Wallet and key custody
Custodial, non-custodial or hybrid wallet models chosen against your risk appetite, with recovery and support procedures written before launch.
Industry context
Blockchain and Web3 applications in financial services
We build Web3 applications where wallets, tokens and on-chain records have to work for customers who never think about the blockchain underneath.
Web3 applications put a wallet, a token or an on-chain record in front of real customers, so the hard parts are key custody, smart contract security and what happens when a transaction cannot be reversed. We design the off-chain services, the contract upgrade path and the support process together, so the application behaves predictably for people who have never used a blockchain.
Financial institutions work under close central bank supervision, with fraud exposure and customers who expect money to move instantly. Risk, compliance and operations teams need to see how each change affects controls before it goes live, so we involve them from design onwards. The regulator differs between the UAE and Saudi Arabia, and within the UAE between Dubai, the financial free zones and federal level, so we confirm it for each market before design.
We hand over with runbooks and training, and can stay on under agreed service levels.
Alongside sector regulation, we often map delivery evidence to cross-industry baselines such as the UAE Information Assurance Regulation issued by TDRA, the NCA Essential Cybersecurity Controls in Saudi Arabia and the NIST Cybersecurity Framework, which many risk reviewers already use.
What the work covers
We design, deliver and stay until operation is stable, with evidence your procurement and risk teams can rely on.
Smart contract assurance
Contract code under version control, automated tests, review before deployment and a documented upgrade or pause mechanism.
Off-chain integration
Node and API providers, indexing and event handling that connect on-chain activity to your existing customer, payment and reporting systems.
Virtual asset licensing
The type of licence decides custody, disclosure and reporting duties. In the UAE, VARA covers Dubai, the DFSA covers DIFC, the FSRA covers ADGM and the SCA works at federal level, while the CBUAE regulates payment token services. In Saudi Arabia, related activity falls under the Capital Market Authority or SAMA, depending on its nature. We map delivery evidence to the regime that applies to each product.
Transaction monitoring
On-chain activity screened and logged, with alerts routed to the compliance team that owns each market.
Support for irreversible actions
Support scripts and escalation for lost access, failed transfers and disputes, agreed before launch.
Signs you are ready to start
A Web3 application is ready to build when the asset, the market and the custody model are decided, because each one changes the design.
- A risk or compliance sponsor has agreed to review the design before build starts.
- Legal and compliance have agreed which tokens, assets or records the application may handle in each market.
- The custody model, and who carries the key risk, has been decided.
Plan blockchain and Web3 applications in financial services
Share your current systems, compliance themes and timeline. We will return a phased plan, a staffing model and a risk register for your stakeholders to review.