Legal controls for crypto foundation treasury management

The foundation company has its own legal personality and capacity to hold property. A wallet controlled by a founder does not establish that the assets belong to the foundation. Reconcile contribution documents, account names, wallet records and any trust, grant-use or security restrictions before identifying investable assets. New gratuitous contributions and contributions for issued shares require the secretary's statutory no-objection notice before acceptance. (Companies Act (2026 Revision), ss 27–28; Foundation Companies Act (2025 Revision), s 17(1)(b).)

Read the actual memorandum, articles, bylaws and reserved powers against the proposed transaction. Objects supporting a protocol do not establish every power needed to lend assets, grant security or appoint a discretionary manager. The Foundation Companies Act permits constitutional allocations of powers to directors, delegates, supervisors, founders and others. Schedule 2 contains optional model documents; its investment powers and decision rules apply only if adopted. (Foundation Companies Act, ss 4, 6–7 and 12.)

Identify the board's voting and quorum requirements, committee limits and any supervisor, member or token-holder consent. A foundation that ceases to have members must retain at least one supervisor if its memorandum permits that cessation. The statute does not give every supervisor a separate investment veto. Token voting has the legal effect conferred by the applicable documents; holding a token alone does not establish approval power or ownership of the treasury. (Foundation Companies Act, ss 7–8.)

If the proposed activity exceeds the constitution, use its authorised amendment process before implementation. A policy or board resolution cannot supply a missing constitutional power. Memorandum and article changes are constrained by sections 9 and 10; the Act also provides specified court routes. The Cayman Islands DAO analysis explains the wider allocation of company and community powers.

The statutory prohibition concerns distributions to members or proposed members as such. It preserves specified benefits in other capacities, including beneficiary benefits, reasonable remuneration and qualifying arm's-length transactions. Calling a token holder a beneficiary does not itself establish a right to returns. Examine the constitution, token terms, funding documents and promises together. (Foundation Companies Act, ss 4(1)(b)(iv), 4(2) and 7(4)(e).)

Using genuinely proprietary reserves to support the protocol does not, by itself, establish a pooled investment fund. The position changes if contributions buy participation in investment profits or gains. Test pooling, the interests issued, redemption rights and management arrangements against the mutual-fund and private-fund definitions. The 2026 amendments expressly address tokenised interests; using a token does not remove fund regulation. (Mutual Funds Act (2025 Revision), s 2, as amended by Act 5 of 2026; Private Funds Act (2025 Revision), s 2, as amended by Act 6 of 2026.)

The virtual-asset analysis is separate. Services carried on as a business for or on behalf of others, and the statutory issuance limb, require their own assessment. Acquiring a treasury position differs from operating a customer staking or transfer service. A sale of newly created tokens can raise issuance questions even where proceeds enter the foundation's treasury. The 2026 exclusion for specified tokenised fund issuances is not a general foundation exemption. (Virtual Asset (Service Providers) Act (2024 Revision), ss 2 and 4, as amended, including Act 4 of 2026.)

Classify each instrument for securities purposes. Principal dealing can be caught where the statutory holding-out, underwriting or solicitation conditions apply. A separate manager exercising discretion over the foundation's securities performs a different activity from the foundation investing its own assets. (Securities Investment Business Act (2020 Revision), ss 4–5, Schedule 2, paras 1 and 3; Schedule 1, para 14, inserted by Law 16 of 2020, s 7.)

Ownership of the treasury assets also does not settle anti-money-laundering obligations. Assess whether organised lending constitutes relevant financial business and, if it does, establish the required controls before starting. A permissionless protocol does not resolve that classification or the practical ability to comply. Where required customer due diligence cannot be completed, board risk acceptance cannot authorise a transaction prohibited by regulation 18. (Proceeds of Crime Act (2025 Revision), s 2 and Schedule 6, para 2; Anti-Money Laundering Regulations (2025 Revision), regs 3, 5 and 18.)

Where funding or commercial functions need a different entity, the offshore structure comparison provides the structural background. Incorporating another entity still requires analysis of what that entity will do.

Section 15 prohibits a foundation from disposing of assets where the resulting position leaves it unable to pay debts as they fall due in the ordinary course. Its incorporated definition of disposition includes transfers, mortgages and pledges. The assessment therefore extends to investments and collateral arrangements that fall within that definition. (Foundation Companies Act, s 15; Trusts Act (2021 Revision), s 87.)

Finance and counsel should prepare a dated commitments schedule. Separate binding grant awards, earned contractor invoices, milestone-dependent obligations, termination liabilities and discretionary future budgets. A budget entry does not establish a debt; an enforceable commitment must be assessed under its actual terms. Record payment currency, due date, conditions, disputed amounts and restrictions on using earmarked funds.

Then match those obligations with assets that can be realised and transferred when needed. Account for staking exits, withdrawal gates, collateral restrictions, stablecoin redemption and conversion routes. A quoted portfolio value cannot establish payment capacity when assets are locked or pledged. Include credible delays, losses and replacement-provider costs in the assessment, with the assumptions recorded.

The board should select the reserve amount and review triggers from that evidence. It may protect planned expenditure beyond legally binding debts, but should identify that additional buffer as policy. Defer any deployment that fails the statutory test. Signs of financial distress also require consideration of winding-up and avoidance rules before favouring particular creditors or making further transfers. (Companies Act, ss 92–93 and 145–147.)

The Ethereum Foundation's June 2025 treasury policy connected deployments with operating reserves and board reporting. Its February 2026 staking announcement described signing, withdrawal and infrastructure arrangements. These dated operational examples identify useful questions; the Cayman foundation must answer them under its own obligations and powers.

Solo staking

First, confirm that the foundation owns the ETH and can commit the proposed amount without compromising payment capacity. Record the authorised network, validator arrangement and persons responsible for signing, monitoring and recovery.

Second, require competent specialists to verify withdrawal credentials, account control, software configuration and protection against slashable activity. Downtime penalties and slashing have different causes. The foundation bears protocol losses on its own stake, subject to any separate recovery rights against a supplier. (Ethereum.org, Home stake your ETH, sections on risks.)

Third, demonstrate the exit procedure before funding. Ethereum permits an execution-layer withdrawal address to trigger an exit without the validator signing key. The foundation must establish control of that address, including any smart-contract restrictions, and provide the necessary transaction capability and gas. An exit request still leaves queue and payout timing to consider. (EIP-7002; Ethereum.org, Staking withdrawals, “Exiting staking entirely”.)

The board can authorise deployment once those records, its powers and the reserve assessment support the amount and operating arrangement. No yield assumption should replace any condition.

Third-party staking

Start by separating validator operation, custody and pooled-token exposure. A node operator may hold signing keys while withdrawals remain controlled by the foundation. A custodian or pool can introduce different legal claims, withdrawal procedures and insolvency exposure. Trace title and control through the chosen arrangement.

Approve the provider and negotiated terms before transferring assets or granting access. Specify fees, reward allocation, permitted subcontractors, withdrawal instructions, operator failures and liability. Identify who initially bears a slashing debit and whether the foundation has an enforceable, financially credible reimbursement claim. Insurance or an indemnity needs its own coverage and exclusion review.

For an in-scope Cayman custodian, check its licensing or applicable waiver position. Require terms covering permitted transactions, client access, termination and loss remedies. Check specific agreement to any encumbrance, entitlement to ancillary proceeds and the protection separating client assets from the provider's estate. The Cayman Islands Monetary Authority's binding market-conduct rules also require disclosure and client consent for the retention, application or transfer of benefits arising from custody, including staking rewards, airdrops and voting rights. Before changing the client agreement, the provider must give prior written disclosure and a reasonable opportunity to accept, reject or terminate without penalty, subject to outstanding obligations or liabilities. These requirements do not establish that every validator operator is a custodian. (Virtual Asset (Service Providers) Act, ss 4, 8 and 10(2)–(3), as amended by Act 22 of 2024; CIMA, Market Conduct for Virtual Asset Service Providers, February 2026, paras 4.1, 10.18 and 16.5.)

For an in-scope EU custodial staking provider, verify the custody permission and the contract's treatment of staking losses. The Commission's published interpretation treats custodial staking as ancillary to MiCA custody and staking losses as attributable to the provider. Consent cannot authorise use of client assets for the provider's own account. (MiCA, Articles 70(1) and 75(8); Commission answer in ESMA Q&A 2067, 20 June 2024; ESMA Q&A 2607, 9 July 2025.)

A liquid staking token requires express approval of its rights and exit conditions. Selling that token and redeeming the underlying stake are separate routes with different liquidity. The foundation should complete the entitlement and exit review described in Client rights in crypto custody and staking.

DeFi lending

Identify the actual chain, protocol version, contracts and assets. Establish what the foundation receives after supply: a receipt token, a contractual repayment claim, a proprietary interest or another entitlement. Record any identifiable obligor, governing law and recovery route. Code execution alone does not establish those legal rights.

Obtain the security and liquidity evidence for the selected deployment. Aave V3 documents withdrawals as dependent on available unborrowed liquidity and, where relevant, sufficient collateral. Its mechanics show why a withdraw function cannot be treated as unconditional payment availability. They do not determine another protocol's terms. (Aave V3 documentation, “Liquidity Pool”, “Withdraw”.)

Approve a defined supply mandate only after the regulatory, title, reserve and technical checks are complete. Keep liquidity provision outside that permission: it exposes assets to exchange and changing inventory. In concentrated-liquidity pools, a position can become entirely one asset. Approve the pair, position controls and withdrawal terms separately. (Uniswap Developers, “Concentrated Liquidity”, “What Active Liquidity Means”.)

Collateralised borrowing also needs separate authority for the debt, asset use and enforcement exposure. Document interest changes, liquidation mechanics, repayment resources and who can act before collateral is sold. Record any applicable mortgage or charge in the company's register. Borrowing to meet an invoice can create a later collateral shortfall. (Companies Act, s 54; Foundation Companies Act, s 15.)

Delegated treasury management

Verify the power to delegate and the manager's permission for the assets and services involved. Define whether the manager advises, chooses investments, executes transactions or controls assets. An investment-management label does not answer those questions.

For a manager providing in-scope crypto-asset portfolio management within the EU, check its Article 59 authorisation or applicable Article 60 route. MiCA requires suitability assessment and periodic portfolio reporting. Provide the manager with the foundation's commitments, loss capacity and liquidity restrictions. Instruments excluded from MiCA require their own classification and permission analysis. (MiCA, Articles 2(4), 3(1)(25), 59–60 and 81.)

Put the permitted activities and limits into the signed mandate and relevant account controls. Address onward delegation, affiliated venues, fees, information access, revocation and transfer to a replacement manager. Reserve new activities and material exceptions to the authorised decision-makers.

The board should retain decisions on objectives, reserves, limits, conflicts and responses to breaches. Directors exercise fiduciary powers for proper purposes; appointing a manager does not convert the foundation's powers into the manager's unrestricted discretion. (Tianrui v China Shanshui [2024] UKPC 36, para 41; Foundation Companies Act, s 7.)

The constitution determines powers and reserved approvals. The board resolution records the authorised route, amount or limit, conditions and signatories. The policy governs recurring decisions within those powers. Contracts bind providers to their obligations. Internal limits should be reflected in the mandate where provider compliance matters, because good-faith counterparties need not investigate the foundation's bylaws. (Foundation Companies Act, ss 9–12.)

A treasury policy should cover:

• Authority and purpose: permitted activities, decision-makers, committee terms and reserved matters.
• Reserves: enforceable commitments, protected budgets, liquidity assumptions and replenishment triggers.
• Limits: assets, approved counterparties, connected groups, protocols, chains, collateral, lockups and aggregate exposure.
• Approvals: who may propose, approve, sign and reconcile; thresholds for new exposure and exceptions.
• Delegation: manager discretion, signing powers, subcontracting and activities requiring further approval.
• Conflicts: disclosure, independent assessment, recusal and lawful approval procedures.
• Reporting and exit: position records, breach escalation, emergency powers, termination and recovery.

Set thresholds from the foundation's obligations and assessed exposures. Several wallets or venues may share one custodian, issuer or collateral dependency. Review that combined exposure when applying concentration limits. Emergency authority should identify who can stop new deployments, revoke access or instruct an exit, subject to law and the actual protocol controls.

A founder-related validator, manager or venue requires disclosure of ownership, remuneration and competing duties before selection. Obtain an assessment independent of the conflicted participants covering price, service, control and loss allocation. Use the constitution's lawful approval mechanism and record the basis for proceeding.

As a policy control, exclude conflicted participants from evaluation and voting, while preserving a valid quorum and any required reserved approval. If the constitution permits different participation, document how the decision still satisfies the applicable duties. Obtain external input where the remaining decision-makers lack sufficient expertise or independence. Check whether the foundation's law or documents impose any additional requirement.

For the manager, specify discretion, execution rights and investment restrictions. For the custodian, verify the foundation's account capacity, title, liens, reuse rights and return process. For the validator, specify signing and withdrawal powers, operating responsibilities and failure remedies. In every relevant agreement, cover onward delegation, information access, incident notice, governing law, dispute resolution and termination assistance.

Do not accept a provider's assurance as evidence that another provider's obligation can be enforced. The foundation needs to know whom it can instruct, whom it can sue and which records remain available after failure.

Before funding, the board pack should contain the authority analysis, contribution and title records, commitments schedule, liquidity assessment, approval record and signed provider documents. Add a wallet and permission map, current positions, receipt tokens, encumbrances, withdrawal dependencies and an assigned exit procedure.

Technical specialists should identify the deployed version and contract addresses, the scope of relevant security reviews and unresolved findings. They should test signing, recovery and exit controls within an agreed scope. The board should record what was reviewed and what remained unresolved; a published audit title does not establish that the selected deployment was covered.

Reporting should reconcile on-chain records, provider statements and accounts, including accrued rewards, fees, borrowing and pending exits. Set reporting frequency to the speed at which limits or payment capacity can change. Require prompt escalation of lost access, slashing, reserve breaches, withdrawal suspensions and material contract or protocol changes. Maintain proper accounting records and written decision records. (Companies Act, ss 59 and 73.)

Commission bounded tax and accounting checks before a new route starts. A business of providing credit for consideration can engage Cayman's economic-substance rules, depending on the entity and activity. Overseas decision-making and contractor arrangements require review in the jurisdictions concerned. Accounting must follow the actual asset and rights: the IFRS Interpretations Committee's June 2019 cryptocurrency decision addresses a defined subset, not every stablecoin or receipt token. (International Tax Co-operation (Economic Substance) Act (2026 Revision), ss 4 and 7 and Schedule; IFRIC, “Holdings of Cryptocurrencies”, June 2019.) Assign any Common Reporting Standard and Foreign Account Tax Compliance Act classification and self-certification questions to a separate reporting review, using the final activities and account relationships.

The board can commission the authority and commitments review, settle proposed limits and negotiate route-specific terms. Implementation requires a completed approval pack and confirmation that the conditions remain satisfied when assets move.

Constitutional gaps require the authorised amendment process. Unclear provider powers or asset-use terms require contract changes. Unresolved financial-business classification, inadequate liquidity, material security findings or an unusable exit justify deferring the affected route. Do not include liquidity provision, borrowing, onward reuse or token-holder return promises in a general approval for staking or lending.

Record the approved activity and amount, the supporting documents, required consents, conditions before funding, persons responsible and events requiring renewed approval. A scoped Web3 legal due diligence review can test those documents and identify the changes required for the proposed arrangement.