Who checked the people who moved FTX’s money

The week

In the week of November 7, 2022, FTX, one of the largest cryptocurrency exchanges, collapsed. A news report on November 2 had raised questions about the balance sheet of Alameda Research, a trading firm owned by FTX’s founder. On November 6, the chief executive of rival exchange Binance said it would sell its holdings of FTX’s token. Customers rushed to withdraw, and FTX stopped processing withdrawals. On November 8 Binance announced a nonbinding deal to acquire FTX, then abandoned it the next day after reviewing the company. On November 11, FTX and about 130 affiliated companies filed for Chapter 11 bankruptcy and the founder resigned. The new chief executive, a veteran restructuring specialist, soon told the court he had found an extraordinary absence of basic corporate controls and reliable records.

FTX turned out to be a fraud, as later proceedings established. It was also a failure of diligence by sophisticated parties. Venture investors, banks, payment partners and sponsors had all done business with it. Most had examined growth, valuation and market position. Few appear to have tested governance: whether anyone other than the founder could stop money from moving, and whether customer funds were where customers believed.

Banks, credit unions and other financial institutions meet fast-growing, founder-led counterparties all the time, as depositors, borrowers, fintech partners and vendors. Their diligence usually starts with financial statements. FTX showed that the statements are only as reliable as the structure that produces them. Three questions about that structure cover most of what failed. Who can move the money? Who checks them? And whose money is it?

Who can move the money

In a well-run company, authority to move funds is divided. Payments above set amounts need two approvers. The people who initiate payments cannot also approve them or reconcile the accounts. Access to wallets, bank accounts and payment systems is limited, logged and reviewed. FTX’s court filings described the opposite: a few insiders with broad control, and spending approved by informal message.

Diligence can test this directly. Ask for the delegation of authority and the payment approval policy. Ask who holds administrative access to treasury systems and crypto wallets, and how that access is reviewed. Ask for evidence, such as a sample of large payments with their approvals. A company that cannot produce these within a few days is telling the bank something important. The answers belong in the relationship file next to the financials, and they should be refreshed as the company grows, since controls that suited fifty employees rarely suit five hundred.

Crypto businesses add a specific item. Control of digital assets rests on private keys, and whoever holds them can move the assets with no bank in the middle to stop a payment. The new management later told the court that FTX had stored keys with little protection. Diligence on a crypto counterparty should ask how keys are generated, stored and split among people, and whether any single person can move funds alone.

Who checks them

The second question is oversight. A board with independent members, an audit committee, an internal audit function and an external auditor with relevant experience are the usual checks. FTX had no functioning board in the ordinary sense. Its financial statements had been audited, but by firms with little profile in auditing complex financial businesses.

For a counterparty, the practical tests are simple. Who sits on the board, and how many are independent of the founder? Does an audit committee meet, and does it see internal audit reports? Who is the external auditor, and is that firm credible for a business of this size and complexity? Has the company had a recent independent review of its controls, such as a service organization controls report? A bank need not demand public-company governance from a startup. It should calibrate its exposure to how much checking actually exists.

The same questions apply to vendors. Third-party risk programs ask detailed information security questions and look at financial health. Governance questions, especially for young, fast-growing or founder-controlled suppliers, deserve equal weight.

Whose money it is

The third question is the one that mattered most to FTX’s customers. Customer assets were not held separately from company and affiliate funds, and money moved between the exchange and the founder’s trading firm. When withdrawals surged, the assets were not there.

For a bank, this question arises whenever a counterparty holds other people’s money: a payments company, a fintech program manager, a crypto platform, a broker. The bank should know how customer funds are held, in which accounts and under what legal arrangements, and how the counterparty reconciles them. Where the bank itself holds those accounts, it has a direct view. It can see whether balances in accounts labeled for customers move to affiliates or are used for operations.

Reconciliation is the weak point even without fraud. In 2024 the collapse of Synapse, a middleware firm that kept the ledgers for fintech programs at several partner banks, left end users unable to reach their money while the records were untangled. A bank that holds pooled customer accounts for a partner should be able to reconcile them to individual customers on its own, not only through the partner’s systems.

Deposit concentration is the bank’s own version of this risk. Several banks had built large deposit bases from crypto firms. Those deposits were cheap and growing, but correlated and flighty, since many depositors would react to the same news at once. Measuring deposits by sector, stress testing correlated outflows and holding liquidity accordingly turns that risk from a surprise into a priced choice.

Boards of financial institutions are part of the answer. They approve strategies that bring in concentrated deposits and new partners. Reporting that shows the governance quality of major counterparties, alongside sector concentration, gives directors something to challenge before the next collapse rather than after.

With hindsight

FTX’s founder was convicted of fraud and conspiracy in November 2023 and sentenced in March 2024 to twenty-five years in prison. The bankruptcy estate recovered enough to begin repaying customers in 2025, based on the dollar value of their claims at the time of the collapse. The banking consequences came sooner. In March 2023 Silvergate Bank, which had served many crypto firms, announced it would wind down, and regulators closed Signature Bank, which also held large crypto-related deposits, in the same week Silicon Valley Bank failed. Supervisors then pressed harder on deposit concentration and liquidity. From 2025, with federal stablecoin legislation and a more permissive stance from bank regulators, banks have re-entered digital asset businesses. The three governance questions remain the cheapest diligence a bank can do on any fast-growing counterparty, crypto or not.