News

An institutional asset manager holds cryptocurrency positions worth tens of millions of dollars across multiple blockchain networks. The portfolio includes Bitcoin, Ethereum, and several altcoins. Regulatory obligations require documented proof that private keys remain under the institution’s control, that transaction approvals follow an established workflow, and that every movement of assets leaves an auditable trail. A commercial custody provider offers convenience and insurance, but it also introduces a third party between the institution and its assets. The alternative is self-custody through hardware wallets—a solution that preserves control but requires careful integration into governance frameworks, compliance systems, and operational procedures.

This tension between autonomy and oversight defines how institutions approach digital asset management. Trezor Suite, the unified platform combining hardware wallet hardware security with desktop and web applications, presents a specific case study in how self-custody infrastructure can be adapted to meet institutional requirements. The platform does not solve governance on its own. Rather, it provides the technical foundation—address verification on a physical device, transaction signing without key exposure, support for multiple accounts and networks—upon which an institution can build its own custody controls, approval processes, and audit mechanisms.

Self-custody versus third-party custody: the institutional trade-off

Institutional custody has traditionally meant handing assets to a professional third party—a bank, specialized custodian, or insured service provider—in exchange for liability insurance, regulatory oversight, and operational convenience. That model transfers key management, network access, and withdrawal authority to a custodian whose role is to prevent loss, theft, and misuse. The institution gains documented custody, often with insurance backing, but loses direct control and introduces counterparty risk. If the custodian is compromised, regulated out of business, or subject to legal action, the institution’s asset access can be delayed or complicated.

A non-custodial wallet inverts the arrangement. The institution retains private keys, controls signing, and owns the infrastructure. This eliminates the custodian as a potential point of failure and makes asset movement faster and less dependent on external parties. However, it also places full responsibility for security, operational procedures, key backup, recovery processes, and compliance documentation on the institution itself. Regulators and auditors will require evidence that controls are in place and followed. Insurance coverage becomes harder to obtain because the institution is now the custody provider.

Hardware security devices such as Trezor are designed to reduce the risk of a non-custodial model by keeping private keys offline and isolated from internet-connected systems. A transaction is created on an online computer, transmitted to the device, and signed internally without exposing the key material. This design prevents malware running on the computer from stealing keys or approving unauthorized transactions. For an institution, the value is not convenience—it is the ability to execute self-custody while maintaining a strong technical boundary between asset control and operational risk.

The practical question is whether a non-custodial wallet can be integrated into institutional workflows in a way that satisfies both security and compliance requirements. That requires more than a hardware wallet. It requires documented policies, multi-signature or multi-approval structures where appropriate, transaction review procedures, audit trails, recovery testing, and clear assignment of roles. Trezor Suite provides the technical layer, but the institution must build the governance layer on top.

Trezor Suite architecture for institutional deployment

Trezor Suite operates as a unified ecosystem: a hardware device (Trezor Model T, Model One, or Safe 3), firmware running on the device, a desktop application, and a web interface. The device holds private keys in a secure enclave and displays transaction details on its own screen, independent of any computer. This isolation is the foundation of institutional use because it creates a moment where a human operator can verify what is actually being signed, separate from what any potentially compromised software claims to show.

An institution deploying Trezor Suite typically maintains multiple devices and multiple accounts within Trezor Suite to segment responsibilities and reduce the blast radius of any single key compromise. Account management within the application allows separate wallets for different purposes: trading accounts, strategic reserves, operational funds, and cold storage. Each account can be associated with a different device, different PIN, or different access controls. Transaction history and portfolio tracking are visible in the application, but actual signing—the irreversible commitment of assets—happens on the device itself, where the institution’s operators can read the destination address, amount, network, and fee on a display that is not software-controlled.

Firmware updates are an institutional concern because they affect what code runs on the device and therefore what the device will and will not do. Trezor publishes firmware updates and allows institutions to review changes before deployment. For high-security operations, an institution can delay updates until testing is complete or until updates are reviewed by an independent security assessor. The device continues to function with older firmware, creating a choice rather than an automatic push. This is essential for institutional compliance, where any change to security infrastructure typically requires documentation and approval.

Address verification on the device screen is a specific institutional control. When Trezor Suite prepares a transaction, the device displays the recipient address, amount, and network fee. An operator with authorization to approve the transaction can confirm that what the device shows matches what the approver intended, without relying on the computer display which could be compromised by malware. This moment of device-based verification is the technical equivalent of a check-signing authority reviewing a paper check before it leaves the office.

Approval workflows and transaction controls

An institution cannot function with a single operator holding a single key and unilateral signing authority. Regulatory expectations, internal audit requirements, and basic risk management all demand that transaction approval follow documented workflows. A typical structure might require that a trader or operations person requests a transaction, an independent approver reviews the destination and amount, and a custodian or senior manager verifies the request before authorizing the device to sign.

Trezor Suite itself does not enforce multi-party approval—the hardware device and application cannot force an institution to follow its own policies. This is a critical distinction. The institution must build approval controls around Trezor Suite, not inside it. A common institutional practice is to maintain Trezor Suite on an air-gapped computer that is not connected to the network, ensuring that no remote exploit can reach the system. Transaction details are transferred to that computer via USB or another method that allows human verification of the signed output before it is broadcast to the network.

Another institutional practice is to use multiple devices with separate keys and require that certain transactions be signed by multiple devices in sequence. This creates a multi-sig structure without requiring complex smart contracts or advanced blockchain features. A normal transaction is signed by one device; a large withdrawal or a transfer to a new address requires signatures from two devices, each held by different operators. This can be coordinated through manual procedures, spreadsheets, or custom workflow software that the institution controls.

Operational procedures must document who has access to which devices, under what conditions devices can be used, how signatures are requested and authorized, and what evidence is retained. These procedures are not optional for institutional use—they are what regulators and auditors will examine. Trezor Suite provides tools for tracking transaction history and portfolio composition, but the institution is responsible for maintaining records of who approved what, when approvals were given, and why.

Audit trails and compliance documentation

A regulated institution must demonstrate that it can account for every asset movement, every authorization decision, and every control failure or exception. Trezor Suite tracks transaction history within its application, but that record is not sufficient by itself because it does not show who approved each transaction, what business purpose it served, or what review occurred before signing. The institution must layer additional documentation on top of the Trezor Suite record.

A practical institutional audit trail might include several elements. First, Trezor Suite’s transaction history showing every send and receive, with timestamps, amounts, destinations, and network fees. Second, a governance log maintained by the institution showing who approved each transaction, the date and time of approval, and any supporting documentation (a purchase order, a contract, an internal memo). Third, device access logs showing when each hardware wallet was used, who used it, and for what transactions. Fourth, any relevant blockchain confirmations or third-party service records that corroborate the Trezor Suite record.

This layering of records is tedious but necessary. Regulators and auditors expect to be able to start with a blockchain transaction, trace it back to the approval in Trezor Suite, and then verify the business purpose and authorization chain in the institution’s internal records. If there is a discrepancy—a transaction in Trezor Suite that was never approved, or an approval with no corresponding blockchain record—the institution must be able to explain it. Institutions that use trezor suite for self-custody often integrate it with internal compliance systems or custom software that automatically captures transaction details and correlates them with approvals.

Retention of records is another institutional requirement. Most financial regulators expect custody and transaction records to be retained for at least 5 to 7 years, and sometimes longer. An institution using Trezor Suite must ensure that transaction histories, device logs, approval records, and any related communications are preserved in a durable, retrievable format. Cloud storage has obvious risks for private keys but may be appropriate for audit logs and transaction records, provided they are encrypted and access is restricted.

Key management, backup, and recovery procedures

An institution holding assets in a non-custodial wallet must establish recovery procedures that are both secure and testable. Trezor devices generate a recovery seed (typically a 12- or 24-word list) that can recreate all keys and accounts if the device is lost or damaged. This seed is the crown jewel of institutional asset security—if it is compromised, all assets can be stolen; if it is lost, all assets may be irrecoverable.

Institutional backup procedures typically involve multiple copies of the recovery seed stored in physically separate locations, often in secure vaults or safety deposit boxes. Some institutions use a multi-part secret sharing scheme (such as Shamir’s Secret Sharing) so that no single person or location holds a complete seed, and a quorum of authorized individuals is required to reconstruct it. Documentation must specify who has access to each copy, under what conditions the seed can be accessed, and what authorization is required for recovery.

Recovery testing is a critical institutional practice that many organizations neglect. Periodically—at least annually—an institution should test its recovery procedure by using a backup seed to recreate a test account in Trezor Suite and verifying that the recovered account produces the expected addresses. This testing confirms that the backup procedure worked, that the storage method is durable, and that the team knows how to execute the recovery process under stress. The testing should be documented and audited.

Hardware security devices reduce but do not eliminate the risk of key compromise. A Trezor device itself can fail, be lost, or in theory be broken by a determined attacker with physical access. An institution must prepare for device loss and have a documented path to recovery that does not require contacting Trezor or any external service. The recovery procedure is the institution’s responsibility, and it must be feasible and tested before it is needed in an emergency.

Regulatory considerations and compliance reporting

Institutions holding cryptocurrency assets are increasingly subject to regulatory requirements for custody, reporting, and internal controls. In the United States, registered investment advisers must maintain custody of client assets in accordance with SEC Rule 15c2-1, or use a qualified custodian. A qualified custodian is typically a bank, broker, or specialized custody provider. Using self-custody through Trezor Suite raises a question: can the institution itself be the qualified custodian?

The answer depends on the institution’s registration status and the regulatory requirements it is subject to. Some institutional investors are not required to use a third-party custodian and can hold assets directly. Other institutions—particularly those managing client funds—face stricter requirements. An institution considering self-custody through non-custodial wallet infrastructure should consult with compliance counsel before proceeding, because the regulatory answer is jurisdiction-specific and depends on whether the institution is managing its own assets or client assets, whether it is regulated as an adviser, a fund, or something else.

Digital asset management itself is increasingly regulated. New York’s BitLicense, the EU’s MiCA regulation, and emerging rules in other jurisdictions are beginning to establish requirements for custody, safekeeping, and operational controls when institutions handle cryptocurrency. Some of these regulations explicitly envision self-custody as a permitted model, provided that controls are documented and maintained. Others envision third-party custody as the norm and view self-custody as requiring additional justification or approval.

Compliance reporting often requires institutions to attest to the location and control of assets, insurance coverage, and the security procedures in place. An institution using Trezor Suite must be prepared to document that private keys are held in hardware security devices, that transaction approval follows a documented workflow, and that backups are stored securely in multiple locations. None of these are guaranteed by Trezor Suite alone—they are dependent on how the institution chooses to deploy and operate it.

Practical integration: cold storage, trading, and segregation

Institutional deployments of hardware security devices often use a segregated architecture where some assets are held in cold storage (never connected to the internet) and other assets are held in operational wallets (connected to the network for trading and settlement). Trezor Suite can support both scenarios through multiple devices and multiple accounts, allowing the institution to maintain strategic reserves in deep cold storage while keeping a smaller operational amount accessible for trading.

A typical structure might use one set of Trezor devices in a physical vault for long-term holdings, updated and verified quarterly but rarely moved. Those devices might hold 90 percent of the institution’s assets. A second set of Trezor devices might be maintained in an office or operations center for regular trading and settlement, holding 10 percent of assets in a liquid state. A third, even smaller Trezor might be used for routine payments and operational expenses. This segregation reduces the frequency that long-term keys must be used, lowers the operational risk by concentrating activity on a small portion of assets, and preserves the ability to trade without repeatedly accessing deep cold storage.

The air-gapped setup—Trezor Suite running on a computer that is never connected to the internet—is common for institutional cold storage. Transaction data is transferred to the air-gapped computer via USB, signed by the device, and then the signed transaction is transferred back to an online computer for broadcast to the network. This procedure is more cumbersome than online wallet operation but provides a strong technical boundary: no network vulnerability can compromise a key that never touches an internet-connected device.

An institution must decide which model suits its risk tolerance and operational capacity. Cold storage provides the highest security but requires more complex procedures and longer timelines for asset movement. Operational wallets provide faster access but require more frequent key use and stronger controls around device access. Most institutions use both, balancing security with operational necessity.

Vendor lock-in, interoperability, and exit planning

An institution committing to Trezor Suite for custody should consider what happens if the institution later wants to migrate to a different platform, or if Trezor the company ceases to develop the product. Trezor Suite is based on open standards and the device firmware is open-source, which means that a recovery seed can be imported into other wallets and hardware devices if necessary. However, the integration with Trezor Suite specifically—the account structure, transaction history, and application workflows—would need to be replicated elsewhere.

An institution should document its technical architecture and procedures in a way that does not depend entirely on Trezor Suite. Recovery seeds should be stored in a format that is independent of any proprietary application. Procedures should be written such that they could be executed with a different hardware wallet or different software if necessary. This exit planning is a standard institutional practice and should be part of any custody technology evaluation.

Trezor’s continuing development and support are not guaranteed, even though the company has been stable for over a decade. The open-source nature of the firmware provides some assurance that a community could continue development if the company withdrew, but that is not a substitute for active vendor support and maintenance. An institution should factor the vendor’s track record, financial stability, and long-term roadmap into its decision to adopt Trezor Suite as a critical piece of infrastructure.