Hold and sign with the custodian and controls you choose

Your clients deposit and withdraw through a gateway of their own, and your custody team closes each custody day against the chain. A bank that takes client coins, such as a stablecoin, into custody needs one deposit point per client, withdrawals that wait for screening and approval, and a daily book it can sign. 3.2 adds that gateway and those books, with embedded wallets, Utila and weighted multisig beside the custody you already run.

Before and after#

Before 3.2: A custodian that holds client coins on chain runs deposits, payout addresses and withdrawal approvals in one system and its books in another. Each morning someone rebuilds the previous day's position from wallet exports and checks it against the chain by hand, and a client who wants to hold their own key needs a wallet the platform does not know.

With 3.2: each client gets a gateway on each network that screens deposits, mints custody receipts into the client's own wallet and pays withdrawals in order. The platform reconciles every closed day from the custody journal against the chain, keeps each run as a numbered version, and records the maker who signed it, and the checker when the organisation has turned on Custody operations approval.

A flag that freezes a client whose claim lapsed#

When a compliance claim a gateway's client must hold is revoked or expires, the client is flagged: its open deposits and withdrawals freeze, its payout addresses are suspended, and no move that pays or credits the client runs until the flag clears. The provider issuing the claim again clears the flag on its own, and a screener clears reviewed flags from the gateway's client-flag panel.

Sign with your custodian, an embedded wallet or both#

An organisation can offer managed and self-custody signing side by side. Utila joins DFNS, Fireblocks, Luna HSM, Ripple Custody and the platform key store as a managed provider. Investors can hold a self-custody wallet in the Investor portal through Privy or a browser wallet, and Console members can also use a Dynamic embedded wallet. Each managed provider declares how it signs on each network, and DALP refuses a custody setup on a network where the provider cannot sign. One participant can hold several custody accounts across providers, such as a treasury desk on the bank's vault and a board member on their own wallet, and picks the primary account for each network.

An Organisation owner adds a Privy configuration with the Privy application ID. An investor signs in to the Investor portal, Privy creates the wallet, and the wallet appears as a custody account on the investor's wallets tab. The investor signs each transfer in Privy, and when the organisation's paymaster pays gas for the investor's smart wallet, the investor needs no native coin.

A custody change always creates a new account and never moves an existing key. DALP holds no key for a self-custody wallet, so Privy or Dynamic secures it for the holder. Both run outside the deployment, as services the organisation sets up with its own application ID. The platform key store keeps keys inside the deployment, so on an instance SettleMint operates, SettleMint runs that store, and an institution whose keys must stay with it chooses a custody provider instead.

Require a second signer or a named checker before a wallet moves#

A participant account can require several signers and give each seat a weight. The creator drafts the seats, invites the signers and deploys the wallet once, and the wallet then works as a co-signing queue. For a single-key wallet whose custodian has no approval step of its own, the platform adds the wallet checker: the wallet's owner names a second member of the organisation, and every transaction from that wallet waits until that person approves it.

A fund's treasurer creates its treasury wallet with a threshold of three, with the treasurer's seat at weight two and two analysts at weight one. The treasurer and one analyst can move funds, and two analysts together cannot. On a key wallet held in the platform key store, the wallet's owner names the head of operations as checker, with a wallet verification step. Each transfer from that wallet then waits in the checker's Actions inbox until the checker decides, and the audit trail names both people.

While a threshold or a checker stands, one person cannot move the wallet alone through DALP, whichever custody it uses. Naming, replacing or removing a checker needs the owner's wallet verification, so an API key cannot remove the control, and the audit trail records the change. The wallet's owner can remove a checker alone, and co-signatures and checker decisions expire on one deadline the deployment sets.

Take client deposits and pay withdrawals through one gateway per network#

The custody gateway gives each client one deposit and withdrawal point on each network. Against each coin it receives, it mints custody receipts, ordinary DALP assets that stand for those coins, into the client's own wallet. A gateway manager approves the payout addresses each client may use. Two organisation service wallets run the daily steps. The screener acts on the verdicts of the screening providers the organisation links to the gateway: a clear from every provider clears the record, and an unclear answer opens a review for a person. A gateway set to screen by hand waits for a person who holds the screener role. The keeper reports plain transfers and pays waiting withdrawals.

A client opens the Investor portal's Deposit dialog, which shows its gateway address as a QR code, and sends a stablecoin to it. Deposits wait in quarantine by default until the screener clears them, and a cleared deposit mints custody receipts into the client's wallet. When the client asks to withdraw, it names an approved payout address, and the platform moves the client's receipts into the gateway's escrow at once. A request at or over the instant limit, a withdrawal amount the gateway managers set, also waits for a gateway manager's approval, which a second gateway manager confirms unless a gateway permission manager changes that count. Once it is cleared and approved, the keeper pays waiting requests in the order they became payable, each in full or not at all. When the funding at hand cannot cover them, the platform records an instruction to the custodian for the missing amount.

An operator sets the gateway up in the Console under “Asset lifecycle”, “Custody gateway”: enable coins, create profiles and name the keeper and screener, create a gateway for each client and clear, freeze, refuse, return or recover the records that wait. An integrator follows a deposit or a withdrawal through the custody gateway API, and Deposit and withdrawal stages lists every stage, who moves it and its time limit.

A Console user deposits and withdraws through the same dialogs on Portfolio, and proves withdrawal wallets on Personal > Withdrawal destinations. Withdraw from your gateway →

The trading venue and the custody gateway share one escrow design instead of each building its own vault. Free units leave only to their owner, and only the contract that controls the escrow can lock or pay them out, with two exceptions: a holder of the token's custodian role can force free and locked units out of an escrow, and a lost wallet's free units go to its recovered wallet. Every movement keeps the escrow's books equal to its free and locked units, so the books never exceed what it holds. XvP settlement keeps its own escrow.

Every 5 minutes the platform compares each receipt's supply with the coins held at the organisation's custody addresses, and a difference that persists for two hours opens a critical case.

Close each custody day against the chain in a versioned report#

Once a day passes the cutoff the deployment sets, the platform reconciles it. It rolls each wallet's book from opening to closing, checks the closing against the chain, and checks that every venue trade delivered the legs it promised. Each run is stored as a numbered version with the chain evidence it read, and a difference opens a break that carries its age until someone resolves it. For custodial withdrawals, an owner also sets a Withdrawal fees schedule per asset: a flat amount, basis points of the withdrawal, or the network cost passed through with a margin. The client sees the custody fee and the network fee as two separate amounts.

An Organisation owner opens “Daily reconciliation”, picks the previous day and selects Run reconciliation. The report shows one venue trade whose cash leg never arrived and opens a break for it. The owner assigns the break and selects “Sign for checker approval” on the latest version. With Custody operations approval turned on, a second owner approves it from the Actions inbox. The version then reads “Locked and attested”. A rerun the next morning adds version 2 and leaves the signed version and its evidence untouched, and the “Download CSV” file of each version stays the same.

An auditor can see what the platform reported for a given day and the chain history it read to get there. A balance the chain cannot answer stays unavailable with its reason and is never shown as zero. The second signature is asked only once an organisation owner or a platform administrator turns on Custody operations under Approvals, and on an instance SettleMint operates, a platform administrator may be SettleMint staff. A run needs the deployment's cutoff to be set.

Decide who pays gas, and hold a write until it is funded#

An organisation picks plain wallets or smart accounts on each network. A plain wallet pays its own gas, or an organisation relayer submits its signed requests and pays for them. A smart account can use a paymaster backed by an organisation reserve. Funding requests follow the network's live fee quote instead of a fixed amount.

An Asset manager sends a transfer while the relayer is short of gas. The chain refuses it, and the platform pauses the transfer instead of failing it. It records one funding requirement that names the wallet and the amount, and the Transaction funding page shows where to send the top-up. Once the top-up lands, every write that waited on that requirement continues. The funding request shows the balance the wallet held when the chain refused, and an open funding dialog takes each new balance in place.

A write still waiting when the network's funding window closes, 30 minutes by default, fails with the gas required error.

On a network with a fee policy, the maximum fee of a Ripple Custody order now uses the fee cap with the tip at the policy's ceiling, so Ripple no longer holds a write on fees only because its own price is above the quoted fee.

Upgrading#

Embedded wallets, multisig, the custody gateway and the custody books are available after the upgrade. Before it, the operator decides and prepares these:

• Utila and Ripple Custody. Both stay off for new provider configurations until the operator enables them, as Utila setup describes, and existing Ripple Custody configurations keep signing.
• Ripple policies. 3.2 names operations differently in the intents it files with Ripple, so update your Ripple policies before the upgrade.
• Fireblocks. Requests sign as a typed message or a contract call, raw signing is refused unless the operator turns it back on, and new vaults carry a tag your policy rules match, as Update Fireblocks settings describes.
• Custody census. The migration records which custodian holds each existing wallet and stops if it cannot prove one. Prepare the custody census says what to set when the legacy signer database still exists.
• Daily cutoff. The daily reconciliation runs only once the operator sets the deployment's daily cutoff time and time zone, as Run the daily custody reconciliation describes.
• Custody operations approval. It starts off in every organisation, and an organisation owner or a platform administrator turns it on under “Approvals” in the General settings.

Why it matters#

• Banks: managed keys stay with the custodian you choose, or in the platform key store, which SettleMint runs on an instance it operates, and the custody day closes with a versioned report, which a second person signs once you turn on Custody operations approval.
• Exchanges, CSDs and market infrastructures: venue trades and the custody gateway settle through one escrow design, and the daily report checks every delivered leg.
• Regulators: client coins sit against receipts in each client's own wallet, and a reserve check raises a case when supply and holdings drift apart.
• Partners: each supported custody provider signs through the same path, so a gateway or a wallet works the same whichever provider signs.

Next steps#

• Run the daily custody reconciliation →
• Understand the custody gateway →
• Understand custody providers →