The Two-Page Policy That Settled Most Arguments

Our auditor asked whether we had a written policy for crypto. We did not. Writing one took an afternoon and settled several recurring arguments. It got clearer once I had a licensed crypto payment processor open next to what I was being offered.

Why she asked

We were holding an asset with a volatile price, through mechanisms she was not familiar with, controlled by processes that existed mostly in my head.

Without a policy she was assessing an arrangement with no stated intent behind it.

What it says

Purpose. We accept crypto as a payment method, not as a treasury position.

Permitted assets. Named, with who can add to the list.

Maximum balance. A figure, with someone accountable for it.

Conversion. Convert on receipt.

Where it sits. Operating balance with our provider, nothing beyond.

Approvals. Who authorises what, at which thresholds.

Valuation. Which rate, from which source, at which time.

Reporting. What is produced, how often, to whom.

Incident response. What happens if funds are lost, a provider fails, or a key holder is unavailable.

Who can change this. Both directors, in writing.

The sections we nearly left out

Maximum balance. We had accumulated a balance nobody had decided to hold. Naming a figure is what stopped that happening again.

Incident response. It felt like planning for something unlikely. It is also the section you cannot write calmly once you need it.

Who can change the policy. Without it, a policy is a suggestion.

What it settled

The recurring argument about whether to hold some crypto because it might go up. That is now a decision requiring both directors in writing, rather than something that happens by inattention. Funds face the same question with more paperwork, which is where ecommerce payment solutions with crypto settlement fits.

And the question of who approves what, which had been decided ad hoc each time.

What the auditor said

The length did not matter. Two pages was fine.

What mattered was that someone had decided, that it was written before rather than after, and that the practice matched the document.

That last part is the one to watch. A policy nobody follows is worse than none, because it evidences that you knew what you should have been doing.

The review

Annually, alongside the access review. Fifteen minutes to confirm it still describes what we actually do.

It has changed once, when we added a second provider, which is exactly the kind of change that should require a decision rather than just happening. Compare anything you are offered against an exchange that publishes its full terms before committing.