CLIENT: Hochwarth Verwahrung🇩🇪Germany

Riegel - Institutional MPC Custody Platform with Quorum Approvals and Client Policies

MPC Custody Platform for a German Crypto Custodian

Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.

Scope of Work
Product design, UI build and clickable demo
Industry
Web3 / Institutional Custody
Web3WalletFinTechEnterprise
Compliance & Certifications
KWGMiCATransfer of Funds Regulation (travel rule)GwGDORAGDPRISAE 3402 / SOC 1ISAE 3000 / SOC 2FIPS 140-2 / 140-3 Level 3

Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.

Impact

5 Screens
Clickable end to end

Dashboard, transactions with a quick view panel, transaction detail, approvals inbox and policies, plus a New withdrawal panel with a live policy preview. Every one of the 25 demo transactions opens its own detail page.

8 Rules
First-match withdrawal policy

From 1 of Treasury for internal transfers to 3 of Treasury and 2 of Risk with a 24-hour time lock above EUR 1m, with velocity limits per vault. One-time addresses and anything else are blocked, and the initiator never counts as an approver.

10 Steps
Status timeline per transaction

Created, policy evaluated, travel rule, screening, approvals, time lock, signing, broadcast, confirmations and completed, each with the time, who or what completed it, and the reason when a transaction stopped there.

25 Transactions
Realistic demo data

6 vaults across hot, warm and cold tiers, 14 wallets on 5 assets, 10 client users in 3 approver groups, 6 policy versions and 3 policy, whitelist and user requests awaiting an admin quorum.

The Problem

Hochwarth started with a multisig setup and a hand-run process. Clients emailed signed PDF withdrawal instructions, an operations officer checked signatures against a specimen list and called the client back, and two key holders met to sign from a hardware wallet. A withdrawal took one to two working days, clients could not set their own rules, nobody could see which transactions were waiting on whom, and reconciliation was a monthly spreadsheet.

Our Solution

Riegel gives Hochwarth's institutional clients one console for their custody position: vaults and holdings in EUR, every transaction with its full status timeline, an approvals inbox where named approvers decide with a security key, and a versioned policy the client's own admins change by quorum. Keys stay split as MPC shares, so no single person or system can move client assets alone.

The Challenge: Moving Client Assets Safely and Quickly

Institutional crypto custody in Germany is a licensed financial service, and every withdrawal has to satisfy the client's own controls, the travel rule, anti-money laundering checks and the custodian's key management at once, while clients now expect same-day withdrawals.

Client Rules Nobody Could Set

Asset managers, banks and funds want rules such as "anything over EUR 500,000 needs our CFO". The old process had one fixed path for everyone, with approvals collected by email and phone and no record of who had decided what.

Travel Rule and Screening on Every Transfer

Since 30 December 2024 the Transfer of Funds Regulation requires originator and beneficiary data on every transfer between CASPs, with no minimum, and proof of wallet ownership for self-hosted wallets above EUR 1,000. The GwG adds due diligence and on-chain screening of sources and destinations.

Keys That Never Exist in One Place

Each wallet is controlled by MPC key shares across a cloud enclave, an HSM in Hochwarth's data centre and offline cold storage. Cold vaults need an in-person signing ceremony, so a client has to see why a transaction is waiting and when it will settle.

Two Licensing Regimes and Daily Evidence

Hochwarth moves from a KWG licence to MiCA authorisation, which asks for a register of positions per client, segregated holdings and regular statements. Insolvency protection depends on the ledger showing whose assets are whose, so reconciliation becomes a daily control.

Our Approach: From Custody Rules to a Clickable Console

01

Spec and Rules Research

Mapped 12 roles across client institutions and Hochwarth, 40 screens over three surfaces (18 in the client console, 5 in the mobile approver app and 17 in the internal ops console) and the data model for vaults, wallets, transactions, approvals, whitelist entries, versioned policies, travel rule messages, MPC nodes, key sets, ceremonies and an append-only, hash-chained audit log. Wrote down the rules the design follows: KWG and MiCA custody duties, the Transfer of Funds Regulation, GwG, DORA, GDPR, ISAE 3402 and proof of reserves.

02

Clickable Demo on a Production UI Kit

Built 5 key client console screens on a production web3 dashboard kit, in light and dark mode: the dashboard with assets under custody by tier and what is waiting on you, transactions with status pills, filters and a quick view, the transaction detail with policy result and approvals by group, the approvals inbox with step-up approval, and policies with a test-a-transaction simulation. Approving updates the quorum on local state.

03

What a Production Build Adds

Integration with an MPC signing engine (such as Fireblocks, Blockdaemon Builder Vault or Dfns), HSMs, chain nodes, on-chain screening (Chainalysis, Elliptic or TRM Labs), travel rule messaging (Notabene or 21 Analytics), price feeds and FIDO2 / WebAuthn security keys. Passkey or SSO login, the audit log, and the remaining screens: vaults, whitelist, the full policy editor, travel rule, reports, administration, the mobile approver app and the internal ops console.

Why It Works: Every Movement Explained Before It Happens

The Policy Is Readable and Testable

Rules are listed in evaluation order with what each one requires, and the first match wins. Test a transaction shows which rule an amount and destination would hit, and the New withdrawal panel previews the rule, approvals, time lock and daily velocity used before anything is submitted.

Quorum by Group, Not by Count

Approvals show progress per approver group, such as 3 of Treasury and 1 of Risk, with each approver's device and method. Approve and Reject appear only for eligible approvers: never the initiator, never twice, and only in a group that is still short.

Deliberate Approvals

Each request is its own card with the destination address and its first and last six characters highlighted, an expiry countdown of 24 hours and a type chip for withdrawals, policy changes, whitelist additions and user invites. Approving needs a security key step-up, rejecting needs a reason, and there is no bulk approve.

Every Wait Has a Reason

The status timeline says where a transaction stands and why: waiting on Risk, a 4-hour time lock, a cold ceremony batched for the next morning, or a deposit held because a self-hosted wallet above EUR 1,000 still needs ownership proof.

Logo
Oceanlab

Enterprise Software Engineering - Human + AI

Languages

Locations

Global Headquarters

21 Merchant Road, 3rd Floor, Singapore 058267

Main corporate office and leadership operations

North America Office

548 Market Street, PMB 12345, San Francisco, CA 94104

Client operations and business development

India Office

402 Shivalik Shilp II, SG Highway, Ahmedabad 380015

Engineering and delivery center

© 2026 - Copyright. All Rights reserved Oceanlab