Start with the right, not the token
Similar-looking records may represent a monetary claim, securities entitlement, service access, provenance evidence, digital currency or a technical identifier. A token name does not determine its legal treatment.
For every object document the issuer, obligated party, substance of the right, creation and redemption conditions, eligible holders, authoritative record and dispute process. If the right exists only in a contract and the token is a reference, the contract remains the primary obligation source.
Keep regulated digital rights and currencies separate
In Russia, digital financial assets are legally defined digital rights that can include specified monetary and securities-related claims. Issuance and circulation take place in systems run by operators entered in Bank of Russia registers, and these assets are not a means of payment.
Digital currency follows a different regime and infrastructure. Do not copy the limits, workflows or control model of one class to another merely because both may use distributed ledgers. Legal and finance teams must confirm the current treatment of the exact asset and participant before an operation.
Maintain a corporate digital-asset register
The internal register connects an external asset identifier with its issuance decision or agreement, operator, internal owner, wallet or account, acquisition value, restrictions, dates, income events and redemption.
Store the valuation source and date, fees, supporting document and external transaction reference. This register does not replace the operator's authoritative record or the accounting system; it links them for control and audit.
Separate initiation, approval and custody
One employee should not be able to create an address, initiate a transfer and approve its accounting. Apply an authority matrix, limits by amount and asset class, multi-party approval, address allowlists and delays for critical operations.
Treat keys as access instruments to the asset. Define generation, protected custody, backup, rotation, revocation, recovery and compromise response. A secret in a spreadsheet, email or ordinary application environment variable is not an adequate custody model.
Design accounting before the first transaction
Agree on source documents, recognition timing, valuation, fees, remeasurement, impairment, income, disposal and disclosure before acquisition or issuance. An automated platform export does not guarantee correct accounting classification.
Periodic reconciliation compares the internal register, operator data, accounting system and blockchain evidence. A discrepancy should block further movement of the affected asset until investigated.
Treat the operator and counterparty as risk dependencies
Verify the operator against the current regulatory register and review system rules, access recovery, data location, enforcement procedures and platform-exit arrangements.
For counterparties preserve identification, authority, approved addresses, required screening, business rationale and source-of-funds evidence where applicable. A technically successful transfer is not proof that the operation was permitted or recorded correctly.
Prove readiness with an end-to-end scenario
Test approval, order creation, signing, execution, confirmation, register and accounting entries, reconciliation, reporting and access recovery. Then rehearse a wrong address, lost key, unavailable operator, dispute and a transaction discovered after period close.
The company is ready when it can identify the process owner, prove every record, demonstrate segregation of duties, reconstruct valuation history and stop an unsafe operation. Buying a wallet or integrating an API does not create that readiness by itself.