Overview

Ripple Custody (Wallet) provides multiple layers of security controls to protect your digital assets. Policies, approvals, and MPC signing work together to ensure that only authorized transactions are executed and that your wallet keys remain secure.

1. Policies define what transactions are allowed (amounts, destinations, frequency). Destinations outside your organization must be registered in the address book.
2. Approvals ensure human oversight before execution.
3. MPC quorums cryptographically sign approved transactions.

For the full transaction pipeline, see Policy evaluation.

Transaction policies control what outgoing transactions your wallets can execute. Every wallet is deposit-only until it has an active policy for an asset. Policies set per-transaction, rolling, and lifetime limits, and can restrict destinations and initiators.

See Policies for details.

Approval groups add a human authorization layer to transactions. Before a transaction is submitted to the blockchain, designated approvers must review and approve it through the web console or mobile app.

Key features:

• Configure approval groups for transactions, addresses, policies, and more
• Set minimum required approvers (for example, 2 of 3 must approve)
• Configurable timeout periods for approval windows

See Approvals for how approvals work, and Configure approval flows for setup instructions.

Multi-Party Computation (MPC) quorums split wallet private keys across multiple devices, ensuring that no single device holds the complete key. When a transaction requires signing, multiple devices must participate to create a valid signature.

MPC quorums support:

• Mobile devices: Manual review and approval via the Ripple Custody (Wallet) Mobile app
• CloudSign devices: Programmatic signing for high-volume operations
• Mixed quorums: Combination of mobile and CloudSign for flexibility

See MPC quorums for configuration details.