Dual control for wallet operations: who may move a stablecoin payment, and how you prove it

Dual control in wallet operations means that no one person can move money alone. One member of staff prepares a payment. A second, with separate credentials, approves it. The wallet releases funds only when both actions are on the record. The principle is old. Funds transfer desks have worked this way for decades.

What has changed is the settlement leg. A stablecoin payout is final once it confirms on a public blockchain. There is no correspondent to telephone and no window in which to pull the payment back. That raises the cost of one mistaken or dishonest release. This article sets out how to design dual control over wallet operations, how to govern the keys behind it, and what evidence to keep.

What does dual control mean in wallet operations?

Three terms get used as if they were one.

Segregation of duties splits a process across roles so that no single role owns it end to end. The person who onboards a supplier does not approve payments to that supplier. Dual control is narrower. It requires two people to complete one act, such as releasing a payout or changing a wallet address. Four eyes is the informal name for it.

Dual control wallet operations combine both. Duties are split by role, and the release step needs two sets of hands. The FFIEC Information Technology Examination Handbook treats dual control and segregation of duties as core internal controls, and expects them to be documented rather than assumed.

One distinction matters. Dual control governs authority, not accuracy. Two people who both misread an invoice approve the same wrong amount. Accuracy comes from validation and reconciliation.

Which steps in a stablecoin payout need separate hands?

Map the flow before you map the controls. A typical corridor payout has seven decision points, and each can be captured by one person if you let it.

They are beneficiary setup, any later change to those payee details, payment initiation, the screening disposition where an alert is cleared or escalated, approval of the payment, signing of the on-chain transaction, and reconciliation of the ledger against the chain and the bank statement.

The most abused step is not the payment. It is the second one. Changing a stored payee detail converts a legitimate payment into a loss, and it does so quietly, because the payment looks routine. Treat a change to beneficiary bank details or to a payout address as a dual control event in its own right, with its own approval record and a notification to the payee through a channel you already hold.

Screening disposition deserves the same care. If one analyst can raise an alert and clear it, the screening control is decorative. Separate the person who investigates from the person who signs off a release.

How do you build dual control wallet operations step by step?

The sequence below works for a credit union, a tier-2 bank or a licensed money service business. It assumes a payments ledger and a wallet, whether self-custodied or held with a custodian.

• Write the authority matrix first. List every action that moves value or changes where value goes. For each, name the role that may initiate, the role that may approve, and the limit above which a second approver is added.
• Enforce the matrix in the system, not in the procedure manual. A control that depends on staff remembering it is a training record.
• Give every operator a named account with its own credentials and strong authentication. Shared service accounts destroy dual control because the log cannot say who acted.
• Split initiation from approval, and make the approver unable to edit the payment. If the approver can change the amount, you have one person with two roles.
• Require a quorum of signatures for the on-chain release, held by different people on different devices, so the approval in the payment system and the signature on the chain are two separate acts.
• Make beneficiary and address changes a separate approval path, with callback verification to a contact detail held before the request arrived.
• Give reconciliation to someone outside the payment chain, reporting breaks to a manager who did not approve the payments.
• Test the chain quarterly by attempting a single-handed payment with a test record, and keep the result as evidence.

Order matters. Firms often start with the signing quorum, because it feels technical, and leave beneficiary changes on an email approval. That inverts the risk.

Dual control is not two clicks in the same session by the same person. It is two people, two credentials and two records, and a system that cannot be persuaded to accept one.

How should signing keys be governed under dual control?

The approval chain is worthless if one person holds a key that can move the balance. Key governance is part of the same control, not a separate project.

Use a threshold scheme. A multi-signature wallet or a threshold signing service requires several of a defined set of key holders to sign before a transaction is valid. Choose the quorum so that no single person, and no single team, can reach it. A common pattern is three of five, split across treasury, operations and a senior manager, with one share in escrow for recovery.

Then protect the quorum from collapsing. Document who holds each share, where it is stored and on what device. Keep two holders organisationally apart. Record key generation as a ceremony, with witnesses and a written record. The NIST Special Publication 800-57 recommendation on key management is the standard most auditors expect you to cite for the key lifecycle.

Offboarding is where quorums fail in practice. When a holder leaves, the share must be revoked and the quorum reconstituted, not passed to a successor by hand. Add that step to the leaver checklist.

If you hold assets with a regulated custodian, much of this moves to the provider. Your control then shifts to the custodian portal: who holds administrator rights, who can add a withdrawal address, and whether the provider enforces your approval policy or merely records it. Ask in writing during due diligence.

What evidence does an examiner or auditor ask for?

Evidence is the deliverable. A control you cannot demonstrate is not a control.

Expect requests for the authority matrix, with version history showing when limits changed and who approved the change. Expect a sample of payments traced from initiation through screening, approval and on-chain confirmation, with the user identity on each step. Expect the access list, with joiners and leavers reconciled to the human resources record. Expect the key holder register, the ceremony records, and the results of your own periodic tests.

Retention is easy to miss. Under the United States Bank Secrecy Act rules administered by FinCEN, records supporting transactions and the programme itself must be kept for five years, and that reaches approval logs, not only the payment record. Canadian reporting entities face an equivalent duty under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act administered by FINTRAC. A system that prunes audit entries after a year will fail the request.

The United States anti-money laundering programme rule also requires an independent review. Dual control over wallet operations sits inside that scope when settlement runs through your own wallets. Give the reviewer the authority matrix and the key register at the start.

One screening point ties the control to a reporting duty. The FATF 2021 Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers applies the Travel Rule above a de minimis threshold of USD or EUR 1,000, so the release approval and the originator and beneficiary data set must be captured together. Approving a release without that data set creates a gap that is hard to repair later.

Where does dual control break down?

Six failures recur, and none of them need a sophisticated attacker.

A break-glass account exists for emergencies and is never reviewed. A shared login means the log names a mailbox rather than a person. One individual holds two roles because the team is small, and no compensating control was written down. The vendor portal has an administrator outside the matrix. A test environment shares credentials with production. A delegation granted during leave is never withdrawn.

Small teams face a real constraint. With three people in operations, strict segregation may be impossible. The answer is not to pretend. Document the conflict, add a compensating control such as same-day review by a manager outside the team of every payment above a low threshold, and disclose it to your auditor. A documented compensating control is defensible. An undocumented gap is not.

Review the matrix on a schedule and after every reorganisation. Controls decay when roles move, and the decay is silent until something goes wrong.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins such as USDC and USDT on public blockchains and completes in minutes with on-chain auditability. Role based access separates customer, operator and compliance duties, and the compliance workbench records screening, KYB and KYC onboarding, KYT and FATF Travel Rule data against a tamper-evident audit trail, so an approval and the payment it released can be produced together. Payments are ISO 20022 native, with pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns tracked end to end by UETR. When you evaluate any provider, ask it to trace one payment from initiation to confirmation with the user identity on every step.