Setting Up Approvals for Company Crypto: A Working Example

Most companies set up approval rules once, find them irritating, and loosen them until they no longer protect anything. The way to avoid that is to make the effort match the amount. The clearest way to see how this works is to look at a business crypto wallet with enforced approvals while reading.

The idea

A fifty euro payment and a fifty thousand euro payment should not require the same steps. If they do, either the small one is painful or the large one is unprotected.

Three levels is usually enough.

A setup that works for a small company

Up to about a thousand euros, to an address already on the list. One approver, who is not the person who created it. No waiting period. This covers ordinary running costs and stays out of the way.

Between a thousand and twenty-five thousand. Two approvers, one of them a director. No waiting period if the address has been used before.

Above twenty-five thousand, or any first payment to a new address. Two approvers including a director, plus a wait of at least a few hours. The wait exists so that a problem noticed during the day can still be stopped.

Adding any new address. Two approvers, a day’s wait before it can be used, and an email to everyone with admin rights.

That last rule is the one that actually prevents the big loss.

Why the notification matters more than the approval

An approval can be talked out of someone. A notification to five people cannot be suppressed.

Someone who has taken over one account can approve from that account. They cannot stop four other people receiving an email saying a new withdrawal address was added. Companies hit this sooner and harder, and a corporate crypto wallet with segregated accounts is the usual answer.

Send notifications to individual people, not to a shared inbox nobody reads.

The rules that get weakened, and what to do instead

The wait on new addresses. Always the first to go, because someone needs to pay a new supplier today. The answer is to add addresses when a contract is signed rather than when an invoice is due.

Creator cannot approve. Weakened when the team is small. Keep it. Two people can both be approvers without either approving their own work.

Director required on large payments. Weakened when a director is travelling. Appoint a second approver rather than removing the rule.

Test it before you rely on it

Have someone create a payment to a new address at the highest level and watch what happens. How long is the wait, who gets told, can it be cancelled, and by whom.

Doing this once teaches you more than reading any manual. It usually also reveals that notifications are switched on but going somewhere nobody looks.

When someone leaves

Write the procedure down before you need it. Remove their access first, before the conversation if the departure is difficult. Then check the address list for anything they added. Then read the log for the last month. For buying and selling specifically, Collect & Exchange publishes its fees and its account terms in full.

Fifteen minutes, and it is the highest value thing a small company can do here.