What Are the Steps to Develop a White-Label Crypto Wallet?

What are the steps to develop a white-label crypto wallet? With a white-label solution, a business does not need to write the underlying code itself, but it still has four things to do: determine the custody model and licensing, evaluate and integrate a provider, configure policies, approvals and compliance processes, and finally complete testing before going live. This article assumes the business has already decided to use a white-label solution; the comparison with building in-house is covered in how a business can launch a digital wallet.

Step 1: How Do You Determine the Custody Model and Licensing?

The custody model determines whether a business needs a licence. Guidance from the Financial Action Task Force (FATF) considers most custodial wallet providers to be virtual asset service providers, because they hold or safekeep virtual assets on behalf of others; providers that only develop or sell unhosted wallet software generally are not. The EU’s MiCA lists “safekeeping or controlling crypto-assets, or the means of access to them (such as private keys), on behalf of clients” as a crypto-asset service, which may only be provided in the EU by an authorized crypto-asset service provider (CASP) or by licensed entities such as credit institutions that have notified the competent authority.

A business therefore needs to determine first who holds the keys or key shards for customer assets: whether it will provide custody itself, use a licensed custodian, or have users hold their own keys. Even when third-party technology is used, regulatory responsibility does not transfer with it; who is responsible for compliance when using a third-party wallet provider summarises the rules in each jurisdiction.

Step 2: How Do You Evaluate and Integrate a Provider?

For a regulated institution, choosing a white-label provider is an outsourcing decision. Article 28 of the EU’s Digital Operational Resilience Act (DORA) requires financial entities, before entering into a contract for ICT services, to assess whether the service supports critical or important functions, identify risks including concentration risk, conduct due diligence on the provider and assess conflicts of interest, and only contract with providers that meet appropriate information security standards; after signing, the contract must also be recorded in the register of information.

The outsourcing guidelines of the European Banking Authority (EBA) and the Monetary Authority of Singapore (MAS) also set out the focus areas for due diligence: the provider’s business reputation, financial strength, expertise and capacity, required regulatory authorizations, and physical and IT security controls. For the specific questions to ask when evaluating a wallet provider, the six criteria in how to choose a secure Wallet-as-a-Service provider can be applied.

Step 3: How Do You Configure Policies, Approvals and Compliance?

A white-label provider supplies the capabilities, but the specific rules must be set by the business itself, including transfer limits, address whitelists and transfer approval workflows, as well as KYT screening of addresses before sending or receiving funds.

If the business provides custody and transfer services, it must also implement the Travel Rule. Taking Article 14 of the EU’s Transfer of Funds Regulation as an example, the originator’s crypto-asset service provider must ensure that transfers are accompanied by originator and beneficiary information, transmitted securely in advance of or simultaneously with the transfer; for transfers of more than EUR 1,000 to a self-hosted address, it must also take measures to assess whether that address is owned or controlled by the originator; and it must not initiate or execute a transfer until it is fully compliant.

Step 4: How Do You Test and Go Live?

The system testing requirements in the MAS Technology Risk Management Guidelines can serve as a benchmark: a test plan should be developed and approved before testing, covering security controls and system performance under different loads; unit testing, system integration testing and user acceptance testing should be conducted in segregated environments; regression testing should be performed after changes; and major issues should be resolved before deployment to production, with test results signed off by the relevant parties.

The same guidelines also require disaster recovery plans to be tested regularly and cryptographic keys to be backed up for recovery. For a wallet, this means rehearsing before launch how funds would be recovered if the provider suffers an outage or a key shard is lost.

Conclusion

A white-label solution removes the need for underlying development, but the custody model and licensing, provider due diligence, policy and compliance configuration, and testing and recovery drills still have to be completed by the business itself. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Is your business planning to launch its own branded crypto wallet?

Contact Safeheron’s Sales Team to Book a 1:1 Demo