Custody Overview

General policy

ICONOMI Ltd assets are segregated from Platform assets (that includes exchanges, cryptocurrency wallets, and bank accounts). 

All Platform assets are in omnibus accounts and the accounting system tracks their attribution to each user and/or portfolio. ICONOMI Platform assets storage is held in:

• Cryptocurrency wallets
• Exchanges
• Bank accounts

Multisignature

Usually, a wallet is represented by a public key and a matching private key. Whoever has access to that private key can access and move the assets in the wallet. Multisignature adds additional complexity so that behind a public key there are multiple private keys that are needed to access those funds. The system is set up in such a manner that any M out of N private keys (or actually corresponding signatures) are needed to access the funds (where M is lower or equal than N). Usual setups are 2/3, 3/5 or even more.

Multisignature offers increased protection from: loss of keys, internal attacks (rogue persons), and theft.

Multilayer HOT-WARM-COLD storage system

The drawback of having a high-security multi-signature system is that it can increase the time to access the funds and thus decreases the liquidity of assets held. Multilayer cold storage is designed in such a manner that different rules apply to different levels of cold storage. The lowest level has the highest security requirements and holds the largest amount of assets. The higher we go, the security requirements lower and the amount of assets allowed to be in a specific layer lowers as well thus reducing risk. This kind of design enables a balance between the security of the system, and the risk it involves, but still enables high liquidity of assets.

The highest level (so-called hot wallet) is the only level that is not multi-signature enabled and is used for liquidity of the platform (enabling withdrawals of assets from the platform). Levels below are warm levels down to the highest security level – cold storage.

Bigger crypto deposits go directly to cold storage addresses. All transfers from cold storage to warm level are logged.

Fiat currency

For the purpose of deposits, withdrawals, and reserve liquidity for fiat trading pairs, ICONOMI maintains at least two bank accounts with two different banks.

The other part of the assets is held at several exchanges – that offer fiat pairs – for the purpose of trading with fiat. 

Other security measures

In addition to high-security standards for key generation, distribution and usage, there are other measures in place that offer additional layers of protection for funds held on the Platform.

• assets spread out across multiple exchanges
• monitoring these exchanges for any disruption in service and transferring assets accordingly
• high standards for asset listing and delisting
• industry-standard security of the whole IT system (hardware, software, code, monitoring, etc.)
  

Internal controls

Risk and control Matrix

ICONOMI has a Risk, Impact, Escalation, and Reporting Matrix and a Business risk register.

Internal control team

There are several teams that execute control over different areas of business. ICONOMI has an AML/legal department, a support department, and an operations team. Where required, 4/6-eyes procedures are put in place.

Processes and controls related to cybersecurity threats and vulnerability management

All systems are regularly scanned for vulnerabilities and maintained according to best practices. Critical configuration is periodically audited and verified by multiple persons.

Audits and registrations

In 2018 ICONOMI became the first blockchain-based company to be audited by a “Big Four” professional services firm (Deloitte).

In 2021 ICONOMI Ltd successfully concluded an FCA (UK financial regulator) registration process and became one of the first registered crypto asset firms in the UK. In order to pass the registration process, ICONOMI had to prove to the FCA compliance with FCR requirements.