Designing a digital asset operating model

The essentials

An operating model assigns decisions, execution and evidence across a service. Start from the client instruction and follow the asset until the client ledger is updated. Technology, operations, risk and product teams need a shared definition of each state: received, approved, signed, broadcast, confirmed and reconciled.

How it works

For every transition, identify an owner, an independent check, a deadline and an exception path. A service diagram should show external dependencies such as signing providers, blockchain nodes and banking rails. A provider can execute a task while the institution retains responsibility for monitoring and escalation.

What to watch

Define who can change limits and who approves those changes. Separate routine processing from emergency intervention. Measure both completed instructions and unresolved exceptions: a high completion rate can hide a small number of old, material breaks. Review access and handovers when teams or suppliers change.

Build your analysis

A withdrawal crosses four teams: client service receives it, operations validates the instruction, a separate signing function authorises it, and accounting reconciles it. Draw the handover between each pair. At every handover, state what the receiver must know before accepting ownership. A message saying “done” is insufficient unless it names the completed state.

Extend the workshop

For the workshop, produce a one-page responsibility map. Include an absent approver, an out-of-hours request and a provider outage. Explain who can stop processing, who investigates the queue and what evidence permits resumption. Compare your map with the transaction states rather than with job titles alone.

Understand the details

A responsibility matrix is useful only when it resolves actual decisions. For a delayed withdrawal, name the person who investigates, the person who may suspend new withdrawals and the person who communicates verified information. Keep an instruction identifier that links the approval, signature and ledger entry without putting personal client data on-chain.

Boundaries and common mistakes

A role label is not evidence of independence. Two approvers using the same compromised account do not create two independent checks. Approval coverage must also exist outside normal office hours if the service continues operating.

The mechanism at a glance

Continue learning

Look up a term in the glossary →