Custody & Security

Choosing self-custody means you alone are responsible for safeguarding your private keys or seed phrases, which carries a significant risk of permanent loss due to hardware failure, theft, or simple human error. Xapo Bank removes this technical burden by offering institutional-grade custody. Through Multi-Party Computation (MPC), your security keys are stored as independent, distributed shares. This eliminates any single point of failure and guarantees Xapo Bank cannot independently access your funds.

We manage the complex cryptographic infrastructure for you, providing absolute peace of mind that your wealth is protected without the anxiety and vulnerabilities associated with managing a personal hardware wallet.

Xapo Bank protects customer funds by utilising advanced Multi-Party Computation (MPC) technology, which splits private keys into multiple "shards" distributed across different secure locations to eliminate any single point of failure.

This security model ensures that no single shard or location can authorise a transaction, effectively preventing unauthorised access. Additionally, all transactions are governed by rigorous, multi-layered approval protocols and human verification steps to ensure assets are only moved by the verified owner. This institutional-grade security framework allows for instant asset availability without compromising on security.

Xapo Bank understands the importance of ensuring that your digital assets are fully backed by reserves. Unlike many other cryptocurrency platforms, we do not operate a fractional-reserve system for your digital assets. Every Bitcoin you hold with Xapo Bank is backed one-to-one (1:1). We never lend, rehypothecate, or leverage your digital assets without your explicit consent. This rigorous standard ensures that your funds are fully reserved and always available for withdrawal exactly when you need them.

Because Xapo Bank is a fully regulated and authorised credit institution, your fiat deposits are afforded robust regulatory protections. All your eligible fiat deposits, including your funds held in USD Savings, are covered by the Gibraltar Deposit Guarantee Scheme (GDGS) up to a maximum of the US Dollar equivalent of £120,000 (subject to prevailing exchange rates on the compensation date).

Furthermore, we maintain stringent capital and liquidity reserves that exceed traditional banking standards.

Your Bitcoin is safeguarded through a powerful combination of advanced cryptographic technology and world-class physical security.

We utilise Multi-Party Computation (MPC) to distribute your private key shares across secure, enterprise-level servers, effectively eliminating any single point of failure. This makes it extremely difficult for bad actors to gain access to your Bitcoin wallets at Xapo Bank. For maximum security, you can also deposit your Bitcoin to the Xapo Vault, which introduces intentional friction through a 48-hour withdrawal timelock. Should you require greater flexibility, you can still rest assured that all Xapo Bitcoin accounts are secured by our robust MPC infrastructure.

To ensure the absolute utmost protection, the physical infrastructure housing these systems includes military-grade physical bunkers. This approach marries Xapo’s legendary physical security with the resilience and accessibility of modern institutional custody.

Yes, absolutely. Your Bitcoin and fiat assets are strictly segregated from Xapo Bank’s own corporate and operational capital. We maintain distinct, ring-fenced accounts for member funds. In the highly unlikely event of institutional insolvency, this strict legal and operational segregation ensures that your wealth remains entirely yours and is completely protected from the bank's creditors.

Yes. Xapo Bank is built to meet the rigorous compliance, security, and treasury management needs of corporate entities, family offices, and institutional clients. Our institutional custody framework supports multi-user access controls, robust corporate governance protocols, and comprehensive financial reporting. This allows businesses to securely hold Bitcoin on their balance sheets, backed by the legal protections of a fully regulated bank and the security of a military-grade, MPC-powered vault infrastructure.

The mandatory 48-hour timelock delay on the Xapo Bank BTC Vault is a deliberate security buffer engineered to protect you against digital theft, account compromise, or physical coercion. If a bad actor accesses your device or forces you to initiate a withdrawal, the funds do not move immediately. Instead, you have a massive 48-hour window to log in from a secure device, detect the unauthorised activity, and instantly cancel the transfer via the app before a single Satoshi leaves our institutional custody framework.

No. For strict security reasons, no one—including Xapo Bank Support, engineers, or executives—can bypass, override, or accelerate the 48-hour waiting period on Vault withdrawals. This hardcoded operational constraint is a vital defense mechanism designed to mitigate the risk of social engineering attacks, insider threats, or administrative manipulation. Because the security protocol cannot be altered by human intervention, your long-term wealth remains insulated from external pressure.

No, Xapo Bank does not utilise a traditional 12-word or a 24-word seed phrase to secure your digital assets. While standard self-custody wallets force you to manage and physically write down a single recovery phrase, our institutional-grade custody relies on advanced Multi-Party Computation (MPC) technology. Instead of a single text phrase that can be stolen, lost, or misplaced, your cryptographic keys are split into independent digital shards distributed across secure enterprise servers, eliminating the vulnerabilities of old-school seed phrase management.

The Xapo Bank app fully integrates native biometric authentication, allowing you to use your device's fingerprint or Face ID sensors to shield your wealth from unauthorised local access. In line with modern mobile security standards, your biometric data is isolated exclusively within your phone’s hardware security enclave (such as Apple's Secure Enclave or Android's Trusted Execution Environment). Xapo Bank never sees, stores, or transmits your actual biometric prints to our servers. Enabling biometrics provides you with instant, seamless account access while creating an impenetrable digital barrier if your mobile device is ever lost, cloned, or physically stolen.