Stablecoins and tokenised real-world assets are steadily moving out of experimental projects and into mainstream financial infrastructure. Banks, fintech companies and other regulated institutions are increasingly exploring them for payments, treasury operations and new ways of issuing or transferring traditional financial instruments. According to Blair Canavan, Director of Alliances for the Post Quantum Cryptography Portfolio at Thales, this shift is being driven less by novelty and more by practical business demand, improving settlement efficiency and creating new financial services for customers.
As adoption grows, however, the conversation can no longer stop at blockchain technology or protecting a private key. Financial institutions need to demonstrate that digital asset operations are secure, governed, accountable and resilient throughout the entire transaction lifecycle. The challenge is therefore becoming much broader: how do banks build digital financial infrastructure that customers, regulators and business partners can continue to trust as the technology scales?
Security Is No Longer Just About Protecting the Wallet
Private-key protection remains fundamental, but digital asset security now stretches far beyond the wallet itself. Institutions have to manage operational risk, insider risk, transaction approvals, compliance requirements and business continuity while making sure no single individual has unchecked control over sensitive processes. The environment surrounding the cryptographic keys has become just as important as the keys themselves.
This changes how financial institutions need to think about security architecture. Instead of asking whether a key is safe inside a secure device, they also need to know who can use it, under what circumstances, which policies apply, how every action is recorded and what happens if a system fails. A trustworthy digital asset platform therefore needs to combine technical security with organisational controls, accountability and operational resilience.
Six Capabilities Form the Foundation of Digital Asset Trust
Canavan describes a complete trust framework as a combination of several complementary capabilities. Security protects cryptographic assets, governance determines who can authorise transactions, compliance provides evidence that controls are operating correctly, while interoperability allows those protections to remain consistent across multiple blockchain networks and traditional banking systems. Resilience ensures the service can continue or recover safely when something goes wrong, while crypto agility prepares the organisation for future cryptographic standards.
The interoperability requirement is especially important because large institutions rarely operate inside one technology environment. A bank may use several blockchain networks while still relying on decades of conventional banking infrastructure behind them. Treating each platform as an isolated technology island can create fragmented controls, so institutions need common trust services capable of spanning both traditional and digital environments.
Good Governance Means Nobody Controls Everything
Governance may be the hardest part of the framework to implement because it requires organisations to deliberately distribute authority. Canavan argues that no individual, application or administrator should have complete end-to-end control over sensitive operations. One team might initiate a transaction, another reviews it, while additional approvals are triggered depending on the transaction value, destination or risk profile.
Policy engines can automate much of this process, ensuring that approval rules are applied consistently instead of depending entirely on manual judgement. Technology can enforce separation of duties, but the broader governance model remains an organisational responsibility because people still need to define who has authority and how that authority is exercised. The objective is not simply to add more approval steps, but to make sure trust is distributed rather than concentrated.
This is particularly important in digital asset environments because transactions can be difficult or impossible to reverse. A weak governance structure may allow one compromised account or malicious insider to cause enormous damage very quickly. Spreading authority across multiple roles provides an additional layer of protection before cryptographic systems are allowed to execute a sensitive action.
Auditability Needs to Be Designed In From the Beginning
Compliance becomes much easier when auditability is treated as part of the architecture rather than something added later. Institutions need reliable records showing who initiated a critical action, who approved it, which controls were applied and how the cryptographic operation was protected. Those records should feed directly into operational monitoring, governance systems and regulatory reporting rather than requiring investigators to reconstruct events manually after something goes wrong.
This approach benefits more than regulators. Detailed audit trails also help organisations investigate incidents, understand unusual activity and verify that internal policies are being followed consistently. When digital asset operations involve several platforms, counterparties and blockchain networks, having a complete record of what happened can become essential to understanding the full transaction lifecycle.
The organisations most prepared for regulation will therefore be those that can demonstrate controls continuously rather than scrambling to produce evidence only when regulators ask for it. In that sense, auditability becomes an operational capability rather than a reporting exercise.
Connecting New Blockchain Platforms to Old Banking Systems Is Difficult
One of the biggest challenges for banks is that new digital asset platforms are normally added to existing infrastructure rather than replacing everything overnight. Different blockchain networks may use different cryptographic systems, transaction models and governance rules, while legacy banking platforms have their own security requirements. Maintaining consistent policies across that mixture is considerably more difficult than securing a single environment.
This is why common security and trust services matter. Instead of designing completely separate controls for every blockchain, institutions can establish shared policies around identity, key management, approvals, monitoring and cryptographic authority. Those common services can provide a consistent security layer even when the underlying platforms are very different.
For established banks, this approach can also protect previous technology investments. Digital assets do not necessarily require ripping out mature banking systems and rebuilding everything around blockchain. The more practical strategy is often to connect new capabilities to existing infrastructure while ensuring trust and governance remain consistent across both.
Resilience Means More Than Having a Disaster Recovery Document
Digital financial services also need to remain secure when systems fail. Operational resilience is not simply about restoring servers from backup; institutions must recover without compromising cryptographic integrity, approvals or governance controls. A recovery process that restores availability while weakening the security model would hardly qualify as successful.
Canavan stresses that resilience plans also need to be tested regularly. A disaster recovery document can look convincing until the organisation discovers during a real incident that systems, teams and procedures do not work together as expected. Exercises help prove that people know their roles, infrastructure can recover and sensitive cryptographic assets remain protected throughout the process.
This becomes especially important as financial services grow more dependent on always-available digital infrastructure. Customers may expect digital asset transfers and payment services to operate around the clock, which leaves institutions little room for prolonged outages or uncertain recovery procedures.
Post-Quantum Cryptography Makes Crypto Agility More Important
Preparing for post-quantum cryptography is another part of the long-term security picture. In January 2026, the G7 Cyber Expert Group published a roadmap encouraging financial institutions to move critical systems toward post-quantum cryptography between 2030 and 2032, with a broader transition target around 2035. Google has separately committed to completing its own post-quantum migration by 2029.
Canavan argues that institutions should not respond with panic. The important lesson is that cryptography has always evolved, and systems should be designed so algorithms, keys and certificates can be replaced without rebuilding the entire architecture. That capability, often described as crypto agility, allows organisations to adapt not only to quantum-resistant standards but also to future regulatory and industry changes.
For banks that have not begun preparing, the first step is understanding where cryptography is already used across the organisation. From there, they can assess whether existing platforms can support future algorithm changes and develop a phased migration plan rather than waiting until deadlines create an emergency. Canavan describes post-quantum transition as a journey, making early assessment far more practical than an eventual last-minute migration.
Hardware Security Modules Remain a Core Trust Anchor
Hardware Security Modules, or HSMs, remain one of the foundational components underneath this broader model. They provide a certified hardware environment for creating and protecting cryptographic keys, but their role becomes more powerful when connected with governance policies, identity systems, transaction workflows and compliance processes. An HSM can then help ensure that cryptographic authority is exercised according to policy rather than simply storing keys safely.
That role will become increasingly important as institutions begin adopting new cryptographic algorithms. HSMs can provide a stable trust anchor while the algorithms and surrounding systems evolve, helping organisations modernise without losing control over their most sensitive cryptographic operations. The device therefore becomes part of a larger security architecture rather than an isolated appliance sitting in a data centre.
Final Thoughts
The financial institutions that succeed with digital assets may not necessarily be the ones that adopt blockchain technology first. The stronger advantage is likely to belong to those that build security, governance, compliance, interoperability, resilience and crypto agility into their platforms from the beginning. Organisations that optimise only for speed may eventually discover that retrofitting those foundations after deployment is considerably harder.
Digital finance is ultimately a trust problem as much as a technology problem. Customers need confidence that assets are secure, regulators need evidence that controls are working, and business partners need assurance that transactions can be conducted consistently across multiple networks. Protecting the private key remains essential, but it is only one part of a much larger operational environment.
As stablecoins, tokenisation and digital assets become increasingly integrated into mainstream financial services, the institutions best prepared for the future will be those whose infrastructure can evolve without sacrificing control. The goal is not simply to build something that works today, but something that can continue to be trusted as regulations, technologies and cryptographic standards change.
Comments 0