Skip to content
Fuga Labs
Scope an engagement
Sector preset

Custodian or asset manager

For firms who will be asked to prove segregation and control on the worst day of their year.

Scope an engagement Every sector preset
PresetonboardInstitutionDetectors in play16Boundaries declared3Refusals at onboarding0

How this sector loses money.

Your mandate says client assets are segregated. Your auditor will ask you to prove it, and your regulator will ask on the worst day of your year. A screenshot of a wallet balance is not proof of segregation, and not proof of control either.

Answered by
  • 15Deterministic rules
  • 1Models

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardInstitution(platform, config) 7 configured
  1. 01Operational and omnibus wallets monitored as distinct subjects
  2. 02Segregated client sets, keyed by an opaque client reference, each monitored separately
  3. 03Counterparty screening at /v1/screen and /v1/screen/batch, with a named source per verdict
  4. 04Reserve attestations under proof of control, putting every declared address under continuous measurement
  5. 05Data residency pinned per tenant and enforced on every authenticated request
  6. 06Hash-chained compliance export of every screening, verdict and action
  7. 07Peel-chain laundering detection across the counterparty graph
Detectors in play
  • rules.safe-structure-delegatecall
  • rules.multisig-signer-overlap
  • rules.admin-authority-change
  • rules.authority-handover-fresh-account
  • rules.role-granted-to-eoa
  • rules.sanctioned-interaction
  • rules.approval-blast-radius
  • rules.multi-token-sweep
  • rules.proportional-drain
  • ml.peel-chain-laundering
  • rules.reserve-shortfall
  • rules.reserve-unexplained-drain
  • rules.reserve-control-unproven
  • rules.reserve-attestation-stale
  • rules.reserve-address-set-change
  • rules.reserve-window-dressing

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Segregation is reported from chain movement, not read from your internal sub-ledger.
Closed by Closed by declaring the client sets. Once declared, every movement between a client set and an operational wallet is named, timestamped and exportable the day it happens, which turns commingling from a conclusion nobody can reach into a movement handed to your compliance team in real time.
The edge Your internal ledger is your system, and it is not an on-chain artefact.
Closed by Closed by publishing the ledger side. Attested balances reconcile against measured on-chain holdings, and the delta becomes a detector with a severity rather than a reconciliation task with a due date.
The edge A residency commitment written in a contract is not the same as one enforced in a request path.
Closed by Closed by pinning residency to the tenant and enforcing it at the API boundary on every authenticated call. If the pin is absent, onboarding says so out loud rather than letting the mandate quietly go unenforced.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Operational and omnibus wallets separated, and each client set keyed by an opaque reference so segregation is a declared structure rather than an inference. Residency is pinned to the tenant in the same session.

  2. Step 2

    Detect

    Every movement between a client set and an operational wallet is named and timestamped the day it happens. A screen with no live source consulted returns insufficient-data, not a pass.

  3. Step 3

    Prevent

    What is enforced here is the request boundary, on every authenticated call, and the export that proves it held. Circuit breaking is available and is rarely what this preset is bought for.

What runs underneath.

Per-tenant residency, enforced at the request boundary, is the control this sector gets audited on rather than the one it gets sold on.

The base under all eleven presets

Scope Custodian or asset manager coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset