Zand Bank security: ISO 27001, ISO 27701 and SOC 2 Type II, with keys in onshore HSMs
Zand Bank holds ISO 27001 and ISO 27701 certification covering Web3 services, announced on , and a SOC 2 Type II attestation covering digital asset infrastructure and escrow, announced on ; custody keys are held in FIPS 140-3 hardware security modules located in the UAE.
Digital asset services: Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The investor can lose all the money or other value they invest, and does not benefit from any form of financial protection. Virtual asset risk disclosure
Proof at a glance
- ISO 27001
- Announced
- ISO 27701
- Announced
- SOC 2 Type II
- Announced
- Credit rating
- Fitch BBB+, stable outlook
- Key storage
- Hardware security modules in the UAE
- Authorisation
- Four-eye check on every custody transaction
- Last reviewed
Certifications and attestations
Each block gives the scope in the words of the bank's release, the date of the release and what is still open. The releases name neither the certification body nor the auditor, so those lines stay open until the certificate or the report is supplied.
ISO 27001: information security
ISO/IEC 27001 is the international standard for an information security management system. Zand Bank announced its certification with a scope that includes Web3 services such as digital asset custody and smart contract management.
The release calls Zand the "first bank in the Middle East" to reach this for Web3. That is the bank's claim and is not measured here.
- Certification body
- to be confirmed
- Certificate link and validity
- to be confirmed
- Announced
- Source
- Zand Bank release of 17 December 2025
- Verified on
ISO 27701: privacy
ISO/IEC 27701 extends ISO 27001 to the handling of personal data. Zand Bank announced it in the same release as ISO 27001 and with the same Web3 scope.
- Certification body
- to be confirmed
- Announced
- Source
- Zand Bank release of 17 December 2025
- Verified on
SOC 2 Type II
A SOC 2 Type II report is an independent auditor's opinion, under AICPA standards, on how a set of controls worked over a period of time. Zand Bank's release says the attestation covers digital and blockchain-based products, escrow services and digital asset infrastructure, and that it was completed against all Trust Services Criteria.
- Auditor
- to be confirmed
- Entities covered
- Zand Bank and Zand Trust
- Announced
- Source
- Zand Bank release of 17 April 2026
- Verified on
Credit rating
Fitch Ratings assigned Zand Bank an investment grade rating of BBB+ with a stable outlook, according to the bank's release of .
A credit rating is an agency's opinion on a bank's ability to meet its financial obligations. It is not a promise, it can change, and it says nothing about the price of any virtual asset.
Rating as published
- Agency
- Fitch Ratings
- Rating
- BBB+, investment grade
- Outlook
- Stable
- Source
- Zand Bank release of 23 June 2025
- Verified on
How digital asset keys are held
Whoever controls the private key controls the asset. These are the key-management facts Zand Bank publishes for its custody service. The service itself is described under how digital asset custody works at Zand Bank.
Hardware security modules in the UAE
Private keys are "protected in onshore UAE Hardware Security Modules (HSMs)", in the words of the custody launch release of . The product page describes the modules as FIPS 140-3 compliant. An HSM is a tamper-resistant device that creates and stores keys so that they are not exposed in plain form to the systems around it.
Signing schemes: multi-signature and TSS
Zand Bank lists two signing schemes: multi-signature and Threshold Signature Scheme (TSS). Both divide the power to sign, so that one key holder or one device cannot move assets alone. The sources used for this page do not say which scheme serves which network.
Cold storage and hot wallets
The service has two parts. Zand Vault is cold storage. Zand Wallet is a hot wallet with what the bank calls "Dynamic Wallet Temperature Switching". The product page lists cold storage allocation ratios among its controls. No ratio is given in the sources used for this page.
Transaction controls
Controls sit between an instruction and its execution. For custody, Zand Bank states "4-eye checks for every transaction authorization": one person enters a transaction and a second must approve it. The custody platform also lists wallet address whitelisting, transaction screening, fraud monitoring, KYT and Travel Rule compliance.
Corporate online banking applies the same idea to payments. The rules for each user are set in an authority matrix across six user roles. A sole proprietorship can be operated by a single user. Every other company needs at least two users to open an account: one enters the details and one authorises.
| Control | As published by Zand Bank |
|---|---|
| Four-eye check | "4-eye checks for every transaction authorization" in custody |
| Authority matrix | Sets the rules for each user of corporate online banking; transfer requests follow its workflow |
| User roles | Viewer, Inputter, Checker, Authoriser, Releaser, Administrator |
| Address whitelisting | Wallet address whitelisting is a feature of the custody platform |
| Screening | Transaction screening, fraud monitoring, KYT and Travel Rule compliance |
| Due diligence | KYC, KYT and KYW protocols |
| Network | Dynamic firewall policies |
| Verified on |
Segregation of custody assets
The custody FAQ says "each user's assets are segregated into dedicated wallets". It gives three bases for bankruptcy remoteness, the principle that assets held for a client are not available to the custodian's creditors:
- UAE federal law on assets held in custody for a third party;
- the VARA Custody Services Rulebook, which requires segregation and forbids commingling with the bank's own assets;
- Zand's Custody Service Terms & Conditions.
This is the bank's description of a legal position and is not legal advice. Segregation does not protect a client against a fall in the value of the assets: read the risks that security controls do not remove. The roles of the two authorities are set out in what each regulator supervises.
Custody model
- Client wallets
- Dedicated to each client
- Bank's own assets
- Kept apart; no commingling
- Licence
- VARA licence no. VL/2024/12/001, Custody Services
- Investor class
- Institutional Investors and Qualified Investors
- Issuer of the licence
- Dubai Virtual Assets Regulatory Authority,
- Verified on
Protection of bank deposits
Money in a Zand Bank account is a bank deposit, not a virtual asset. Zand Bank PJSC is licensed by the Central Bank of the UAE and rated BBB+ with a stable outlook by Fitch.
Zand Bank names no deposit protection scheme, limit or eligibility rule on zand.ae, so this page names none. A licence and a rating are not a promise that deposits are protected.
Virtual assets in custody are not deposits. The risk warning at the top of this page applies to them.
Deposits
- Deposit-taking entity
- Zand Bank PJSC
- Supervisor
- Central Bank of the UAE
- Credit rating
- Fitch BBB+, stable outlook
- Deposit protection scheme
- to be confirmed
- Verified on
Insurance and incident history
Two proof blocks are open. They are shown here so that a reviewer can see what has not been evidenced yet.
Insurance
Zand Bank's custody page lists "Insurance Coverage Available" and names no insurer, limit or scope. Until those terms are published, this page makes no statement about insurance cover.
- Insurer
- to be confirmed
- Limit and scope
- to be confirmed
- Source
- Custody product page on zand.ae
- Verified on
Incident history
The sources used for this page record no security incident disclosure and no status page. That is an absence of published information. It is not a statement that no incident has occurred.
- Published incidents
- None recorded in the sources
- Status page
- None recorded in the sources
- Source
- Pages of zand.ae read for this page
- Verified on
Reporting fraud or a vulnerability
Report suspected fraud to [email protected] or call the Contact Centre on +971 600 502 328. The other channels are on the page to report fraud or contact support.
Security researchers can report a weakness under the Vulnerability Disclosure Policy that Zand Bank publishes on zand.ae.
Check the address before you sign in
Fraudulent messages often copy a bank's name and lead to a look-alike address. Corporate online banking is at corporate.zand.ae. Treat any message that asks for a password, a one-time code or a wallet key as suspicious. Do not follow its links, and report it.
Official domains and profiles
- Website
- zand.ae
- Corporate online banking
- corporate.zand.ae
- Zand AED, by Zand Trust
- zandtrust.com
- linkedin.com/
company/ joinzand - instagram.com/
zand_bank - Fraud reports
- [email protected]
Policies and documents
Zand Bank publishes its policies as PDF documents on zand.ae. Four of them bear on this page: the risk disclosure statement, the conflict of interest policy, the code of fair treatment and the internal audit charter 2025.
The SOC 2 Type II attestation covers Zand Trust as well as the bank. Reserve reports for Zand AED are a separate matter, covered under Zand AED reserve attestations. How the services are charged is set out under fees and charges.
Security questions
Is Zand Bank licensed and independently audited?
Zand Bank PJSC is licensed by the Central Bank of the UAE and holds VARA licence no. VL/2024/12/001 for Custody Services. Fitch rates it BBB+ with a stable outlook, and the bank has announced ISO 27001, ISO 27701 and SOC 2 Type II. People who search "is Zand Bank safe" should weigh these facts themselves: no licence, rating or audit removes risk.
How can a client obtain the SOC 2 report and the ISO certificates?
Ask your Relationship Manager or write to [email protected]. No public link to the report or the certificates was found in the sources used for this page. A SOC 2 report is normally a restricted-use document, so a confidentiality agreement may be required.
How do I report a suspicious message?
Forward it to [email protected] and do not open its links or attachments. If you have already entered a password or approved a transaction, call the Contact Centre on +971 600 502 328 at once. Zand Bank's sites are zand.ae, corporate.zand.ae and zandtrust.com. Treat a sign-in page on any other address as suspicious until the bank confirms it.
Need the reports for a vendor review?
Say which documents your review needs. The digital assets team or your Relationship Manager will tell you what can be shared and on what terms.