yields.digital
Institutional DeFi - Control & Role Architecture
Consolidated design · Technology, InfoSec, Asset Management & Risk Management frameworks applied
MiCA + DORA ALIGNED
Click role cards to view permissions
Governance & Oversight Layer
Applies to all tiers below
Owner - Board Level
Geographically distributed signers. Independent of investment function. Multi-sig 3-of-5 + HSM.
Upgrade authorityRole assignmentEmergency pause
Independent Risk Committee
Separate from investment team. Sets risk limits. Approves mandate changes. Art. 68 compliance (governance & record-keeping) - reviewed quarterly.
Sets limitsMandate approvalArt. 68 review
IAM / PAM Layer
Privileged Access Management for all signing roles. Mandatory MFA. Quarterly access reviews. Joiners/Movers/Leavers enforced.
PAM systemAccess reviewsMFA required
DORA ICT Framework
ICT risk management. 4-hour NCA incident notification. TLPT testing cadence. Third-party ICT risk register maintained.
4hr notifyTLPTICT register
Investment Decision & Execution Workflow
Pre-trade → Execution → Post-trade
1. Investment Decision
Portfolio Manager forms thesis. Mandate boundary check. Asset on approved list?
2. Pre-Trade Risk Gate
The client's gate checks yields.digital risk scores - asset and protocol risk, concentration, provisional MiCA classification - against its own mandate thresholds. Execution blocked if any threshold is breached.
3. Four-Eyes Approval
Transactions above threshold require dual sign-off. Risk Manager independently confirms. MPC policy enforces.
4. Signing Layer
MPC custody policy executes. MEV protection via private mempool. Address verified on hardware.
5. On-Chain Execution
Transaction broadcast via redundant RPC nodes. On-chain audit log updated.
6. Post-Trade
Reconciliation against on-chain state. NAV administrator updates share price independently. yields.digital evidence trail updated - Art. 68 record complete.
Key Management
EOA (single private key) is not acceptable for any operational role managing client assets. All operational signing requires MPC minimum.
On-Chain Multi-sig
Multi-sig Platform
3-of-5 threshold. Signers geographically distributed. Each signer independent.
Owner operations only
HSM
Hardware Security Module. HSM Provider. Air-gapped environment.
High-value signing + key storage
Off-Chain MPC
MPC Custody Provider
Off-chain key split. Presents as single signer on-chain. Policy-enforced.
Signing layer - Admin + Portfolio Mgr
Secondary MPC Provider
Secondary / failover MPC provider. Reduces concentration on single vendor.
Backup signing + qualified custody
Smart Account
On-chain programmable policy. Enforces spend limits, whitelists, time delays at contract level.
Automated parameter enforcement
Other Providers
Custody
Qualified CustodianQualified custody
Compliance
On-chain AnalyticsOn-chain analytics
Compliance ScreeningCompliance screening
Assurance
Smart Contract Auditor ASmart contract audit
Smart Contract Auditor BSmart contract audit
NAV AdministratorIndependent NAV calc
Legal CounselMiCA auth. opinion
Control Hierarchy
Tier 1
Institutional Allocator
Pension fund · Family office · Crypto hedge fund
Sets mandate Approves risk limits Receives independent NAV Conducts quarterly DD Direct yields.digital reporting
⇅
Tier 2 - CASP · Arts. 59, 66, 68, 81
Crypto Asset Manager
REGULATED
OWNER
Board / Legal Entity
Multi-sig 3-of-5 + HSM
▼ PERMISSIONS
RISK MANAGER
Independent Risk Function
MPC - observe, pause & risk limits
▼ PERMISSIONS
PORTFOLIO MGR
Investment Team
MPC -2-of-N policy
▼ PERMISSIONS
⇅
Signing & Execution Layer
MPC Custody Provider (Primary) · MPC Custody Provider (Failover)
Sits between Manager & Vault
MPC Policy Engine
Velocity limits, whitelist enforcement, dual-approval above threshold
MEV Protection
Private mempool provider. Prevents front-running of large vault transactions.
Address Verification
Hardware confirmation of destination address before broadcast. Prevents substitution attacks.
Redundant RPC
Self-hosted nodes with redundant provider failover. No single RPC dependency. DORA ICT resilience.
⇅
Tier 3 - Smart Contract Layer
Vault 7540 - Contract Components
Vault 7540 - Core Contract
Share issuance, redemption accounting, deposit and withdrawal interface
Strategy Contracts
Protocol interactions isolated per strategy. Separate audit surface per deployment.
Fee Contract
Independent fee calculation and extraction. Auditable. Prevents undocumented extraction.
Withdrawal Queue
Manages redemption sequencing for illiquid positions. Defines notice periods for allocator.
Upgrade proxy (UUPS) 72h time-lock minimum On-chain audit log Audited: Independent Smart Contract Auditors Board approval required pre-upgrade
⇅
Oracle & NAV Layer
Price Feeds · NAV Calculation · Independent Verification
Primary Price Oracle
Decentralised price feeds. Cross-validates against secondary feed. Deviation alert if >0.5%.
Secondary Price Oracle
High-frequency institutional feeds. Independent of primary feed. Manipulation cross-check.
NAV Administrator (Independent)
Calculates share price from verified feeds. Reports direct to allocator. Not via asset manager.
⇅
Tier 4 - DeFi Protocol Layer
Lending
Aave
Compound
Morpho
Spark
Gearbox
AMM / DEX
Curve
Uniswap
Balancer
Liquid Staking
Lido
Rocket Pool
Yield / Structured
Pendle
Governance risk note: Each protocol has its own governance token and voting process. External governance decisions (e.g. AAVE parameter changes) can affect vault positions without asset manager action. Risk monitoring must track protocol governance activity.
yields.digital
Independent Risk Intelligence Infrastructure
ARCHITECTURALLY INDEPENDENT

yields.digital provides independent, time-series risk scoring and intelligence across crypto-assets, protocols, pools, and chains. Operating entirely outside the control chain - with no asset-movement, parameter-change, or key-holding capability - our scores and reports carry the independence regulators and institutional allocators require. All data is sourced directly from on-chain state, not via the asset manager, ensuring no intermediation of the evidence trail.

MiCA Art. 68 MiCA Art. 66 MiCA Art. 81 DORA Art. 6
Ongoing Risk Scoring & Art. 68 Evidence Trail
REGULATORY
Proprietary risk scores across every asset, protocol, pool, and chain under management, on pool data refreshed every 2 hours. Each score is timestamped, and portfolio reports are stored with their source data and a tamper-evident integrity manifest - the basis of the evidence trail Art. 68 demands. An append-only immutable ledger is planned.
MiCA Art. 68MiCA Art. 66MiCA Art. 81
Risk ManagerCompliance TeamPortfolio Manager
Pre-Trade Risk Gate Intelligence
RISK CONTROLS
yields.digital risk scores, available through the API, can feed the client's pre-trade compliance gate before any execution is permitted - asset and protocol risk, concentration, and provisional MiCA classification, checked against the client's own mandate thresholds - giving the Portfolio Manager and Risk Manager a single, evidenced risk signal at the point of decision.
MiCA Art. 68MiCA Art. 66MiCA Art. 81
Portfolio ManagerRisk Manager
MiCA Asset & Protocol Eligibility
COMPLIANCE
Each asset carries a provisional MiCA classification (ART, EMT, other) in yields.digital reports, as an input to the client's own assessment against MiCA Arts. 4-6 (white paper obligation and content) and Art. 16(1) (ART authorisation). Continuous eligibility monitoring is planned. Supports the documented asset-level matrix FIN-FSA and other NCAs request in supervisory reviews.
MiCA Art. 4MiCA Art. 5MiCA Art. 6MiCA Art. 16(1)MiCA Art. 68MiCA Art. 66
Compliance TeamRisk ManagerPortfolio Manager
Alerts & Circuit Breaker (planned)
RISK OVERSIGHT
Planned: threshold-based alerts on protocol risk events, liquidity deterioration, smart contract anomalies, or compliance breaches, delivered to the client's systems. The vault's own circuit breaker, operated through the Risk Manager role, could then act on defined critical scenarios without waiting on a manual process.
MiCA Art. 68MiCA Art. 66DORA Art. 10DORA Art. 17
Risk ManagerBoard / OwnerCompliance Team
Protocol & Chain Risk Intelligence
RISK INTELLIGENCE
Proprietary risk scores across every integrated asset, pool, protocol and chain - covering market risk, liquidity depth and stability, fee generation, holder concentration, and chain activity. Enables the Risk Manager and Portfolio Manager to make and evidence decisions with a consistent, independent risk methodology.
MiCA Art. 68MiCA Art. 66MiCA Art. 81DORA Art. 6
Portfolio ManagerRisk ManagerCompliance Team
Institutional Reporting & AUM Support
AUM & OVERSIGHT
Automatically generates the institutional-grade documentation allocators require during due diligence: documented risk methodology, asset-level scoring history, decision rationale, and continuous monitoring evidence. The Art. 81 portfolio management suitability record is built as a byproduct of normal operations - not as a separate compliance exercise. Supports AUM growth by demonstrating the governance standard institutional capital demands.
MiCA Art. 68MiCA Art. 66MiCA Art. 81
Portfolio ManagerCompliance TeamInstitutional Allocator
Reporting Architecture
All lines direct - NOT via investment team
yields.digital→ Risk Manager
Risk reports and evidence trail; circuit-breaker alerts planned
yields.digital→ Allocator
Independent portfolio monitoring
yields.digital→ NCA / FIN-FSA
Regulatory submissions on request
NAV Administrator→ Allocator
Independent share price - not via asset manager
The Four Questions Serious Allocators Ask
1 - Who can move assets?
Portfolio Manager role within Owner-set limits. MPC 2-of-N policy. Four-eyes approval above threshold. Every movement on-chain, timestamped, captured in Art. 68 evidence trail.
2 - Who can change parameters?
Risk Manager role - independent of investment team, within board-approved ranges. Smart account policy enforces limits on-chain. Portfolio Manager cannot change risk parameters.
3 - Who can pause activity?
Risk Manager (circuit breaker - automatic on defined triggers) and Owner (multi-sig). Portfolio Manager cannot pause. Feeding yields.digital alerts into the circuit breaker is planned.
4 - Who can upgrade contracts?
Owner only. Multi-sig 3-of-5 with geographically distributed signers. 72-hour time-lock minimum. Fresh security audit required before execution. Board-level approval documented.
DORA & Regulatory Compliance Layer
DORA (EU) 2022/2554 + MiCA (EU) 2023/1114
ICT Incident Reporting
Major ICT incidents: 4-hour initial notification to NCA (from classification). 24-hour initial report. 72-hour intermediate report. 1-month final report (from resolution). Pipeline pre-built, not ad hoc.
Threat-Led Pen Testing (TLPT)
DORA mandates TLPT for entities identified by competent authorities (Art. 26). Signing infrastructure, vault contracts, and RPC layer in scope. Minimum cadence: every 3 years.
ICT Third-Party Risk Register
All critical ICT providers documented. Concentration risk assessed. Exit plans for critical providers required.
Business Continuity / DR
RTO and RPO defined for each system. Failover to secondary MPC provider if primary unavailable. Self-hosted RPC nodes as primary. Incident playbook documented.
yields.digital · Institutional DeFi Risk Infrastructure
v2.4 · 5 October 2026