Digital asset custody in the UAE for institutional and qualified investors
Zand Bank PJSC provides digital asset custody under VARA VASP licence no. VL/2024/12/001 for Custody Services, issued on and limited to Institutional and Qualified Investors, with each client's assets in segregated wallets and private keys in FIPS 140-3 hardware security modules held onshore in the UAE.
For Institutional Investors and Qualified Investors only
Risk warning. Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The investor can lose all the money or other value they invest, and does not benefit from any form of financial protection. Risk disclosure for virtual assets
Custody at a glance
- Licensed activity
- Custody Services
- Issued
- Investor class
- Institutional Investors and Qualified Investors
- Key storage
- Hardware security modules, onshore in the UAE
- Networks listed
- Bitcoin, Ethereum, Polygon, Solana
- Fee basis
- Tiered by assets under custody and transaction volume
- Last reviewed
Who the custody service is for
The custody service is open to Institutional Investors and Qualified Investors only. That is the condition on the public register for VARA licence no. VL/2024/12/001: "Permitted to serve Institutional Investors and Qualified Investors." Zand Bank does not offer custody to retail clients.
Both classes are defined terms in the VARA rulebooks. How Zand Bank evidences a client's class at onboarding is not published.
Within those two classes, the bank's custody FAQ names seven kinds of client, grouped in the table. A firm of a listed type still has to pass onboarding. Being named here is not an acceptance.
| Group | Client types named |
|---|---|
| Financial sector | Financial institutions, banks |
| Companies | Corporate clients |
| Virtual asset businesses | Virtual Asset Service Providers (VASPs), crypto or digital asset exchanges |
| Trading firms | Market makers, liquidity providers |
| Retail clients | Not served under the licence condition |
How custody works at Zand Bank
The custody platform gives a client wallet addresses, address whitelisting, a full transaction view and statements. A dedicated Relationship Manager is the named contact. Five steps take an asset from onboarding to a signed withdrawal, and Figure 1 shows the same path.
Onboarding. A dedicated Relationship Manager assists with the documentation and with account and wallet set-up.
Wallet addresses. On account set-up the platform provides wallet addresses for all supported networks and tokens. Each client's assets sit in dedicated wallets, apart from the bank's own assets.
Deposit. The client sends assets to its own addresses. Transfers pass the screening described below, and each movement appears in the transaction view.
Whitelisting and authorisation. The client whitelists the wallet addresses it will send to. Every transaction authorisation then passes a four-eye check, which means two people approve the same instruction.
Withdrawal and statements. An approved transaction is signed with keys held in hardware security modules and sent to the network. Statements are generated from the platform.
Zand Bank publishes no document list, onboarding time, approval limits, processing times or cut-offs for custody.
Zand Vault: cold storage
Zand Vault is the cold storage component. Cold storage keeps the keys that sign for an asset away from internet-facing systems, which suits holdings that rarely move. The product page lists cold storage allocation ratios among its controls. The ratio itself is not published.
Zand Wallet: hot wallet with temperature switching
Zand Wallet is the hot wallet, for assets that have to move at short notice. The product page names a feature called "Dynamic Wallet Temperature Switching" and does not describe it. Read literally, it moves a wallet between hot and cold handling. What triggers a switch, and who approves it, has to be confirmed.
How keys and assets are protected
Four controls, each with the source that states it. The ISO 27001 and ISO 27701 certifications announced on cover Web3 services such as digital asset custody, and the SOC 2 Type II attestation announced on covers digital asset infrastructure. Scope and dates are on the page about security certifications and key management.
Hardware security modules held in the UAE
Private keys are protected in hardware security modules (HSMs) located onshore in the UAE, according to the custody launch release of . An HSM is a tamper-resistant device that generates and stores keys and signs inside the device, so a key is not exported in readable form.
The product page gives the module standard as FIPS 140-3. The custody FAQ refers to FIPS 140-2/3 and Common Criteria, so the level has to be confirmed.
- Key storage
- HSMs, onshore in the UAE
- Module standard
- FIPS 140-3
- Source
- Custody product page and release of 13 December 2024, read
Multi-signature and threshold signing
The product page lists multi-signature and a Threshold Signature Scheme (TSS). Multi-signature means a transaction needs more than one key. In a threshold scheme several parties each hold a share of a key and sign together, so no single party holds the complete key.
- Signing
- Multi-signature, Threshold Signature Scheme
- Source
- Custody product page and custody FAQ, read
Segregation and bankruptcy remoteness
Each client's assets are segregated into dedicated wallets. The custody FAQ rests bankruptcy remoteness on three points: UAE federal law on assets held in custody for a third party, the VARA Custody Services Rulebook, and Zand Bank's Custody Service Terms & Conditions.
The rulebook requires a separate wallet for each client, treats client assets as not belonging to the custodian and bars rehypothecation. This page makes no insurance statement: the insurer, the limit and the scope have to be confirmed first.
- Client wallets
- Segregated, dedicated to each client
- Legal bases stated
- Federal law, VARA rulebook, custody terms
- Insurance
- to be confirmed
- Source
- Custody FAQ, read ; rulebook summary,
Screening, KYT and Travel Rule
The product page lists transaction screening, fraud monitoring, Know Your Transaction (KYT) checks and Travel Rule compliance, with KYC, KYT and KYW protocols and dynamic firewall policies.
KYT looks at the history of a transfer and KYW at the wallet on the other side. The Travel Rule requires details of the sender and the recipient to accompany a transfer between providers.
- Checks listed
- Transaction screening, fraud monitoring, KYT, Travel Rule
- Protocols
- KYC, KYT, KYW
- Source
- Custody product page, read
Supported networks and assets
The live custody page lists four networks: Bitcoin, Ethereum, Polygon and Solana, followed by "& More". No full list of networks or tokens is published. The custody FAQ points to a table of supported tokens that is missing from the page.
Two releases describe plans, not live support. A release dated announces plans to support USDC. A release dated announces a partnership with Ripple to explore RLUSD support in custody.
The group's dirham token, the AED stablecoin Zand AED, is issued by Zand Trust, a wholly owned subsidiary of Zand Bank PJSC, and not by the bank. Whether the custody platform holds it is not stated.
Ask for the current list before planning a transfer: [email protected].
| Network or asset | Status |
|---|---|
| Bitcoin | Listed |
| Ethereum | Listed |
| Polygon | Listed |
| Solana | Listed |
| Other networks and tokens | to be confirmed |
| USDC | Plan announced, 25 August 2026 |
| RLUSD | Under exploration, 10 February 2026 |
| Last reviewed |
Custody fees
Zand Bank publishes no custody fee figures. The custody FAQ gives the basis only: fees are tiered by the amount of assets under custody and by transaction volume. The product page describes the fee model in general terms and prints no number.
A quote therefore depends on two inputs that you can prepare in advance: the value you expect to hold and the number of transactions you expect to make. Ask your Relationship Manager, or contact the digital assets team.
| Item | Basis as published | Amount |
|---|---|---|
| Custody fee1 | Tiered by the amount of assets under custody | to be confirmed |
| Transaction fee1 | Tiered by transaction volume | to be confirmed |
| Set-up, minimum and network fees2 | Not stated | to be confirmed |
| Last reviewed | ||
Notes to the statement
- Source: custody FAQ, read 6 October 2026. Tier boundaries and rates are not published.
- The pages reviewed do not say whether these fees apply.
Banking and custody from one licensed bank
A company that looks for a crypto friendly bank in the UAE usually needs two things: an account for dirhams and foreign currency, and a custodian for its digital assets. Zand Bank provides both from one institution, under two licences. Banking services fall under its licence from the Central Bank of the UAE. Custody falls under VARA licence no. VL/2024/12/001. The live custody page states the same split.
That does not mean every virtual asset business gets an account. A crypto company bank account in the UAE depends on the bank's own eligibility checks, and Zand Bank does not publish its criteria for virtual asset businesses. Nothing on this page promises an account.
The page on the corporate bank account for UAE companies sets out what the account includes. The guide to what a VARA licence covers explains which regulator supervises which activity, and there are more digital asset guides in Insights.
Which licence covers which service
- Accounts and payments
- Central Bank of the UAE licence
- Digital asset custody
- VARA licence no. VL/2024/12/001
- Zand AED issuance
- Zand Trust, not Zand Bank PJSC
- Account for a virtual asset business
- eligibility to be confirmed
Bank custody compared with exchange custody and self-custody
Three ways to hold digital assets, and what each costs in control, effort and access. Every option has a drawback, including this one.
| Criterion | Bank custody at Zand Bank | Exchange custody | Self-custody |
|---|---|---|---|
| Who holds the keys | The bank, in HSMs in the UAE | The trading venue | Your own team |
| Segregation of client assets | Dedicated wallets for each client | Depends on the venue and its terms | Not applicable: no third party |
| Supervision of the custodian | VARA licence no. VL/2024/12/001 for Custody Services | Depends on the venue's licence and jurisdiction | None: there is no custodian |
| Who can use it | Institutional Investors and Qualified Investors only | Set by each venue | Anyone with the technical means |
| Assets covered | Four networks listed, full list to be confirmed | Often the longest list | Whatever your wallets support |
| Work on your side | Onboarding documents, then user roles on the platform | Account opening | Key generation, backups, signing policy, staff controls |
| Main drawback | Restricted investor classes, onboarding effort, a shorter asset list than an exchange | Assets sit with a trading counterparty | Nobody else can recover a lost or stolen key |
The table describes the models in general. It is not advice on which to choose.
Frequently asked questions
Six questions that institutions ask before onboarding. Short answers on eligibility, networks and fees are among the custody questions in the FAQ.
Is Zand Bank licensed to hold digital assets?
Yes. Zand Bank PJSC holds VARA licence no. VL/2024/12/001, a VASP Licence for Custody Services that the Dubai Virtual Assets Regulatory Authority issued on 9 December 2024. The register shows the status as Active and limits the service to Institutional Investors and Qualified Investors. The licence covers Custody Services and no other virtual asset activity. Each field can be checked on the VARA public register entry for Zand Bank P.J.S.C.
What happens to client assets if the bank fails?
Client assets are held in dedicated wallets, apart from the bank's own assets. The custody FAQ rests bankruptcy remoteness on three points: UAE federal law on assets held in custody for a third party, the VARA Custody Services Rulebook and the Custody Service Terms & Conditions. The pages reviewed do not say how assets would be returned or how long that would take. Take legal advice on your own position.
How are withdrawals approved?
Withdrawals pass a four-eye check on every transaction authorisation, so two people approve the same instruction. The platform also supports wallet address whitelisting, where the client records destination addresses in advance. An approved transaction is signed with keys held in hardware security modules. Approval roles, limits and whether a transfer can go to an address that is not whitelisted are not published.
Can a virtual asset business also hold a bank account with Zand Bank?
It can apply, and approval is not promised. Zand Bank provides banking services under its licence from the Central Bank of the UAE and custody under VARA licence no. VL/2024/12/001, so both come from one institution. The eligibility criteria for virtual asset businesses are not published. Read about the corporate bank account for UAE companies, then raise the question with a Relationship Manager.
Is there an API for the custody platform?
Not as a published product yet. The live custody page marks API integration as "coming soon" and gives no date or scope. Until Zand Bank confirms the status, plan to use the custody platform itself for addresses, whitelisting, transactions and statements. The APIs that Zand Bank does describe are for banking: virtual IBANs, payments, reconciliation and reporting.
How does custody onboarding work?
Onboarding runs through a dedicated Relationship Manager, who assists with the documentation and with account and wallet set-up. Once the account is set up, the platform provides wallet addresses for the supported networks and tokens. The list of documents and the time onboarding takes are not published. To start, write to [email protected].
Regulatory disclosure
Digital asset custody is provided by Zand Bank PJSC, which is regulated by the Dubai Virtual Assets Regulatory Authority (VARA) under VARA licence no. VL/2024/12/001, a VASP Licence for Custody Services issued on 9 December 2024. The licence permits service to Institutional Investors and Qualified Investors only. It covers Custody Services only and is not a licence for exchange, broker-dealer, advisory or lending services in virtual assets.
Banking services are provided under a separate licence from the Central Bank of the UAE. Virtual assets do not benefit from any form of financial protection.
This page is information for Institutional Investors and Qualified Investors. It is not financial, investment, legal or tax advice, and it is not an offer to anyone the licence does not permit Zand Bank to serve. Read the risk disclosure for virtual assets before you transfer anything. Register fields are set out in the VARA licence VL/2024/12/001 details, and owners and directors are on the page about Zand Bank leadership and licences.
- Entity
- Zand Bank PJSC
- Regulator
- Dubai Virtual Assets Regulatory Authority
- Licence
- VASP Licence, VARA licence no. VL/2024/12/001
- Activity
- Custody Services
- Issued
- Condition
- Institutional Investors and Qualified Investors
- Status
- Active
- CMA registration no.
- CMA-VASP-0010000-0023
- Register
- VARA public register entry
- Register read on
Talk to the digital assets team
Ask about eligibility, supported assets and the fee tiers for your institution. The team answers at [email protected].