papers/lux-institutional-custody/sections/14-migration-plan.tex

\section{Migration Plan}

\label{sec:migration}
%% =====================================================================

A fund with \$8B at an incumbent custodian cannot migrate in a single
movement. The migration is structured as a 90-day staged transfer
overlapping the implementation timeline, with explicit checkpoints
and rollback paths.

\subsection{Pre-Migration Checklist}

Before any client funds move, the following must be in place:

\begin{enumerate}[nosep]
\item Cold, warm, and hot DKG ceremonies complete; transcripts
witnessed and published on M-Chain.
\item Sealed envelopes deposited at three vault jurisdictions;
chain-of-custody documented.
\item M-Chain custody ledger online with daily reconciliation
running.
\item Daily test-transactions of \$1k each on BTC and ETH executing
end-to-end through the new architecture for at least seven calendar
days, with two operator review of every test.
\item Insurance tower bound and certificate of insurance received.
\item SOC 2 Type II observation window started.
\item Notice provisions of the incumbent contract reviewed; required
notice served (typical: 30--90 days).
\end{enumerate}

\subsection{Stage 1: Pilot (Day 75--80, 1\% of AUM = \$80M)}

\begin{enumerate}[nosep]
\item Withdraw \$80M from incumbent (typically equal weight BTC and
ETH).
\item Deposit to the new \emph{warm} tier address.
\item Verify deposit on chain and on M-Chain ledger.
\item Execute one rebalance through warm tier; verify M-Chain ledger
matches chain.
\item Execute one warm-to-cold transfer; verify cold tier deposit.
\item Execute one cold-to-warm transfer; verify ceremony, time-lock,
and on-chain finality.
\end{enumerate}

The pilot exercises every signing path on real funds at a size that
is recoverable if anything goes wrong.

\subsection{Stage 2: Bulk Migration (Day 80--85, 50\% of AUM = \$4B)}

\begin{enumerate}[nosep]
\item Daily withdrawal of \$1B from incumbent to new cold-tier
address, four daily tranches.
\item Each tranche verified on chain and on M-Chain.
\item Daily reconciliation runs as normal during migration.
\item Pause-and-investigate trigger: any reconciliation discrepancy,
any signing-path delay outside SLA, any audit-log anomaly.
\end{enumerate}

\subsection{Stage 3: Final Migration (Day 85--90, remaining 49\% = \$3.92B)}

\begin{enumerate}[nosep]
\item Final tranche transfer; settle to within 2\% residual at
incumbent for tail wind-down.
\item Reduce the incumbent's authority by closing the active
withdrawal whitelists at the incumbent and revoking API keys.
\item Maintain incumbent custodial relationship for residual 2\% as
a 30-day belt-and-braces; close fully on day 120.
\end{enumerate}

\subsection{Parallel-Run Risk Controls}

For days 75--90 the fund is split between custodians. The risk
controls during parallel running:

\begin{itemize}[nosep]
\item \textbf{Daily reconciliation} runs on both sides; the sum must
match the prior-day NAV plus any P\&L.
\item \textbf{Two-custodian board attestation}: both the incumbent's
SOC report and the new architecture's interim attestation are
delivered to the fund board weekly.
\item \textbf{Withdrawal moratorium} on the incumbent for days
75--90 except the planned migration tranches.
\item \textbf{Insurance gap coverage}: temporary cap on the fund's
trading until the new architecture's insurance tower is fully bound.
\end{itemize}

\subsection{Rollback Procedure}

If at any point during the migration a critical defect is discovered
(e.g.\ a signing-path failure that cannot be explained in 24 hours),
the rollback is:

\begin{enumerate}[nosep]
\item Halt all forward migration; freeze new deposits.
\item Reverse-transfer the most recently migrated tranche back to
the incumbent.
\item Investigate root cause; remediate.
\item Resume forward migration only after a fresh witnessed
attestation that the defect is fixed.
\end{enumerate}

The rollback is exercised once on the pilot ($\geq$ \$1k) before any
bulk migration begins, to validate that the reverse path works.

\subsection{Post-Migration}

\begin{enumerate}[nosep]
\item Day 120: incumbent custodial relationship fully closed; final
asset reconciliation signed off.
\item Day 150: SOC 2 Type II observation window completes; auditor
report ordered.
\item Day 180: ISO 27001 certification expected; CCSS Level 3 audit
completes.
\item Year 1 anniversary: full audit cycle complete; cost actuals
compared to plan; threat-model review.
\end{enumerate}

\subsection{Migration Cost}

\begin{table}[h]
\centering
\small
\begin{tabular}{lr}
\toprule
\textbf{Item} & \textbf{Cost (USD)} \\
\midrule
Incumbent withdrawal fees (estimated 5 bps on \$8B) & 400{,}000 \\
On-chain transaction fees (BTC + ETH bulk movements) & 50{,}000 \\
Parallel-run insurance gap coverage & 100{,}000 \\
Migration ops surge (2 additional engineers, 90 days) & 150{,}000 \\
Legal review of incumbent contract termination & 75{,}000 \\
\textbf{Migration total} & \textbf{775{,}000} \\
\bottomrule
\end{tabular}
\caption{One-time migration costs (incremental to capex and ceremony
costs).}
\label{tab:migration-cost}
\end{table}

The migration cost amortises against the steady-state savings
relative to incumbent fees within the first year for any incumbent
custodian charging more than \$5.4M per annum on \$8B AUM. For
Anchorage Digital and Coinbase Custody at the published rate-card
levels, payback is well under a year.

%% =====================================================================