Client Overview
Finary is a French fintech that gives individuals a single place to see and manage their entire net worth. Bank accounts, brokerage holdings, real estate, crypto, life insurance, and private equity are valued together in real time in one interface. Finary is regulated in France by the AMF and the ACPR as both an investment firm and a crypto-asset service provider, a status that carries institutional-grade requirements for how it protects the crypto assets it custodies.
Security Challenges Faced
Finary needed to generate and back up the recovery key protecting its crypto custody disaster recovery path through a formal key ceremony, a procedure that can only be executed once. A flaw in the runbook would not surface during the ceremony itself; it would surface only on the day the key was actually needed. No internal team member had run a ceremony of this kind before.
As a regulated investment firm and crypto-asset service provider, Finary needed the ceremony witnessed and documented by an independent third party with a demonstrated track record in crypto custody.
Halborn's Solutions
Custody & Key Management Advisory: Halborn reviewed the ceremony runbook Finary had authored internally before any key material was generated, returning specific, actionable changes rather than general best-practice commentary.
Key Ceremony Attestation: Halborn provided attestation to the ceremony, overseeing key generation on an isolated machine, threshold splitting of the backup key, and distribution of shares to designated holders, verifying and recording each step as it occurred.
Compliance Readiness Advisory: the attested ceremony record was structured so it could feed directly into Finary's regulatory documentation for the ACPR and its DORA resilience file.
Assets and Technologies Assessed
- Crypto custody disaster recovery key generation and backup procedure
- Threshold key-splitting scheme and share distribution workflow
- Isolated, air-gapped key generation environment
- Ceremony runbook documentation, including sequencing and verification steps
Results Achieved
Two procedural gaps in the runbook were identified and corrected before the ceremony was executed, closing risks that would otherwise have gone undetected until the recovery key was actually needed.
Finary ran multiple dry rehearsals ahead of the live ceremony and reached full readiness before executing the real procedure.
The attested ceremony record was accepted into Finary's ACPR custody documentation and DORA resilience file with minimal additional rewriting, an outcome beyond the original scope of the engagement.
The reviewed runbook became Finary's internal standard, now reused as the reference procedure for key rotation and for future ceremonies as the group of shareholders changes.
What Set Halborn Apart
Other vendors Finary had worked with tended to return a runbook with a page of generic best practices attached. Halborn engaged with Finary's actual procedure step by step, telling the team precisely which parts would not hold up under real conditions. For a one-shot operation with no opportunity to rehearse against real stakes, that level of specificity was exactly what Finary needed and had struggled to find elsewhere.
Finary’s Head of Security: "A key ceremony is the kind of thing you only get to do once. Having Halborn pull our runbook apart beforehand, then run the ceremony with us, is the reason we were confident in the result."
Going Above and Beyond
More than reviewing a document, Halborn stood in the room for the moment that mattered most: Finary's engineering team and compliance team worked from the same runbook, verified by the same partner, without either side needing a translator between technical execution and regulatory expectation. That combination, a rigorous pre-ceremony review paired with an experienced team present on the day, is what let Finary move through an irreversible procedure with confidence instead of improvisation.
The engagement outlasted the ceremony itself. The runbook Halborn helped rebuild is now Finary's standing reference for every future key rotation, and the attested record it produced slotted directly into the company's ACPR and DORA regulatory files. Finary's engineering and compliance functions aligned around a single, independently verified procedure, and that alignment is what positions Finary's leadership to run future custody ceremonies, including changes to its shareholder group, on a proven internal standard rather than starting from a blank page.
