Custody & attestation — where capital lives, who attests to it, what an allocator verifies themselves.
The policy page for the desk’s ‘allocator can actually verify’ pillar. Today’s custodians and the qualified-custody account in onboarding, the segregation between Counterfoil and LP assets, the independent attestation cadence, the six checks an allocator runs without asking the desk to vouch for itself, and how custody, prime brokerage, and the trading venues relate.
What this page covers
- Today's custodians and the qualified-custody account in onboarding.
- Asset segregation between Counterfoil's capital and each allocator's capital.
- The independent Big-4 attestation cadence and the policy it covers.
- Six checks an allocator runs themselves — no desk email needed.
- A short map of custody → prime brokerage → trading venue, so the boundary between each layer is explicit.
Allocator can actually verify
The mission pillar is published, attested, and reproducible.
Capital sits at a regulated, qualified custodian under segregated client accounts. Counterfoil’s assets and each allocator’s assets are accounted separately, the segregation survives rebalance and reorg, and an independent attestation firm refreshes a controls-level attestation over the desk on a published cadence. The remainder of this page names the custodians, the segregation scheme, the attestor, and the checks an allocator runs themselves.
Custody · live roadmap
Loading custody readout…Asset segregation
Counterfoil’s assets vs. LP capital — what’s owned by whom.
Three lines an allocator reconciles first. The desk’s own capital and each allocator’s capital are accounted separately, the segregation survives across the daily rebalance, and Counterfoil never holds a signing key over allocator funds. The same line items are published in the whitepaper and on onboarding.
- Counterfoil operating capitalSegregated desk-side account; subject to the daily 16:00 UTC reconciliation.—
- Allocator subscriptions—Segregated qualified-custodian client account, sub-accounted per sidecar mandate and reconciled against the daily memo.
- Trading book positions (BTC, ETH, SOL, stable & basis)Settled from desk-side custodian to the listed-margin venue, never agent-controlled.Settled from LP-side custodian to the venue; positions remain in the LP’s segregated custodian account throughout.
- Yield-bearing stablecoin balancesAllocated across desk-side Aave / Morpho / Spark / perp carry balances and reconciled at 16:00 UTC.Allocated across the LP-side Aave / Morpho / Spark / perp carry balances per the published basket.
- On-chain treasury walletsAgent-controlled treasury wallets, read at the keyless public RPC at 06:00 UTC, published on /proof-of-reserves.—
Third-party attestation
Independent controls attestation, on a published cadence.
An independent Big-4 firm refreshes an engagement-agreement-level attestation over the desk’s internal controls over the custody flow, the mandate reconciliation, and the daily PnL pipeline. The cadence is published, the scope is published, and the attestation pack ships with the allocator brief on request.
Engagement level
Big-4 ISSAE 3402 Type 2
Controls-level attestation over the custody flow, the daily mandate reconciliation, and the daily PnL pipeline. Covers the period-to-date effective control operation, not a single-point-in-time self-attestation.
Cadence
Annual, refreshed against the published period
Twelve attestations issued to date. The most recent attestation report ships with the allocator brief on request, alongside the daily counterparty stack an allocator reconciles against the same period.
Your own verification
Six checks an allocator runs without asking the desk.
Each check below resolves to a public, independently-readable surface. Run them in any order — together they re-derive the four figures the desk publishes as a single dossier.
01
Cross-foot the published holdings against the published NAV.
Open /treasury, read the four rows of the holdings table, and confirm the percentages sum to 100% and the USD cents sum to the published NAV figure in the totals row. The allocator-side math should match the desk’s cross-foot exactly — if it does not, the snapshot is wrong.
Open /treasury02
Read the on-chain balances of the agent-controlled treasury wallets at the public RPC.
Open /proof-of-reserves, read each row of the on-chain balances table, and replay it against the public RPC. The desk publishes the column labelled `rpc:cloudflare-eth` for any row read live — that label is the witness path, and any reviewer can re-run the call.
Open /proof-of-reserves03
HMAC-verify the daily PnL manifest against the canonical series endpoint.
Pull /api/pnl/series for a closed trading day, canonicalise the JSON bytes (sorted keys, no whitespace), pull /api/pnl/manifest/[date] for the same date, and HMAC-SHA256-verify against the manifest’s `signature`. The hash re-derives byte-for-byte without trusting the desk’s narrative.
Open /api-docs04
Compare the custodian-attested total against the on-chain treasury total.
Open /proof-of-reserves, read the two totals cards (custodian attestations vs on-chain treasury) at the same `as of` date. The two figures reconcile to within the published tolerance band — that reconciliation is a single check, no email required.
Open /proof-of-reserves05
Read the day’s memo for the cadence the desk claims, and verify the cadence column matches the methodology table.
Pull /api/memos/allocator, open any memo, and read the cadence the desk claims that day. Compare against the cadences on /methodology — the sleeve column on the cadence table is byte-for-byte identical to the per-strategy page.
Open /memo06
Read the counterparty stack the desk publishes — funds + custodians + venues — as one dossier.
Each surface allocates a slice: /treasury holds the custodian set + balances; /proof-of-reserves holds the attestations + on-chain read; /risk-metrics holds the exposure breakdown; /performance holds the comparator series. Together they compose the allocator pack.
Open /allocator-apiMap
Custody, prime brokerage, trading venue — three layers, three jobs.
An allocator decomposes the desk’s settlement stack in three layers. This page covers the custody layer; the other two are briefly named so a verifier knows what each one does and where the boundary crosses.
- CustodyHolds the segregated client account and enforces movement policy at the boundary.Anchorage Digital · Fireblocks · BitGo Trust (today); Coinbase Custody (in onboarding).Capital. The asset sits here throughout its time in the desk.
- Prime brokerageProvides the credit, financing, and listed-margin venue access the desk uses; never holds the asset.Listed-margin venue the desk quotes (per-sleeve financing carries separately).Nothing. The prime broker is a financing counterparty, not an asset holder.
- Trading venueMatches orders, settles fills, and reports trades. No long-term holding; positions are returned to the custodian after settlement.Spot and listed-margin venues the desk quotes per sleeve.Nothing. The trading venue never holds client assets longer than a settlement cycle.
Speak with the desk
Want the full dossier?
The allocator brief bundles today’s treasury snapshot, the proof-of-reserves attestation, the most recent signed daily PnL manifest, the methodology note, and the desk’s published risk and exposure breakdowns — sent before any pitch conversation.
Read alongside
- Treasury report — today's custodians and balances
- Proof of reserves — attestations + on-chain read
- API reference — HMAC-verify the daily manifest