Institutional Security Requirements for Onchain Teams

By the Guardian team Updated November 2026 5 min read

Quick answer. Evidence, not assurances: a SOC 2 Type II report or status, audits tied to deployed code, offchain pentests, key management records, incident notice terms and an exit plan. US bank guidance calls for diligence first, then monitoring.

Watch: Institutional Security Requirements for Onchain Teams 1:41

Video transcript

A bank that partners with you takes on your risk. So it wants evidence, not assurances.

U.S. guidance and DORA agree: outsourcing does not move responsibility. So banks run every vendor through planning, due diligence, contract negotiation, ongoing monitoring and termination.

Reviewers lean on SOC 2 for controls, CCSS for crypto systems and keys, and NIST CSF 2.0 for the bank's side. No report yet? Say exactly where you stand.

Crypto adds a layer. A 2025 statement from U.S. agencies calls compromise or loss of keys one of the primary risks.

Reviewers go past the chain. They want your key architecture, audits tied to commit hashes, proof deployed bytecode matches, who can upgrade or pause, and offchain pentests and incident terms.

These rules bind the institution and reach you through its contract: threat-led pentests under DORA, reviews of your test results under the GENIUS Act rule, and 72-hour breach notice under Regulation S-P.

The fix is one evidence pack, kept current and shared by link. It covers architecture, attestations, audits, pentests, key management, and incident and exit plans. Name what is still open.

Guardian works on both sides of this process. It has run more than fifty engagements on USDT0 since January 2025, and writes committee-ready evidence for institutions.

Read the full guide for every rule and request, or talk to Guardian about building your evidence pack.

A bank or asset manager that works with you takes on your risk. Its regulators hold it responsible for what you do.

So before it integrates, custodies or allocates, it sends a questionnaire. Some of it looks like enterprise sales. Much of it does not.

This guide covers what institutions ask onchain teams for, why, and how to answer once instead of every time.

This article explains the technical and security side of these rules and frameworks. It is not legal advice; confirm how they apply to you with counsel.

Why Institutions Ask Differently

Outsourcing does not move responsibility. The 2023 US interagency guidance says a bank's "use of third parties does not diminish its responsibility" to operate safely and soundly and within the law.

DORA says the same in the EU: financial entities "remain fully responsible" for compliance when they use ICT providers.

So the guidance has a bank manage each third party through a five-stage life cycle:

Planning
Due diligence and selection
Contract negotiation
Ongoing monitoring
Termination

Expect the questions back periodically, and after any material change on your side.

Crypto adds a layer. The agencies' 2025 safekeeping statement calls compromise or loss of keys "one of the primary risks" of crypto safekeeping.

The Frameworks They Expect

Three frameworks give reviewers a shared language.

Framework	What it is	What reviewers check
SOC 2	A CPA's examination of a service organization's controls	Report type, period covered, exceptions, systems in scope
CCSS	C4's standard for cryptocurrency systems, Levels 1 to 3	Which system is certified, and at what level
NIST CSF 2.0	NIST's framework of security outcomes, February 2024	Supply chain controls in its GV.SC category

The AICPA describes SOC 2 as reporting on controls relevant to security, availability, processing integrity, confidentiality or privacy.

CCSS is the one built for keys. Its v9 matrix covers key generation, wallet generation, storage, access, usage and key compromise.

NIST CSF 2.0 describes the bank's side. It calls for due diligence "before entering into formal supplier or other third-party relationships."

No report yet? Say exactly where you stand. Guardian's own institutional page lists its SOC 2 Type II as "Auditor engaged."

Onchain Evidence They Ask For

Generic frameworks stop at the chain. These requests go past it.

Keys and control

For custody, the agencies describe a control test: no other party, including the customer, holds enough to move the asset unilaterally. A bank applies the same test to sub-custodians.

Key architecture: HSM, MPC, multisig or enclave, and who holds each share.
Key generation ceremony records and a dated recovery test.
Signer onboarding and offboarding, with revocation times.
Segregation of client assets from your own.

Contracts and code

If custodied assets depend on smart contracts, the statement says a bank should oversee them "throughout their life cycle."

Audit reports with the commit hash each one reviewed.
Proof that deployed bytecode matches the audited commit.
A role map: who can upgrade, pause or mint, at what threshold and delay.
An upgrade review process, and monitoring with a named responder.

Offchain systems and incidents

Pentests of the cloud, APIs, web apps and SDKs that reach keys or contracts.
Contract terms for notice of key compromise, backup use or irreversible errors.
Incident history, with post-mortems.

Stablecoin issuers get an explicit duty. From January 18, 2027, the OCC's GENIUS Act rule requires the issuers it supervises to "review audits, summaries of test results, or other equivalent evaluations" of their service providers.

Institutions diligencing a protocol work from a similar list: see our DeFi protocol due diligence checklist.

Regulatory Drivers

These rules bind the institution. They reach you, as its vendor, through its questionnaire and its contract.

Rule	Binds	What reaches you
US interagency guidance (2023)	US banks	Diligence on 14 factors; audit and remediation rights
DORA (applies from January 17, 2025)	EU financial entities, including MiCA CASPs	Audit rights, threat-led pentests, incident help, exit terms
GENIUS Act: OCC final rule (effective January 18, 2027)	OCC-supervised payment stablecoin issuers	Due diligence, contract terms, review of your test results
NYDFS Part 500.11	DFS-regulated firms	Minimum practices: MFA, encryption, incident notice
SEC Regulation S-P (amended 2024)	Broker-dealers, advisers, funds, transfer agents	Breach notice within 72 hours; due diligence and monitoring

MiCA firms are in DORA's scope. Article 2(1)(f) covers MiCA crypto-asset service providers and issuers of asset-referenced tokens.

For critical or important functions, DORA contracts must require the provider to join the entity's threat-led penetration testing. See our guide to DORA pentesting requirements.

Looking for an SEC vendor rule? Amended Regulation S-P is one: covered firms must oversee service providers through due diligence and monitoring. Its compliance dates for larger and smaller firms have both passed.

For Fed-supervised issuers, see our guide to the Federal Reserve's GENIUS Act proposal.

Building an Evidence Pack

Answer once, keep it current, and send a link. A good pack holds:

An architecture overview: trust boundaries, data flows and where keys live.
Attestations: a SOC 2 Type II report or status, plus CCSS and NIST CSF mapping.
Audit reports with commit hashes, and a deployed bytecode match record.
Pentest reports and retests for cloud, web app, API and SDK.
A role map read from chain state, with thresholds and timelocks.
A key management summary: ceremonies, backups, last recovery test.
An incident response plan, notice commitments in hours, and past post-mortems.
A subcontractor list: cloud, RPC, oracles, bridges and custody.
Continuity and exit: data return, asset migration and support after termination.

State residual risk plainly. A reviewer trusts a pack that names what is still open, with an owner.

Our vendor due diligence questionnaire shows the questions the pack has to answer.

How Guardian Helps

Guardian works on both sides of this process.

On the onchain side, Guardian has run more than fifty engagements on USDT0 since January 2025, and twelve for Ethena since May 2025.

Managed Security includes a hosted trust center with the technical evidence regulators ask for under DORA, MiCA, the GENIUS Act, VARA and NYDFS.

For institutions, Guardian writes technical diligence responses and committee-ready evidence. The Digital Asset Assurance Pilot is built for vendor approval.

Frequently Asked Questions

What security do banks require from crypto vendors?

Evidence, not promises. Typically that means a SOC 2 Type II report or status, audits tied to deployed contracts, offchain pentests, key management records, incident notice terms and an exit plan.

Do DeFi protocols need SOC 2?

None of the rules above require SOC 2 by name. The 2023 interagency guidance says banks may consider reviewing SOC reports, so a SOC 2 Type II report, or a clear status, answers much of the controls review.

What is CCSS?

The CryptoCurrency Security Standard from the CryptoCurrency Certification Consortium (C4). It certifies cryptocurrency systems, not whole companies, at Level 1, 2 or 3, covering key generation, storage, access, usage, logging and key compromise.

Does DORA apply to crypto companies?

DORA has applied since January 17, 2025 to EU financial entities, including MiCA crypto-asset service providers and issuers of asset-referenced tokens. Most ICT providers meet it through contracts and diligence; providers designated critical are also overseen directly.

Sources

Build the evidence banks ask for

Guardian audits, pentests and documents your system so an institution's risk team can follow the evidence without calling you.

Talk to Guardian Explore institutional security