The questions your custodian
has not been asked.

Briefing 003 made the argument in full: every custody architecture, from a hardware wallet in a safe to institutional MPC with a qualified custodian, terminates in a person who can approve a transaction. Cryptography relocates that person. It never removes them.

The standard DDQ interrogates the cryptography and the corporate shell around it. It rarely interrogates the authorizer. Who are the people who can approve or co-approve movement of client assets? How were they selected, and how are they supported? What happens when one of them is coerced, compromised, or simply leaves? What does the vendor know about the physical exposure of its own signing personnel, and what has it done about it? These questions sit at the seam between cyber and physical security, which is precisely why neither the security questionnaire nor the HR policy covers them. Each discipline assumes the other has it.

A custody diligence instrument earns its keep when it produces answers the vendor has not pre-written. That means questions with three properties. They are specific enough that a marketing answer is visibly non-responsive. They probe governance and design rather than certifications, because certifications are inputs, not outcomes. And they cross the cyber-physical seam deliberately, because that is where the vendor's own blind spot usually sits.

The instrument also has to grade the answers, not just collect them. A confident answer that names a tradeoff is worth more than a flawless answer that names none. Vendors who say "we have not solved this fully, here is the compensating control" are describing reality. Vendors whose every answer terminates in an acronym are describing their document library.

A sample from the full questionnaire. Each is designed so that the quality of the answer, not the presence of one, is the signal.

1. 01

   Name every role that can individually or jointly authorize movement of client assets, including break-glass and recovery paths. Which of these roles existed in your architecture diagram, and which exist only in practice?

2. 02

   Describe the last time an authorizer left the firm. What access was retired, in what order, and how long did full retirement take?

3. 03

   What is your written protocol if an authorizer reports a threat against themselves or their family? Who is notified, and what changes about their signing authority while the threat is open?

4. 04

   Under what circumstances can a client-initiated withdrawal be slowed or stopped by a human at your firm, and who reviews that human's decision?

5. 05

   Which of your controls assume the authorizer is acting freely? What compensates when that assumption fails?

6. 06

   Describe a real incident or near miss from the last 24 months and what changed afterward. If you cannot describe one, explain how incidents reach management.

7. 07

   What does your firm know about the public discoverability of its signing personnel, and when was that last assessed?

8. 08

   If we asked to observe a signing ceremony or a recovery drill, what would we be permitted to see, and why is the rest withheld?

The full instrument, with scoring guidance and the follow-up sequences for weak answers, is available to subscribers.

This briefing describes an evaluation methodology. It names no vendor, describes no specific firm's weaknesses, and contains nothing that assists an attacker; every question probes governance that a serious custodian should be able to discuss with a serious client. That restraint is the editorial policy of this series: we publish the pattern and the protective takeaway, and we omit operational detail.