MPC Custody Platform for a German Crypto Custodian
Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Dashboard, transactions with a quick view panel, transaction detail, approvals inbox and policies, plus a New withdrawal panel with a live policy preview. Every one of the 25 demo transactions opens its own detail page.
From 1 of Treasury for internal transfers to 3 of Treasury and 2 of Risk with a 24-hour time lock above EUR 1m, with velocity limits per vault. One-time addresses and anything else are blocked, and the initiator never counts as an approver.
Created, policy evaluated, travel rule, screening, approvals, time lock, signing, broadcast, confirmations and completed, each with the time, who or what completed it, and the reason when a transaction stopped there.
6 vaults across hot, warm and cold tiers, 14 wallets on 5 assets, 10 client users in 3 approver groups, 6 policy versions and 3 policy, whitelist and user requests awaiting an admin quorum.
Hochwarth started with a multisig setup and a hand-run process. Clients emailed signed PDF withdrawal instructions, an operations officer checked signatures against a specimen list and called the client back, and two key holders met to sign from a hardware wallet. A withdrawal took one to two working days, clients could not set their own rules, nobody could see which transactions were waiting on whom, and reconciliation was a monthly spreadsheet.
Riegel gives Hochwarth's institutional clients one console for their custody position: vaults and holdings in EUR, every transaction with its full status timeline, an approvals inbox where named approvers decide with a security key, and a versioned policy the client's own admins change by quorum. Keys stay split as MPC shares, so no single person or system can move client assets alone.
Institutional crypto custody in Germany is a licensed financial service, and every withdrawal has to satisfy the client's own controls, the travel rule, anti-money laundering checks and the custodian's key management at once, while clients now expect same-day withdrawals.
Asset managers, banks and funds want rules such as "anything over EUR 500,000 needs our CFO". The old process had one fixed path for everyone, with approvals collected by email and phone and no record of who had decided what.
Since 30 December 2024 the Transfer of Funds Regulation requires originator and beneficiary data on every transfer between CASPs, with no minimum, and proof of wallet ownership for self-hosted wallets above EUR 1,000. The GwG adds due diligence and on-chain screening of sources and destinations.
Each wallet is controlled by MPC key shares across a cloud enclave, an HSM in Hochwarth's data centre and offline cold storage. Cold vaults need an in-person signing ceremony, so a client has to see why a transaction is waiting and when it will settle.
Hochwarth moves from a KWG licence to MiCA authorisation, which asks for a register of positions per client, segregated holdings and regular statements. Insolvency protection depends on the ledger showing whose assets are whose, so reconciliation becomes a daily control.
Mapped 12 roles across client institutions and Hochwarth, 40 screens over three surfaces (18 in the client console, 5 in the mobile approver app and 17 in the internal ops console) and the data model for vaults, wallets, transactions, approvals, whitelist entries, versioned policies, travel rule messages, MPC nodes, key sets, ceremonies and an append-only, hash-chained audit log. Wrote down the rules the design follows: KWG and MiCA custody duties, the Transfer of Funds Regulation, GwG, DORA, GDPR, ISAE 3402 and proof of reserves.
Built 5 key client console screens on a production web3 dashboard kit, in light and dark mode: the dashboard with assets under custody by tier and what is waiting on you, transactions with status pills, filters and a quick view, the transaction detail with policy result and approvals by group, the approvals inbox with step-up approval, and policies with a test-a-transaction simulation. Approving updates the quorum on local state.
Integration with an MPC signing engine (such as Fireblocks, Blockdaemon Builder Vault or Dfns), HSMs, chain nodes, on-chain screening (Chainalysis, Elliptic or TRM Labs), travel rule messaging (Notabene or 21 Analytics), price feeds and FIDO2 / WebAuthn security keys. Passkey or SSO login, the audit log, and the remaining screens: vaults, whitelist, the full policy editor, travel rule, reports, administration, the mobile approver app and the internal ops console.
Rules are listed in evaluation order with what each one requires, and the first match wins. Test a transaction shows which rule an amount and destination would hit, and the New withdrawal panel previews the rule, approvals, time lock and daily velocity used before anything is submitted.
Approvals show progress per approver group, such as 3 of Treasury and 1 of Risk, with each approver's device and method. Approve and Reject appear only for eligible approvers: never the initiator, never twice, and only in a group that is still short.
Each request is its own card with the destination address and its first and last six characters highlighted, an expiry countdown of 24 hours and a type chip for withdrawals, policy changes, whitelist additions and user invites. Approving needs a security key step-up, rejecting needs a reason, and there is no bulk approve.
The status timeline says where a transaction stands and why: waiting on Risk, a 4-hour time lock, a cold ceremony batched for the next morning, or a deposit held because a self-hosted wallet above EUR 1,000 still needs ownership proof.

Built an iOS and Android self-custody wallet supporting BTC, ETH, LTC, XRP and AVAX with one-tap send, receive and swap, plus a clean activity feed - shipped from clickable AI prototype to App Store in 8 weeks.

Built a focused onboarding, recovery-phrase backup and PIN/biometric setup flow for a Japanese self-custody wallet - designed to convert first-time holders into confident self-custodians, shipped in 8 weeks.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab