Separate control

No single employee, credential or system should initiate and complete an asset movement.

Protect the key lifecycle

Generation, storage, backup, rotation, signing and destruction require documented controls.

Reconcile and recover

On-chain holdings, custody records and the customer ledger should be reconciled regularly.