Access Control: Who on Your Team Should Hold the Keys

When a business opens a crypto account, the question of who can sign in, move funds, or change settings is often answered by accident: whoever opened the account holds the keys, and everyone else asks that person when something needs doing. That arrangement works until the day it does not, which is usually the day the key holder is on holiday, leaves the business, or is unavailable during an urgent payment. Access control is the discipline of answering that question deliberately, before it becomes an emergency, and it belongs with the business's other decisions about money, not buried in an IT setting somewhere.

The starting point is a simple principle: nobody should hold more access than their job requires, and no important action should depend on a single person alone. A person who only needs to view balances should not be able to move funds. A person who can move funds should not be the only person who reviews the movements. These are not expressions of distrust; they are the same separation of duties that businesses already apply to bank accounts, petty cash, and invoice approval, applied to accounts that happen to live on exchanges. The /blog index on this site carries companion reading on handover and bookkeeping that shows why documented access matters when people change roles.

Begin by listing the jobs that actually touch the account, rather than the people who happen to be around. A typical small business needs a viewer, who checks balances and downloads statements; an operator, who makes routine payments within agreed limits; an approver, who authorises larger or unusual movements; and an administrator, who manages the access itself. In a very small team, one person may fill two of these roles, but the map still matters, because it makes the overlaps visible and deliberate instead of accidental.

For each role, write down what it can do and what it cannot do, in plain language, and match that list to the settings the exchange actually offers. Some platforms offer granular permissions, others offer only a few levels of access, and a few offer little more than a single login shared by everyone. If the platform cannot express the roles you need, that is a limitation to record and work around, for example by keeping the shared login with one responsible person and handling approvals outside the platform, rather than pretending the limitation does not exist. The map should describe reality, not an ideal the platform cannot deliver.

A common mistake is treating access as a single thing, when it is really two things: the credentials that open the account, and the knowledge of how the account is used. Credentials include passwords, two-factor devices, and recovery codes. Knowledge includes which account is used for which purpose, what the approval limits are, and where the records live. If one person holds both, the business has a single point of failure. If the credentials are held by one person and the procedures are written down where the team can find them, the business can survive that person being away.

In practice, this means the person who holds the everyday credentials should not be the only person who knows the recovery method, and the recovery method should not be stored alongside the everyday credentials. A useful pattern is to hold the main access with the operator, the recovery codes and backup device with a different trusted person or in a locked location the business controls, and the written procedures in the business's normal document store. Nobody needs to memorise the whole arrangement, but everyone who needs a piece of it should be able to find their piece without asking the one person who is unavailable.

For any movement above a routine amount, require a second person to approve it before it is sent. The threshold will differ by business, but the principle does not: the person who prepares a payment should not be the person who releases it alone. On platforms that support multi-user approval, configure it there. On platforms that do not, use a simple out-of-band rule, such as a message to the approver stating the amount, the recipient, and the invoice or purpose, with the approver confirming before the operator sends. The record of that exchange then becomes part of the bookkeeping, as described in the bookkeeping reading linked from the /buy-crypto-accounts section and the /blog index.

Approval rules also protect the operator. A payment that two people agreed to is much easier to explain later than a payment one person made alone, and an operator who can point to an approval is protected when a payment is questioned months later. The rule should cover exceptions honestly: if an urgent payment genuinely cannot wait for the approver, write down who may act alone, up to what amount, and what must be reported afterwards. An exception that is written down is a policy; an exception that is improvised is a precedent, and precedents have a habit of becoming the new normal.

Access control fails most often not at setup, but when people change roles. A new joiner needs access promptly, or the team will share a login to get work done, and shared logins are very hard to unshare later. A mover, someone changing roles inside the business, needs their old access removed as well as their new access granted, because access that lingers after a role change is access nobody is watching. A leaver needs their access revoked on their last day, before they leave the building, including any shared credentials they knew, which should then be changed.

The way to make this reliable is a short checklist tied to the same process that handles any other starter or leaver: accounts to grant, accounts to remove, credentials to change, and records to update. Run the checklist on the day of the change, not at the next quarterly review, and keep a dated note of what was done. Quarterly reviews still have their place, as the hygiene review on this site explains, but they are a safety net for catching drift, not a substitute for acting on the day someone's role changes. A business that reviews access only quarterly will, on average, carry stale access for six weeks after every change.

Every access plan should answer one uncomfortable question: what happens if the person who holds the keys is suddenly unavailable. Illness, travel, and resignation are ordinary events, and a plan that cannot survive them is not a plan. At minimum, the business needs a named deputy who can access the account, a tested recovery method that does not depend on the absent person's phone, and a written note of where the recovery codes and the procedures live. Test the deputy's access while nothing is urgent, because a deputy who discovers they cannot sign in during a crisis is no deputy at all.

This is also where the handover discipline from earlier reading pays off. A key holder who documents their routine, their limits, and their open items as they go makes a deputy's job possible; a key holder who keeps everything in their head makes it impossible. The test is simple: could a competent deputy, given only the written procedures and the access you have granted them, make a routine payment and reconcile it? If the answer is no, the gap is not the deputy's competence, it is the documentation, and closing it is part of the key holder's job, not an extra favour.

For a business starting from scratch, a one-page access policy is enough. Name the roles and what each can do. Name the people currently in each role, and the deputy for each critical role. State the approval threshold and the exception rule. State the joiner, mover, and leaver checklist and who runs it. State where the credentials, the recovery method, and the procedures live, and who may reach each. Review the page quarterly, and update it on the day any role changes, not at the next review. That page, kept current, is the whole system for most small businesses.

Access control is sometimes presented as a security product, but for a business holding crypto accounts it is mostly a management habit: decide who should hold what, write it down, separate the duties that matter, and act on role changes the day they happen. Businesses that do this spend less time untangling who did what, recover faster when someone is unavailable, and give auditors and advisers a clear story about how their accounts are run. If your business cannot currently name who holds the keys to each account and who the deputy is, that gap is the first thing to close, and the one-page policy above is a reasonable place to start.

This article is educational and does not constitute financial, legal, tax, or accounting advice. Platform access features and record-keeping obligations vary by exchange and jurisdiction, so check the current terms of the services you use and consult a qualified professional for your situation.