Digital Asset Due Diligence: How Institutional Investors Evaluate Crypto Opportunities

Due diligence in digital assets suffers from an unusual problem: there is more data available than in almost any other asset class, and less of it is decision-useful. Every transaction is public, every balance verifiable, every protocol parameter inspectable. Yet the questions that determine whether an institution should commit capital — who controls the asset, what happens if the code fails, whether the counterparty holding it is solvent — are frequently answered nowhere in that data.

This note sets out how institutional investors structure the investigation. It is written for allocators who already run diligence processes in traditional markets and want to understand which frameworks transfer directly, which require adaptation, and which questions have no equivalent in a prospectus or an audited financial statement.

Why Diligence Differs in Digital Assets

Two features of the asset class change the shape of the work.

Radical transparency, uneven disclosure

Blockchains disclose more than any traditional issuer: holdings, flows and contract state are observable in real time by anyone. This is genuinely valuable — an institution can verify reserves and concentration directly rather than relying on an assertion. But observability is not disclosure. The on-chain record shows what happened; it does not identify who acted, why, or what commitments exist off-chain. Diligence therefore combines verification of what is publicly observable with conventional investigation of what is not.

The absence of a prospectus

Most digital assets have no issuer in the legal sense, no offering document, no audited accounts and no directors carrying liability for statements made. The materials that substitute for these — whitepapers, documentation, governance forums — carry no accountability and are frequently written promotionally.

The practical consequence is that the analyst must construct the equivalent of a prospectus rather than assess one. Facts must be assembled from primary sources: the code, the on-chain record, the legal filings where they exist, and direct enquiry of the parties involved. Nothing in a project’s own marketing material is evidence of anything except what the project wishes to convey.

The Four Objects of Diligence

A common failure is to treat diligence as a single exercise. It is four related investigations, each with a different question and a different disqualifying answer:

• The asset — what it is, what gives it value, who controls it, and what its economics require to remain true.
• The technology — what secures it, what could fail, and who holds the authority to change it.
• The counterparties — the exchanges, custodians, brokers and lenders that will touch the asset, and whether their failure would impair the position.
• The manager — where exposure is obtained through a third party, the process, controls and independence of the firm running the mandate.

An asset that passes analytical scrutiny but can only be held through an unacceptable counterparty is not investable. A manager with an excellent track record and weak operational controls presents a risk the track record does not describe. Each investigation can independently disqualify the opportunity.

Asset-Level Due Diligence

The asset investigation establishes what the position actually is — a question that sounds trivial and frequently is not.

Economics and supply

The analysis begins with the mechanics of the asset itself: total and circulating supply, the issuance schedule and what governs it, the distribution at inception, and any vesting or unlock schedule that will introduce supply on a known timetable. Where a token accrues value from network activity, the analyst traces the mechanism precisely — whether fees are genuinely captured by holders or merely described as though they were.

This is the same discipline we apply to income streams in our note on reading risk in on-chain yield: trace the return to its source and identify what must remain true for it to persist. A yield or accrual funded by issuance rather than revenue is a transfer between holders, not a gain, and we examine that distinction further in sustainable staking and protocol economics.

Governance and control

The controlling question is who can change the rules. Many assets that present as decentralised retain concentrated authority — a foundation, a core development team, or a governance process in which a small number of holders can pass any proposal. Diligence identifies where that authority sits, what it can do unilaterally, and what procedural or time-lock constraints apply to its exercise.

Governance concentration is not automatically disqualifying. Concealed or misrepresented governance concentration generally is, because it indicates that other representations should be treated with equal scepticism.

Holder concentration

Because holdings are observable, concentration can be measured directly rather than inferred. The analyst examines what proportion of supply sits with the largest holders, whether those holdings are identifiable as treasury, team or exchange balances, and what the liquidity consequences would be if a significant holder were to exit. A liquid-looking asset in which a small number of wallets hold most of the float is less liquid than its trading volume suggests.

Liquidity and market structure

Tradability is assessed separately from market capitalisation, which measures neither. The analyst examines where the asset actually trades, how volume is distributed across venues, and how much of that volume occurs on venues the mandate would be permitted to use — a headline figure that aggregates unregulated platforms overstates accessible liquidity, sometimes substantially.

Depth is then measured at realistic size rather than inferred from turnover. The relevant question is the market impact of exiting a position of the size contemplated, under stressed rather than prevailing conditions: thinner books, wider spreads and correlated selling. Where liquidity depends materially on a small number of market makers, that dependency is itself a risk, since market-making commitments are generally discretionary and tend to be withdrawn precisely when they are most needed.

The output is a stated exit assumption — how long a position of this size would take to unwind without disproportionate impact — recorded at the point of investment and matched against the mandate’s own liquidity obligations. A position whose realistic exit period exceeds the horizon over which the portfolio may need the capital is a mismatch, however attractive the analytical case.

Technology and Protocol Diligence

Technical diligence does not require an institution to audit code itself. It requires the institution to know what has been examined, by whom, and what remains unexamined.

Audits and their limits

A security audit establishes that specified code was reviewed against known vulnerability classes at a point in time. It does not establish that the code is safe, that subsequent changes were reviewed, or that the economic design is sound. Diligence therefore asks what was in scope, what was excluded, whether findings were remediated, and how much has changed since. Where custody or key management is involved, the relevant standards are cryptographic rather than merely procedural — the threshold cryptography work maintained by NIST is a useful reference point for evaluating claims about distributed key management.

Upgrade authority and administrative keys

The question that most often surfaces unpriced risk is who can change the contract after capital is committed. Many protocols retain upgrade authority, emergency pause functions or administrative keys. These capabilities frequently exist for good reasons, but they mean the position depends on the honesty and operational security of whoever holds them.

Diligence establishes whether such authority exists, who holds it, whether it is subject to a multi-signature quorum and time-lock, and what notice holders would receive before it is exercised. An institution that cannot answer these questions does not know what it owns.

Venue and Counterparty Diligence

Counterparty failure has impaired more institutional capital in this asset class than adverse price movement, and it does so without the market moving at all. The commingling of client funds at failed exchanges established the principle that assets held at a venue are exposed to that venue’s solvency, whatever the account statement says.

Counterparty diligence is accordingly conservative and continuous. The assessment covers:

• Licensing and regulatory standing in each jurisdiction where the counterparty operates, and what those permissions do and do not cover.
• Segregation of client assets — whether legally segregated, how that is evidenced, and what would happen to client claims in an insolvency.
• Ownership, group structure and financial condition, including whether affiliated entities create undisclosed exposure.
• Audit and attestation history, including who performed the work and its scope.
• Behaviour in previous stress — withdrawal handling, disclosure quality and operational continuity during past market dislocations.
• Concentration — what proportion of the portfolio would be exposed to this counterparty, and whether that exposure is capped.

Approved counterparties are then used in combination rather than exclusively, exposure to any one is limited, and balances are swept to custody rather than left resting on a venue. Diligence continues on a defined cycle and on trigger events — a change of ownership, a regulatory action, a withdrawal disruption. We set out the wider control framework in our note on institutional crypto risk management.

Legal and Regulatory Diligence

The legal investigation establishes what is actually owned and whether the mandate permits holding it. For tokenised instruments in particular, the token and the underlying claim are separate things, and the enforceability of the link between them is where the substantive risk sits — a point we develop in our note on tokenization of real-world assets.

The regulatory element asks how the asset is treated in each relevant jurisdiction, whether that treatment is settled or under consultation, and what a change would require the institution to do. Frameworks such as the European Union’s Markets in Crypto-Assets Regulation have brought licensing and disclosure obligations that institutions recognise from other markets, and we map the wider landscape in our note on the regulatory perimeter for digital assets. The practical output is an eligibility conclusion: whether this asset, held this way, through these counterparties, is permissible for this mandate. Nothing here constitutes legal advice, and jurisdiction-specific questions belong with qualified counsel.

Operational and Manager Diligence

Where exposure is obtained through a manager, the operational investigation frequently matters more than the investment one. Track records in this asset class are short and say little about whether client assets are controlled.

The assessment examines the custody model and who holds signing authority; whether the risk function is genuinely independent of the investment function and what happens procedurally when a limit is breached; how venues and counterparties are approved and monitored; the licences the manager and its custodian actually hold; the frequency and audit standard of reporting; reconciliation practice between on-chain records, venue balances and internal books; and key-person dependency.

Much of this is standard operational due diligence of the kind professional investment standards bodies have long applied to traditional mandates; the digital asset specifics sit on top of that framework rather than replacing it. The governing principle throughout is to ask for evidence rather than assurance. A manager operating to an institutional standard will have policies, review reports and reconciliation records available on request, because those artefacts are produced in the ordinary course of the work rather than assembled for a prospective client.

Building the Diligence File

The output of the process is a document, not a decision. Its purpose is to record what was examined, what was concluded and on what basis — so that the conclusion can be reviewed later by someone who was not present.

What must be true, and what would prove us wrong

The most useful discipline we apply is to state the investment case as a set of conditions rather than a view. What must remain true for this position to work — about adoption, about the fee mechanism, about the regulatory treatment, about the counterparty? And, more importantly, what observation would tell us the case has broken?

Recording falsification conditions in advance converts a subsequent decision to exit from a judgement made under pressure into the execution of a pre-agreed rule. It also imposes a useful discipline at the outset: a position whose thesis cannot be falsified by any observable event is not an investment case but a belief.

The file should also record dissent. Where a member of the investment team argued against the position, the substance of that argument belongs in the document rather than in the memory of the people present. It provides the most useful starting point for a later review, since the objection raised at the outset is frequently the one that turns out to matter, and it protects the process from the retrospective consensus that forms around any decision once its outcome is known.

Diligence is continuous

The file is a living document. Counterparties are re-reviewed on a defined cycle and on trigger events; protocol changes, governance proposals and unlock schedules are monitored on a calendar; and the falsification conditions are tested against what has actually occurred. Diligence completed once at onboarding describes a counterparty that no longer exists.

Common Red Flags

Certain findings warrant disproportionate weight, less because each is individually fatal than because each indicates that other representations deserve scepticism:

• Governance or ownership concentration that was not disclosed and had to be discovered.
• Administrative or upgrade keys held by an individual or an undisclosed party, without quorum or time-lock.
• Returns that cannot be traced to an identifiable source, or that are described by reference to rate rather than mechanism.
• A counterparty unwilling to evidence segregation of client assets, or unable to explain its insolvency treatment.
• Audit scope that excludes the components most material to the risk.
• Marketing material that describes regulatory status in terms that do not match the register.
• Any party that responds to a documentation request with assurance rather than documents.

Key Takeaways

• Observability is not disclosure — the chain shows what happened, not who acted or what was agreed off-chain.
• Construct the equivalent of a prospectus from primary sources; project marketing is evidence only of intent to persuade.
• Run four separate investigations — asset, technology, counterparty and manager — each capable of disqualifying the opportunity alone.
• Establish who can change the rules after capital is committed, and under what constraints.
• Trace any yield or accrual to its source; a return funded by issuance is a transfer, not a gain.
• Counterparty failure has impaired more capital than price movement — diligence there is continuous, not one-time.
• Record what must be true and what would prove the case wrong, before committing capital.
• Ask for evidence rather than assurance, and treat unwillingness to provide it as a finding in itself.

To discuss how this framework would apply to a specific opportunity or mandate, explore our research and diligence expertise or book a confidential portfolio review.

Risk Disclaimer

This article is provided for informational and educational purposes only and does not constitute investment, legal, tax or financial advice, nor an offer or solicitation to buy or sell any asset. Digital assets are highly volatile and speculative, and their value can fall as well as rise; you may lose some or all of your capital. Due diligence reduces neither volatility nor the possibility of loss, and no process can identify every risk or assure a favourable outcome. Past performance is not indicative of future results, and no return is promised or guaranteed. Any examples are illustrative only. The regulatory treatment of digital assets varies by jurisdiction and continues to evolve. Prospective investors should conduct their own due diligence and seek independent professional advice appropriate to their circumstances before making any allocation.