Digital Assets Reach The Board Before The Balance Sheet

A board that has never discussed digital assets may already be exposed to them. A customer settling an invoice through a third party that converts from crypto. A supplier requesting payment to an offshore processor. An employee running a side operation using company infrastructure. A subsidiary in another market accepting a payment channel that head office has not reviewed.

None of those begins as a treasury decision, which is exactly why none of them reaches the board. They arrive through operations, and they are typically discovered during a reconciliation or an incident rather than through a policy discussion.

The first governance action is not an investment policy. It is a factual question to management: where, if anywhere, does this organisation already touch virtual assets - in receipts, in payments, in payroll, in any subsidiary?

Where an organisation does hold digital assets, the control that matters is key management, and it does not resemble any control the finance function already runs. There is no bank to call, no chargeback, no reversal, and no counterparty who can restore a balance. Whoever controls the key controls the asset, completely and finally.

That collapses segregation of duties into a single technical control. The questions a board should be able to get answered are basic and specific: who holds the keys, what happens if that person is unavailable, is there a multi-signature arrangement, where are backups held, and who has ever tested a recovery.

If any answer is "one person knows", the organisation has an unhedged key-person risk sitting on a liquid asset.

Tax and reporting obligations follow transactions, not intentions. Kenya has legislated in this area and the regime continues to develop; the durable point is that a transaction creates a record-keeping obligation on the day it happens, and reconstructing a history of transfers after the fact is materially harder than recording them as they occur.

Keep the transaction log from the first transaction: date, counterparty, value in shillings at the time, purpose, and the wallet or platform involved. Whatever the specific treatment turns out to be for a given period, no version of it is satisfied by an exchange export retrieved two years later - assuming the exchange is still operating.

Three items, once, and then annually. A factual map of existing exposure across the group. A decision on appetite - including a considered decision to have none, which is a legitimate position but should be recorded as a decision rather than left as a silence. And an owner in management with the standing to enforce whatever the board decides.

Boards that treat this as a technology topic delegate it to people without the authority to say no. It is a risk appetite topic, and it belongs where risk appetite is set.