Token Treasury Governance Framework

How to use this framework: Score each of the 20 questions across 5 areas. Select the answer that most accurately reflects your current state. Your total score reveals whether your token treasury governance is Exposed, Developing, Proficient, or Excellent — with a maximum of 40 points.

Token treasuries introduce unique governance challenges that traditional corporate treasury frameworks are not designed to address. This framework evaluates your treasury policy, custody security, valuation methodology, and board oversight. A poorly governed token treasury creates compounding risks: accounting misstatements from inconsistent valuation, security breaches from inadequate custody arrangements, and community or investor relations damage from opaque disposal processes.

As token treasuries grow in significance — both for Web3 native businesses and increasingly for corporate entities exploring digital asset diversification — the CFO function must build governance structures that are both technically sound and auditor-ready. The five areas below cover the full governance lifecycle, from policy and custody through to board-level reporting and public disclosure.

Area 1: Treasury Policy

Treasury Policy

Q1. Is a formal treasury management policy in place for the token treasury, covering permitted asset types, risk appetite, and governance authorities?

2 — Fully in place: A board-approved treasury management policy exists, covering permitted token types, concentration limits, custody requirements, and disposal authorities; it is reviewed annually. 1 — Partially in place: Informal guidelines exist but have not been formally documented or approved by the board; the policy has not been reviewed in the past 12 months. 0 — Not in place: No treasury management policy exists; treasury decisions are made on a case-by-case basis without a formal governance framework.

Q2. Is there a documented investment mandate specifying which categories of digital assets the treasury may hold (e.g. protocol tokens, stablecoins, Layer 1 assets only), and which are prohibited?

2 — Fully in place: An investment mandate is documented and board-approved; permitted and prohibited asset categories are clearly defined; compliance is reviewed quarterly. 1 — Partially in place: Permitted assets are broadly understood but not formally documented; the mandate has not been reviewed following market or business model changes. 0 — Not in place: No investment mandate exists; the treasury holds assets based on opportunity rather than a defined framework.

Q3. Are concentration limits set for individual tokens or asset categories, expressed as a percentage of total treasury value, to prevent over-exposure to a single asset?

2 — Fully in place: Concentration limits are documented for individual tokens and asset categories; adherence is monitored monthly and breaches trigger a review and rebalancing decision. 1 — Partially in place: Concentration risk is acknowledged but limits are not formally set or enforced; the team is aware of concentration but does not have a defined threshold for action. 0 — Not in place: No concentration limits exist; the treasury may be significantly over-exposed to a single token or protocol with no governance trigger for rebalancing.

Q4. Is a liquidity runway target maintained in fiat or stablecoins, with a policy specifying the minimum proportion of the treasury that must be held in immediately liquid form?

2 — Fully in place: A minimum fiat/stablecoin liquidity target (e.g. 12 months of operating costs) is documented and monitored monthly; the board is alerted if the liquidity position falls below the target. 1 — Partially in place: Liquidity is considered informally but no formal target is set; the team assesses runway periodically but without a defined trigger threshold. 0 — Not in place: No liquidity runway target is defined; the business may face a cash shortfall if token prices decline sharply without a fiat conversion plan.

Score your token treasury governance against institutional standards — multi-sig controls, sell-down policy, concentration limits, counterparty risk management and board-level oversight of token holdings.

Area 2: Custody & Security

Custody & Security

Q5. Does the treasury use an institutional-grade custody solution (e.g. Fireblocks, Copper, BitGo, or equivalent) for assets above a defined materiality threshold?

2 — Fully in place: An institutional custody solution is deployed for all material treasury assets; the custodian's security certifications (SOC 2, insurance coverage) have been verified. 1 — Partially in place: Institutional custody is used for some assets but not all material positions; some assets remain in less secure arrangements (exchange wallets, software wallets). 0 — Not in place: No institutional custody solution is in place; material treasury assets are held in self-managed wallets or on exchange, creating significant security exposure.

Q6. Is multi-signature (multi-sig) governance implemented for transaction authorisation, requiring approval from multiple designated key holders for all material treasury transactions?

2 — Fully in place: Multi-sig is implemented with a documented threshold (e.g. 3-of-5); key holders are designated by role; the signing policy specifies transaction size thresholds requiring multi-sig approval. 1 — Partially in place: Multi-sig exists for some wallets but the policy is not consistently applied; some material wallets may be single-sig or have informal signing arrangements. 0 — Not in place: Single-signature access is used for treasury wallets; any single key compromise could result in total treasury loss.

Q7. Is there a documented key management procedure covering key generation, storage, backup, rotation, and the process for removing access when a key holder leaves the organisation?

2 — Fully in place: A key management procedure is documented and follows best practices (air-gapped generation, encrypted backup, defined rotation schedule, immediate revocation on departure). 1 — Partially in place: Keys are managed with some care but the procedure is not formally documented; revocation processes on key holder departure are informal. 0 — Not in place: No formal key management procedure; key generation, storage, and revocation are handled informally with significant operational security risk.

Q8. Is there a hardware wallet policy governing the use and storage of hardware devices used for treasury key management, including physical security and access controls?

2 — Fully in place: A hardware wallet policy defines approved device types, physical storage requirements (e.g. secure location, off-site backup), and access controls; compliance is audited annually. 1 — Partially in place: Hardware wallets are used but without a formal policy; physical storage and access controls are informal and not documented. 0 — Not in place: No hardware wallet policy; devices may be stored insecurely or accessed without adequate controls.

Area 3: Valuation & Accounting

Valuation & Accounting

Q9. Is there a documented token valuation policy specifying the pricing source, valuation frequency, and methodology for illiquid or non-exchange-listed tokens?

2 — Fully in place: A valuation policy is documented for each asset category; pricing sources are specified (e.g. CoinGecko, CoinMarketCap, VWAP); illiquid token methodology is defined and reviewed by auditors. 1 — Partially in place: Valuation uses consistent pricing sources for major assets but no formal policy is documented; illiquid token valuation is handled on a case-by-case basis. 0 — Not in place: No token valuation policy; pricing is inconsistent across periods and asset types, creating significant accounting and audit risk.

Q10. Is the token treasury marked to market at a defined frequency (at minimum monthly for material positions), with fair value changes recognised in accordance with the applicable accounting standard?

2 — Fully in place: Mark-to-market is performed monthly (or more frequently for material positions); fair value changes are recognised in line with the applicable accounting policy and reviewed at each management accounts close. 1 — Partially in place: Token positions are revalued but not consistently on a defined schedule; mark-to-market may be performed only at year-end for statutory purposes. 0 — Not in place: Token positions are carried at cost; no mark-to-market process is in place; the balance sheet does not reflect current fair values.

Q11. Is there a documented accounting policy for unrealised gains and losses, consistent with the applicable framework (UK GAAP, IFRS, or US GAAP) and reviewed by the external auditor?

2 — Fully in place: The accounting treatment for unrealised gains and losses is formally documented, consistent with the applicable accounting standard, and has been discussed with and agreed by the external auditor. 1 — Partially in place: An accounting approach is applied but has not been formally documented as an accounting policy; the treatment has not been reviewed by the external auditor. 0 — Not in place: No accounting policy for unrealised gains and losses; treatment is inconsistent and likely to create audit qualifications.

Q12. Is there an impairment policy for illiquid or significantly depreciating token positions, defining the triggers, methodology, and frequency of impairment assessment?

2 — Fully in place: An impairment policy is documented and applied consistently; impairment triggers (e.g. price decline threshold, loss of liquidity) are defined and reviewed at each period close. 1 — Partially in place: Impairment is considered at year-end but no formal policy defines the triggers or methodology; impairment decisions are subjective. 0 — Not in place: No impairment policy; token positions may be carried above recoverable value on the balance sheet without recognition of the decline in value.

Area 4: Diversification & Risk

Diversification & Risk

Q13. Is stablecoin concentration risk assessed, with limits on exposure to any single stablecoin issuer and an assessment of the underlying collateral quality?

2 — Fully in place: Stablecoin concentration is monitored; limits are set per issuer; collateral quality (e.g. USDC vs USDT) is assessed and documented; limits are reviewed following market events. 1 — Partially in place: Multiple stablecoins are held but concentration limits are not formally defined; counterparty quality of stablecoin issuers has not been formally assessed. 0 — Not in place: Stablecoin concentration is not managed; the treasury may have significant exposure to a single stablecoin issuer without collateral quality assessment.

Q14. Is there a documented fiat conversion policy specifying the triggers, process, and authorisation requirements for converting token treasury assets into fiat currency?

2 — Fully in place: A fiat conversion policy documents conversion triggers (e.g. runway threshold, market price level), the execution process (OTC, exchange, TWAP), and the approval authority required for each conversion size. 1 — Partially in place: Fiat conversions are made when operationally required but without a documented policy; trigger criteria and approval processes are informal. 0 — Not in place: No fiat conversion policy; the business risks being unable to fund operations if token markets move adversely while the conversion process is being decided.

Q15. Are DeFi protocol exposure limits defined, with a maximum percentage of the treasury that may be deployed in any single DeFi protocol or yield strategy?

2 — Fully in place: DeFi exposure limits are documented; protocol risk assessment (smart contract audits, TVL, insurance coverage) is required before deployment; limits are set per protocol and in aggregate. 1 — Partially in place: DeFi deployments are made with some diligence but formal limits and a risk assessment framework are not documented. 0 — Not in place: No DeFi exposure limits; the treasury may be significantly exposed to smart contract or liquidity risk in DeFi protocols without a governance framework.

Q16. Is counterparty risk assessed for all treasury service providers (custodians, OTC desks, exchanges), including their financial stability, regulatory status, and insurance coverage?

2 — Fully in place: Counterparty risk assessment is performed for all material service providers; assessments are documented, cover financial stability and regulatory status, and are reviewed annually or on material news. 1 — Partially in place: Service providers were assessed at onboarding but are not periodically re-evaluated; the business may not be aware of changes in provider financial health or regulatory status. 0 — Not in place: No formal counterparty risk assessment process; the business may have material exposure to financially unstable or unregulated service providers.

Area 5: Governance & Reporting

Governance & Reporting

Q17. Is there a board treasury committee (or equivalent governance body) with defined terms of reference, responsible for oversight of the token treasury?

2 — Fully in place: A board treasury committee (or finance committee with treasury mandate) has documented terms of reference; it meets at least quarterly and receives a treasury report at each meeting. 1 — Partially in place: The board reviews treasury matters but without a formal committee structure or defined terms of reference; oversight is ad hoc. 0 — Not in place: No formal board oversight of the token treasury; treasury decisions are made at management level without board visibility or approval.

Q18. Is a monthly treasury report produced for management, covering treasury composition, fair value, liquidity runway, unrealised gains/losses, and compliance with policy limits?

2 — Fully in place: A comprehensive monthly treasury report is produced and reviewed; it covers all policy compliance metrics, fair value, and a commentary on material market movements. 1 — Partially in place: Treasury composition and value are reported but without full policy compliance monitoring or a structured commentary format. 0 — Not in place: No regular treasury report; management does not have a structured, consistent view of treasury composition and performance.

Q19. Is there a documented disposal approval process for token treasury assets, specifying the approval authority required for transactions above defined size thresholds?

2 — Fully in place: A disposal approval matrix is documented; different transaction sizes require different approval levels (management, CFO, board committee); all disposals are recorded with rationale. 1 — Partially in place: Large disposals require board approval informally, but a formal approval matrix with defined thresholds is not documented. 0 — Not in place: No disposal approval process; treasury assets may be sold without appropriate governance oversight or a documented rationale.

Q20. Are public treasury disclosures (on-chain dashboards, community reports) reviewed for accuracy against internal records before publication, with a designated owner for external treasury communications?

2 — Fully in place: Public disclosures are reconciled against internal treasury records before publication; a designated owner approves external treasury communications; disclosures are archived. 1 — Partially in place: Public disclosures are made but without a formal reconciliation to internal records or a defined owner; accuracy is not independently verified before publication. 0 — Not in place: Public treasury disclosures are not reconciled to internal records; discrepancies between on-chain data and official communications may exist without detection.

Your Score

0 / 40

Answer questions above to see your result

Token Treasury Governance Framework

Area 1: Treasury Policy

Treasury Policy

Area 2: Custody & Security

Custody & Security

Area 3: Valuation & Accounting

Valuation & Accounting

Area 4: Diversification & Risk

Diversification & Risk

Area 5: Governance & Reporting

Governance & Reporting

Build a token treasury governance framework your board and auditors can rely on.

Build a token treasury governance framework
your board and auditors can rely on.