for banks and credit unions
Digital-asset custody, run for you and controlled by your people.
Metal Custody is a managed custody service. Metallicus runs the platform. Your staff approve and sign every transfer on their phones. Each key is split between your team's phones and a Metallicus co-signer in secure hardware, so neither side can move assets alone.
Running end to end on the Bitcoin and Ethereum test networks.
use cases
Three ways institutions put it to work.
Institutional wallets
Settlement and operating vaults with separate requesters, approvers and signers, and a record of every step.
- Owner
- Treasury and finance
- Control
- No one person can send
Assets members and customers ask about
Hold Bitcoin and Ethereum for members or customers, where your charter and regulators permit it, instead of sending them elsewhere.
- Owner
- Digital-asset operations
- Control
- Approval before every send
Learn on test networks first
A testnet workspace with your own team, phones and vaults, so staff and examiners can see every step before real assets are involved.
- Owner
- Innovation and risk
- Control
- Nothing of value at stake
Coming from the Stablecoin Pilot? The pilot requires no custody of digital assets. Metal Custody is the step when your institution starts holding digital assets.
shared control
No single party can move your assets.
When a bank safekeeps a crypto-asset, the Federal Reserve, FDIC and OCC describe control as being able to show that no other party, including the customer, can unilaterally transfer it (July 2025 statement). The statement adds no new requirement, and it does not apply to credit unions.
In Metal Custody, a transfer needs a governance admin's approval, then one of your team's phones and the Metallicus co-signer to sign it. Neither Metallicus nor any one of your staff can complete it alone. Whether your charter permits a given activity is for your counsel and regulators: NCUA currently does not authorize federal credit unions to custody digital assets, and state-chartered authority depends on state law.
how a transfer works
Requested, approved, then signed on a phone.
- 01
Requested
An admin enters the recipient and amount. Metal Custody builds the transaction from the network, fees included.
- 02
Approved
A governance admin approves it in the portal. Approving and signing are separate steps.
- 03
Signed and sent
Your phone shows the recipient, amount and fee. The phone and the co-signer each check the exact transaction, sign it together, and Metal Custody sends and tracks it.
security model
Your phones and our co-signer, each holding part of the key.
Neither side signs alone
Keys are generated jointly by your team's phones and the co-signer. No complete private key is ever assembled, and neither the phones nor the co-signer can sign without the other.
Co-signer in secure hardware
The co-signer runs in an attested AWS Nitro Enclave or Azure confidential container. Its key shares are sealed so only the approved software can use them.
Every signer checks the transaction
Phones and the co-signer recompute exactly what they are asked to sign. A changed recipient, amount or fee is refused.
Limits the co-signer enforces
The co-signer checks its own per-transfer limits, and a fee cap on Bitcoin, whatever the approvals.
A key for every vault asset
Each deposit address gets its own key, created in a ceremony every phone approves. Nothing is derived from a master key.
Deposits checked twice
A deposit counts only once it has enough confirmations and a second, independent network provider reports the same transfer.
Threshold signatures (FROST for Bitcoin Taproot, CGGMP21 for Ethereum) produce ordinary transactions on each network: no smart contracts or on-chain multisig to review.
who does what
We run the platform. Your people hold the controls.
- The portal, database and co-signer
- Network monitoring and deposit tracking
- Updates, backups and uptime
- The iOS and Android signing app
- Invites staff and sets their roles
- Approves transfers in the portal
- Signs on phones and keeps their backups
- Your BSA/AML and OFAC programs
No servers, hardware security modules or blockchain specialists to hire.
pilot to production
From a testnet transfer to live custody.
- 01
Walkthrough
A transfer approved and signed on a phone, on a test network, for your leadership and BSA officer.
- 02
Testnet workspace
Your own team, phones, vaults and approvals, with nothing of value at stake.
- 03
Security and compliance review
Charter and legal review, independent testing, third-party risk, BSA/AML and OFAC.
- 04
Mainnet
A new workspace on the main networks, keys created on your team's phones, and operating procedures in place.
networks and assets
The assets members already ask you to hold.
Each workspace is either mainnet or testnet, so staff can practice on test networks with the same vaults, approvals and phones.
- BitcoinDeposits and sending
- EthereumDeposits and sending
Running today on the Bitcoin and Ethereum test networks.
faq
Questions before custody rollout.
Can Metallicus move our assets?
No. The co-signer holds part of each key in secure hardware, but it cannot sign without one of your team's phones, and a phone signs only when its holder checks the transfer and approves it.
Can one of our staff move assets alone?
No. A phone cannot sign without the co-signer, and a transfer is sent to be signed only after a governance admin approves it in the portal.
Does our charter allow this?
This site doesn't decide that; your counsel and regulators do. NCUA currently does not authorize federal credit unions to custody digital assets, and state-chartered authority depends on state law. The Stablecoin Pilot is a path that requires no custody.
What would our staff need?
Phones, iPhone or Android, and the people who request, approve and sign. Metallicus runs everything else.
See a transfer approved and signed on a phone.
A 30-minute walkthrough of a testnet transfer, what a pilot would look like at your institution, and a diligence checklist for your team.