Bitpanda Enterprise Custody separates system access, transaction authorisation and final blockchain signing into distinct stages of the custody workflow.
This separation means that the ability to access the custody platform or create a transaction does not, by itself, provide the cryptographic authority required to produce a blockchain signature.
Transactions must progress through the applicable authorisation and policy controls before final signing can occur.
Transaction authorisation and signing flow
At a high level, the transaction lifecycle is separated into two areas:
Authorisation
The transaction is created, reviewed and approved according to the applicable wallet policy and configured transaction controls.
Cryptographic enforcement
The required transaction, policy and approval conditions are validated before the custody key can be used for final blockchain signing.
1. Create the transaction instruction
A transaction instruction can be created through an authorised interface, such as the custody API or user interface.
Creating a transaction instruction does not produce a blockchain signature.
It begins the transaction workflow.
2. Obtain the required approvals
The transaction is presented to the authorised signer or signers required by the applicable wallet policy.
Each required signer can review the transaction before approving it.
The resulting approval signature is cryptographically associated with the transaction instruction.
3. Apply the wallet policy
The wallet policy defines the authorisation requirements that apply to the transaction.
This can include:
- who is authorised to approve;
- the required approval quorum; and
- the approval structure governing the wallet.
The transaction cannot proceed towards final signing until the applicable approval requirements have been satisfied.
4. Apply additional transaction controls
Additional controls can form part of the transaction workflow before final cryptographic signing.
Depending on the configured operating model, these can include:
- approved-destination controls;
- value-based threshold rules;
- time delays; and
- additional policy-driven approval or co-signing requirements.
These controls operate alongside the wallet policy to determine whether the transaction can proceed.
5. HSM validation
The HSM provides the final cryptographic enforcement boundary.
Before custody-key use, the HSM validates:
- the transaction request;
- the applicable wallet policy;
- the required cryptographic approval signatures; and
- the authorised policy state.
The required cryptographic conditions must be satisfied before the blockchain key can be used.
6. Blockchain-key derivation
Following successful validation, the required blockchain key can be derived within the HSM security boundary.
Key derivation remains part of the protected cryptographic process and is separate from transaction initiation and approval.
7. Final blockchain signing
The HSM uses the relevant custody key to produce the final blockchain signature.
This is the cryptographic operation that authorises the transaction for the relevant blockchain network.
8. Blockchain submission
Following final signing, the signed transaction can proceed to the appropriate supported blockchain network.
The blockchain network then processes the signed transaction according to the rules of that network.
Authentication, approval and signing are separate
A key security principle within the architecture is the separation between the credentials used for API authentication, transaction approval and final blockchain signing.
API key
An API key authenticates access to supported custody APIs.
It enables authorised systems to interact with the custody platform but does not itself provide the custody key required for blockchain signing.
Instruction key
An instruction key is used to cryptographically authorise a transaction instruction or approval within the applicable policy.
The instruction key is separate from the blockchain custody key.
Custody key
The custody key is protected within the HSM-led custody architecture.
It is used for final blockchain signing only after the required cryptographic conditions have been satisfied.
Put simply:
API key ≠ Instruction key ≠ Custody key
Approval signature ≠ blockchain signature
A transaction approval signature and the final blockchain signature serve different purposes.
An approval signature represents cryptographic authorisation of the transaction instruction according to the applicable wallet policy.
It does not mean that the approval device holds or exposes the blockchain custody key.
The custody key remains within the HSM-led cryptographic architecture and is used separately for final blockchain signing.
This means:
Approval signature ≠ Blockchain signature
Why does this separation matter?
Separating access, transaction authorisation and blockchain signing creates multiple control boundaries within the transaction lifecycle.
For example:
- API access alone is not sufficient to produce a custody signature;
- creating a transaction does not automatically authorise it;
- transaction approval does not expose the custody key;
- approval requirements can involve multiple authorised participants; and
- final custody-key use remains subject to cryptographic enforcement at the HSM boundary.
This allows institutions to combine operational access and automation with independent transaction governance and protected blockchain signing.
Further information
For more information about approval controls and custody security, see: