More digital asset fund launches fail operational due diligence over exchange and withdrawal controls than over strategy. An allocator can underwrite a strategy they do not fully understand if the controls around it are sound. They generally will not underwrite a strategy where a single individual can both trade and withdraw fund assets, however good the returns.

CV5 Insight: The question an ODD reviewer is actually asking is not "where are the assets held", it is "who can move them, and what stops one person from doing it alone".

Fund-Level Accounts, Not Manager Accounts

Exchange and custody accounts should be opened in the fund's own name, not the manager's personal or corporate name, with the fund as the legal account holder and beneficial owner of the assets. This sounds obvious, but it remains one of the most common findings in early-stage digital asset fund reviews: a manager who set up exchange accounts before the fund was formed, and never migrated them, leaving assets legally held in the wrong entity.

Trading-Only Access for the Investment Manager

The investment manager's trading personnel should hold API keys or account permissions scoped to trading and position management only, with withdrawal and address-whitelisting permissions withheld entirely. Most major exchanges support this permissioning natively; the control failure is usually not a technology limitation, it is a manager who never configured the restriction because no one required it at onboarding.

Maker-Checker Controls on Withdrawals

Any withdrawal of fund assets, whether to a bank account, another exchange, or a cold storage wallet, should require at least two authorised individuals to approve, with neither able to unilaterally initiate and approve the same transaction. This maker-checker structure is standard in traditional fund treasury operations and should be applied with equal rigour to digital asset withdrawals, including transfers between the fund's own wallets.

Whitelist Governance

Withdrawal addresses should be restricted to a pre-approved whitelist, with additions to that whitelist themselves subject to the same maker-checker approval and, ideally, a cooling-off period before a newly added address becomes active for withdrawals. This closes the most common attack vector in digital asset theft, where a compromised account is used to add and immediately withdraw to an attacker-controlled address.

Administrator Visibility

An administrator that only receives a manager-prepared summary at month end cannot independently verify any of this, which is precisely what a thorough ODD review will test.

How CV5's Platform Model Supports This

CV5 Digital SPC's operating model is built around fund-level exchange onboarding, trading-only manager permissions and administrator visibility into custody and withdrawal activity as standard practice, coordinated with the platform's exchange, custody and KYB-cleared exchange onboarding relationships rather than left to each manager to configure independently.

Risks and Caveats

No control framework eliminates operational risk entirely, and digital asset custody carries risks, including exchange counterparty risk and smart-contract risk for certain custody models, that do not exist in traditional fund administration. Managers should treat these controls as necessary rather than sufficient, and should discuss the specific custody model with their administrator and directors before launch.

This article is for general information only and does not constitute legal, regulatory, tax or investment advice. Fund managers should obtain advice based on their specific structure, investors, strategy and regulatory obligations.

Conclusion

Exchange, custody and withdrawal controls are where digital asset fund ODD is actually won or lost. Fund-level accounts, trading-only manager access, maker-checker withdrawal approval, whitelist governance and administrator visibility are not advanced practices; they are the baseline an institutional allocator now expects.

Speak with CV5 Capital about launching a digital asset fund with institutional exchange and custody controls in place.

FAQs

Can the investment manager hold any withdrawal permissions at all?
Generally this should be avoided or, where unavoidable for operational reasons, paired with maker-checker approval from an independent party such as an administrator or director.

Do all exchanges support trading-only API permissions?
Most major exchanges used by institutional digital asset funds do, though the granularity varies, which is itself a factor in exchange selection.

Is qualified custody required for a digital asset fund?
It depends on the strategy, investor base and jurisdiction of investors; it is increasingly expected by institutional allocators even where not strictly mandated by regulation.

CV5 Capital is registered with the Cayman Islands Monetary Authority (CIMA Registration No. 1885380, LEI: 984500C44B2KFE900490).