Custodial Framework

Tungsten (Tungsten) Custody Solutions FZE is a UAE based and operated Virtual Asset Service Provider (known as VASPs) established in 2024 and regulated by Virtual Assets Regulatory Authority. Tungsten provides a secure solution for custodising virtual assets, safeguarding it from loss by holding them securely and controlling who has access by acting as an intermediary.

We provide a white glove custodial service using a dedicated customer-facing team we call the Trust Office. They provide you with a contact point through multiple channels to receive and then process instructions according to a pre-agreed delegation of authority. Our Compliance function completes Know Your Customer (KYC) and Know Your Transaction (KYT) protocols using best-in-class tooling to ensure that all transactions are compliant to the requirements of AML and CFT.

Secure and accredited cold wallet management is provided through a best in class HSM based platform which is administered by Tungsten in the UAE through a secure physical environment of controlled environments and strict procedural controls.

Trust Office (Operations)

We offer a premium white-glove custodial service through our dedicated customer-facing team, the Trust Office. This highly specialised team is designed to deliver personalised service tailored to your specific needs. The Trust Office is the central point of contact, available through multiple communication channels, including phone and email, to ensure seamless interaction and accessibility.

Upon engaging our services and establishing a pre-agreed delegation of authority, this ensures that all instructions, whether they pertain to deposits, withdrawals, transfers, or other account activities, are executed with precision, adhering to specific preferences and requirements. Tungsten archives this by securely managing the private keys on behalf of clients, at no point in the course of the relationship does the client ever hold any responsibility for their private keys, in whole or in part. Our Trust Office team takes a proactive approach to managing instructions, ensuring they are processed efficiently and securely, while keeping the client informed at every step of the way. The delegation of authority is maintained and compliant with clients’ wishes throughout the custodial relationship

Security

Although Information Communication and Technology risks are ever-evolving and complex, Tungsten applies a base air-gap approach to all wallet operations in a clean room without network access. We maintain strong controls over data leak prevention and managed device configuration. Our key technology suppliers are all SOC2-certified. Tungsten holds ISO27001 (information security management system) and a SOC2 Type 2. Tungsten has cybersecurity and data privacy policies, procedures, controls and systems, including how we will respond to data breaches and cyberattacks, and notification, reimbursement and remediation policies.

Compliance

Tungsten maintains comprehensive controls and monitoring mechanisms to ensure regulatory compliance in the dynamic and closely monitored realm of virtual assets. This includes implementing rigorous Know Your Customer (KYC) procedures to verify client identities, which serve as a crucial defence against illicit financial activities. Additionally, we enforce robust Anti-Money Laundering (AML) programs, featuring systems for monitoring suspicious transactions, maintaining detailed records, and conducting thorough risk assessments. Continuous and sophisticated transaction monitoring is essential to track virtual asset flows and identify unusual or potentially illicit activities. We also comply with the Travel Rule, necessitating the transmission of specific transaction- related information between parties, which demands secure data handling and sharing protocols. Furthermore, we have procured, implemented and integrated with advanced solutions like Passfort, Onfido, Elliptic and Refinitiv to ensure our controls are advanced, automated and fit for purpose.

Risk Management

We have a Risk Management Framework approved at the Board of Directors level. This covers how we apply our risk management approaches with target Risk Appetite statements, risk identification and assessment to determine the inherent risk level, how controls are designed and the determining of the residual risk level resulting from the risk modification from the control execution. Risk treatments are also categorised and action plans arising determined for management tracking. If a risk is assessed to be outside of appetite and a risk acceptance is required this is brought to the attention of Senior Management for their approval and then up to the Board of Directors for their review and approval.