Wallet Evolution: Why Institutional Digital Assets Need More Than Secure Keys?

Image courtesy of Cregis

Digital-asset wallets have evolved alongside the industry they serve. Initially designed to store assets and authorize transactions, they have developed into enterprise infrastructure supporting increasingly complex financial operations. As banks and other institutions enter the market, however, the requirements extend beyond secure key management. Institutions must also demonstrate control over access, authorization, asset movements, and operational records.

This shift is shaping Cregis’s expansion from MPC-based self-custody wallets into institutional asset management and custody. Founded in 2017, the digital-asset infrastructure company has developed Trust Vault, a governance framework for institutional operations, and expanded into custody.

We spoke with Aaron Zhang, co-founder of Cregis and CTO of Cregis Custody FZE, who has worked on digital-asset products since 2015, about the evolution of wallet infrastructure, the changing requirements of institutional custody, and the technology needed to support them.

Q: You began working on digital-asset products in 2015. What drew you to the industry, and how has your approach to building technology evolved?

My interest in economic systems began long before I entered the technology industry. I was curious about fundamental questions such as why money exists and how economic exchange works. With a background in science, I pursued computer science rather than economics, but that interest in underlying systems remained.

In 2015, my team began developing digital-asset products, initially focusing on wallets and Web3 tools. Over the years, the industry has changed considerably, and so have the problems we work on.

I have always viewed technology as a means of solving practical problems rather than an end in itself. Building a technically sophisticated product is not enough; it must address a genuine operational need. This has become particularly relevant as digital assets move from individual ownership into institutional financial operations.

Q: How have wallet requirements changed as the digital-asset industry has matured?

The most significant change is in the nature of the assets being managed and the responsibilities involved.

Early wallets primarily served individuals, for whom protecting private keys and preventing asset theft were the central concerns. As businesses adopted digital assets, wallets had to support multiple users, differentiated permissions, and more structured transaction management. MPC (multi-party computation) became an important foundation for this transition by distributing key control and reducing reliance on a single point of compromise.

Institutional adoption has introduced another layer of complexity. Exchanges, fintech companies, and banks increasingly manage assets on behalf of clients and other stakeholders, rather than simply holding their own funds. Their requirements therefore extend beyond asset protection to include internal controls, authorization procedures, and accountability.

A wallet is no longer simply a place to store assets or sign transactions. It increasingly functions as part of an organization's broader asset-management infrastructure.

Q: Why is private-key security alone insufficient for institutional asset management?

Institutions must demonstrate not only that assets are secure but also that their management follows established rules.

For a company handling client assets, important questions include who can initiate transactions, who must approve them, who can modify whitelists and authorization policies, and whether any individual can bypass internal controls. If an irregular transaction occurs, the institution must also be able to establish what happened and trace the decision-making process.

This is particularly important for organizations subject to external audits and regulatory oversight. A secure key-management mechanism cannot, by itself, establish whether transactions comply with internal policies or whether access privileges have been appropriately controlled.

The integrity of the governance framework matters just as much as the security of the assets. Even a well-designed approval process is ineffective if privileged users can modify its rules without authorization. Institutional security must therefore encompass access management, transaction authorization, policy protection, and auditability.

Q: How does Cregis Trust Vault address these requirements?

Cregis began researching institutional access-management mechanisms in 2022 and developed the Trust Vault framework in 2024. Its purpose is to translate an organization's internal policies into enforceable controls over digital-asset operations.

Institutions can define role-based permissions, establish approval requirements for transactions, and determine who is authorized to modify those policies. Controls can also vary according to transaction amounts and risk levels, allowing organizations to apply stricter oversight to higher-risk operations without unnecessarily complicating routine transfers.

One important design principle is Sign What You See. Before approving a transaction, an operator must be able to review its exact contents, which must correspond to the transaction ultimately executed. This helps prevent discrepancies between what an operator authorizes and what the system processes.

Trust Vault also protects the integrity of the governance rules themselves. Without safeguards against unauthorized changes, access controls and approval workflows could be circumvented from within the organization.

The distinction is fundamental: Cregis Trust Vault is not simply a key-storage solution. It provides a governance framework for determining who can access and move assets, under what conditions, and how those operations can be verified and audited.

Q: Why is Cregis expanding from self-custody wallets into institutional custody?

The expansion reflects the changing requirements of the market. As banks and other regulated businesses enter the digital-asset sector, not all have the technical capabilities or operational experience to manage assets independently.

Self-custody infrastructure can meet many enterprise requirements, but institutions operating under regulatory oversight may need additional assurance around asset management, operational controls, and independent verification. Depending on their business model and regulatory obligations, they may require a formal custody arrangement involving an independent provider.

For Cregis, custody builds on capabilities developed through years of working with digital-asset businesses. Trust Vault provides the governance foundation, while our experience in wallet infrastructure and institutional operations informs the broader custody offering.

I see this as an extension of the same underlying objective: ensuring that digital assets are not only protected but also managed within a framework of clearly defined responsibilities and verifiable controls.

As institutional participation grows, wallet infrastructure will increasingly be judged not only by how securely it manages private keys but also by how effectively it supports the governance, accountability, and operational requirements of financial institutions.

About Cregis

Cregis is a digital asset infrastructure platform, providing technology for digital asset collections, payouts, and fund operations. Its offerings include wallet infrastructure, fund flow orchestration, and regulated custody capabilities. These solutions help businesses manage digital assets with greater security, efficiency, and control. Founded in 2017, Cregis serves financial institutions, payment service providers (PSPs), foreign exchange (Forex) brokers, fintechs, and Web3 businesses. The company operates across Asia, the Middle East, and Latin America. Today, Cregis supports more than 4,000 businesses across over 50 countries.