Some interesting points. Not all of them are applicable to the people offering services. Some comments/observations:
1: Having higher liquid reserves can be useful, but at a 20-30% level would leave small (by customer number) or poorly diversified operations exposed to contingent events. Also, the short-term asset market is not as liquid as many people would like.
Not sure what sort of event would be made worse by having extra reserve cash sitting around. Thinking about it, though, the 1-month term for "current debts" is probably a good enough approximation for "short term".
2: Tracking maturities in a "point in time" system is not practical and some CD issuers manage this internally, but not visibly. It is a cash-flow management issues and relates to solvency (paying debts as they fall due).
Cash flow is a pretty fundamental part of credit analysis :\. It doesn't really need to be tracked exactly, just to make certain that loan/asset terms have similar (or greater) liquidity as the deposit terms.
3: Surplus or net assets - covered. Should it be greater than 100% is debatable - that goes to risk profile and the nature of the business.
The rule of thumb for non-financial businesses is 1:5 (20% debt) debt/asset ratio or lower preferred, and 1:3 (33%) is running on bankruptcy. For a financial business, higher ratios are acceptable, but the considerations are different. Frankly, if a business chooses a higher risk model, they probably should not have as high of a credit score, and higher leverage means lower ability to repay principle in the event of some unexpected adversity. It does depend on the nature of the business, though, since a mutual fund would have very different considerations (and expected higher leverage) than a more money-market oriented "bank".
There's also incentive to consider, ie a mutual fund owner who charges clients even when he makes a loss does not deserve a high rating.
4: If I wanted to look at security, I'd also look at the kind of websites and other things people do, but there are some clever thieves out there. That is part of the due diligence anyone should do before investing. That might also assume coins are sitting idle which is unlikely.
I was thinking more along the lines of the recent forum hack whereby the hacker(s) gained access to other people's accounts and then made withdrawal request PMs to be delivered to a hostile address (client rather than server side compromise). On the other hand, security is probably beyond the scope of credit ratings anyway.
