Ripple Custody (Wallet) provides multiple layers of security controls to protect your digital assets. Policies, approvals, and MPC signing work together to ensure that only authorized transactions are executed and that your wallet keys remain secure.
- Approvals – Set up approval workflows for transactions and operations
- Policies – Set limits on what can leave each wallet, and where it can go
- Address book – Register the counterparties and external addresses your wallets can send to
Related: MPC quorums – Configure multi-party signing with distributed key shards
- Policies define which transactions can go ahead: how much can leave per transaction, over a rolling window, and over a wallet's lifetime, scoped by destination and initiator. When you send from the console or the API, you must register destinations outside your organization in the address book. WalletConnect and passkey transactions aren't checked against it.
- Approvals ensure human oversight before execution.
- MPC quorums cryptographically sign approved transactions.
For the full transaction pipeline, see Policy evaluation.
Transaction policies control what outgoing transactions your wallets can execute. A wallet can only receive an asset until it has an active policy for that asset. A few operations aren't evaluated against policies, such as sweeps and passkey transfers. See Operations that bypass policies. Policies set per-transaction, rolling, and lifetime limits, and can restrict destinations and initiators.
See Policies for details.
Approval groups add a human authorization layer to transactions. When an approval group applies to a transaction, designated approvers must review and approve it through the web console or mobile app before Ripple Custody (Wallet) submits it to the blockchain. If no transaction approval group has approvers, ordinary transfers pass the approval stage automatically. See Approvals.
Key features:
- Configure approval groups for transactions, addresses, policies, and more
- Set minimum required approvers (for example, 2 of 3 must approve)
- Configurable timeout periods for approval windows
See Approvals for how approvals work, and Configure approval flows for setup instructions.
Multi-Party Computation (MPC) quorums split wallet private keys across multiple devices, ensuring that no single device holds the complete key. When a transaction requires signing, multiple devices must participate to create a valid signature.
MPC quorums support:
- Mobile devices: Manual review and approval via the Ripple Custody (Wallet) Mobile app
- CloudSign devices: Programmatic signing for high-volume operations
- Mixed quorums: Combination of mobile and CloudSign for flexibility
See MPC quorums for configuration details.