Bitcoin custody your examiners will understand
A custody platform where keys are born and stay inside hardware security modules, every withdrawal needs the bank's signature, and compliance runs inside the transaction, not after it.
Custody as a banking product, not a crypto product
LedgerBridge Bitcoin Custody lets a bank hold digital assets for its customers under the same principles it applies to any other asset: segregation, dual control, auditability and the right to stop.
Unlike consumer wallets or third-party custodians, the bank is a signer in every movement of funds. LedgerBridge operates the infrastructure; the bank keeps the operational authority.
- Per-client wallets with per-client keys. No master key, no omnibus wallet.
- Bank-controlled 2-of-3 multi-signature enforced on-chain by the Bitcoin script itself.
- Keys generated in, and never exported from, FIPS 140-3 Level 3 validated hardware.
- Full compliance sequence: KYC, OFAC screening, AML rules, officer review, SAR generation.
- Three consoles: Admin, Compliance Portal and a white-label client app.
| Key | Held by | Role |
|---|---|---|
| Platform key | LedgerBridge HSM | Operational signing after compliance checks pass |
| Bank key | Bank's own HSM (sidecar) | Independent co-signature; verifies the exact transaction bytes before signing |
| Recovery key | Dual-control escrow | Business continuity only, under documented ceremony |
Any two of three keys are required. Neither LedgerBridge nor the bank can move funds alone.
Crypto custody is a permissible banking activity
OCC Interpretive Letters 1183 and 1184, issued in 2025, confirm that national banks and federal savings associations may provide crypto-asset custody and may use third parties to do so, subject to appropriate risk management. The FDIC's FIL-7-2025 states that the institutions it supervises may engage in permissible crypto-related activities without prior approval. In July 2025 the federal banking agencies issued a joint statement on crypto-asset safekeeping that explains how existing risk management principles apply.
LedgerBridge Bitcoin Custody is designed around the control standard in that statement: no party can move a customer's assets alone, and the bank is a signer in every withdrawal. Read our decision guide for community banks and the vendor due diligence questions.
The bank can always say no, and always see why
Emergency stop
A role-gated kill switch halts fund movement at five distinct points of the flow: deposit crediting, withdrawal quoting, submission, signing and broadcast.
Wallet freeze & compliance hold
Compliance officers can freeze a wallet or hold a deposit pending review. Frozen wallets cannot withdraw or sign. Every decision is attributed and logged.
Key rotation
Platform and bank keys can be rotated without downtime. Only one active encryption key exists at any time, enforced at the database level.
Append-only audit log
Operator actions, compliance decisions and signing events are recorded in an append-only trail designed for examiner review.
Self-service analytics
Per-bank, permissioned SQL analytics over your own data: balances, flows, alerts and operator activity, exportable for internal audit.
Role-based access
Customer, Operator, Compliance Officer and Administrator roles with multi-factor authentication through your existing identity provider.
Six requirements banks will not negotiate on. Neither do we.
KYC / CIP
Identity verification through the platform's provider, or reliance on the bank's own onboarding.
Sanctions screening
OFAC/SDN lists synchronized continuously; matches stop the flow automatically.
AML monitoring
Configurable rules raise alerts; officers review in the Compliance Portal.
Blockchain analytics
Address risk scoring from leading analytics providers, integrated at deposit and withdrawal.
SAR generation
FinCEN-format SARs composed from case data and stored per bank for filing by your compliance team.
Audit logging
Every decision attributable, timestamped and retained for examination.
Enterprise infrastructure, bank-grade operations
- Cloud HSM key management; keys are non-exportable and the platform refuses to run without hardware.
- Dedicated Bitcoin nodes operated by LedgerBridge; the platform validates independently rather than relying on third-party APIs.
- Multi-tenant by design: each bank has isolated data, separate signing secrets and its own read replica for reporting.
- Continuous monitoring, maintenance mode and replay-safe message queues for resilient operations.
- Independent security review of the codebase, with a dependency and vulnerability gate in every release.
Thousands of real transactions, end to end, on the live network.
Deposit, compliance hold, approval, withdrawal, bank co-signature and broadcast were exercised on Bitcoin mainnet and independently verified on public block explorers before we invited the first partner bank.
Questions your risk committee will ask
Who can move customer funds?
No single party. Every withdrawal requires two of three signatures, and one of those keys lives in the bank's own HSM. The bank verifies the exact transaction before it signs.
What happens if LedgerBridge is unavailable?
Funds are never held on LedgerBridge's balance sheet and keys are never solely under LedgerBridge's control. The recovery key, held under dual-control escrow and a documented ceremony, ensures the bank can always recover customer assets.
Is customer data protected?
Personal data is encrypted at rest with AES-256-GCM, tenants are isolated, and access is role-based with multi-factor authentication through your identity provider.
Which assets are supported?
Bitcoin is supported in production today. The custody engine is chain-agnostic by design, and additional assets are enabled per bank policy as they are added to the platform.
How does the bank stop a transaction?
Through the Compliance Portal: emergency stop, wallet freeze, or a compliance hold on a specific deposit. Each action is role-gated and recorded in the audit log.
Ready to see custody from the operator's chair?
We will walk your compliance officers through the portal on a live test bank.