Virtual Asset Custody Software for Custodians across the UAE

Who this is for: Dubai VARA-licensed custody providers building or rebuilding institutional custody propositions, ADGM FSRA-regulated institutional custodians, institutional asset managers (family offices, hedge funds, sovereign-adjacent) requiring custody wrappers over third-party custody infrastructure, and crypto-native operators extending into regulated institutional custody. Not positioned as a Hex Trust, Komainu, or Copper platform replacement - those operate proprietary in-house custody infrastructure at institutional scale with established counterparty books.

Six connected capability areas: (1) MPC and multi-sig key ceremony governance with dual or quadruple control. (2) Hot/warm/cold wallet segregation enforced at transaction-routing level. (3) VARA Custody Services Rulebook alignment with continuous evidence capture. (4) Operational resilience evidence layer across BCP, DR, incident, insurance, audit. (5) Client reporting and segregation verification. (6) Blockchain-protocol-specific integration across Bitcoin, Ethereum, major Layer 1 and Layer 2 protocols.

Hex Trust, Komainu, Copper, Fireblocks, and BitGo operate proprietary institutional custody platforms with deep engineering investment, established counterparty books, and extensive blockchain protocol support. These are mature institutional infrastructure.

Custom virtual asset custody software is designed for operators building their own VARA or FSRA-licensed proposition, for asset managers requiring a custody wrapper over third-party custody infrastructure (preserving Hex Trust or Komainu as the underlying custody authority while adding operator-specific compliance wrapper), and for crypto-native firms extending into institutional custody. The platform is designed to align with institutional counterparty expectations from day one.

Multi-party computation (MPC) distributes key material across multiple parties with threshold signing - typically m-of-n schemes like 5-of-7 or 3-of-5. No single party holds the full key; signing requires threshold cooperation. Multi-signature wallets operate natively on blockchain protocols that support them (Bitcoin, some EVM chains via contract wallets, etc).

Key ceremony events - initial key generation, shard rotation, participant changes, restoration testing - are captured with dual or quadruple control. Hardware security modules (HSMs) at FIPS 140-2 Level 3 or above provide tamper-evidence. Geographic distribution of key shards across data centres and jurisdictions. Audit trail continuous.

Institutional custody segregates assets across hot (operational liquidity for immediate settlement, typically 1-5% of AUC), warm (daily settlement buffer, typically 3-10%), and cold (long-term custody, typically 85-95%+). Each tier has distinct key management, approval workflow, and security posture.

Segregation is enforced at transaction-routing level - transfers between tiers require approval with tier-specific governance. Limits are enforced automatically. Client assets are segregated from firm assets per VARA Custody Services Rulebook and ADGM FSRA equivalents. Reconciliation between on-chain balances and internal ledger runs continuously.

VARA Custody Services Rulebook requires client asset segregation from firm assets, reconciliation procedures at defined frequency, client reporting with specified content and cadence, operational resilience evidence, and ongoing client communication. FSRA ADGM equivalents apply parallel obligations for ADGM-regulated custodians.

The platform captures rulebook-aligned evidence continuously across the operational lifecycle. VARA supervisory engagement becomes data-driven. Client reporting is generated from operational data rather than assembled per period. Segregation verification runs as automated check with continuous audit trail.

Institutional counterparty due diligence includes operational resilience evidence comparable to traditional custody. Business continuity plan with documented RTO (recovery time objective) and RPO (recovery point objective). Disaster recovery testing evidence with at least annual full-scale testing. Incident response workflow with runbook execution capture. Insurance coverage for operational risk and potentially for cryptographic custody.

Independent third-party audit (SOC 2 Type II, ISAE 3402, or equivalent) structured as evidence artifacts. Penetration testing reports. Cold storage and key ceremony audit. These are captured as integrated evidence rather than scattered across vendor reports. Counterparty due diligence becomes a structured data-sharing exercise.

Here's where custom virtual asset custody platform typically sits in a wider stack.

Institutional custody infrastructure - we sit alongside Hex Trust, Komainu, Copper, Fireblocks, BitGo, and Ledger Enterprise for the underlying custody authority. Where the operator wraps third-party custody, the partner retains custody authority and the custom layer provides the operator-specific compliance and client-facing wrapper.

Key management and HSM - we integrate with Fireblocks MPC, Copper ClearLoop, Thales Luna HSM, Utimaco HSM, and AWS CloudHSM for key management infrastructure.

Compliance and screening - we connect with Chainalysis KYT, Elliptic, TRM Labs, Merkle Science for blockchain analytics and sanctions screening at the custody boundary.

Integration approach is scoped during discovery. We don't ask you to rip and replace anything that works.

Discovery runs six to eight weeks. Working with your custody, technology, compliance, operations, and risk teams, we map current key management, wallet segregation, VARA or FSRA alignment, and operational resilience posture. Output is a detailed report covering current-state map, platform architecture, integration scope with institutional custody infrastructure, phased implementation plan, and fixed-price build proposal.

Build for a core custody platform runs sixteen to twenty-four weeks from discovery completion. Full MPC governance, wallet segregation, VARA alignment, and operational resilience rollout phases in over twelve to twenty-four months depending on blockchain protocol breadth and counterparty scope.

Pricing varies by blockchain protocol breadth, custody partner integration depth, and institutional counterparty scope. A bracket isn't published; discovery produces a fixed-price proposal with no obligation to proceed.