Blockchain & digital asset security
The business wants to move on digital assets, and there is no internal standard that says what secure enough means.
Digital assets fail differently from everything else in a bank. Settlement is irreversible, key compromise is usually terminal, and control frameworks designed for traditional systems do not map cleanly onto custody.
The standard comes first
I have developed and implemented an institutional blockchain security standard establishing governance requirements for responsible adoption. Having that in place before the first product decision keeps the conversation focused on architecture rather than appetite.
Custody
The questions that matter are unglamorous. How keys are generated and by whom. What quorum is needed to sign. How recovery works when someone leaves. What an auditor can be shown. What happens on the worst day. Most custody risk turns out to be operational rather than cryptographic.
Translating for the risk committee
A large part of this work is making the risk legible to people who will never read a consensus specification but are accountable for the decision.