Security, data and compliance in Crypto-Asset Custody Bridge

How Crypto-Asset Custody Bridge protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

No keys or assets at Moraph

The Bridge never holds private keys, digital assets or funds. Assets and keys stay with the sub-custodian under its agreement with your bank.

Role-based access

Entering an instruction is separate from approving it, and administrators cannot do either.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, instruction, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• OCC Interpretive Letters 1170 and 1183 (crypto-asset custody by national banks)
• Interagency statement on crypto-asset safekeeping by banking organizations (2025)
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• OCC fiduciary activities of national banks (12 CFR Part 9)
• Bank Secrecy Act recordkeeping and travel rule (31 CFR 1010.410)
• OFAC sanctions regulations (31 CFR Chapter V)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for sub-custodian connection monitoring and platform administration.

Limitations

• Moraph does not hold digital assets, private keys or funds, and is not a custodian. Assets are held by the sub-custodian under its agreement with your bank.
• Whether your bank may offer digital asset custody, and on what terms, is a matter for your bank and its regulators. The Bridge supports your controls; it does not grant permission to offer the service.
• It works only with sub-custodians whose interfaces are supported; others can be added by agreement after review.
• It does not perform sanctions screening, blockchain analytics or travel rule messaging itself. It uses the results of the tools your bank already has.
• It does not execute trades or provide access to exchanges or liquidity providers.
• Staking, lending and other activities beyond safekeeping and transfer are not included.
• Reconciliation depends on the sub-custodian supplying complete and timely position and transaction data.
• It does not provide accounting or tax treatment of digital assets; your finance team determines how they are recorded.