Tokenised asset custody, security and compliance: ISO 27001, safeguarding and sandboxes
Tokenised asset custody (US spelling: tokenized) and security at Ctrl Alt rest on dated evidence: the Dubai Land Department project uses Ripple's institutional custody technology (announced 16 July 2025), ISO 27001 certification was announced on 7 November 2025 and granted by NQA, and Ctrl Alt Ltd holds a Gate 1 Sandbox Approval Notice dated 4 December 2025 in the Bank of England and FCA Digital Securities Sandbox, the testing stage before any live activity.
UK United Kingdom: Don't invest unless you're prepared to lose all the money you invest. This is a high-risk investment and you are unlikely to be protected if something goes wrong.
AE Dubai (VARA): Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner or investor in a Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection.
Our services can only be used by professional or institutional investors. When investing, your capital is at risk. The value of an investment may go down as well as up and past performance is not a reliable indicator of future results.
| Claim | Issuer | Date | Where to check |
|---|---|---|---|
| ISO 27001 certification | NQA | Announced | Ctrl Alt press release of that date. Certificate: Not published |
| Digital Securities Sandbox, Gate 1 Sandbox Approval Notice for Ctrl Alt Ltd | Bank of England | Bank of England sandbox dashboard | |
| Synchronisation Operator in the Synchronisation Lab | Bank of England | Announced | Ctrl Alt press release of that date |
| Ripple institutional custody technology for the Dubai Land Department project | Ripple and Ctrl Alt | Announced | Press release of that date, and the issuer's whitepaper for TRE-1110 |
| Ctrl Alt Ltd: authorised and regulated firm, FRN 1045023 | Financial Conduct Authority | Announced | FCA Register search |
| Ctrl Alt Technologies Limited: investment firm under MiFID, reference C571300 | Central Bank of Ireland | Announced | Central Bank of Ireland register entry |
| Ctrl Alt Corporate Services Limited: fiduciary and investment licences, GFSC reference 3085959 | Guernsey Financial Services Commission | Announced | GFSC register entry |
| Ctrl Alt Solutions DMCC: VASP Licence VL/25/05/002 | Virtual Assets Regulatory Authority | Issued | VARA public register entry |
Press releases are named by date. Where this page says "Not published", the item could not be found on the live site and is not claimed.
Certifications
Ctrl Alt announced certification to ISO 27001 on 7 November 2025. The release says the certificate was granted by NQA, which it describes as an independent, UKAS-accredited auditor. ISO 27001 is the international standard for an information security management system. A certificate shows that such a system exists and has been audited against the standard. It does not certify a product, a ledger or a smart contract.
A certificate is only as useful as its scope. Three details decide what it covers, and none of them is published.
- Certificate number
- Not published Identifies the certificate when you ask the issuer to confirm it.
- Scope statement
- Not published Which entities, offices and systems sit inside the certified boundary.
- Expiry and surveillance audits
- Not published The date the certificate runs to and the date of the last surveillance audit.
- Other assurance reports
- Not published No SOC 2 report and no penetration test summary is published.
Tokenised asset custody and key management
Who holds the keys to tokenised assets depends on the custody model. There are three common ones. In self-custody the investor keeps the private key in a wallet of their own. In third-party custody a separate custodian holds the keys for the investor. In issuer-hosted custody the issuer or its agent runs the wallets and keeps the register that maps each wallet to an investor. The model decides who can move a token and whose failure the investor is exposed to.
One model is on the public record for Ctrl Alt, for one programme: the Dubai property tokens. The background is in the guide to custody in the Dubai Land Department project.
Custody model: issuer-hosted wallets
The Dubai property tokens sit in custodial wallets hosted and controlled by the issuer, Ctrl Alt Solutions DMCC. The issuer keeps the mapping between wallet addresses and investors. Private wallets are not supported, and tokens cannot be transferred outside the issuer's ecosystem. The whitepaper names no separate third-party custodian.
Key management: hardware security modules
The wallets use hardware security module technology provided by Ripple Custody under an outsourcing agreement. Ctrl Alt announced that it uses Ripple's institutional custody technology for the Dubai Land Department project on 16 July 2025. Not published Signing policy, approval quorum, key backup and recovery.
Custody for other mandates
Not published Custody providers for mandates outside the Dubai programme, and whether assets are segregated client by client.
Insurance
Not published Cover for tokens in custody: carrier, limit and scope. No cover is claimed on this page.
Safeguarding of client assets
Ctrl Alt Ltd is authorised and regulated by the Financial Conduct Authority (FRN 1045023). Where it is responsible for safeguarding client assets, it states that appropriate segregation measures, systems and controls are in place, and that it oversees third-party custodians.
The Financial Services Compensation Scheme protects eligible investors up to £85,000 per person per authorised firm. Ctrl Alt Ltd adds that the investments it arranges may not always be covered by an equivalent investor compensation scheme.
The Dubai property tokens are asset-referenced virtual assets (ARVA). An ARVA is not covered by any investor protection or deposit guarantee schemes, and VARA's Issuance Rulebook, Annex 2 requires all marketing of one to say so.
The same annex requires an issuer to disclose on its website, at least monthly, the number and value of tokens in circulation and whether they are fully backed, and to commission an independent audit every six months. It also sets a floor for paid-up capital: at least the higher of AED 1,500,000 and 2% of the average reserve value. Not published The auditor's name, and where the monthly figures and audit reports appear.
The risks that safeguarding does not remove are listed under risk disclosure by jurisdiction.
Regulatory sandboxes and market infrastructure
Digital Securities Sandbox
The Digital Securities Sandbox is run by the Bank of England together with the FCA. The Bank describes it as a regulated live environment for the notary, maintenance and settlement of financial securities, alone or combined with operating a trading venue. It is due to run until , and entrants move through three gates.
Gate 1: testing
Ctrl Alt Ltd holds a Gate 1 Sandbox Approval Notice dated 4 December 2025. Stage on record
Gate 2: go-live under initial limits
Approval at this gate is what permits live activity.
Gate 3: scaling
Scaling of live activity inside the sandbox.
The Bank's dashboard records that the firm first passed Gate 1 as Alt Ltd on 26 March 2025, and that the notice was withdrawn and reissued to Ctrl Alt Ltd, the new entity. Ctrl Alt announced its approval into the sandbox on 3 April 2025. An entrant at Gate 1 has no permission to undertake live activity until it is approved at Gate 2. Sandbox status is evidence of supervised testing. It is not evidence of a live settlement service. The wider picture is in the guide on how the Digital Securities Sandbox fits UK regulation.
Synchronisation Lab
On 10 February 2026 Ctrl Alt announced that it had been approved as a Synchronisation Operator in the Bank of England's Synchronisation Lab. That release is the only source used here. The Bank's own list of lab participants was not opened for this page.
Ledgers and smart-contract assurance
| Ledger | On record for | Date |
|---|---|---|
| XRP Ledger | Dubai Land Department's Real Estate Tokenization Project, for which it was selected as the blockchain | Launched |
| Solana | Ctrl Alt's first tokenised structured product, issued through a Guernsey-domiciled vehicle with legal structuring by Carey Olsen | Announced |
Ctrl Alt also helped design XLS-68d, "Sponsored Fees and Reserves", an amendment to the XRP Ledger, with Ripple and the XRPL developer community. No list of supported ledgers is published.
Smart-contract and code audits
Not published The firm that audits Ctrl Alt's smart contracts, the audit dates and the reports.
Compliance functions and policies
Three compliance roles are shown on the live site: a Global Head of Compliance, who is also Risk Officer and Money Laundering Reporting Officer for the Dubai entity, a Head of Compliance for the UK and a Head of Compliance for Ireland. They are given here as roles. The four entities they cover are set out with their licence numbers and register links.
The Dubai entity publishes eight policy documents as PDF files:
- Data Privacy Policy
- Risk Disclosure Statement
- Anti-Bribery and Corruption Policy
- Complaint Handling Procedures
- Whistleblowing Policy
- Broker Dealer Policy
- Website Terms of Use
- Virtual Asset Standards and VA Listing Policy
Reporting a security concern
- Where to report
- [email protected]. No dedicated security address is published.
- Official domain
- ctrl-alt.co. The published email addresses all end in @ctrl-alt.co.
- Official profile
- Ctrl Alt company page on LinkedIn
- Telephone
- No telephone number is published. Treat any caller who claims to be Ctrl Alt support with caution, and reply through the address above.
- Bug bounty
- None published
Incident history
None published No security incident or loss event is reported on the live site. That is an absence of disclosure, not a confirmed clean record.
Procurement pack and related pages
A security or procurement review needs documents, not web pages. When you request the procurement pack, name the entity you would contract with and ask for these four items.
- The ISO 27001 certificate with its scope statement
- The policy set that applies to the contracting entity
- The Gate 1 Sandbox Approval Notice entry for Ctrl Alt Ltd
- An extract of each licence from the regulator's register
Ctrl Alt does not provide investment advice or recommendations. This page is for information only and is not investment advice.
Ask for the evidence in writing
Tell us which entity you would contract with and which documents your review needs. Services are for professional or institutional investors only.