--- title: Institutional Custody & MPC Architecture entity: SwissChain Holding SA jurisdiction: Switzerland doc_type: infrastructure status: in_progress last_reviewed: 2026-03-09 owner: TBD evidence_level: public source_urls: [] related_docs: [] --- # DFNS Institutional Custody & Cryptographic Control Infrastructure (Regulatory & Technical Memorandum) ## I. Systemic Role within SwissChain Control Architecture Within SwissChain's control architecture, DFNS functions as the primary cryptographic execution and wallet orchestration layer for digital assets, covering the generation, protection and use of private keys across onchain operations. SwissChain deliberately externalizes key management and signing to DFNS rather than operating proprietary wallet infrastructure, preserving governance and regulatory accountability internally while delegating technical custody execution to an audited, specialist provider. In systemicrisk terms, this means that any onchain movement of client assets—whether driven by trading, treasury, staking or settlement workflows—ultimately passes through DFNS's MPCbased signing fabric, while upstream eligibility, AML and sanctions controls are determined by SwissChain's own policies and by identity/AML infrastructure such as Sumsub. This separation of functions is central to SwissChain's prudential posture. Cryptoasset custody risk is concentrated in the ability to generate, reconstruct and use private keys; DFNS's design objective is to remove any single point where a complete private key exists, while SwissChain's objective is to ensure that keys cannot be used except in accordance with boardapproved policies and regulatory constraints. By positioning DFNS as a pure walletinfrastructure and signingorchestration provider—rather than as an exchange, brokerdealer or depository—SwissChain can demonstrate to banks, listing venues and regulators that it retains full responsibility for client asset entitlements, AML and sanctions decisions, while relying on DFNS only for cryptographic correctness, policydriven execution and secure key lifecycle management. ## II. Legal Nature, Regulatory Perimeter and Market Positioning Dfns SAS is a Frenchincorporated technology company that operates a WalletasaService (WaaS) platform, providing programmable digital asset wallet infrastructure to banks, payment institutions, regulated crypto custodians, trading venues, fintechs and enterprises. DFNS does not hold client assets on its own balance sheet, does not operate a trading venue, and does not intermediate orders or provide brokerage; its business model is limited to exposing APIs and services for key management, wallet orchestration and transaction signing, which are then integrated into clients' regulated environments. This delineation is legally relevant for SwissChain: outsourcing to DFNS does not transfer regulatory obligations for safekeeping or AML/CFT, but it does place critical operational resilience, information security and cryptographic integrity within DFNS's control environment, which must therefore be treated as a critical outsourced function under applicable outsourcing guidelines. From a market standpoint, DFNS has evolved into a recognised institutional walletinfrastructure provider with both traditional financial and crypto-native clients. In its publicly disclosed 2025 review, DFNS reports USD 12.5 million in annual revenue (6.25× yearoveryear growth), USD 26 billion in digital assets processed through the platform, and 324 clients, including Circle, Broadridge, MoonPay, Vermont State Bank, ADI Foundation, Gemini, Republic and Paxos, with more than 200% yearoveryear client growth. Public materials and client casestudies also reference ABN AMRO, Fidelity, Zodia Custody, Stripe, Banca Sella and IBM among over 200 financial applications and institutions, and indicate that DFNS secures more than USD 2 billion in monthly transactions. This level of institutional adoption and transaction volume is material for SwissChain's vendorrisk narrative: it evidences that DFNS operates at a scale and maturity compatible with bank-grade and capitalmarkets use, rather than as an earlystage or retailfocused custody solution. ## III. Certification and Assurance Framework DFNS maintains a layered assurance stack comprising SOC 2 and ISO certifications that directly address institutional expectations for information security, operational resilience and cloud governance. DFNS has produced SOC 2 Type I and SOC 2 Type II assurance reports, including Deloitte-audited reports in the available evidence set, with additional renewal cycles and third-party attestations communicated by DFNS over time. From an audit perspective, SOC 2 Type II provides external assurance not only on the design but also on the operating effectiveness of DFNS's controls, which supports SwissChain's ability to place reliance on DFNS under its own financialstatement audit and regulatory reviews, subject to appropriate scoping and bridging. In August 2025 DFNS announced certification to ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018, with audits and certification performed by accredited independent bodies as disclosed in DFNS materials. ISO/IEC 27001 confirms the existence of a governed Information Security Management System, ISO/IEC 27017 extends specific controls to cloud services (including sharedresponsibility models and provider assurance), and ISO/IEC 27018 adds controls for handling personal data in the cloud aligned with GDPR expectations. DFNS explicitly notes in its public materials that these standards require clear acceptableuse policies, defined securecoding rules, explicit frameworks for cloudservice selection and configuration, and forensic readiness (including preservation of logs and chainofcustody for evidence), all of which go beyond typical SOC 2 testing and are directly relevant to regulator and auditor requests during incident investigations. DFNS further communicates plans to pursue CCSS Level 3 (CryptoCurrency Security Standard) to extend assurance specifically to cryptoasset key management, though this appears as a roadmap item rather than a completed certification and should be recorded as such in SwissChain's vendor files. Beyond formal certifications, DFNS's public security documentation indicates continuous audits and penetration testing of its platform, including its MPC libraries, authentication services and infrastructure, by independent firms such as Kudelski Security and Halborn. Kudelski Security, a Swiss cybersecurity and cryptography firm, has conducted independent cryptographic review of DFNS's threshold ECDSA implementation, distributed keygeneration logic, signature integrity and associated libraries, which is particularly relevant for SwissChain's Swiss positioning and for demonstrating to domestic regulators and investors that the critical MPC layer has undergone local, recognised scrutiny. Together, this assurance stack allows SwissChain to demonstrate that the cryptographic custody provider operates under a governance, security and audit framework consistent with expectations for critical financial infrastructure. ## IV. Core Technical Architecture and Control Surface DFNS operates an MPCbased wallet infrastructure where private keys do not exist as a single secret at any point in time and are never reconstructed within a single computational domain. Instead, key material is fragmented into multiple cryptographic shares held and processed by independent components; signing is performed via threshold multiparty computation, where each participant produces partial signatures that are combined into a valid ECDSA or other supported signature without any participant ever seeing the full private key. This "key nonreconstruction" principle materially alters the custody risk topology compared to traditional hotwallet or HSM designs where compromise of a single keystore can lead to unilateral asset transfer; in DFNS's model, an attacker must compromise multiple independent components and satisfy policydriven authorization conditions to effect a transaction. The DFNS platform is exposed as an APIfirst wallet orchestration service capable of deploying millions of multichain wallets, with current public materials indicating support for at least 22 blockchains integrated in 2025 and over 1,000 tokens, with sustained processing of more than USD 2 billion in monthly transaction value. According to publicly available partner directories and documentation, DFNS supports more than 30 public blockchains including Ethereum, Bitcoin, Solana, and other major networks, as well as alternative institutional networks such as Canton, with support for various signature schemes (ECDSA, EdDSA, Schnorr, Stark). Wallets are managed under a single key and policy framework, with finegrained entitlements controlling who can create wallets, approve transactions, modify policies or access logs. DFNS's Wallet Entitlement Management (WAM) and Key Deployment Service (KDS) concepts allow institutions to manage multiple keys and policies across business lines and entities from a central control plane, which is directly relevant for a holding structure such as SwissChain operating multiple regulated entities and products. Enterprise integration extends to hardwarebacked and confidentialcomputing environments. DFNS maintains an official partnership with IBM and integrates with IBM Crypto Express HSMs via PKCS#11, enabling banks and market infrastructures to anchor private keys in FIPS 1402 Level 4 hardware within existing IBM compliance perimeters while using DFNS APIs as the orchestration layer. DFNS is also integrating with IBM Hyper Protect Virtual Servers (HPVS) and Offline Signing Orchestrator (OSO), enabling hybrid architectures where different asset classes or risk tiers can be managed across segmented compute environments (onpremises, cloud or hybrid) with differentiated latency and security characteristics. In parallel, DFNS integrates with Thales Luna HSMs to support sovereign, hardwareanchored key storage and to reduce dependence on generalpurpose cloud providers. Together, these integrations expand DFNS's control surface beyond pure cloud MPC into a composable architecture compatible with bank and CSDgrade infrastructure norms. ## V. Risk Mitigation Mechanics and Residual Risk From SwissChain's perspective, DFNS mitigates several core custody risks. First, the MPC, keynonreconstruction architecture eliminates the classical singlekey compromise scenario: there is no single file, device or enclave whose loss or breach directly exposes all controlled assets. Threshold signing requirements, combined with rolebased access controls and multiparty approvals at the businesslogic layer, reduce insider risk by preventing unilateral signing by a single operator or engineer, provided SwissChain configures policies consistent with its segregationofduties framework. Second, DFNS's continuous auditing, penetration testing and independent cryptographic reviews reduce the probability of undetected vulnerabilities in the signing layer, which is a key concern for supervisors given the irreversibility of onchain transactions. Third, the integration with HSMs (IBM Crypto Express, Thales Luna) and confidentialcomputing environments (HPVS) allows SwissChain to situate keyholding components within jurisdictions and infrastructure perimeters that align with its regulatory obligations and risk appetite. In markets where HSMbased key storage is legally required—such as Singapore, South Korea, Japan, Turkey, Hong Kong and the UAE—DFNS's HSM integration helps ensure that SwissChain can comply with local custody requirements while preserving a unified wallet orchestration layer. For SwissChain's Swiss and EU entities, the ability to deploy DFNS components in specific data centres and to anchor keys in hardware under its chosen jurisdiction reduces exposure to extraterritorial cloudprovider risk and supports compliance with local expectations around operational resilience and data/control localization. Residual risk arises chiefly from dependency and complexity. By centralizing wallet orchestration in DFNS, SwissChain becomes reliant on DFNS's availability, changemanagement discipline and security governance; operational outages, keymanagement defects or misconfigurations at DFNS could have immediate impact on SwissChain's ability to process client transactions or recover from incidents. MPC architectures also introduce systemic risk if parameters, thresholds or recovery mechanisms are misset: for example, an incorrectly configured threshold or sharemanagement process could render assets inaccessible or reduce the effective security margin if too many shares are held within correlated environments. Moreover, while DFNS's ISO and SOC 2 attestations provide highlevel assurance, detailed technical configurations, incident metrics and RTO/RPO values are not fully disclosed publicly and must therefore be obtained and reviewed under NDA as part of SwissChain's vendorrisk governance. ## VI. Integration with SwissChain Stack and Control Flows In SwissChain's target operating model, DFNS is integrated via API as the authoritative wallet and signing layer across custody, treasury and onchain product operations. SwissChain's internal systems—core ledgers, trading engines, settlement services and compliance platforms—do not handle raw private keys; instead, they submit intentlevel instructions (e.g. "transfer X units of asset Y from wallet A to wallet B") to DFNS, together with policyrelevant metadata such as user identity, risk scores, Travel Rule data and AML flags originating from upstream systems like Sumsub. DFNS then enforces technical policies on whether a transaction may proceed, which approvals or multifactor authorizations are required, and which keys and shares should participate in the signing process, before returning signed transactions for broadcast. This integration enables a strong coupling between SwissChain's identity/AML controls and its custody execution. For example, SwissChain can configure DFNS policies so that transfers to external wallets are permitted only if the originator and beneficiary have been verified, the address or VASP has passed risk thresholds from blockchainanalytics and Travel Rule checks, and any applicable sanctions filters have cleared; otherwise, DFNS will not orchestrate the signature even if an internal system attempts to initiate it. Similarly, highvalue or highrisk transfers can be routed through offline or OSObased signing flows with stricter approvals, while lowrisk internal rebalancing can use faster online paths, all under the same DFNS control plane. For SwissChain, this means that its written policies on riskbased segregation of assets, withdrawal controls, and escalation thresholds can be operationalised as technical constraints in DFNS rather than as purely procedural guidance. ## VII. Auditability, Supervisory Defensibility and Strategic Implications DFNS's architecture and assurance framework significantly enhance the auditability and supervisory defensibility of SwissChain's custody model. The platform maintains unified, searchable audit logs across wallets, transactions, policy changes and authorization events, providing timestamped evidence of who initiated, approved and executed each onchain operation, as well as how policies and entitlements have evolved over time. ISO 27001/27017/27018 requirements for forensic readiness and log preservation, combined with SOC 2 Type II testing and external penetrationtesting by firms such as Kudelski and Halborn, mean that SwissChain can supply external auditors and regulators with structured evidence that custody controls are both designed and operated in line with recognised standards. The existence of a Swissbased cryptographic review (Kudelski) is particularly useful when engaging with Swiss authorities and institutional investors who expect local technical scrutiny of key infrastructure. Strategically, using DFNS as the custody infrastructure provider allows SwissChain to present a credible prudential narrative: that it has chosen to externalise one of the highestimpact operational risk domains—private key management—to a specialist provider with independently verified controls, while retaining full governance, compliance and supervisory accountability. The publicly reported metrics—USD 26 billion processed in 2025, 324 institutional clients with more than 200% yearoveryear growth, 22 integrated blockchains, over USD 2 billion secured in monthly transactions, and partnerships with IBM and Thales—support the argument that DFNS is not an experimental or retailoriented wallet, but a piece of emerging financialmarket infrastructure designed to meet institutional standards. At the same time, SwissChain's vendorrisk framework must explicitly recognise DFNS as a critical outsourced function, with documented SLAs, independent review of SOC and ISO reports, periodic security and resilience assessments, and a credible exit and migration strategy to avoid structural dependence. Managed in this way, DFNS can be positioned to bank boards, listing committees and regulators as a deliberate, riskreducing design choice that materially strengthens SwissChain's custody posture and overall systemicrisk profile.