Digital asset operations glossary
The terms Client Focus uses in service descriptions, incident records and regulatory evidence, defined for technology and risk readers. Each entry links to the page where the term is applied.
Reference
Terms in operational use
Definitions describe how Client Focus applies each term in delivery. Where a term is defined by regulation, the regulation page carries the primary source.
A
- Allow-list
- A policy limiting transfers to approved destination addresses. It converts a value-at-risk problem into a change-control problem, because additions to the list become the sensitive action. Additions and removals are monitored as privileged events.Related: Secure
B
- Behavioral baseline
- The recorded normal pattern of a wallet, contract or counterparty, covering counterparties, amounts, timing and venues. Detection compares activity against the baseline instead of against generic thresholds. Baselines are reviewed as the client's business changes.Related: Artificial intelligence
- Bridge
- Infrastructure that moves value or messages between two networks, usually by locking assets on one side and issuing a representation on the other. Bridges concentrate value and privileged control, which is why they attract attackers. Cross-chain movement is monitored on both sides of the bridge.Related: Secure
C
- Custody
- Holding and safeguarding assets, and the keys that control them, on behalf of a client. On chain, custody is a key management discipline supported by segregation of duties and monitoring. Control failures usually appear in the approval path rather than in cryptography.Related: Exchanges and custodians
D
- Digital asset operations
- The engineering, network operations and security operations work required to keep a service running on blockchain networks. It covers the systems themselves, the people who watch them and the records that prove what happened. Client Focus delivers it as one operating model across Build, Run and Secure.Related: What we do
E
- Escalation chain (L1 to L4)
- The four documented levels an incident can travel, from the Watch Officer on shift to the operations lead and the client's accountable executive. Each level has a named owner and a time budget. Hops are timestamped so the chain can be reconstructed after the fact.Related: Run
- Evidence pack
- The assembled record of an operating period or an incident: timelines, access and change records, decisions, notifications and supplier assessments. It is produced from the operating system of record rather than reconstructed later. Evidence packs are the practical output of regulatory readiness work.Related: Trust and compliance
F
- Full node
- A node that validates and stores the chain state independently rather than trusting a third party's view of it. Institutions run full nodes so that balances, confirmations and contract state can be verified in house. Client diversity and verified builds reduce correlated failure.Related: Blockchain
H
- Hardware security module (HSM)
- A tamper-resistant device that generates, stores and uses cryptographic keys without exposing them. HSMs constrain where signing can happen and produce an auditable record of use. They protect the key, not the decision to sign, which is why approval controls matter separately.Related: Cybersecurity
- Hop-by-hop timestamp
- A recorded time for every transfer of an incident between people or systems. It is what turns a narrative of an incident into evidence a supervisor can test. DORA major-incident reporting and bank examinations both depend on it.Related: DORA
I
- ICT third-party risk (DORA)
- The DORA obligation to assess, contract for and monitor providers of information and communication technology services. For on-chain services the population includes node and RPC providers, indexers, oracles, bridges and analytics vendors. Each needs a named owner, a criticality assessment and a tested exit plan.Related: DORA
- Indexer
- A service that transforms raw chain data into queryable records for applications, reporting and reconciliation. When an indexer lags, customer balances and internal ledgers disagree even though the chain is correct. Indexers are third parties under supervisory third-party risk expectations.Related: Run
- Invariant monitoring
- Continuous checking of properties that must always hold, such as total supply matching reserve records or a vault never paying out more than it holds. A broken invariant is evidence of an exploit in progress rather than a suspicious pattern. Invariants are defined with the engineering team that wrote the contract.Related: Secure
K
- Key ceremony
- A scripted, witnessed procedure for generating, splitting or rotating keys. The artifacts are the script, the attendance record and the signed attestation that the script was followed. Auditors examine the ceremony record, not the cryptographic claim.Related: Trust and compliance
L
- Layer 1
- A base blockchain network that reaches its own consensus and settles its own transactions, such as Ethereum or Solana. Layer 1 operations include node and validator engineering, upgrade planning and fork readiness. Availability of the network is not the same as availability of the client's service on it.Related: Blockchain
- Layer 2
- A network that executes transactions separately and settles proofs or data back to a Layer 1, such as Base, Arbitrum or Optimism. Layer 2 introduces sequencer, bridge and withdrawal-delay considerations that do not exist on the base chain. Monitoring must cover the Layer 2 and its settlement path.Related: Tokenized deposits move to public networks
M
- Mint and burn
- The issuance and destruction of tokens that change circulating supply. Mint authority is a privileged role and every use of it should map to an approved instruction. Monitoring compares mint and burn events against the issuance policy in force.Related: Stablecoin issuers and payments
- Mixer
- A service that breaks the on-chain link between the source and destination of funds. Exposure to mixers is a common trigger for enhanced review and, in some jurisdictions, a sanctions concern. Mixer proximity is scored at the boundary rather than after settlement.Related: Exchanges and custodians
- Multi-party computation (MPC)
- A method of producing a signature from key shares held by separate parties so that no single party holds the whole key. It distributes custody risk but introduces operational complexity in share management and recovery. Quorum design and share custody must be documented and tested.Related: Cybersecurity
- Multi-signature
- A contract or wallet arrangement requiring several independent approvals before a transaction executes. Its strength depends on signer independence and on each signer verifying what they approve. Signer sets, thresholds and dormant signers are monitored continuously.Related: Lessons for signing operations
N
- Network operations center (NOC)
- The function accountable for availability and performance of the infrastructure a service depends on. For on-chain services that includes nodes, validators, RPC endpoints, indexers and the integrations behind them. Incident, problem and change management follow ITIL practice.Related: Run
- Non-custodial
- An arrangement in which a provider never holds the keys that control client assets. Client Focus is non-custodial: it monitors and operates, and clients retain control of their keys. Monitoring uses read access, forwarded logs and API integration.Related: Frequently asked questions
- Notification clock
- The measured interval between detection and an acknowledged notification to a named person at the client. Client Focus notifies within ten minutes of detection and expects client acknowledgment within fifteen. The clock, not the alert count, is the control that supervisors examine.Related: Alerts are not controls
O
- Oracle
- A mechanism that supplies external data, such as a price, to a contract on chain. Contract logic that depends on an oracle inherits that oracle's failure modes, including staleness and manipulation. Oracle behavior is monitored as a control, not assumed.Related: Cybersecurity
P
- Pause state
- A contract condition that halts transfers or specific functions, usually reserved for incident containment. Who may pause, under what authority, and how the state is restored must be decided before an incident rather than during one. Pause and unpause events are monitored as privileged actions.Related: Secure
- Permissioned network
- A blockchain where participation, and often validation, is restricted to identified parties, for example Hyperledger Fabric or Corda deployments. Permissioned networks simplify counterparty identity but do not remove operational, key management or change control obligations. Client Focus builds and runs both permissioned and public deployments.Related: Build
- Privileged role
- An address or key permitted to change how a contract behaves, for example an admin, minter, pauser or upgrader. Privileged actions are the highest-signal events in a contract's life and are treated as critical by default. Every grant and revocation is baselined against change records.Related: Privileged actions on-chain
- Proxy upgrade
- A change of the implementation contract behind a stable proxy address, which alters logic without moving assets. An upgrade that matches an approved change ticket is routine; one that does not is a critical security event. Upgrade authority and timelocks are part of the control record.Related: Cybersecurity
- Public blockchain
- A network open to any participant, where transactions are visible and finality rules are set by the protocol rather than by contract. Public chains do not close for weekends, holidays or maintenance windows. That property is the reason continuous coverage is an operating requirement.Related: What we do
Q
- Qualified custodian
- An entity that meets a regulator's standard for holding client assets, which varies by jurisdiction and client type. The designation carries record-keeping, segregation and reporting expectations. Operations must be able to evidence those controls on request.Related: US bank supervision
R
- Register of information
- The structured inventory of contractual arrangements for ICT services that DORA requires financial entities to maintain and report. It records criticality, substitutability and exit arrangements, not just supplier names. Supervisors use it to test concentration risk.Related: DORA
- Reserve attestation
- A third-party report on the assets backing an issued token at a point in time. Attestation depends on records the issuer's operations produce, including issuance history and reconciliation output. Gaps in the operating record become findings in the attestation.Related: GENIUS Act
- Risk intelligence
- Curated information about addresses, contracts, exploit patterns and threat actors used to enrich a detection. It shortens the time between an alert and a decision by supplying context the raw transaction lacks. Sources are versioned so a past decision can be explained.Related: Artificial intelligence
- RPC endpoint
- The interface an application uses to read chain state and submit transactions. RPC latency, error rates and rate limits sit directly on the critical path of deposits, withdrawals and settlement. A single dependent provider is a concentration risk that belongs in the register of information.Related: Node and RPC health as a security signal
S
- Sanctions screening
- Checking counterparties and addresses against sanctions lists before value moves. On chain this means screening addresses and their close counterparties, not only named entities. Screening decisions and their inputs are retained as evidence.Related: US bank supervision
- Security operations center (SOC)
- A continuously staffed function that detects, validates and responds to security events. In digital asset operations the SOC watches wallet, contract, validator and counterparty behavior as well as conventional infrastructure telemetry. C'ROC is the Client Focus blockchain security operations center.Related: Secure
- Separation of duties
- Structuring work so that no single team or individual can build, approve and operate the same control. Where a client or its supervisor requires it, Client Focus engineering and security operations run under independent reporting lines with separate access and change authority. The arrangement is documented in the service agreement.Related: Trust and compliance
- Severity framework
- The three-tier classification applied to every validated event, which determines who is notified and how fast. Severity is agreed with the client in advance rather than decided during an incident. It drives the escalation chain and the reporting record.Related: Secure
- Smart contract
- Program code deployed to a network that executes deterministically when called. Once deployed it is production software with money attached, subject to change control, monitoring and incident handling. Audit at deployment does not substitute for runtime monitoring.Related: Build
- Stablecoin
- A token designed to hold a stable value, typically against a fiat currency, backed by reserves held off chain. Issuance, redemption and reserve reporting are supervised activities in the United States and the European Union. Operations must reconcile on-chain supply with reserve records continuously.Related: GENIUS Act
T
- Tokenized deposit
- A bank deposit represented on a blockchain, redeemable at the issuing bank and reconciled to the core ledger. Tokenized deposits carry transfer restrictions and privileged-role governance that a general-purpose token does not. When they run on a public network, bank operating standards must extend to that network.Related: Tokenized deposits move to public networks
- Travel Rule
- The requirement to transmit originator and beneficiary information alongside a qualifying transfer between obliged institutions. Compliance depends on integration between the transfer path and the messaging layer, which is an operations problem as much as a policy one. Failures surface as unmatched transfers that must be investigated.Related: MiCA
V
- Validator
- A node that participates in consensus and proposes or attests to blocks, usually with staked capital and signing keys at risk. Validator operations combine availability engineering with key protection. Performance, peer health and finality are monitored continuously.Related: Blockchain
W
- Watch Officer
- The named analyst on shift who validates a detection, assigns a severity and opens an incident. The Watch Officer owns the event until it is closed or escalated to the next level. Every action is timestamped against the notification clock.Related: Secure
Put these terms to work on your estate.
Whether you are designing a new system, running one in production, or defending one, Client Focus brings engineering, network operations and security operations under one accountable model. Every request is reviewed by a principal of the firm.