Digital Asset Risk Taxonomy: Match Failures to Controls
Diagnose digital asset risk by the mechanism that can cause loss: market prices, custody, counterparties, code, liquidity or legal rights. Match the control to that mechanism; a price hedge does not fix a stolen key or a broken smart contract.
The key decisions, at a glance
| Concept | What to do | Watch for |
|---|---|---|
| Market and liquidity | Stress prices, spreads and executable exit size. | Reported volume does not guarantee liquidity in stress. |
| Custody and operations | Test authorization, key recovery and asset segregation. | A single backup does not establish a resilient control system. |
| Protocol and code | Inspect contract logic, upgrades, bridges and dependencies. | An audit is not a guarantee that software has no exploit. |
| Counterparty and rights | Verify obligations, reserve claims and enforceability. | On-chain visibility does not reveal every off-chain liability. |
1. Market and liquidity
Stress prices, spreads and executable exit size.
Watch for: Reported volume does not guarantee liquidity in stress.
2. Custody and operations
Test authorization, key recovery and asset segregation.
Watch for: A single backup does not establish a resilient control system.
3. Protocol and code
Inspect contract logic, upgrades, bridges and dependencies.
Watch for: An audit is not a guarantee that software has no exploit.
4. Counterparty and rights
Verify obligations, reserve claims and enforceability.
Watch for: On-chain visibility does not reveal every off-chain liability.
Original worked case
Three failures that need different controls
Given: A token fund hedges price exposure. One employee controls the only signing key, and assets are deposited into an upgradeable lending protocol.
01 Price exposure
The hedge may reduce a specified price sensitivity, subject to basis and funding risk.
02 Key control
Independent approvals and tested recovery address custody concentration.
03 Protocol control
Review upgrade authority, collateral rules and emergency procedures.
Answer and interpretation
The price hedge leaves custody and protocol failures unresolved. Record each exposure and its control owner separately.
Change one assumption
Moving the assets to a custodian changes the operational arrangement but introduces service-provider and contractual dependencies.
Independent teaching example with the stated assumptions. Not an official exam question, marking key or observed market trend.
Understand the method
Part 1
Describe the incident as a chain of events
Begin with what happened, where the asset was held and which actor or system could change the outcome. “Crypto risk” is too broad to diagnose a failed withdrawal. The cause could be a custodian access failure, an exchange insolvency, a network outage, a frozen issuer redemption process or a compromised key. The same visible symptom can arise from different mechanisms.
Write a short event chain: initiating shock, transmission channel, affected claim, loss or delay, and recovery route. Separate established facts from hypotheses. A price fall after an incident does not prove that market risk caused the incident; it may be a consequence of an operational or counterparty failure. This distinction guides the evidence you request next.
Part 2
Use categories that lead to different tests
Market risk concerns adverse price changes. Liquidity risk concerns the cost or inability to trade or redeem. Counterparty risk concerns another party failing to perform. Custody risk concerns control, safeguarding and recovery of assets. Protocol and smart-contract risk concern how the underlying system behaves. Legal and regulatory risk concern rights, restrictions and enforceability in the relevant jurisdiction.
Categories can overlap without becoming interchangeable. A bridge exploit can create a technical loss, trigger market repricing and make liquidity disappear. Record a primary initiating mechanism and secondary consequences instead of forcing the whole incident into one box. The objective is a useful control response, not a perfect label for its own sake.
Part 3
Match the proposed control to the actual failure
A control is only useful if it addresses the identified mechanism. Multi-person transaction approval can reduce unauthorized transfers but cannot guarantee the solvency of an exchange. A price limit can restrict market exposure but cannot repair a defective redemption right. Diversifying custodians may reduce one concentration while adding operational complexity and more interfaces to monitor.
For each control, state its owner, operating frequency and evidence of effectiveness. A policy document shows intended design; a recent access review, tested withdrawal, reconciled wallet balance or documented recovery exercise provides evidence of operation. Avoid treating an audit badge as coverage of every account, smart contract and service the investor actually uses.
Part 4
Record residual risk and escalation criteria
A completed worksheet should say what remains uncertain after the controls. Examples include dependence on a single redemption issuer, an untested recovery procedure, a concentration of signing authority or incomplete transparency over reserves. Describe the potential consequence and the condition that would cause a position limit, pause or exit review.
Prioritize by exposure and plausible impact rather than by the number of categories checked. A tiny experimental position and a portfolio’s operating-cash reserve require different tolerances for the same withdrawal delay. Revisit the map when providers, protocols, permissions or instrument rights change. A taxonomy created at onboarding can become stale even if the ticker is unchanged.
Incident diagnosis and evidence worksheet
Assets leave without authorization
- Mechanism to investigate
- Compromised signing or approval process
- Evidence / matching control
- Signing logs, role separation and recovery test
Exchange suspends withdrawals
- Mechanism to investigate
- Solvency, funding or operational failure
- Evidence / matching control
- Asset segregation, liabilities and alternate access
Token trades below promised value
- Mechanism to investigate
- Redemption, backing or market liquidity
- Evidence / matching control
- Holder rights, reserve evidence and redemption test
Smart contract pays incorrectly
- Mechanism to investigate
- Code or external-data failure
- Evidence / matching control
- Transaction trace, contract review and exposure limits
More worked practice
Original teaching cases. Use the stated assumptions; these are not official exam questions or marking keys.
A price-stable asset with inaccessible cash
Given: An institution holds a token quoted near $1 on an exchange. Withdrawals are suspended for five days. No evidence yet establishes whether the cause is insolvency or a systems incident.
- 1Record the observed fact: the institution cannot access its assets despite the quoted price.
- 2Classify immediate liquidity and counterparty or operational uncertainty; do not assert insolvency without evidence.
- 3Request account segregation, withdrawal status and recovery evidence, and update the institution’s cash forecast.
Interpretation: Price stability did not provide funding liquidity. The correct response follows the missing access to cash and the unresolved mechanism, rather than assuming a low-volatility asset is low risk in every dimension.
Check your understanding
Answer first, then open the explanation. These checks are original practice and do not generate an exam score.
1. Would a stop-loss order prevent a stolen-key transfer?
No. It targets market-price exposure, while key compromise requires access and transaction controls.
2. Why retain multiple categories for one event?
An initiating technical or operational failure can produce market and liquidity losses. The chain matters for control design.
3. What distinguishes a control description from evidence that it works?
A description states intended behaviour. Dated testing, reconciliation and review records show whether it operated for the relevant assets and accounts.
Common questions
Can diversification eliminate custody risk?
Not if all assets depend on the same compromised key or service provider. Diversify and control the actual dependency, not only token tickers.
Is a smart-contract audit enough?
No. Scope, date, upgrades, external dependencies and unresolved findings matter. Monitoring and incident procedures remain necessary.
Sources and scope
The sources below establish their stated framework or subject context. Calculations and cases are our own teaching material; these sources do not endorse them or establish complete exam coverage.
- CAIA contributor: Institutional digital asset custody (2025)
Contributor discussion of custody models and operational dependencies. Background context, not an official curriculum statement or current legal assessment.
- AIMA: Investment manager due diligence questionnaires
Industry due diligence framework. Our workpapers are original examples, not reproduced AIMA templates.
- CAIA curriculum and study tools
Official curriculum, companions and required readings for the exam year. The current page now links to 2027 materials.
- BIS / FSI: Financial stability implications of tokenisation
Tokenized financial assets and their liquidity, operational and interconnected risks. Not a legal assessment of a particular token.
- CAIA 2027 curriculum overview
Published topic categories and Emerging Topics reading titles for 2027. The overview is not the complete learning-objective list.
By MiloPrep editorial team. Updated 10 October 2026. Independent study notes, not affiliated with or endorsed by CAIA Association. How we prepare our content.
Notes
- * Study scope: Selected study concepts, not complete curriculum coverage. Match your sitting to the official exam-year materials; CAIA’s current resource page now links to 2027. ↩ Return to content