Crypto custody built to a bank’s standard, before banks held crypto.

• Two verification flows. Private clients upload identity documents and a selfie. Companies add company details. Declarations are generated as PDFs, and documents are screened against AML watchlists.
• Locked-down accounts. Mandatory two-factor authentication, phone verification with one-time codes, validated IBANs and whitelisted withdrawal addresses.
• Sensible limits. A cap on a new client’s first order. The whole flow runs in English and French.

Client orders in Bitcoin and Ethereum, paid in CHF, EUR or USD, were executed on external exchanges. Bitstamp was the default, with Kraken, GDAX, Bitfinex and Coinbase integrated behind one shared interface, so a venue could be added or swapped without touching the rest.

Live prices and order status were pushed to clients in real time, with tiered fees that fell as order size grew.

Signing a transaction doesn’t finish it. After broadcast, the exchange tracked each one to final confirmation and handled the ones that stalled or were rejected, so clients’ orders and withdrawals always showed the right status.

The internal ledger had to match three outside sources at once: the blockchain, the exchanges where orders were executed, and client bank transfers. Every deposit, order, withdrawal and fee reconciles, because any difference is real money unaccounted for.

Private keys and signing could never live on a server. Every transaction and whitelist change had to be signed by an operator on a personal YubiKey, so we built a local signing layer into a desktop app for macOS and Windows.

It talks to the hardware token directly, handles PIN entry and locked tokens, and turns hardware errors like “no token inserted” into clear messages for the operator. The data being signed is encoded in a strict binary format, so every signer signs exactly the same bytes.

In custody software, the client can’t simply believe what the back end tells it. Before the app shows a whitelisted or deposit address as valid, it checks the address’s signature chain locally against known operator public keys.

If an address can’t be verified, it isn’t shown. Even a compromised or faulty back end can’t trick an operator into sending funds to an address nobody approved.

Every outgoing transaction passed validations by three independent teams before it was released. Administrative changes, from users and trading rules to limits and whitelist entries, needed a second person’s approval before taking effect.

Each role, whether initiator, validator or admin, sees only the screens it needs. Reviewers get before-and-after comparisons and every transaction’s full approval history, without slowing down day-to-day operations.