trust and compliance
For compliance, risk and exam teams.
What Metal Custody does, what it doesn't, who is responsible for each control, and where it stands today. Written so your third-party risk review can start from facts rather than a sales deck.
at a glance
Shared control, by design.
No single party can sign
Each key is split between your team's phones and the Metallicus co-signer. Neither can sign without the other, and no complete private key is ever assembled.
Co-signer in attested hardware
The co-signer runs in an AWS Nitro Enclave or Azure confidential container. Its key shares are released only to the approved software, verified by the cloud's attestation service.
Approval before signing
A governance admin approves each transfer in the portal before any phone is asked to sign, and the co-signer enforces its own per-transfer limits and a Bitcoin fee cap.
Every signer checks the payload
Phones and the co-signer rebuild the exact transaction they are asked to sign from the details shown, and refuse any mismatch.
Separate roles
Workspace roles separate who can request, approve and sign, and team changes need the workspace's governance quorum.
A record of every step
Requests, approvals, key ceremonies and transfers are recorded with who did what and when, visible to your team in the portal.
regulatory alignment
How it relates to the guidance you're examined against.
Metal Custody doesn't make an activity permissible for your charter. Your counsel and regulators decide that.
| Framework | How Metal Custody relates |
|---|---|
| Fed, FDIC and OCC statement on crypto-asset safekeeping (July 2025) | No single party, including Metallicus, can transfer assets alone; key generation, approval and transfer are recorded. |
| NCUA letters 21-CU-16 and 22-CU-07 | Federal credit unions aren't currently authorized to custody digital assets; state-chartered authority depends on state law. |
| Interagency third-party risk guidance (2023) | Metallicus operates the service, so it is a third-party relationship: we'll support your due diligence, and the shared-responsibility table below is the starting point. |
| BSA/AML, OFAC and the Travel Rule | Your programs remain yours. |
current status
Where it stands, stated plainly.
| Item | Status | Detail |
|---|---|---|
| Test networks | Running | Bitcoin and Ethereum deposits and transfers, end to end on public test networks, signed by phones and the co-signer. |
| Co-signer in secure hardware | Tested | Attested runs in an AWS Nitro Enclave and an Azure confidential container, with key shares sealed to the approved software, in September 2026. |
| SOC 2 | Company level | Metallicus completed a company-level SOC 2 Type I in August 2026: a point-in-time review of control design, not an opinion on Metal Custody. |
shared responsibility
Who does what.
| Area | Your institution | Metallicus |
|---|---|---|
| Keys | Staff phones hold their shares and backups | The co-signer holds its shares in secure hardware |
| Approvals and roles | Chooses people, roles and approvers | Enforces them in the portal and co-signer |
| Servers and operations | Oversight | Runs the portal, database, co-signer, monitoring and updates |
| Software security | Reviews our evidence | Secure development, fixes, advisories |
| Charter and permissibility | Counsel and regulators decide | Supplies facts for the analysis |
Talk to us before your review starts.
We'll walk your compliance, risk and technology teams through the controls and the open items.