Q&A: Why Security Tokens Need Institutional-Grade Custody

Posted by Polymath

Institutional investors depend on custodians to safeguard their assets, and in many ways growth of the security token market hinges on investor confidence in custodians. Security and compliance are major pieces of the puzzle, but the underlying blockchain is also a critical factor. While it can often be invisible to the investor, it has significant ramifications on custodial operations and efficiency.

In this Q&A, Polymath asked James Byrne, CTO of Digivault, about the main difficulties and threats in digital asset custody, the role blockchains play in making it possible to provide institutional-grade security, and where he sees the security token market going next.

Digivault operates a node on the Polymesh blockchain and is a member of the Polymath Service Provider Ecosystem.

Polymath: Your team draws on decades of experience delivering secure technical solutions in financial services, defence, and other sectors. What have you found to be the unique challenges in providing security for digital assets?

James Byrne (James): The main gaps we’ve found within the asset custody industry are with the development of the technology itself. Up to now, most solutions have been developed by technologists, instead of core banking and security specialists, leading to solutions that lacked the foresight of certain risks. Combined with the nascency of the industry and lack of regulation, you can imagine how this created unforeseen challenges.

We’ve found the best answer to be one that combines the past and the present. Taking from the past, we model our solutions on those of traditional banking and work closely with regulators to understand their requirements. We then layer in a granular focus on foreseeing and eliminating all possible points of compromise in the digital ecosystem. By bringing together traditional and blockchain elements, we're able to supersede many of these challenges.

Security Token Custody: The Challenges and Opportunities CTAPolymath: What do you see as the main cybersecurity threats around digital securities?

James: When considering cybersecurity threats, it’s useful to consider both the potential sources of threats as well as the attack vectors. Hacking groups are a credible threat; many are well financed with substantial organisation and in some cases nation-state backing. These groups have the time and ability to carry out extended and highly sophisticated attacks. Insider threats also need to be considered; the loss of assets from Canadian exchange Quadriga is a cautionary tale highlighting the need for segregation of duties and third-party custody.

In terms of attack vectors, social engineering attacks may not be technically sophisticated, but they remain a commonly used and often successful approach. Examples of these include emails where the sender has been forged so that they appear to come from a trusted source. They may look to be from a senior manager requiring an urgent transaction to be actioned or from technical support requiring a password to be changed. Old and outdated software with security flaws is another significant attack vector, since these allow a hacker to remotely gain access and attempt to steal assets.

This cannot be done with a generic blockchain and requires the creation of a new blockchain characterised by its customisation for securities.

Polymath: Blockchains power asset tokenization, but they are each made differently. What characteristics does a blockchain need to support robust security token custody?

James: For security tokens, blockchains need the capability to encode the business rules required by the security token. This has previously been done by specific code written for each security token, known as a smart contract. In this model, each security token has its own separate smart contract holding all the business logic and the blockchain has no customisation to assist with this. Great care must be taken to ensure that every separate smart contract enforces the correct regulatory rules.

To improve on that approach, common requirements and business logic for securities can be moved from the smart contracts into the blockchain software. This cannot be done with a generic blockchain and requires the creation of a new blockchain characterised by its customisation for securities. Specifically, in relation to custody, custodians need reliable and enterprise-grade blockchain software to provide a reliable connection to the blockchain. Software features such as performance instrumentation and clustered deployments are needed. A blockchain that involves custodians within its governance is well positioned to excel at security token custody.

Custodians need reliable and enterprise-grade blockchain software to provide a reliable connection to the blockchain.

Polymath: What additional value do you see custodians bringing to the security token space beyond the safekeeping of digital assets?

James: Custodians are regulated entities that can attest to the identity of investors within their jurisdiction. Custodians within the EU and UK are required to be registered under the Fifth Money Laundering Directive (‘5MLD’) and this ensures that their KYC/AML onboarding processes are verified by the relevant regulator as being rigorous and compliant.

When combined with blockchains that support identity management and confidentiality, custodians can perform KYC/AML on investors and store the outcome on the blockchain. This information can then be reused by the security token’s business logic and other participants of the market such as broker-dealers and exchanges.

Polymath: How close do you think the market is to embracing asset tokenization?

James: With recent announcements such as the SEC’s custody framework, we believe asset tokenization will accelerate like Bitcoin institutional adoption did throughout the last year. We are already seeing tokenized artwork, and initiatives such as the UAE's tokenization of real estate. Through the emergence of platforms such as our own, which have an institutional focus, we feel confident the industry is shifting its perspective to see the benefits asset tokenization brings to the world.

It will be exciting to watch the security token market grow. The evolution from basic primary issuance to an ecosystem including secondary markets is one that has required several threads to come together in a process that we’re seeing in action currently. The regulatory framework has been steadily progressing along with the technical capabilities of blockchain and security tokens. As these converge, we will see the delivery of rapid settlement, cost reduction, automated compliance, and 24/7 markets for blockchain based securities, and in turn, this will drive a greater representation of securities using tokenization.

James Byrne

CTO of Digivault

James Byrne has been responsible for re-architecting infrastructure at some of the world’s largest banks prior to designing institutional grade digital asset custody at Digivault.

All views expressed or claims made above solely belong to James Byrne and do not reflect those of Polymath. Polymath does not endorse or recommend any product or service provided, or to be provided, by James Byrne or Digivault.

The information in this document does not purport to be complete and has not been independently verified. Polymath gives no undertaking, and is under no obligation, to update this document or provide any additional information or to correct any inaccuracies which may become apparent.

Related Posts


Security Token Custody: The Challenges and Opportunities

Security tokens come with a unique set of requirements. While they’re intended to bring efficiency and automation to capital markets, digital asset custodians often face scalability and efficiency issues when handling them on public blockchains.

This guide dives deep into the challenges surrounding security token custody and how a purpose-built blockchain can overcome them.