Self-custody: an undeniable trend

The implosion of the digital asset platform FTX in late 2022 continues to send aftershocks through the crypto ecosystem.

The factors that led to the collapse of the world’s second largest crypto exchange will be debated and analyzed for years to come, but one side effect has been clear to see: the spike in demand for self-custody.

The phrase “not your keys, not your coins” has been an oft-repeated mantra in the wake of FTX.

Leaving crypto in centralized exchange wallets goes against this foundational philosophy of Bitcoin, which was designed to give users control over their funds without the need for intermediaries like banks.

<strong>Background reading: [Crypto wallets: 5-minute guide](/blog/intro-crypto-wallets)</strong>

With the amount of BTC held on exchanges <a href="https://cryptoslate.com/btc-on-exchanges-fall-to-new-lows-since-2018/" target="_blank">reaching new lows</a>, it seems that jittery retail users are looking for alternatives to exchange custody – an assumption that appears to be backed up by the <a href="https://cointelegraph.com/news/trezor-reports-300-surge-in-sales-revenue-due-to-ftx-contagion" target="_blank">record sales of hardware wallets</a> such as Ledger and Trezor in recent weeks.

However, it’s interesting to note that the consumer shift towards self-custody was underway well before FTX’s downfall.

One study in July 2022 suggested that the hardware wallet industry <a href="https://cointelegraph.com/news/hardware-wallet-industry-to-outstrip-crypto-exchanges-report" target="_blank">could outstrip crypto exchanges</a> by 2027.

## Challenges of self-custody for institutions

Retail users are spoilt for choice when it comes to self-custody options, though the technical setup (managing a hardware wallet and private keys) can have a steep learning curve at first.

For institutions, whose funds reportedly <a href="https://markets.businessinsider.com/news/currencies/ftx-crash-institutional-investors-hit-as-exchange-collapses-2022-11" target="_blank">made up the bulk of those affected</a> by the FTX collapse, the situation is more complex.

The typical setup of a single hardware wallet, private key and a backup/seed phrase is impractical at an institutional level.

What's more, institutions have complex requirements when it comes to areas such as governance, transparency, and auditability.

Let’s look at some of the key challenges, and how they can be resolved.

### 1. Governance and permissions

It is important that institutions don’t fall into the same trap that can come with entrusting custody to a third party: having a single point of failure when it comes to key management.

This can result in nightmare scenarios such as <a href="https://www.cbc.ca/news/canada/nova-scotia/quadriga-widow-jennifer-roberston-gerald-cotten-1.6318955" target="_blank">the case of a CEO’s death</a> that led to the loss of millions of dollars in customer funds.

Equally, permissions and approvals need to be properly distributed to prevent bottlenecks in essential business operations such as bulk payments and payroll.

<strong>Solution:</strong>
When it comes to self-custody, this means creating a secure system whereby transactions can only be created and authorized by pre-approved individuals or teams, in accordance with an institution’s governance policies.

Clear controls in this area are essential from an auditor’s perspective, as <a href="https://www.pwc.ch/en/insights/digital/crypto-custody-risks-and-controls-from-an-auditors-perspective.html" target="_blank">PWC notes.</a>

One way of managing this involves the use of <a href="https://fortris.com/blog/multi-sig-wallet" target="_blank">multi-signature wallets.</a>

The diagram below shows how different payment thresholds can be established to further customize the approvals process using a platform such as [Fortris](/).

![alt An example of requiring a specific number of approvals for transactions over a particular amount](/images/posts/operational-control.png)<strong><small>Organizations can create business rules requiring that transactions above a set threshold must have a specific number of authorizations.</small></strong>

### 2. Hardware security

The promise of self-custody is that individuals and institutions alike can “be their own bank”.

With that comes the requirement to physically safeguard the hardware needed for key storage, backups, and account recovery mechanisms.

<strong>Solution:</strong>
For financial institutions well versed in the physical elements of OpSec (operational security), building secure on-site storage is probably less of a barrier than it is for SME or retail users.

However, working with an experienced self-custody treasury logistics specialist can make the process even smoother.

### 3. Reporting and analytics

The beauty of a self-custody solution with Bitcoin, for example, is that it leverages the transparency of blockchain technology. Any transaction that takes place “on chain” can be located using a publicly available block explorer.

However, Bitcoin is [private by design](/blog/is-bitcoin-anonymous), meaning that the sender and receiver of a transaction are represented by strings of code. The raw transaction metadata of the blockchain will not fulfil an institution’s reporting requirements by itself.

Institutions are operating in a fiat world, where journal reports follow a standard format, and the correct tracking of a digital asset’s cost basis can have major implications for tax and compliance.

They could end up with two parallel sets of data that then need to be manually reconciled.

<strong>Solution:</strong>
To avoid having to fill in spreadsheets manually, which would be impossible to scale and a waste of team resource, institutions should look for software solutions that seamlessly integrate digital assets into existing financial planning and reporting programs.

<strong>Further reading: [Bitcoin bookkeeping best practice guide](/blog/bitcoin-bookkeeping-best-practice)</strong>

## Self-custody benefits and use cases

In addition to the operational security advantages of self-custody, such as complete ownership of digital assets and the removal of counterparty risk, there are other clear benefits for institutions.

### Auditability

In a self-custody model, transactions are easier to track “on-chain” because there is no risk of a third party commingling an institutions’ assets with those of other customers.

This can occur when exchanges, for example, use omnibus instead of segregated accounts.

![alt An omnibus versus a segregated account model](/images/posts/omnibus-vs-segregated-blog-post.png)<strong><small>In omnibus accounts funds are pooled together, whereas in segregated accounts client funds are held separately from those of other clients. </small></strong>

### Wallet storage mode flexibility

Having complete control over its own digital assets means an institution is free to decide on the combination of cold, hot, and warm wallets it uses, in accordance with its operational requirements and risk management policies.

<strong>Background reading: [The different kinds of crypto wallets](/blog/intro-crypto-wallets#the-different-kinds-of-crypto-wallets)</strong>

### Speed of access

For institutions that choose not to self-custody, a qualified crypto custodian can present an attractive alternative to exchange storage. The advanced security and safeguarding processes of a custodian provide a level of reassurance, especially for non-crypto native companies.

However, the main drawback of custodians is the time and friction involved in accessing funds. The core competency of custodians is secure storage (and rightly so), but this model can be impractical for institutions that need to move funds regularly or at short notice.

## Custody diversification

As we have seen, there are numerous benefits of digital asset self-custody for institutions. But it is realistic to expect self-custody to fulfil all an organization’s needs?

The reality is that institutions may require custom solutions that feature a range of different custody options. For example:

- Highly secure self-custody cold storage wallets for treasury reserves
- Hot or warm wallets with an operational float for day-to-day business
- Exchange wallets for trading.

Assets can be moved around between these different buckets as required.

Whatever custody solution an institution opts for, it is important that it has the necessary financial tooling to manage them according to accounting best practices and for maximum operational efficiency.

<div id="table-menu">

- [Self-custody: an undeniable trend](#self-custody-an-undeniable-trend)
- [Challenges of self-custody for institutions](#challenges-of-self-custody-for-institutions)
- [Self-custody benefits and use cases](#self-custody-benefits-and-use-cases)
- [Custody diversification](#custody-diversification)

</div>


Digital asset self-custody guide for institutions


In the peer-to-peer world of cryptocurrency, crypto wallets were first designed with the individual user in mind.

However, with corporate adoption of digital assets becoming increasingly mainstream, wallet technology has evolved to meet the more complex needs of large corporations and institutions.

In this article, we’ll cover the key differences between small business and enterprise crypto wallet solutions. We’ll also look at the advanced functionality that enterprise users should look for in a wallet provider.

<strong>Background reading: [Crypto wallets: 5-minute guide](/blog/intro-crypto-wallets)</strong>

## Crypto management options for business

Just as there are now many options for consumers in the crypto sphere, there are a range of solutions for businesses wishing to branch into crypto.

Not all of these require them to manage their own crypto wallet per se. Let’s look at some of the options for non-crypto native businesses.

### Accepting payments in crypto

For companies that simply wish to accept crypto payments in exchange for goods and services, a third-party payment gateway provider may be sufficient. Paypal, Stripe and Square are just a few examples of companies that offer this service.

![alt Diagram showing a crypto payment gateway provider](/images/posts/crypto-payment-gateway-provider.jpg)<center><strong><small>Payment gateway providers can convert crypto into fiat currency.</small></strong></center>

This may be a good solution for small to medium businesses that are looking to simply diversify the payment options for their customers, without having to buy or build systems to hold crypto themselves.

With a <a href="https://www.paypal.com/us/business/website-payments" target="_blank">Paypal merchant account</a>, for example, a small business could allow their customers to pay in crypto but receive the payout themselves in USD.

### Crypto exchange accounts for business

For enterprises and institutions that wish to hold crypto as a treasury asset within a balanced investment portfolio, a third-party solution may meet their needs.

Some crypto exchanges allow companies to apply for business accounts to buy and sell crypto.

Exchanges have on and off-ramps for fiat, meaning that they allow users to exchange crypto for highly regulated currencies such as USD. Because of this, there are often stringent KYC (Know Your Customer/Client) procedures for new business customers to go through.

Not all businesses are eligible for such accounts, depending on which field they operate in, where they are based, and other factors that can affect their risk profile as assessed during KYC.

### Institutional custodians

If a business is looking to hold crypto as an investment asset, then they may also consider using a [digital asset custody service](/blog/digital-asset-custody#third-party-custodians). This is often the preferred choice for large enterprises and institutions.

The benefits of institutional-grade custody include enhanced security, with robust authentication measures required before a customer can access their holdings.

This benefit can also be a drawback, however, should treasury teams need fast or regular access to their crypto funds.

### Hardware wallets for business

Hardware wallets primarily serve the retail market, as an offline (cold storage) solution for users who wish to manage their own keys rather than rely on a third party.

The oft-repeated phrase here is "not your keys, not your coins" – meaning that if key management is outsourced, the user does not have true sovereignty over their crypto.

Due to their very nature, hardware wallets – which could be a USB drive, computer hardware or similar – can be impractical for large or distributed treasury teams, since the users must be in the same geographic location as the device.

There is also the question of the software used to operate a hardware wallet.

Is it open source or is it proprietary? If it’s the latter, there is a risk that, should the company cease operating, the software needed to run the wallet would stop being maintained.

#### A new generation of hardware wallets

To reflect the growing enterprise demand for crypto wallets, some hardware wallet providers have scaled their offer to provide self-custody solutions, with Ledger’s enterprise vault being one example.

<iframe src="https://www.youtube.com/embed/HAFriI60a-M" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Corporate crypto wallet requirements

As we have seen, corporate crypto wallets can take different forms.

Whether their keys are entrusted to third parties (in the case of exchanges or custodians) or managed in-house through a self-custody solution, enterprises have a number or requirements that don’t apply for individuals or small businesses.

These include:

### Security

It goes without saying that enterprises have an operational complexity that far exceeds smaller companies and the retail market.

And as security technologist Bruce Schneier wrote in a <a href="https://www.schneier.com/essays/archives/1999/11/a_plea_for_simplicit.html" target="_blank">much-cited 1999 essay</a>, complexity is the worst enemy of security.

To manage this risk, enterprise crypto wallet platforms need sophisticated storage solutions that may need to combine cold, hot, and warm wallets, or even a bespoke self-custody solution built to accommodate a client’s specific business needs.

### Multi-user, multi-wallet

In addition to granting multiple team members wallet access, corporate wallet platforms should allow businesses to maintain several different wallets.

A business is likely to require at least two wallets: a treasury wallet for reserves held on the balance sheet, and an operational one for sending and receiving payments. From there, wallet requirements can scale depending on business needs.

They may require a separate wallet for [crypto payroll](/crypto-payroll), for example, or a set of internal wallets that are used solely to hold and transfer funds within different parts of the business.

Such arrangements can help companies that are geographically distributed manage operations such as payroll without the friction of dealing with cross-border payments.

### Reporting integration

The raw data that can be extracted from blockchain records is not in itself compatible with legacy financial systems, and the reality is that replacing such systems is neither an affordable nor a practical solution for most enterprise users.

Therefore, any crypto wallet service needs to offer reporting integration on some level. This is because the more manual processes required to report on a business’s crypto activities, the bigger the knock-on effect on treasury teams, and the less scalable such operations become.

Good reporting is not only essential from a reporting and compliance point of view, but also vital for business intelligence.

To learn more about this in the context of Bitcoin, see our article on [best practices for Bitcoin bookkeeping](/blog/bitcoin-bookkeeping-best-practice).

### Data analytics capabilities

Studies show that data analytics is playing an ever more important role in treasury operations.

In just one example, a <a href="https://eact.eu/articles/covid-treasury-insights-2020-survey/" target="_blank">2020 survey</a> of treasury professionals across Europe found that 62% use, or plan to use data analytics, compared to 43% in 2019.

A <a href="https://thefullfx.com/citi-corporate-treasury-survey-finds-technology-front-of-mind/" target="_blank">separate study by Citi</a> found that while corporate treasurers are heavily focused on adopting new diagnostics technology, legacy tech stacks are struggling to meet this demand.

A corporate crypto platform that is fit for purpose will support this increasingly data-led approach to treasury management, rather than further complicate it with laborious manual processes.

### Scalability

Finally, a corporate crypto wallet needs to grow with the business. This is especially the case for businesses that are not crypto-native and entering the ecosystem step by step.

## Beyond wallets: full operational integration

To benefit from the many benefits of digital assets, from being ahead of the curve on [crypto payroll](/crypto-payroll) to making efficient [cross-border payments](/blog/benefits-cross-border-digital-assets), corporates need solutions that bring this new technology into the heart of their business.

The challenge is to do this without radically overhauling their existing software and systems.

Fortris has a proven track record in providing financial tooling for enterprise-level digital asset operations.

<iframe src="https://www.youtube.com/embed/pAnAYOD6B1A" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

<div id="table-menu">

- [Crypto management options for business](#crypto-management-options-for-business)
- [Corporate crypto wallet requirements](#corporate-crypto-wallet-requirements)
- [Beyond wallets: full operational integration](#beyond-wallets-full-operational-integration)

</div>


Corporate crypto wallets introduction


When Satoshi Nakamoto’s original Bitcoin whitepaper (<a href="https://bitcoin.org/bitcoin.pdf" target="_blank">PDF</a>) was released in 2008, there was a clear emphasis on reducing friction in digital payments.

While Bitcoin has evolved from being just a peer-to-peer payment system to a new global reserve asset, there is reason to believe this new form of digital money can make global payments much more efficient.

Meanwhile, the wider digital assets ecosystem is growing fast.

Whether it’s reducing costs, speeding up settlements, or reaching new markets, there are clear benefits to the use of assets such as crypto and stablecoins in international business payments today.

## Reducing international payment costs

Satoshi blamed the large number of intermediaries for the unnecessary costs found in international transactions.

The SWIFT network, for example, uses a system of correspondent banks. Payments may pass through multiple third parties before settlement occurs, sometimes with fees accrued at each stage.

![alt Diagram showing one individual sending money to another individual through a number of correspondent banks](/images/posts/correspondent-banking-model.jpg)<center><strong><small>Source: <a href="https://aite-novarica.com/report/frictionless-cross-border-payments-alternatives-correspondent-banking" target="_blank">Aite Group</a></small></strong></center>

Satoshi’s solution was to create a system based on trust in cryptography rather than in financial institutions. With Bitcoin, internet users were able to transact with each other directly without intermediaries.

While blockchain-based transactions on the Bitcoin network have become more expensive over time, the <a href="https://lightning.network/" target="_blank">Lightning Network</a> has effectively lowered the cost of sending Bitcoin to zero.

That said, on-chain transactions can still very much outcompete traditional options when it comes to larger transaction sizes. International wire transfers can cost as much as $50, while the current median on-chain Bitcoin transaction fee is less than $0.50.

> <p class="quoteText">A key side effect of the lower transaction costs found on Bitcoin’s Lightning Network is that it also enables much smaller transactions.</p>
> <p style="text-align: right"></p>

Of course, many users still wish to hold value in their local currency rather than Bitcoin, but the large amount of liquidity that has come into Bitcoin over the years has reduced the costs of swapping between Bitcoin and traditional currencies.

And when stablecoins are used, there are usually no conversion fees to worry about.

A key side effect of the lower transaction costs found on Bitcoin’s Lightning Network is that it also enables much smaller transactions.

In fact, this digital payments technology enables new business use cases around microtransactions that can be less than a penny in value.

## Faster transaction times

In addition to lower fees, the removal of middlemen from digital payments also enables them to move around the world as quickly as an email or text message.

Final settlement for international transactions can take days, weeks, or even longer.

With Bitcoin and other blockchain-based payment networks, payments can be completely finalized in a matter of minutes.

Additionally, transactions made via Bitcoin’s Lightning Network are practically instant.

<strong>Related: [How long does a Bitcoin transaction take?](/blog/bitcoin-transaction-time)</strong>

## Reaching new markets

The key innovation with Bitcoin is that it created a global, permissionless network that anyone can connect to at the click of a button.

There are no forms to fill out when creating an account, and there is no possibility of being rejected by a financial institution that picks and chooses who is allowed to transact on the network.

This means that anyone in the world can use Bitcoin as a payment network, as long as they are able to connect to the internet.

For many people around the world, the Bitcoin network is the best way to connect to the global economy.

While those living in developed countries are able to use tools such as credit cards or PayPal to engage in online commerce, a <a href="https://finance.yahoo.com/news/world-bank-1-7-billion-152239354.html" target="_blank">general lack of banking access</a> and digital payment mechanisms has effectively locked billions of people out of the digital economy on the internet.

Whether it’s accepting payments or distributing payroll, Bitcoin and other crypto networks enable financial connections with international customers, business, and other entities that would otherwise not be possible.

<strong>Fortris CTO Tibor Ballai discusses use cases for Bitcoin in cross-border payments:</strong>

<iframe src="https://www.youtube.com/embed/-kZ9bOeHO1E?start=542" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Use cases for crypto cross-border transactions

Due to the global nature of digital assets, they can fill the gaps left by the traditional financial system.

In other words, Bitcoin is useful for the types of transactions that are simply not prioritized by traditional banks.

In most cases, businesses that operate on the internet will be the ones that see the greatest benefit from using Bitcoin for cross-border transactions.

However, this should not be viewed as a limitation of the technology, as we're living in an increasingly digital world with 25% of all professional jobs <a href="https://www.forbes.com/sites/bryanrobinson/2022/02/01/remote-work-is-here-to-stay-and-will-increase-into-2023-experts-say/" target="_blank">expected to be remote by the end of 2022</a>.

Here are a few of the most prominent uses of Bitcoin and other crypto networks for international payments today:

### Gaming

- Gamers can be found in every country around the world; however, banks are not. Whether it’s rewards for time spent playing a mobile app or distributing winnings for an online gaming tournament, digital assets offer the ability to instantly transmit value to anyone in the world.

- Additionally, the use of crypto-based microtransactions offer new economic models for rewarding more users.

### Creator economy

- Bitcoin allows content creators to monetize fans from anywhere in the world.

- Creators can only benefit from accepting Bitcoin-based donations and payments from their users, as they’ll now be able to receive transactions from those who are not connected to the global financial system.

- Bitcoin also cuts out the financial middlemen found between content creators and their fans.

### Rewards programs

- Bitcoin can be a powerful option as a drop-in replacement or addition to any rewards program. When users are rewarded with Bitcoin for completing tasks online, they receive an extremely liquid asset that has universal utility on the internet.

- This is an area where Bitcoin’s Lightning Network shines, as a practically unlimited number of payments can be instantly sent to thousands or millions of users at effectively no cost.

### International payroll

- Online businesses tend to have global workforces, which means managing dozens of different local payment systems that all come with their own quirks and fees.

- Alternatively, crypto-based payroll systems remove potential friction between the employer and employee and allow digital payments to be sent anywhere in the world.

While these are not all the industries where digital assets make sense for cross-border transactions, these examples illustrate the key benefits of this new financial technology.

For businesses that operate online, enabling crypto payments on both sides of their transaction flows can only increase the customer base and total addressable market.

<div id="table-menu">

- [Reducing international payment costs](#reducing-international-payment-costs)
- [Faster transaction times](#faster-transaction-times)
- [Reaching new markets](#reaching-new-markets)
- [Use cases for crypto cross-border transactions](#use-cases-for-crypto-cross-border-transactions)

</div>


Benefits of digital assets for cross-border transactions


A crypto wallet is a device, software or service that allows you to buy, sell and store cryptocurrencies.

It does not actually store the crypto itself – rather, it stores the keys you use to access your crypto.

## The evolution of crypto wallets

In the early days of Bitcoin, the earliest cryptocurrency, anyone who wanted to buy and sell Bitcoin (BTC) had to use the <a href="https://news.bitcoin.com/bitcoin-history-part-18-the-first-bitcoin-wallet/" target="_blank">original Bitcoin client software</a>.

This meant operating as a “full node” on the Bitcoin network, which in turn meant downloading and maintaining a full copy of the public database that is the Bitcoin blockchain.

Over time, more wallet solutions were created by third parties for users who wanted to transact with Bitcoin without the complexity and expense of running a node.

Today, there are thousands of different cryptocurrencies in operation in addition to Bitcoin.

Crypto wallets have become increasingly sophisticated to cater to the growing consumer demand for crypto as both a store of value and a fast, convenient, and secure way of paying for goods and services.

## The different kinds of crypto wallets

There are two broad categories of crypto wallet when it comes to connectivity: hot wallets and cold wallets.

![Hot vs cold wallets](/images/posts/hot-cold-wallet.jpg)

<strong>Hot wallets</strong> are so called because they are connected to the internet. A hot wallet might be a piece of software that you run on your computer, an app on your mobile phone or tablet, or an account that you create in an online crypto exchange.

<strong>Cold wallets</strong> are hardware devices that are not usually connected to the internet, such as a separate computer hard drive or a USB drive. A cold wallet can also be as a simple as a piece of paper that records a user’s public and private keys (using a QR code, for example).

### Pros and cons of hot and cold wallets

Hot wallets can be easier and faster to use, but come at a risk of being hacked, since they are connected to the internet. Cold wallets don’t carry the same risk because they are only briefly connected to the internet to “sign” transactions.

However, should they be lost or stolen, the owner would lose access to the private keys and therefore the funds.

It could also be argued that cold wallets aren’t as quick or convenient as hot wallets, as there are more steps to go through before funds can be accessed.

## Key custody options for crypto wallets

In addition to whether they are hot or cold, crypto wallets can be classified according to who ultimately controls the keys.

There are two main categories here: <strong>self-custody</strong>, and third-party custody (often described as <strong>custodial wallets</strong>).

### Benefits of custodial wallets

If a user holds crypto in an exchange account or in the vault of a crypto custodian, their private keys are ultimately controlled by that third party.

For individuals and businesses new to crypto, the user-friendliness of such platforms can be an accessible way to enter the digital assets sphere.

The convenience of outsourcing key management can make this tempting as an option for longer-term storage as well, but there are downsides to this approach, as we shall see.

### Benefits of self-custody

The phrase “not your keys, not your coins” is often used in relation to third-party key management options.

<iframe width="560" height="315" src="https://www.youtube.com/embed/JAyBvxB-6lA" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Crypto is decentralized by design, so it could be argued that placing key management in the hands of third parties goes against that core philosophy.

There are also practical considerations: centralized exchanges with online interfaces are vulnerable to hackers in a way that self-custody cold storage options are not.

Exchanges have also been known to freeze access to funds for reasons related to liquidity (in the case of sudden market volatility for example), or for risk management.

Individuals and business users alike should carefully consider the balance between convenience and security when it comes to their crypto custody options.


<div id="table-menu">

- [Evolution of crypto wallets](#the-evolution-of-crypto-wallets)
- [Different kinds of crypto wallets](#the-different-kinds-of-crypto-wallets)
- [Key custody options for crypto wallets](#key-custody-options-for-crypto-wallets)

</div>



Crypto wallets: 5-minute guide


Cryptocurrency wallets contain the keys that are used to “sign” transactions, passing an amount of crypto from one user to another.

Some wallets require just one key to sign transactions, while others are set up to require multiple keys.

These are most commonly called multi-signature wallets or multisig wallets, but they can also be referred to as shared wallets or joint wallets.

## Crypto wallets: an overview

To understand what multisig wallets are and how they work, let’s first cover the basics of crypto wallets.

A common misunderstanding when it comes to crypto wallets is that the wallets themselves are storage devices for crypto.

In fact, a wallet is simply a tool for unlocking (ie, spending) crypto.

In the case of Bitcoin, for example, your Bitcoin wallet stores your public and private keys.

A wallet can take multiple forms. It may be a piece of software, an app or online platform, or a hardware wallet like a computer hard drive or USB drive.

A wallet could even be a piece of paper that contains key information.

## How public and private keys work

In Bitcoin, key pairs are a cryptographic mechanism with a similar function to login credentials in online banking. They give you control over the Bitcoin that is recorded on the blockchain as belonging to you.

In a typical Bitcoin wallet setup, your wallet generates a seed phrase (also known as a recovery phrase), a string of randomly generated words. The seed phrase is used to generate a private key.

![alt From left to right, we see a Bitcoin wallet, then a seed phrase, then a private key, then a public key, then a Bitcoin address.](/images/posts/how-generate-bitcoin-address.jpg)

The private key in turn generates a public key, which looks like a long string of letters and numbers. Your public key can then generate a shorter address, a bit like a bank account number, that you can use to receive Bitcoin.

With your private key, you can “sign” transactions to transfer the ownership of an amount of your BTC to another party.

Private keys can be used to generate public keys, but not the other way around. This is an important security consideration.

The private key is the mechanism you use to spend your BTC, so if a third party had access to it, they would also have access to your BTC.

## Single signature vs multisig

Many Bitcoin wallets, especially those created for individual users, are set up to require just a single key to sign for transactions.

However, some use multi-sig technology, requiring at least two private keys to sign a transaction.

![alt A multi-sig wallet showing a "2-of-3" signing arrangement.](/images/posts/multi-sig-transaction-updated.jpg)<center><strong><small>A Bitcoin wallet with a "2-of-3" signing arrangement.</small></strong></center>

Such transactions could require “M-of-N” transactions, where N is the total number of possible signatures and M is the minimum number required to sign it.

For example, in a 4-of-5 multi-sig transaction, where five people hold private keys for a wallet, any four of them must sign the transaction for it to be broadcast to the blockchain.

It is also possible to have an “N-of-N” arrangement, whereby all the private keys are required to sign for a transaction.

## Reasons for using multisig wallets

Multisig wallets offer several benefits for crypto users.

### No single point of failure

For retail users, a multisig wallet may be useful if two or more people, for example a couple or family, wish to share control of a crypto wallet. If one of the family members were to die, the others would still have access to the funds.

Likewise, if one set of private keys is stolen, they cannot be used in isolation. The other holders of the private keys can then take appropriate steps to secure the funds.

### Security

For business and enterprise users, multisig wallets are one of the ways that the company can protect against misuse of funds by a single rogue employee.

There is also more protection against theft or hacking, since a bad actor would need to acquire multiple keys in order to take control of the funds.

### Efficiency

In enterprises, a multisig setup means approval bottlenecks are less likely because the responsibility for signing transactions is distributed among multiple team members.

If just a single signature is required, for example that of the CFO, then making a high volume of payments will prove difficult, with a knock-on effect on scalability.

## Considerations for enterprise users

Enterprise users of multisig wallets have more complex needs than smaller businesses.

When looking at wallet providers, enterprises should be sure to ask the following key questions:

**1. Is there a transparent record of authorizations?**

Depending on how a wallet is set up, it may be difficult to identify who in an organzation signed for any given transaction.

The “on chain” data (ie, the information stored on the blockchain) may not in itself be granular enough to meet business intelligence and audit requirements.

**2. What levels of security access are there?**

In addition to dividing key access between multiple parties within your business, you should consider the acccess control for the system used.

How can you be sure that only the parties with security clearance are making the transactions? Extra security measures should be considered, such as multi-factor authentication and biometrics.

**3. Is there operational flexibility?**

In other words, can wallet access easily accommodate changes in the team and regular occurrences such as sick leave or maternity leave.

<div id="table-menu">

- [Crypto wallets: an overview](#crypto-wallets-an-overview)
- [How public and private keys work](#how-public-and-private-keys-work)
- [Single signature vs multisig](#single-signature-vs-multisig)
- [Reasons for using multisig wallets](#reasons-for-using-multisig-wallets)
- [Considerations for enterprise users](#considerations-for-enterprise-users)

</div>


What is a multisig wallet?


Bitcoin users can buy, sell, and trade the digital asset without going through traditional banking institutions.

The peer-to-peer nature of Bitcoin means many consumers and, increasingly, businesses have realized its potential for facilitating fast, cheap, and secure financial settlements.

But the time it takes to settle a Bitcoin transaction can vary depending on a number of factors. To understand these, let's first look at how Bitcoin transactions work.

## What happens when a Bitcoin transaction is sent

Bitcoin transactions must be verified on the blockchain, a decentralized database, to ensure legitimacy.

The way this works is that transactions are bundled into "blocks" of data. Once the network has verified the transactions are all legitimate, the block is added to the blockchain. This is known as a confirmation.

### Timeline of a Bitcoin transaction

**1. The transaction is signed**

A Bitcoin holder uses wallet software to send their BTC transactions. The wallet “signs” the transaction and broadcasts the details to the network of nodes that make up the Bitcoin network.

This happens in stages. First, the wallet sends the transaction to the nodes that it is connected to. Those nodes check that the transaction is valid, then send it to the nodes that they are connected to – and so on.

**2. The transaction enters the mempool**

It’s important to note the difference between verifying a transaction (ie, checking that all the numbers add up and that no one is spending funds they don’t have) and confirming it.

Each node keeps a database of unconfirmed transactions, known as the mempool (memory pool). This is like a waiting room where transactions are stored until the final step in the process.

**3. A miner puts the transaction into a block**

Mempool transactions are bundled into blocks of up to <a href="https://news.bitcoin.com/fork-watch-first-bitcoin-cash-block-mined-clears-over-6k-transactions/" target="_blank">3,000 transactions </a>. This work is done by Bitcoin miners, who are ultimately responsible for building the Bitcoin blockchain.

Their incentive comes from the block rewards that they earn (paid in an amount of newly-minted BTC), and from the transaction fees of the transactions included in the block.

These transactions are confirmed, and cleared from the mempool, as new Bitcoin blocks are added.

But how long does this process take?

The average block confirmation time for a Bitcoin transaction is <a href="https://www.blockchain.com/charts/avg-confirmation-time" target="_blank">about 10 minutes</a>. This number can vary widely based on the following factors.

## What can affect Bitcoin transaction times?

### Fees

Bitcoin transaction fees are the primary determinant of how long it takes to transfer Bitcoins.

The transaction fee (more accurately called the mining fee) is set by the party who creates the transaction.

Miners will prioritize transactions with higher fees, as it boosts their earnings per block. As a result, paying a higher miner fee can speed up a transaction.

In this way, we can compare paying a higher transaction fee with taking a toll road when a regular road is available.

![alt Two parallel roads are shown. The road at the top has a lot of cars and the road below has just two cars.](/images/posts/bitcoin-transaction-fees-toll-road.png)<center><strong><small>Think of Bitcoin transaction fees as being like driving on a regular road versus a toll road. You can either take the slower, more congested road, or you can pay more to beat the traffic and get to your destination faster.</small></strong></center>

Low-fee transactions can also be rejected by the mempool or otherwise get stuck and remain pending.

### Network congestion

Bitcoin’s scalability limitations also make an impact. The blockchain can only handle [up to seven transactions per second](https://originstamp.com/blog/here-is-why-bitcoin-transactions-take-so-long/).

If many transactions flow into the mempool at the same time, some might need to wait for inclusion in the next block.

### Hash rate

The hash rate is another factor. This refers to how much computing power a network is using for transaction processing.

A low hash rate means there’s a lack of miners to work and help confirm transactions. Miners will often refuse to work if they believe the potential rewards are not worth the effort, meaning transactions will take more time to confirm.

### Number of confirmations

Another consideration when it comes to the timing of Bitcoin transactions is the number of confirmations required.

As we explained above, Bitcoin transactions are confirmed on the blockchain when the block they are in is created and added to the chain.

These transactions are then re-confirmed as subsequent blocks are created and added and the chain grows.

This short video demonstrates this process:

<iframe src="https://player.vimeo.com/video/740498495?h=48e851203e&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479" title="Blockchain Confirmations" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Some tools only require one confirmation, but others might require multiple transaction confirmations before a transaction is considered "settled" - ie, the funds are available to spend.

For example, the crypto exchange Binance <a href="https://coinmarketcap.com/alexandria/article/how-long-does-a-bitcoin-transaction-take" target="_blank">requires a one-block confirmation</a> for deposits and two for withdrawals. With Coinbase, <a href="https://help.coinbase.com/en/coinbase/getting-started/crypto-education/glossary/confirmations" target="_blank">three confirmations</a> are needed to consider a Bitcoin transaction as "final".

For high-value transactions, and depending on the provider, many more confirmations may be required.

Crypto users should always research how many confirmations a particular platform or tool requires to get a good idea of how long transactions might take.

## How to speed up a Bitcoin transaction

Many Bitcoin users wonder how they can expedite their transactions. Raising the transaction fee remains the easiest way to help a transaction settle faster. Miners are incentivized to prioritize transactions with higher fees.

Another strategy is to transact during low-congestion periods. Bitcoin holders can use tools like Blockchain.com’s <a href="https://www.blockchain.com/explorer" target="_blank">Explorer</a> to study mempool size charts to understand when the number of unconfirmed transactions is at its lowest.

Some rely on <a href="https://originstamp.com/blog/here-is-why-bitcoin-transactions-take-so-long/" target="_blank">transaction accelerators</a> to optimize speeds. These tools rebroadcast transactions to a vast array of nodes across the world, placing the transaction back into the queue. A few accelerators can even automatically add transactions to the next block.

## The big picture: Bitcoin scalability

Slow transaction speeds, especially as Bitcoin becomes more popular, have always been a key issue within the crypto community.

In fact, Bitcoin Cash (a "fork" or spinoff network) emerged due to arguments about how to best scale Bitcoin’s blockchain to <a href="https://edge.app/blog/market-updates/scaling-wars-bitcoin-vs-bitcoin-cash/#:~:text=Scaling%2C%20in%20the%20context%20of,camps%20proved%20to%20be%20irreconcilable." target="_blank">boost the number</a> of transactions per second.

Other options include so-called soft forks to Bitcoin’s protocol. In 2017, the community activated SegWit to optimize second-layer scaling solutions.

Another solution comes through secondary Bitcoin layers like the <a href="https://lightning.network/" target="_blank">Lightning Network</a>.

Lightning allows users to make up to hundreds of thousands of cheap transactions each second while still benefiting from Bitcoin’s blockchain security.

**Learn more about Lightning Network in this talk by Fortris Innovation Manager, Antonio Tovar:**

<iframe width="560" height="315" src="https://www.youtube.com/embed/WVgSx8Epz7g" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

<div id="table-menu">

- [What happens when a Bitcoin transaction is sent](#what-happens-when-a-bitcoin-transaction-is-sent)
- [What can affect Bitcoin transaction times?](#what-can-affect-bitcoin-transaction-times)
- [How to speed up a Bitcoin transaction](#how-to-speed-up-a-bitcoin-transaction)
- [The big picture: Bitcoin scalability](#the-big-picture-bitcoin-scalability)

</div>


How long does a Bitcoin transaction take?


Cryptocurrencies, particularly Bitcoin, are on the verge of widespread mainstream adoption, and companies that want to move into crypto payroll have a chance to get ahead of the curve.

However, for large organizations to make crypto payroll a robust, scalable process, there are several factors to consider.

In this guide, we’ll answer some of the commonly asked questions about crypto payroll. We’ll also go into some of the not-so-obvious challenges that lie ahead for enterprise payroll departments wishing to branch into digital currency.

## Business benefits of crypto payroll

### Efficient cross-border payments

One of the side-effects of the Covid-19 pandemic has been the increasing decentralization of workforces.

With remote working the new norm, including the trend towards <a href="https://hbr.org/2020/11/our-work-from-anywhere-future" target="_blank"> “work from anywhere” </a>, many large-scale companies have employees and contractors scattered across the globe.

When paying employees in foreign countries using fiat currencies, payments often filter through third parties such as correspondent banks. This means they can take several days to show up in the employee’s account.

The fees for such payments are not always obvious upfront. They may include a percentage of the overall payment value, a one-off fee and/or a markup on the exchange rate.

### Fee transparency and flexibility

Cryptocurrencies such as Bitcoin, on the other hand, can be sent around the world relatively quickly and without the need for intermediaries.

The average confirmation time for a Bitcoin transaction is 10 minutes. This is the the time taken to add it to the distributed public ledger of the Bitcoin blockchain.

Bitcoin transaction fees are are set by the party making the payment. The amount the payer pays in fees determines the speed at which the transaction is confirmed on the blockchain. Paying a higher fee will mean it has a higher chance of being confirmed by the network more quickly.

The amount required in fees for a transaction to be confirmed on the network is also impacted by its size. By this we mean the amount of information it contains rather than its value.

![alt Transaction size and market demand both influence transaction fees](/images/posts/bitcoin-transaction-fees.png)

You can read more about how transaction size affects fees in our article on [UTXO management](/blog/utxo-management).

Overall, the party sending a Bitcoin transaction has far more control over the fees than in a traditional international funds transfer. They can make a decision based on a trade-off between speed and cost.

So-called layer 2 solutions like the <a href="https://lightning.network/" target="_blank"> Lightning Network </a> are another way that Bitcoin transactions can be sped up.

<strong>Further reading: [Benefits of digital assets for cross-border transactions](/blog/benefits-cross-border-digital-assets).</strong>

### Attract talent

Another benefit of offering a crypto option for payroll is that it can attract employees who would prefer to be paid in crypto.

At this point in time, there is a high demand for crypto pay, and yet very few companies are offering to pay even partial salaries using cryptocurrencies.

Offering this option will give early adopters an edge when attracting those job seekers who are interested in being paid in cryptocurrency.

## Why employees want to get paid in crypto

### Crypto as an investment opportunity

<a href="https://www.americanbanker.com/news/small-banks-set-to-go-live-with-bitcoin-trading" target="_blank">Banks, </a>financial institutions and large multinationals <a href="https://www.newswire.ca/news-releases/kpmg-in-canada-adds-bitcoin-and-ethereum-to-its-corporate-treasury-851778842.html" target="_blank">like KPMG</a> are increasingly embracing digital assets, showing crypto’s growing presence as an asset class.

Just as an employee may opt to receive part of their salary in company stock options, crypto payments could soon become a normal part of flexible compensation packages. As <a href="https://www.cnbc.com/2021/12/20/more-businesses-offer-pay-in-cryptocurrency-in-a-bid-to-lure-young-workers.html" target="_blank">CNBC reports,</a> this is particularly attractive to younger workers.

In fact, asking to be paid in crypto is already a growing trend. A number of public figures have recently announced they will be taking a crypto wage, from New York City Mayor-elect Eric Adams to a number of professional athletes.

### Crypto payments are increasingly widespread

The future of crypto payments is already here. PayPal now offers its users the ability to buy and sell with crypto, as does Venmo. Apple has also announced that it will be <a href="https://finance.yahoo.com/news/apple-enable-crypto-payments-tap-150300322.html" target="_blank">enabling crypto “tap to pay” payments </a>.

Meanwhile, companies from AXA Insurance to Microsoft and even Starbucks are among the ever-growing list of multinational corporations embracing crypto. And according to <a href="https://www.skynova.com/blog/accepting-bitcoin" target="_blank">an October 2021 survey, </a> 32% of US small businesses accept payment in cryptocurrency.

Many of these developments have happened during the last year, showing the ever-growing pace at which cryptocurrencies are becoming mainstream thanks to a surge in consumer demand.

## Challenges presented by crypto payroll

Adding crypto to an organization’s payroll system presents several challenges that simply don’t exist with fiat payroll systems. These challenges need to be carefully considered and balanced against the benefits.

Let’s start by outlining two of the more obvious challenges presented by paying employees with crypto — the added cost, and taxes.

### Crypto payroll has added overhead costs

It goes without saying that legacy payroll systems were not designed to operate with crypto. For any enterprise to safely store and transact crypto, especially at scale, additional software and human resources will be required.

### Crypto taxes and regulations

The requirements for business and personal taxes in relation to crypto are evolving so fast, that it is beyond the scope of this article to cover them in detail.

Since tax regulations already vary considerably from country to country, it is important for businesses to seek tax advice from a trusted expert in their jurisdiction.

However, one predictable requirement is the need for robust and transparent reporting when it comes to paying employees in crypto.

<iframe src="https://www.youtube.com/embed/tk77Jhp2Zh8" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

<i>Video: Fortris CEO Shane Lourensse discusses how businesses can prepare for a shifting regulatory landscape.</i>

A specialist digital asset treasury operations platform like [Fortris](/) can help enterprises integrate a payroll solution into their existing operations in a seamless way. With Fortris, it’s easy to track payments and produce reports that are compatible with leading financial management and accounting software.

### Some less obvious challenges with crypto payroll

In addition to the commonly considered questions about crypto payroll, there are several considerations that are not so obvious and need to be pointed out.

<strong>Crypto wallet security</strong>

• Companies that already use cryptocurrency as an operational asset will likely be familiar with best practices around <a href="https://www.investopedia.com/news/bitcoin-safe-storage-cold-wallet/" target="_blank">cryptocurrency wallet security,</a> But for businesses new to crypto, it can present a steep learning curve.

• In order to maintain a high level of security, finance departments may wish to keep one or more payroll wallets separate from other crypto wallets in the organization.

• Depending on the software being used to store and process crypto funds, this could result in additional overhead expenses and bottlenecks.

<strong>Managing payment authorizations</strong>

Unlike banks, blockchains can’t return funds that have been sent inadvertently or maliciously. It’s important that businesses have checks and balances to ensure that payment authorizations have robust security built in.

For example, with a [multi-signature strategy](/blog/multi-sig-wallet) and authorizations divided among a number of individuals, it becomes virtually impossible for a single employee to transfer a large sum of money to an anonymous address and then disappear.

<strong>Bitcoin wallet addresses are not like bank account numbers</strong>

When paying employees with fiat currencies, generally deposits go into the same bank account every pay period.

However, with cryptocurrencies such as Bitcoin in particular, the best practice is to <a href="https://en.bitcoin.it/wiki/Address_reuse" target="_blank">use a different wallet address</a> for each transaction for greater security and privacy.

Because of this, employers paying staff in Bitcoin may wish to have a protocol for constantly updating the employees’ wallet addresses, unless they have a software solution that securely automates this.

<strong>Scalability of crypto payroll</strong>

For larger organizations, having to manually convert, calculate, and input the correct salary amount as well as confirm the wallet address each time for each employee could be time-consuming and tedious.

This approach would make scaling the process difficult for larger organizations.

<strong>Fluctuating exchange rates</strong>

Most salaries are negotiated and paid in the local fiat currency, not in cryptocurrency. The exchange rate between the particular cryptocurrency and the agreed-upon fiat salary will vary every time payroll is processed.

Making matters more difficult, the exchange rate can even vary widely over the course of sending out payments. Moreover, the calculated exchange rate must be transparent and verifiable by all parties.

## Managing crypto payroll with Fortris

At [Fortris](/), we specialize in enterprise-level solutions for the complex challenges of [crypto payroll](/crypto-payroll). Our platform integrates seamlessly with existing operational systems for ERP and accounting.

Key features include:

<strong>• Fund segregation  
• Multi-user management  
• Reporting integration  
• Managing fees and exchange rate fluctuations.</strong>


<div id="table-menu">

- [Business benefits of crypto payroll](#business-benefits-of-crypto-payroll)
- [Why employees want to get paid in crypto](#why-employees-want-to-get-paid-in-crypto)
- [Challenges presented by crypto payroll](#challenges-presented-by-crypto-payroll)
- [Managing crypto payroll with Fortris](#managing-crypto-payroll-with-fortris)

</div>


Crypto payroll for enterprise guide


The growing number of crypto payment gateway providers means that anyone from a small business to a multinational company like Amazon can now accept crypto payments for goods and services.

But beyond taking payments, how can enterprise-level companies safely store their cryptocurrency assets? This article will address some of the key considerations for digital asset custody in enterprise business.

We’ll cover the three broad categories: crypto exchanges, self-custody and third-party custodians.

## Crypto exchanges

First, there is <strong>exchange custody</strong>. This includes services such as Coinbase, Robinhood, and Paypal.

When a party purchases crypto from a centralized exchange, the custody of the crypto remains with the exchange until the customer withdraws or spends the funds. Many retail consumers who use these services never actually take custody of their crypto assets.

The upside of having crypto held on an exchange is liquidity, meaning the funds can quickly be deployed, sold, or transferred.

![alt Balance liquidity with risk](/images/posts/digital-asset-2.png)

The problem with using exchanges for digital asset custody is that they can be hacked, or they can be shut down by authorities and go bankrupt.

One of the most high-profile incidents was in 2011 when the Mt Gox exchange was hacked and bitcoin worth $8.75m was stolen. More recent examples include <a href="https://techcrunch.com/2019/05/07/binance-breach/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZm9ydHJpcy5jb20v&guce_referrer_sig=AQAAAE5ohAyPB0q1_5PdJ2un2hK1MFQzw2xfOCCWBeD5b4TkL3q5GRBcmLCrspq1QiWN-zI96eAqiLhwc90yK0ss1IaMWCxvUYGOJoA-9zA50wuoVeK5cx4KPOECKhz1GKmm_jL-KDvLbAWDTHAxIIoWrRR430Mvcm7N_cyc26AYCUtl" target="_blank">the hacking of the Binance exchange</a> in 2019.

## Self-custody

Many exchanges allow customers to transfer their funds to their own crypto wallets for <strong>self-custody</strong>.

The upside of self-custody is that, when used properly, crypto wallets are generally more secure than exchanges.

However, great care must be taken to assure that the private key to a wallet remains secret.

If a nefarious party were to find the key, they could quickly and easily empty the wallet. And there’s nothing the previous owner can do to recover the funds.

Enterprise wallets with multiple users have more complex security arrangements than those used by individuals or small businesses, but the same underlying principles apply. The benefits of self-custody must be carefully weighed against the risks and responsibilities.

Corporations with a high volume of transactions may find that a bespoke or custom solution works better than an out-of-the box enterprise wallet when it comes to digital asset custody.

## Third-party custodians

Large enterprises such as institutional investors and hedge funds have more complicated requirements for digital asset custody.

These big players (sometimes referred to as “whales” in the crypto world) need a robust security solution that involves more than just a login and password to access the funds.

Because of the complexities of crypto, institutional investors turn to what are known as <strong>crypto custodians</strong>. For a fee, custodian services will hold and safeguard the client’s crypto funds.

In order to be useful to a crypto whale, custodians must offer measures such as top-level cybersecurity and tiered levels of authorization.

Oftentimes custody services will use a combination of “hot” and “cold” wallets.

![alt Balance liquidity with risk](/images/posts/hot-cold-wallet.jpg)

A hot wallet is usually software-based and runs on a computer or mobile device that is connected to the internet.

Hot wallets provide a high level of liquidity. However, being connected to the internet means they carry a risk of being hacked.

A cold storage wallet is a hardware device that is not connected to the internet. Cold wallets store a user’s private keys, which are used to “sign” transactions, offline. They are less convenient than hot wallets but much more secure.

Even if a hardware wallet is stolen, the thief would also need the login credentials such as a password and biometrics in order to gain access to the wallet’s funds.

### Extra security measures

Because a single key is prone to theft, crypto custodians often utilize additional security steps such as multi-signature wallets.

A [multi-signature wallet](/blog/multi-sig-wallet) requires two or more parties to sign off on a transaction before it can take place. This distributes the trust and assures that no one person at the custodian service has access to the funds.

Crypto custodians invariably go to extreme lengths to employ strict security measures to protect private keys such as storing them in separate vaults so that they can’t be stolen.

Licensed custodians offer additional security to clients through trusted insurers. Insurance gives clients recourse in the event of a security breach and increases trust in the custody provider.

### Choosing a crypto custodian

<a href="https://www2.deloitte.com/content/dam/Deloitte/xe/Documents/finance/me_Digital-Custodian-Whitepaper.pdf" target="_blank">According to Deloitte (PDF),</a> institutional investors should consider the following questions when vetting potential crypto custodians:

● The security provisions used by the custodian

● The processes in place for key generation, storage, and access

● Authentication and transaction safeguards employed by the custodian

● Recourse in the event of loss or theft of the asset.

Another factor to consider is the value of assets in custody. Also of high importance is how well the custodian integrates with existing financial systems (more on this below).

## Beyond custody: crypto treasury management

As more and more institutional investors and hedge funds enter the ring, crypto will really start to shake up financial institutions. With so much at stake, global demand for digital asset custody services is growing exponentially.

But in addition to securely holding cryptocurrencies as an investment asset, enterprise-level businesses may well need to incorporate crypto into their day-to-day treasury operations. This could be for the purposes of paying employees in Bitcoin, to give one example.

Treasury management for crypto assets is a specialty field, and providers need to offer flexible and scalable digital asset custody solutions, especially for companies entering the crypto ecosystem for the first time.

When it comes to crypto treasury management, companies like [Fortris](/) offer enterprises a seamless way to integrate digital assets without having to replace their existing workflows.


<div id="table-menu">

- [Crypto exchanges](#crypto-exchanges)
- [Self-custody](#self-custody)
- [Third-party custodians](#third-party-custodians)
- [Beyond custody: crypto treasury management](#beyond-custody-crypto-treasury-management)

</div>




Digital asset custody for enterprise business


## Bitcoin: private by design

Bitcoin enables peer-to-peer transactions to take place directly over the internet. It uses a [UTXO model](/blog/utxo-management), instead of a ledger of accounts or balances.

This means individual coins are transferred between users much like physical objects.

The ability to send and receive payments directly via blockchain technology removes the need for third parties such as banks or other financial institutions.

Although this seems to establish the ideal conditions for maintaining one's anonymity, this is not necessarily the case in practice.

## Bitcoin is pseudonymous, not anonymous

On the one hand, Bitcoin is completely private. On the other hand, it is entirely transparent and traceable. This is because Bitcoin is not completely anonymous, but rather pseudonymous.

To send or receive Bitcoin (BTC), you must first obtain a [Bitcoin wallet](/blog/intro-crypto-wallets) address. A Bitcoin wallet address is made up of a series of letters and numbers. BTC can be sent to a Bitcoin wallet just as emails can be sent to an email address.

However, every transaction involving that address is recorded on the public database of the Bitcoin blockchain. If your address was ever linked to your identity, every transaction associated with that wallet would be linked to you as well.

It's like writing under a pen name. If an author's pseudonym is ever linked to their identity, everything they've written under that pseudonym will also be linked to them.

This is the principle behind dusting attacks. A dusting attack involves sending a small amount of BTC to a wallet to try to determine its owner. If the attack is successful, the information can be used for nefarious means such as phishing scams, or even a physical attack.

Read our article [what is a dusting attack?](/blog/what-is-dusting-attack) To find out more.

## How can Bitcoin transactions be traced?

### Crypto exchanges and KYC

When opening a traditional bank account, account holders are required to provide KYC information. 
KYC, also known as "Know Your Customer" or "Know Your Client," in the financial services industry, is a set of procedures for validating a customer's identity.

To complete the KYC procedures, users must submit personal information such as their full name, date of birth, address, social security number, and contact details.

![alt Typical documentation required for KYC](/images/posts/bitcoin-anonymous-2.png)<center><strong><small>Typical documentation required for KYC</small></strong></center>

Additionally, users must supply proper supporting documentation to verify their identity, such as a photo of their driver’s license or passport.

KYC rules can help prevent money laundering, terrorism financing, and other types of fraud.

When it comes to buying Bitcoin, many users don't buy and sell BTC directly with other users. Instead, they may use a cryptocurrency exchange service.

Crypto exchanges may require users to go through a KYC process. Whether they require this will depend on factors such as the laws of the country or countries they operate in, and whether the user wishes to exchange crypto for fiat currency.

Any transactions made through a crypto exchange are therefore much more traceable than direct peer-to-peer BTC transactions.

### Paying for goods and services

While some goods and services can be purchased directly with BTC, it is usually necessary to convert it into the local currency before it can be spent.

This in turn create a "paper trail" that could identify a user, because fiat currencies are highly regulated by government bodies.

It is important to note that even future technological developments and regulation changes may mean that transactions that aren't currently traceable may be in the future.

### Blockchain analysis firms

The Bitcoin public ledger provides specific information about the characteristics of each and every transaction that has ever occurred.

This includes the time a transaction was sent, the value of the transaction, and the recipient and sender public keys.

So, while perhaps it does not reveal a transactor’s identity, the Bitcoin blockchain is not anonymous in the commonly considered sense.

An entire industry has developed around analyzing the blockchain.

Blockchain analysis solutions include transaction monitoring, risk analysis, and investigative tools.

The most common ways of tracing Bitcoin transactions is the use of automated software monitoring and manually analyzing transaction behaviour. This approach can even be used to identify a user's IP address.

## Key takeaways

Bitcoin offers its users a higher level of anonymity compared to alternative electronic payment systems that are managed by third parties such as banks.

Your real name, your email address, or your physical address are not tied to your Bitcoin possession or transactions. The only thing that is tied to them is your randomly generated Bitcoin address.

However, that doesn’t make the system completely anonymous.

The blockchain performs the function of a "public ledger". This means it is possible for a anyone to view the records of all transactions that have ever involved a Bitcoin address.

Take note, however, that your anonymity will remain intact unless someone is able to link the Bitcoin address you use to a recognizable identity in the real world.


<div id="table-menu">

- [Bitcoin: Private by design](#bitcoin-private-by-design)
- [Bitcoin is pseudonymous, not anonymous](#bitcoin-is-pseudonymous-not-anonymous)
- [How can Bitcoin transactions be traced?](#how-can-bitcoin-transactions-be-traced)
- [Key takeaways](#key-takeaways)

</div>



Is Bitcoin anonymous? Privacy and the Bitcoin blockchain


## Introducing unspent transaction outputs

In some cryptocurrencies, such as Bitcoin, unspent transaction outputs (UTXOs) are used as a unit of measurement. When we talk about the number of UTXOs someone has, what we’re really talking about is the value of their coins.

In the same way that we use can use the internet without knowing exactly how wifi works, it’s possible to own and use Bitcoin without knowing exactly what UTXOs are.

However, it’s worth understanding the principles behind Bitcoin UTXOs, especially for enterprises using Bitcoin in their daily operations. Good UTXO management can lead to lower fees, faster transactions and improved security online.

### UTXO model versus account model

The UTXO model is an alternative to having accounts or balances. In a fiat bank account, you have a balance. When you make a payment, you send some of that balance to someone else.

Your bank and their bank communicate to each other to validate the transaction and update both your accounts. This system relies on trusting third parties (banks) to process and authorize the payment.

But there is no central authority in Bitcoin.

Instead, Bitcoins (BTC) are exchanged on a peer-to-peer basis and every transaction is recorded on an open database – the blockchain – which is managed in a decentralized way by a network of computers (nodes).

![alt UTXO model is represented by one person sending a Bitcoin to another person with a network of computers in the background. Bank account model is represented by one person sending money to another person via a bank. ](/images/posts/UTXO-model-vs-bank-account-model.png)<center><strong><small>Bitcoin transactions are validated by a network of computers, instead of a central authority like a bank.</small></strong></center>

After being added to the blockchain and independently validated by a number of independent nodes (each of which has a complete copy of that database), the transaction is confirmed and becomes part of Bitcoin’s permanent and public ledger.

When you send someone BTC you’re not actually making a transfer from one account to another. 

Instead, you’re signing over the ownership of an amount of BTC that exists as data in the blockchain and is recorded as belonging to you. 

You manage this through your Bitcoin wallet, which holds a private key that you use to “sign” or authorize the transaction.

And the amount of BTC that you send? That’s measured in UTXOs.

## How Bitcoin UTXOs work

UTXOs are discrete amounts and indivisible. This means that if you have a UTXO worth 5 BTC and wish to send someone 1 BTC, you need to “spend” the entire 5 BTC in this transaction and generate change for yourself in the process.

• Let’s say someone sends you 5 BTC. You now have one unspent transaction output (UTXO) in your wallet worth 5 BTC.

• Later, you spend 1 BTC. The recipient gets 1 BTC while your wallet is credited back a new UTXO worth 4 BTC (the “change,” if you will).

• Each time someone sends you BTC, you get another UTXO. And each time you spend a UTXO you get a new (different) UTXO back as change.

Now you have several UTXOs in your wallet with varying values.

When paying cash for a $6 item, you can choose either a $10 bill or two $5 bills. Similarly, each time you spend some BTC, you can theoretically choose which UTXOs to spend from your wallet. However, many wallets will choose the UTXOs for you.

You also need to pay a fee. In banking, when transaction fees occur, they are either a fixed rate or a percentage of the transaction amount and are paid to a central authority (the bank or card provider, for example) that validates the transaction.

In Bitcoin, as there is no central authority, the fee is the commission paid to the mining node that does the work of adding your transaction to the blockchain.

The UTXOs you’re sending need to add up to slightly more than the amount your recipient will get, and the difference between the two figures is the fee.

This video shows the process when person A, let’s call them Alice, owns 5 BTC and wants to send 3 BTC to person B (Bob).

<iframe src="https://player.vimeo.com/video/716723628" title="Vimeo video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Why does Bitcoin use UTXOs?

UTXOs allow Bitcoin transactions to be settled via the blockchain in a way that is transparent, immutable and secure.

In this way, they also solve the “double-spend problem” that was a major challenge for digital currencies before Bitcoin came along.

### The double-spend problem

If something exists in a solely digital form, it can be easy to duplicate.

This causes major problems for businesses that use digital assets. Think of the efforts of the TV, film and music industries to combat piracy, for example.

So how do we avoid people simply duplicating digital currencies in order to spend them more than once?

The answer lies in the unique identifier (think digital “DNA”) of each UTXO, and how the blockchain processes this information each time a transaction is made.

The technical term for this unique identifier is the outpoint. This contains the ID of the previous transaction that created the UTXO, and its position in the sequence of UTXOs.

A Bitcoin transaction completely consumes the UTXOs that are used to create it. They are temporarily transformed into “inputs” during this process. The new outputs generated, including the change, are fresh UTXOs that overwrite the previous ones and can now be spent in new transactions.

The original UTXO cannot be spent again, because it no longer exists.

As well as preventing the double spending of BTC, this system also means that at any point in time, it’s possible for all nodes to agree on how much BTC is in existence. They can do this by calculating the total value of all the UTXOs on the blockchain (called the “UTXO set”).

## Why UTXO management matters

If you’re an individual buying BTC as an investment, you may not need to make many transactions at all beyond that initial purchase.

Likewise, large institutions such as banks and hedge funds may simply hold Bitcoin and not transact with it for a long period of time.

In these cases, managing their UTXOs is not such an issue.

But companies that use Bitcoin in their regular business operations can accumulate many UTXOs of different sizes in their wallets, and how they manage these has implications for cost and security.

### UTXO management can minimize fees

Let’s look in more detail at how Bitcoin transaction fees work.

• Traditional bank fees are usually a flat rate or a percentage of the transaction. However, Bitcoin fees vary from transaction to transaction.

• Bitcoin mining fees depend on the amount of traffic on the network (number of transactions being processed) and how fast the parties want the transaction to be confirmed.

• The more UTXOs there are in a transaction, the more information there is to process, and therefore the higher the fee.

![alt Transaction size, market demand](/images/posts/enterprise-guide-2.png)

Unlike a fiat wallet, with a UTXO system it pays to hold a variety of UTXOs of varying denominations.

Each time a transaction is made, the fewest number of UTXOs can be used, thus keeping the mining fees low. This also speeds up confirmation times.

That being said, this causes some other challenges. For example, busy wallets can accumulate excessive numbers of small UTXOs. And, once again, making payments with several of these smaller UTXOs is not cost-effective. So, at some point, UTXOs need to be consolidated.

### UTXO management can improve security

Aside from reducing the cost of doing business and speeding up confirmations, there’s another reason for enterprise users to adopt good UTXO management practices.

Enterprise-level users rarely use a single wallet, because it leaves assets more vulnerable to theft or accidental loss (the problem of putting all your eggs in one basket). It also decreases privacy.

Bitcoin is known as a “pseudonymous” blockchain, meaning that although individual wallets are anonymous, transactions can be seen by anyone due to the public nature of the ledger. You can read more about this in our article [Is Bitcoin anonymous? Privacy and the Bitcoin blockchain](/blog/is-bitcoin-anonymous/). 

This means that patterns of transactions can be analyzed to draw conclusions about who is making them and the size of their business.

Wallets that send particularly large transactions can draw attention to themselves, as discussed in [this article](https://www.investopedia.com/news/why-storing-bitcoin-single-wallet-bad-idea/). For this reason, among others, most enterprise users maintain two or three wallets or even more.

Another potential security issue arises when you receive an unexpected payment of UTXOs of small value, in what is known as a dusting attack (see our article on [crypto dusting attacks](/blog/what-is-dusting-attack/) for more).

The key thing here is to avoid spending those small UTXOs, which is where good UTXO management also comes into play.

## UTXO management with Fortris

As we have seen, UTXO management for large-scale users of Bitcoin is a complex balance between keeping business overheads as low as possible, operating efficiently, and maintaining robust security.

As a Bitcoin treasury management solution, [Fortris](/) specializes in UTXO optimization for enterprise business. Not only can the Fortris platform help companies manage their UTXOs at scale, but it also integrates seamlessly with existing treasury and accounting systems.

<div id="table-menu">

- [Introducing unspent transaction outputs](#introducing-unspent-transaction-outputs)
- [How Bitcoin UTXOs work](#how-bitcoin-utxos-work)
- [Why does Bitcoin use UTXOs?](#why-does-bitcoin-use-utxos)
- [Why UTXO management matters](#why-utxo-management-matters)
- [UTXO management with Fortris](#utxo-management-with-fortris)

</div>


What is UTXO management?


A crypto dusting attack is a distribution of small amounts of cryptocurrency to numerous cryptocurrency wallets. This activity is undertaken with the intention of flushing out the identity of a wallet owner.

In this article, we’ll look at how crypto dusting attacks work and how to protect against them, using Bitcoin as an example.

## What is Bitcoin dust?

Bitcoin’s smallest denomination is one satoshi (sat). One sat is one 100-millionth of one BTC. At the time of writing, $1 is worth about 2,000 sats.

Bitcoin dust is simply a very small amount of BTC, often defined as no more than several hundred sats, equivalent to just a few cents.

![alt A large circle with the Bitcoin symbol on it. A small slice of the circle has been removed, to show the relative size of a satoshi.](/images/posts/bitcoin-vs-SAT-1.png)

Units of Bitcoin are recorded in UTXOs, or unspent transaction outputs. The key thing to know is that UTXOs are irregular and indivisible amounts of Bitcoin.

For example, if you have a UTXO worth 3 BTC and wish to send someone else 1 BTC, the only way to do that is to create a new transaction to “spend” the original 3 BTC UTXO. This transaction returns the “change” to you in the form of a new UTXO worth 2 BTC.

If you send or receive a number of transactions using small UTXOs, you may end up with a natural accumulation of dust in your wallet.

_See also: [What is UTXO management?](/blog/utxo-management)_

## How does a Bitcoin dusting attack work?

A dusting attack involves sending small amounts of Bitcoin to many addresses, with the purpose of gathering information about the recipients.

Crypto dusting can be for nefarious purposes, or it can be for research purposes.

When used for nefarious activity, a dusting attack can arm a criminal with enough information to attempt a scam such as a phishing attack.

In the worst-case scenario, it can reveal the identity of a crypto whale — an individual or organization that holds vast amounts of cryptocurrency.

Once a criminal knows the identity of a whale, they can make an ultimatum and demand a ransom to avoid it. This ultimatum could be a physical threat such as bodily harm or kidnapping. It could also be a digital threat such as holding files or information for a ransom.

## What happens in a dusting attack?

When a Bitcoin address receives a dust deposit, the transaction is recorded on the blockchain.

If the recipient then combines the dust UTXOs with other UTXOs that they own in order to create a transaction, they will be connected on the blockchain.

The sender of the dust can then connect the dots between the public wallet addresses of the dust UTXOs and other UTXOs that the recipient owns and sends or receives.

By analyzing the wallet’s transaction patterns, they might even be able to piece together the identity of the wallet holder.

## How to protect against dusting attacks

We cannot prevent dust being sent to us, because anyone can send Bitcoin to a wallet address that is public on the blockchain. This means any address that has previously been involved in a transaction.

What we can do is protect our anonymity by not spending the dust.

![alt Animation showing dust being sent to multipe wallets](/images/posts/dusting-attack-animation.gif)<center><strong><small>Spending UTXOs sent in a dust attack can compromise anonymity. In this example, three wallets receive dust but only one spends it.</small></strong></center>

## Protection against dust attacks for enterprise business

Things get more complicated for large corporations using Bitcoin in their business operations.

Enterprise-level users often make large numbers of transactions using multiple wallets. The organization might not care about maintaining the anonymity of its public-facing wallet and thus might choose to spend unsolicited dust.

However, this dust should never be transferred from an organization’s public-facing wallet to a wallet intended for internal use only.

That’s because of the business-sensitive information that might be revealed.

If internal wallets are used to transfer funds between different parts of the business, for example, then analysis of transaction patterns could give attackers an idea of the organization’s total BTC balance.

So as we have seen, maintaining control over which UTXOs are used in a transaction is key for protecting against dusting attacks. This is why good [UTXO management](/blog/utxo-management) is particularly important for enterprise business.

<strong>Further reading: [How to deflect a Bitcoin dusting attack in three steps](/blog/deflect-bitcoin-dusting-attack).</strong>


<div id="table-menu">

- [What is Bitcoin dust?](#what-is-bitcoin-dust)
- [How does a Bitcoin dusting attack work?](#how-does-a-bitcoin-dusting-attack-work)
- [How to protect against dusting attacks](#how-to-protect-against-dusting-attacks)
- [Protection against dust attacks for enterprise business](#protection-against-dust-attacks-for-enterprise-business)

</div>



What is a dusting attack?


Taproot is the most recent Bitcoin update that includes major changes that will redefine multiple spending rules, signature algorithms, and scalability of the entire Bitcoin network.

In other words, with Taproot widely adopted, the Bitcoin blockchain and its Layer 2 solutions become cheaper, faster, and more privacy friendly.

## What does Taproot mean for enterprise business?

**1) Enhanced privacy**

By switching to a new signature algorithm, multi-signature transactions will no longer be distinguishable from a regular single-signature transaction.

This makes it much harder to conduct a privacy-compromising analysis and gives enterprise business a level of anonymity on the blockchain.

**2) Fee reduction**

Since the new signature algorithm derives a single key out of ‘n’ number of keys, it reduces the overall data size.

The successful implementation of new spending rules means less data is embedded in each transaction, which in turn, trims down fees.

## How does Taproot work?

Schnorr Signatures effectively hide the public keys of all individuals or business entities that are involved in a transaction.

Before Taproot, when a multi-signature transaction had been completed, it was possible for individual/business key account holders to be identified through pattern analysis.

![alt Diagram showing the makeup of a multi-signature transaction before Taproot](/images/posts/before-taproot.png)

After Taproot, all key account holders who sign a multi-signature transaction are aggregated into one signature and only that aggregated signature is public on the blockchain.

These means that a single signature transaction, will be indistinguishable from a multi-signature transaction.

![alt Diagram showing the effect of Taproot on multi-signature transactions](/images/posts/after-taproot.png)

The previous state (before Taproot) not only adds more data to an already congested network, but it is also exposed potentially sensitive information about the agreement and accounts associated with a transaction.

However, the Taproot update changes these spending rules, which will eventually mitigate these privacy issues.

As explained in the <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" target="_blank">proposal,</a> “Taproot improves the privacy of Bitcoin because instead of revealing all possible conditions for spending an output, only the satisfied spending condition has to be published.”

This breakthrough allows the implementation of complex conditions from multiple signees while omitting any of the included data from the public eye.

## Taproot increases transaction verification speed

With Taproot, it is no longer required by the protocol to reveal all the data of the executed transaction as was previously the case. This means running a full node becomes less resource-intensive because there is less information that needs to be processed.

At the same time, the <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#cite_note-3" target="_blank">Schnorr algorithm</a> is simpler than its predecessor <a href="https://www.hypr.com/elliptic-curve-digital-signature-algorithm/" target="_blank">ECDSA</a> and takes less time to verify a transaction.

## Reduce transaction fees with Taproot

The cumulative effect of Taproot spending rules and the Schnorr Signature algorithm leads to overall reduced fees.

What makes this possible is the fact that it uses the minimum amount of information needed by the blockchain. By simply using less data, we are cutting down the fees. The reduction in data weight consequently enables more transactions to be added to a single block.

## What's next?

When Taproot is adopted globally, the Bitcoin blockchain will inevitably gain new momentum.

With this <a href="https://taprootactivation.com/" target="_blank">upgrade now live,</a> Bitcoin becomes an ecosystem that will provide improved privacy, increased transaction speeds, reduction in fees, and optimization of several critical components of the network.

The Taproot upgrade opens the door for further innovations not only in the legacy chain but also in layer two scaling solutions built on top of the Bitcoin blockchain.

<div id="table-menu">

- [What does Taproot mean for enterprise business?](#what-does-taproot-mean-for-enterprise-business)
- [How does Taproot work?](#how-does-taproot-work)
- [Taproot increases transaction verification speed](#taproot-increases-transaction-verification-speed)
- [Reduce transaction fees with Taproot](#reduce-transaction-fees-with-taproot)
- [What's next](#whats-next)

</div>


What is Taproot?


## What are Bitcoin transaction fees?

When an amount of Bitcoin changes location (wallet address) this is considered a transaction and there is always a fee associated with registering this transaction to the blockchain.

Think of these fees as payments made to authenticate transactions and keep the blockchain operational.

A Bitcoin transaction fee is calculated using these two main factors:

1. Market demand – Just like with everything, if demand is high then the fees will also be higher.

2. Transaction size – With a limited amount of space in every block, fees are proportional to the size of the transaction.

![alt Transaction size and market demand both influence transaction fees](/images/posts/bitcoin-transaction-fees.png)

## Calculating transaction size

While market demand is somewhat straightforward, transaction size is where you will see the main difference in fees between single-signature and multi-signature transactions.

Think of every transaction like a parcel that you would send at the post office.

To make sure that your transaction gets approved, your parcel should include all information related to that transaction.

We will say that every piece of information is a piece of 1 gram paper.

So, the more information (data) that is included in your parcel (transaction), the heavier it is (the more data there is) and the more it will cost to send (transaction fees).

![alt Calculating Bitcoin transaction fees](/images/posts/calculating-transaction-fees.png)

## Single vs multi-signature transactions

A single signature transaction requires only one signature from the person sending the Bitcoin and this signature authorizes that the transaction is ready to be sent to the blockchain for authentication.

![alt A single signature transaction](/images/posts/single-sig-wallet.png)

Whereas a multi-signature transaction requires that two or more people (signatures) authorize a transaction prior to being sent for authentication onto the blockchain.

**For example:**

A multi-signature wallet may have 3 people (signatures) associated with the account, but only require 2 of those 3 people to authorize a transaction.

![alt A multi-signature transaction](/images/posts/multisig-wallet-1200x867.png)

Back to our parcel analogy, a multi-signature transaction has more ‘information’ associated with it, which means that its fees will be more expensive.

## Structure of a Bitcoin transaction

![alt The structure of a Bitcoin transaction](/images/posts/bitcoin-transaction-structure.png) <center><strong><small>Source: <a href="https://github.com/bitcoinbook/bitcoinbook" target="_blank">Mastering Bitcoin – Andreas Antonopoulos 2014</a></small></strong></center>

There are many variables that go into calculating the size of a Bitcoin transaction. All this information is required and the associated bytes (data) is part of what influences the transaction fee.

Since a multi-signature transaction requires more information (bytes), we know that the transaction fee will cost more.

We took a deep dive into these numbers to see exactly how much more a multi-signature transaction is compared to its single-signature counterpart.

## Transaction fee comparative analysis

Since most multi-signature transactions today are done using the Pay-to-Script-Hash, we will be using this pattern for our comparison against single signature transactions.

![alt The formula for an unlocking script](/images/posts/formula-unlocking-script.png)

![alt The formula for a locking script](/images/posts/formula-locking-script.png)

For both formulas the key variable that will influence size is the number of keys involved in the transaction.

![alt List of assumptions about transaction size](/images/posts/assumptions-bicoin-transactions.png)

![alt A table showing the breakdown of mining fees](/images/posts/mining-fees-table.png)

As we can see in this table, while transaction size influences the fee, from an enterprise perspective, the key variable to consider is the amount of Bitcoin being sent.

For an individual sending a small amount like $100, it’s clear that the difference between single signature and multi-signature fees will have a noticeable impact, as the fee could be over 25% of the value being sent.

However, for enterprise businesses who are moving large sums of money like $100k, the $20 difference between a single-signature and a multi-signature transaction fee is nominal and shouldn’t be a deterrent to multi-signature technology.

## What about Taproot?

Taproot is a recent upgrade to Bitcoin and introduces new features to the network.

While the upgrade includes three Bitcoin improvement proposals (BIP), what is interesting related to multi-signature fees are Schnorr Signatures.

This feature allows the signatures of all multi-signature participants to be recorded as one signature on the blockchain. This means that regardless of the number of participants, the transaction size will be smaller and therefore the transaction fees will be cheaper.


<div id="table-menu">

- [What are Bitcoin transaction fees?](#what-are-bitcoin-transaction-fees)
- [Calculating transaction size](#calculating-transaction-size)
- [Single vs multi-signature transactions](#single-vs-multi-signature-transactions)
- [Structure of a Bitcoin transaction](#structure-of-a-bitcoin-transaction)
- [Transaction fee comparative analysis](#transaction-fee-comparative-analysis)
- [What about Taproot?](#what-about-taproot)

</div>



Blog

SOX compliance for digital asset treasury management

How to deflect a Bitcoin dusting attack in three steps

What does a Bitcoin journal entry look like?

Bitcoin bookkeeping best practice guide

Checklist for digital asset self-custody

Digital asset self-custody guide for institutions

This site uses cookies

Digital assets

Financial tools