Digital Asset Vendor Due Diligence Questionnaire (Template)

By the Guardian team Updated November 2026 6 min read

Quick answer. Ask who controls the company, who can move assets, how keys are generated and recovered, which audits match deployed code, what offchain pentests found, and how incidents and exit work. Require dated evidence for each answer.

Watch: Digital Asset Vendor Due Diligence Questionnaire (Template) 1:40

Video transcript

Standard security questionnaires ask about laptops and firewalls. They rarely ask who can move the assets. This template fills that gap.

In May 2025, the OCC confirmed banks it supervises may use crypto sub-custodians. US banking agencies say diligence on them includes evaluating key management.

Before you send it, tier the vendor by criticality. Send every section to vendors that hold keys or run contracts. Require evidence, agree red flags first, and re-run it on triggers like an upgrade.

The questions cover five areas: governance, key management, smart contracts, offchain security, and incidents and exit.

A strong answer comes with evidence. Secure key storage needs ceremony records and a dated recovery test. An audit claim needs commit hashes and a bytecode match.

The key question: can any single person, or the customer, move assets alone? The strong answer is a reasoned no.

For incident notice, amended Regulation S-P sets a benchmark. Covered firms must ensure service providers notify them within 72 hours of becoming aware of a breach.

For institutions, Guardian reviews the custodians, bridges, oracles and protocols you depend on, and the Digital Asset Assurance Pilot is a low-commitment start. As a vendor, Guardian aligns with NIST CSF 2.0 and CCSS, with a SOC 2 Type 2 audit underway.

Read the full article to copy every question. Or talk to Guardian about your crypto vendors.

Banks and funds now rely on crypto vendors: custodians, wallet providers, tokenization platforms and the protocols they integrate.

In May 2025 the OCC confirmed that the banks it supervises may use crypto sub-custodians, "subject to appropriate third-party risk management practices."

Standard security questionnaires ask about laptops and firewalls. They rarely ask who can move the assets.

US banking agencies say diligence on a crypto sub-custodian includes "evaluating the effectiveness of the sub-custodian's cryptographic key-management solution." This template covers that gap.

This template explains the technical and security side of the guidance it cites. It is not legal advice; confirm how it applies to you with counsel.

How to Use the Questionnaire

The 2023 interagency guidance on third-party risk lists 14 due diligence factors, including information security, operational resilience and subcontractors. Use it for the general review; this questionnaire adds the crypto-specific questions.

Before you send it, take five steps.

Tier the vendor. NIST CSF 2.0 says suppliers should be "known and prioritized by criticality."
Send every section to vendors that hold keys or run contracts. Trim it for the rest.
Ask for evidence with each answer: a document, a date and an owner.
Agree red flags first, so scoring is not a negotiation.
Re-run it on triggers: a new owner, a new chain, an upgrade or an incident.

The difference between a weak and a strong answer is usually the evidence.

Area	Weak answer	Evidence to request
Keys	"Keys are stored securely"	Key inventory, ceremony records, a dated recovery test
Smart contracts	"We are audited"	Reports with commit hashes, a bytecode match record
Offchain	"We pentest regularly"	Latest reports, their scope and retest results
Incidents	"No incidents"	Incident log, post-mortems, notice terms in hours

Copy the questions below and keep the IDs, so answers can be compared year to year.

Governance and Ownership

Start with who controls the company. They control the roadmap.

GV1. Who owns the company, and has ownership changed in the last three years?
GV2. Who is accountable for security, and to whom do they report?
GV3. Which regulators license or supervise you, and where?
GV4. Will you notify us of a change of control, and may we exit then?
GV5. Which subcontractors touch our data, keys or transactions?
GV6. What insurance covers theft or loss of client assets, and what does it exclude?
GV7. Do we and our regulators have audit rights?

Key Management

This is the section generic questionnaires miss. The agencies' 2025 safekeeping statement calls compromise or loss of keys "one of the primary risks."

KM1. Describe your key architecture (HSM, MPC, multisig or enclave) and why you chose it.
KM2. Can any single person, or the customer, move assets alone?
KM3. How are keys generated, and who witnessed the last ceremony?
KM4. Where are key shares and backups stored, and in how many locations?
KM5. How are signers added and removed, and how fast is access revoked?
KM6. When did you last restore from backup, and what happened?
KM7. Are client assets segregated from yours? Separate or omnibus wallets?
KM8. What is your plan for a lost or compromised key?
KM9. Which certifications cover key management, such as a CCSS level?

The strong answer to KM2 is a reasoned no. Under the agencies' statement, a bank applies its control standard to sub-custodians too: no other party, including the customer, holds enough to move the asset unilaterally.

For KM9, CCSS certifies systems, not whole companies, at Level 1, 2 or 3. Ask which system the certificate covers.

Smart Contract Assurance

If custodied assets depend on smart contracts, the agencies say a bank should oversee them "throughout their life cycle."

SC1. List every contract that holds or moves our assets, by chain and address.
SC2. Provide audit reports with the commit hash each one reviewed.
SC3. Show that deployed bytecode matches the audited commit.
SC4. Which findings were acknowledged rather than fixed, and why?
SC5. Who can upgrade, pause, mint or change parameters, at what threshold and delay?
SC6. How is each upgrade reviewed before it ships?
SC7. What monitors these contracts, and who responds to an alert?
SC8. Do you run a bug bounty, and what is the maximum payout?

For the protocol side, see our DeFi protocol due diligence checklist and how often deployed code matches the audit.

Offchain Security

Most of what can reach keys is ordinary infrastructure. Under NYDFS Part 500.11, a covered firm's vendor guidelines must address, where applicable, access controls with MFA, encryption, incident notice, and representations and warranties.

OS1. Provide your latest SOC 2 Type II report, its period and any exceptions.
OS2. Provide recent infrastructure, web app, API and SDK pentest reports, with retests.
OS3. Is MFA enforced on every privileged path, including cloud and code hosting?
OS4. How is data encrypted in transit and at rest?
OS5. Who can deploy to production, and what approvals does a release need?
OS6. How are CI/CD secrets and signing services isolated from staff laptops?
OS7. Which registrar, DNS and front-end controls stop a hijacked domain?
OS8. How do you confirm published packages and SDKs match your repository?

Incidents, Response and Exit

Ask what has gone wrong, and what happens when it does again.

IR1. List security incidents in the last three years, with post-mortems.
IR2. Within how many hours will you notify us of an incident affecting us?
IR3. Will you notify us of any key compromise, backup use or irreversible transaction error?
IR4. Will you join our incident exercises and resilience testing?
IR5. When did you last test continuity, and with which critical providers?
IR6. How would our assets be treated if you became insolvent?
IR7. On exit, how are our assets and data returned, and in what format?

IR2 has a benchmark in amended Regulation S-P. Broker-dealers, registered advisers, funds and transfer agents must ensure service providers notify them "as soon as possible, but no later than 72 hours" after becoming aware of a breach.

IR3 and IR6 come from the agencies' safekeeping statement. IR4 and IR7 mirror DORA's contract terms: data return in every ICT contract, plus threat-led pentests and exit plans for critical or important functions.

For the vendor's view of the same process, see what banks and funds ask onchain teams.

How Guardian Helps

Guardian works on both sides of this questionnaire.

For institutions, Guardian reviews the bridges, custodians, oracles and protocols you would depend on, "as concentrations of risk rather than as logos on a slide."

The Digital Asset Assurance Pilot is a low-commitment way to start, built for vendor approval.

When Guardian is the vendor, our institutional page states where we stand: aligned with NIST CSF 2.0 and CCSS, with a SOC 2 Type II audit underway.

Frequently Asked Questions

What is a vendor due diligence questionnaire in crypto?

A structured set of questions a bank, fund or exchange sends a crypto vendor before contracting. It covers the usual governance and IT controls, plus keys, smart contracts and incident response, with evidence attached to each answer.

How is a crypto DDQ different from a standard security questionnaire?

It asks who can move the assets. Standard questionnaires cover access, encryption and continuity. A crypto DDQ adds key generation and recovery, signer thresholds, audited versus deployed code, and notice of key compromise.

What do US bank regulators say about crypto sub-custodians?

Their July 2025 joint statement calls diligence before selecting a sub-custodian an important part of sound risk management, including its key management. It creates no new supervisory expectations; it explains how existing rules apply.

How often should a crypto vendor DDQ be repeated?

At an interval matched to the vendor's risk, and on triggers: a new owner, a new chain or contract, a major upgrade, or an incident. The 2023 interagency guidance treats ongoing monitoring as a stage of the third-party life cycle.

Sources

Get a technical read on your crypto vendors

Guardian reviews the custodians, wallets and protocols your program depends on, and checks the evidence behind every answer.

Talk to Guardian Explore institutional security