Why Solana custody language breaks down in RFPs

Solana uses Ed25519 keypairs and fast finality. Custodians adapt traditional banking custody vocabulary to on-chain reality, but committees rarely see a side-by-side view of signing paths. A wallet labelled "cold" might still automate co-signing through an online policy engine. Your RFP should ask how signing happens, not only where keys are stored.

Hot custody: speed with visible trade-offs

Hot arrangements keep signing keys in online systems for low-latency withdrawals and programmatic treasury operations. On Solana, hot wallets suit operational float and rapid rebalancing—but they concentrate operational risk. Ask custodians: Who can initiate a transaction? Is there a velocity limit? How are program interactions whitelisted?

Committee memo language might read: "Hot wallet holdings capped at X% of AUM; single-transaction limit Y SOL; dual approval for transactions above Z."

Warm custody: scheduled signing windows

Warm models batch withdrawals through defined signing ceremonies—perhaps twice daily—with keys held in HSMs that connect only during windows. Solana's sub-second finality does not eliminate operational delay; humans and policy engines still gate outbound flows. Warm custody suits funds that accept hours-not-minutes liquidity in exchange for fewer online key exposures.

Cold custody: ceremonies and SLAs

Cold storage implies offline or physically isolated key material. Withdrawals require multi-person ceremonies, often documented on video or in tamper-evident logs. Solana committees should confirm cold status per address, not per brand, and negotiate SLAs for emergency withdrawals separately from routine flows.

Qualified custodian overlay

Regardless of hot/warm/cold topology, a qualified custodian adds regulatory licensing, bankruptcy-remote contracts, and periodic proof-of-reserves or attestation reports. Qualification criteria differ across Korea, Singapore, and Hong Kong—verify registers rather than marketing badges.

Sample approval workflow

Consider a typical outbound transfer: initiator creates draft → compliance screen against sanctions lists → second approver confirms destination → custodian co-signs → transaction lands on Solana within one slot. Document each step owner in your policy. Gaps appear when "initiator" and "signer" roles collapse onto one person during staffing shortages.

Questions for your next committee meeting

  • What percentage of Solana holdings may sit in hot wallets overnight?
  • How are program-derived addresses treated in segregation reports?
  • What evidence proves a withdrawal followed the documented ceremony?
  • How does the custodian model staking delegation—is it a custody event in your policy?

Need a facilitated walkthrough with your team? Our Institutional Custody Briefing includes a decision-tree handout based on this article. See also cold storage and qualified custodian in the glossary.