A useful crypto risk checklist is a living control document, not a one-time questionnaire. It should show exactly which legal entities, custodians, lenders, stablecoin issuers, venues, blockchains and other dependencies stand between you and your assets; test whether your legal rights and collateral would hold up under stress; and specify who acts when a limit or warning indicator is triggered.
The framework below is designed for an investor or portfolio team to adapt. It is not a substitute for jurisdiction-specific legal, tax, regulatory or compliance advice. Basel rules apply to banks, MiCA applies only within its legal scope, FINMA guidance addresses supervised Swiss institutions, and Financial Stability Board and IOSCO recommendations are international policy materials rather than an investor-specific rulebook.
As an Amazon Associate I earn from qualifying purchases.
What a crypto counterparty and collateral checklist must cover
Crypto portfolio losses can arrive through several channels at once: market prices can fall, a counterparty can default, withdrawals can be frozen, a custodian can lose access to keys, a stablecoin can face redemption pressure, or a legal claim can prove weaker than expected. Looking only at the token price misses these dependencies.
Use one record for every material exposure. A position that appears diversified by token may still be concentrated if several tokens use the same issuer, bank, market maker, exchange, wallet infrastructure, bridge or blockchain. The checklist should therefore combine five views:
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
- Legal and credit: who owes you what, under which law, and what happens in insolvency.
- Custody and operational control: who controls keys or account access, how your entitlement is recorded, and how recovery works.
- Collateral and liquidation: whether pledged assets can be enforced, valued and sold quickly in a stressed market.
- Liquidity and concentration: whether you can meet cash needs without one venue, lender, token or redemption route.
- Governance and evidence: who owns the decision, what limits apply, and when the information must be refreshed.
International standards support this broad approach. The Financial Stability Board’s 2023 Recommendation 5 says: “Authorities, as appropriate, should require crypto-asset service providers to have an effective risk management framework in place that comprehensively addresses all material risks associated with their activities.” That recommendation is directed at authorities and providers; it is a useful governance principle for an investor, not a prescribed retail checklist.
Step 1: Set governance, limits and escalation rules
Define the portfolio’s purpose and risk appetite
Write down why each activity exists: long-term holding, trading, liquidity management, lending, hedging, staking or another objective. State which losses, lockups and operational complexities are acceptable. A portfolio that needs cash for payroll or a near-term liability should use tighter liquidity and counterparty limits than money reserved for a long-term speculative allocation.
Define permitted products and activities before opening an account. For example, you might require separate approval for borrowing, rehypothecation, derivatives, bridges, algorithmic protocols or assets that cannot be redeemed on demand. Record prohibited activities as well as permitted ones; otherwise an exception can become the default.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Set exposure limits by legal entity and related group
Set a maximum exposure for each legal counterparty, not merely for each brand or application. Aggregate entities that share ownership, a parent, a bank, a wallet system, a stablecoin, a market maker or another critical dependency. Keep separate limits for:
- assets held in custody;
- unsecured receivables and loans;
- collateralized loans;
- derivatives or other contingent claims;
- assets dependent on a single chain, bridge, oracle or settlement route.
Include both the current amount at risk and the amount that could become trapped or lost in a stress event. A small account balance can still create a large liquidity problem if it is needed to meet a margin call or a payment deadline.
Assign decision owners and independent review
Name an owner for every exposure. That person should know the contract, the operational process and the exit plan. For material exceptions, use a separate reviewer where feasible. Record who can approve a new counterparty, increase a limit, accept a new collateral type or override a warning.
Specify review intervals and event triggers
Set a normal review cadence appropriate to the exposure, then require an immediate review after a material change. Triggers include new custody terms, a change in legal entity, an incident, a withdrawal pause, a change in collateral composition or haircuts, a reserve or redemption change, a new subcontractor, a relevant regulatory development, or a sharp deterioration in market depth.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPre-authorize responses
Do not wait for a crisis to decide what “monitoring” means. Define the action attached to each breach:
- reduce or stop new exposure;
- suspend deposits or lending;
- withdraw assets or move them to an approved arrangement;
- post additional collateral or reduce leverage;
- close or novate a position;
- obtain legal, compliance, operational or technical review.
Step 2: Map the complete exposure chain
Create a position register with one line for every account, contract, protocol and wallet. At minimum, capture the following fields.
| Field | What to record | Why it matters in stress |
|---|---|---|
| Asset and amount | Token, quantity, valuation time and currency | Shows the direct market exposure and the size of a potential loss. |
| Service and legal counterparty | Product name, contracting entity, jurisdiction and related entities | A familiar interface may conceal a different contracting party or a shared corporate group. |
| Custody and control | Custodian, wallet type, key or account controller, segregation method | Determines who can move assets and what claim you have if access is interrupted. |
| Settlement route | Chain, bridge, exchange, bank, oracle and other required steps | A failure at any link can delay or prevent withdrawal or liquidation. |
| Contract terms | Termination, withdrawal, fees, dispute forum, governing law and insolvency language | Legal recovery and exit rights may differ from the product’s marketing description. |
| Dependencies | Issuer, reserve custodian, bank, market maker, vendor or protocol dependency | Different positions may fail together even when their tokens or interfaces differ. |
| Stress loss or freeze | What could be lost, delayed, frozen or rendered illiquid | Supports limits based on the portfolio’s actual ability to withstand an event. |
Include exchange balances, custodial holdings, lending and borrowing, derivatives, staking or yield services, stablecoins, bridges and decentralised protocols where relevant. For a protocol, record the legal and operational entities around it even if the smart contract itself has no conventional company. A token may depend on an issuer, reserve custodian, bank, market maker, oracle, bridge or centralised platform.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Step 3: Assess each counterparty before adding exposure
Confirm the legal entity and scope
Obtain the exact entity named in the contract, its jurisdiction, registration or licence where applicable, and the services and assets covered. Do not treat a logo, domain or trading interface as proof of the responsible legal entity. Check whether the entity you evaluated is the same entity that holds assets, owes repayment or can change the terms.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Read the agreement for rights and failure scenarios
Record termination rights, withdrawal conditions, notice periods, fees, dispute forum, governing law, set-off provisions and the treatment of client assets in insolvency. Identify language allowing the provider to lend, pledge, rehypothecate, commingle or otherwise reuse assets. Note who may change collateral requirements, liquidation triggers, fees or supported assets and how much notice is required.
Examine financial and operational evidence
Collect the financial information available to you, independent assurance reports and the precise scope and date of each report. An assurance statement may cover controls for a defined period without proving solvency, asset ownership, reserve quality or future performance. Record those limits instead of treating “audited” or “attested” as a complete safety conclusion.
Test resilience and incident handling
Ask how the provider handles cyber incidents, employee error, key compromise, system outages, chain reorganisations and withdrawal queues. Identify critical subcontractors and concentration in vendors such as cloud, wallet, banking, oracle or settlement providers. Review public incident history and the provider’s response: speed of notification, clarity about affected assets, remediation and evidence that controls changed.
Define warning indicators and the exit plan
Choose indicators that can be monitored, such as slower withdrawals, increased queue times, changed terms, declining market depth, missing reports, unexplained outages, legal-entity changes or a concentration limit breach. For each indicator, document the owner, decision deadline, alternative venue and practical steps to withdraw, transfer or close the position. An exit plan that assumes the same venue, bank or blockchain will remain available is not a stress-tested plan.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsStep 4: Check custody, client records and access control
Ask who controls access and how your entitlement is recorded
For a custodial arrangement, establish who controls private keys or account credentials, how transactions are authorised, how approvals are separated, and how access is recovered. Confirm how your balance or beneficial interest is recorded, reconciled and protected from another client’s claim. Ask what happens after a cyber incident, employee error, provider insolvency or withdrawal halt.
MiCA Article 75 requires covered crypto-asset service providers that provide custody to keep a register of positions for each client and maintain a custody policy designed to minimise losses of clients’ crypto-assets, related rights or means of access caused by fraud, cyber threats or negligence. The provision applies only within MiCA’s legal scope, so verify whether the provider and service are covered and check the current consolidated text.
The European Securities and Markets Authority’s MiCA text states: “The custody policy referred to in the first subparagraph shall minimise the risk of a loss of clients’ crypto-assets or the rights related to those crypto-assets or the means of access to the crypto-assets due to fraud, cyber threats or negligence.” This is a requirement for covered providers, not a guarantee that every custody arrangement has the same protections.
Check segregation, reuse and insolvency treatment
Ask whether client assets are held separately from the provider’s own assets, whether they can be lent or pledged, and how records are reconciled. Determine whether the contract gives you a property claim, a contractual claim, or another form of entitlement. If the answer depends on local law or a court interpretation, mark it as unresolved and obtain advice rather than assuming segregation.
Document self-custody controls
Self-custody removes one type of intermediary exposure but makes the holder responsible for key security and recovery. Document:
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- How keys are generated and whether the device and software environment are trusted.
- Where backups are stored, who can access them and how theft, fire, loss or tampering is addressed.
- How transactions are approved and whether high-value transfers require multiple people or devices.
- How recovery works after device failure, loss of credentials or the death or incapacity of the owner.
- How firmware, software, addresses and transaction details are verified before signing.
- How a recovery procedure is tested without exposing the production key.
A hardware wallet can be one access-control tool for readers who choose self-custody, but possession of a device does not solve backup, recovery, software, physical-security or user-error risks. The available evidence supports the importance of these controls; it does not test or endorse any particular brand or model.
FINMA’s 12 January 2026 announcement notes that custody of crypto-based assets such as Bitcoin or Ether has particular risks arising from distributed-ledger technology and requires expertise and robust technical infrastructure. That statement concerns FINMA-supervised Swiss institutions and should not be generalized to every provider or jurisdiction.
Step 5: Evaluate collateral and liquidation mechanics
Verify the legal pledge
Record exactly what collateral is pledged, who controls it, where it is held and whether the security interest is enforceable in the relevant jurisdictions. Check whether another lender, custodian or protocol can claim the same assets. Confirm whether collateral can be frozen, commingled, reused or encumbered elsewhere.
Recommended Free Tools
Test whether collateral can be realised under stress
For each asset, assess independent valuation, market depth, trading venue concentration, market hours, settlement delays, network congestion and likely slippage. A displayed price is not the same as cash proceeds when a large position must be sold quickly. Record the expected time to transfer, sell and settle, not just the quoted market value.
Review margin and liquidation terms
Capture the initial haircut, margin-call threshold, cure period, liquidation trigger, auction or sale process, fee treatment and authority to change terms. Identify who decides when a call is made, whether the borrower receives notice, and what happens if an oracle fails or a blockchain pauses. Check whether a market gap can move the position from compliant to undercollateralized before a cure is possible.
Look for correlation and wrong-way risk
Ask whether the borrower, collateral, stablecoin, venue or liquidity provider could weaken at the same time. Collateral issued by the borrower, dependent on the same bank, or traded mainly on the same venue can provide less protection than its headline value suggests. Include forks, protocol pauses, oracle errors and abrupt changes in market correlation in the stress case.
The Basel Framework’s cryptoasset chapter says: “Cryptoassets shall only be recognised as collateral where volatility in values and holding periods under distressed market conditions can be confirmed to not be materially increased compared with the traditional asset or pool of traditional assets.” Basel’s SCO60 changes took effect on 1 January 2026. This is a bank capital standard, not a universal retail eligibility rule, but it is a useful diligence lens.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Overcollateralized” therefore does not mean risk-free. Value can fall faster than liquidation, legal rights can be uncertain, and stressed markets can make quoted prices poor guides to recoverable proceeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 6: Stress liquidity and concentration together
Run a combined scenario rather than testing one risk at a time. Consider a sharp price move, wider spreads, reduced depth, a counterparty default, a withdrawal freeze, delayed settlement, higher collateral haircuts and stablecoin redemption disruption occurring in the same period.
| Stress question | Evidence to collect | Possible control |
|---|---|---|
| Can cash needs be met during a withdrawal freeze? | Unencumbered assets, alternate venues, bank routes and expected settlement times | Keep liquidity outside the affected counterparty and set a minimum immediately available reserve. |
| What happens when market depth falls? | Order-book depth, venue concentration, transfer time and estimated slippage | Cap position size and diversify execution routes; do not assume simultaneous liquidation at quoted prices. |
| What if collateral haircuts rise? | Available excess collateral, margin-call timing and transfer capacity | Pre-fund collateral calls and define a deleveraging trigger. |
| Can a default and a chain outage coincide? | Settlement dependencies, bridge alternatives and legal enforcement route | Set lower limits for exposures that share a chain, bridge, oracle or custodian. |
| What if a stablecoin redemption route is impaired? | Issuer terms, redemption capacity, banking dependencies and settlement window | Limit cash-like balances and maintain alternatives that do not rely on the same issuer or bank. |
Estimate what can be liquidated, on what timetable and at what likely loss. Set exposure and liquidity limits based on the portfolio’s ability to withstand the combined scenario, then record the action required when a limit is breached. The Basel framework includes liquidity and funding concentration among cryptoasset-related risks for banks; investors can adapt the same question by asking whether one venue, token, lender or redemption route is indispensable.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Step 7: Treat stablecoins as issuer and reserve exposures
A stablecoin used as collateral or cash-like liquidity is not simply cash. Add a separate issuer and reserve review to the checklist.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the legal claim and redemption path
- What legal right does the holder have: redemption, a claim on reserves, or another contractual entitlement?
- Who is the issuer and which jurisdiction governs the claim?
- Are there redemption limits, eligibility conditions, fees, queues or settlement delays?
- Which banks, exchanges, custodians and payment rails must function for redemption?
Review reserve quality and disclosure
Identify the reserve assets, where they are held, how liquid they are, and how frequently information is disclosed. Obtain independent assurance and note its scope, methodology and date. Ask whether reserves could lose value or become illiquid during the same event that causes holders to seek redemption.
Assess run and concentration risk
Consider whether many holders might redeem at once, whether secondary-market liquidity could disappear before redemption is processed, and whether the stablecoin is concentrated in one venue, market maker or bank. IOSCO’s 2023 policy recommendations identify concerns about transparency, verification of reserve assets, potential run dynamics and issuer credit risk in relevant stablecoin structures. They do not establish the current reserve quality or redemption performance of any particular token, so token-specific decisions require current primary disclosures and applicable rules.
How to compare two custodians, lenders or collateral options
Use the same questions for every candidate. A lower fee does not compensate for weaker legal rights, slower exits or greater shared dependency.
| Comparison axis | Questions to answer |
|---|---|
| Legal claim | Which entity owes you the asset or proceeds? What law, forum and insolvency treatment apply? |
| Asset control | Who controls keys, are assets segregated, and can they be reused, lent or pledged? |
| Transparency | What reports or assurance are available, what do they cover, and when were they issued? |
| Shared dependencies | Do candidates rely on the same bank, issuer, chain, oracle, custodian or market maker? |
| Collateral resilience | What are the haircut, volatility, liquidation depth and realistic time to realise proceeds? |
| Operational recovery | How are incidents detected, communicated, contained and recovered? |
| Exit reliability | What are withdrawal capacity, queues, redemption limits, fees and alternate routes? |
| Cost and flexibility | What are all-in fees, lockups, notice periods and rights to terminate or change terms? |
Step 8: Keep evidence current and auditable
Store dated copies or stable references for contracts, custody policies, reserve reports, audit or assurance statements, licences or registrations, risk limits, incident notices and key correspondence. For each checklist item, record:
- the person who checked it;
- the date and evidence used;
- what was verified;
- what remains unknown or depends on legal interpretation;
- the next review date and the trigger for an earlier review.
Reconcile balances and entitlements regularly. A policy that says assets are segregated is not the same as a current record showing where they are held. A reserve report from an earlier period is not current evidence after a material change. Preserve the version of the contract and terms that governed the exposure when the decision was made.
What to do when a checklist item fails
The legal entity or claim cannot be confirmed
Do not increase exposure while the responsible entity, governing law or insolvency treatment is unknown. Escalate for legal review, set a zero or reduced limit, and identify an alternative that provides clearer documentation.
Withdrawals are paused or materially delayed
Stop new deposits and lending, notify the exposure owner, compare the delay with the pre-set trigger, and execute the documented withdrawal or transfer plan if permitted. Recalculate the amount that could be trapped and the effect on cash needs.
Collateral value or liquidity deteriorates
Check the current haircut, margin threshold, market depth and transfer route. If the cure period is shorter than the time needed to move or sell collateral, reduce the position or add eligible collateral before a forced liquidation.
A stablecoin’s redemption or reserve information changes
Pause new collateral use, review the issuer’s current terms and reserve disclosure, test whether redemption remains available to your entity and jurisdiction, and reduce concentration if the route depends on an impaired bank, venue or market maker.
A custody incident or access failure occurs
Activate the incident contacts, preserve logs and transaction records, verify balances through an independent channel, and follow the recovery and notification plan. Do not improvise key transfers while facts are uncertain; involve the designated technical and legal reviewers.
When the checklist is complete
You have a defensible process when every material position has a named legal counterparty, a mapped dependency chain, documented custody and access controls, enforceable collateral terms, a stress-tested exit route, an exposure limit and a dated review owner. Unknowns are recorded as risks rather than silently treated as safe. That discipline makes the checklist useful whether the counterparty is a regulated institution, a crypto service provider, a lender, a stablecoin issuer or a decentralised protocol.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
