# Financial Institutions

> Banks, asset managers, fintechs, payment firms, and financial infrastructure providers.

Canonical page: https://www.guvenkaya.co/solutions/financial-institutions

**Build a digital asset program whose controls hold in production.** We review custody, settlement, and wallet infrastructure for banks, asset managers, fintechs, and payment firms.

## Bring us in while the architecture can still change.

- **Before you choose architecture or vendors**: Evaluate custody, settlement, and wallet options while the architecture can still change.
- **When adding a product or integration**: Challenge a new custody provider, fintech partner, or core-system integration before it ships.
- **Before launch or external review**: Test whether controls, recovery, and evidence hold up to production and outside scrutiny.
- **When security work has piled up**: Findings, vendors, and open items have accumulated. We tell you what to fix first.

## A custody platform is only one part of the security model.

We review the custody platform alongside signing, identity, integrations, and recovery.

- **Ownership & approvals**: Who can approve what, who owns each control, and what happens when they leave.
- **Custody, signing & recovery**: Custody architecture, MPC and HSM models, signing policy, key ceremonies, and break-glass access.
- **Platforms & integrations**: Wallet, settlement, API, identity, and core-system boundaries reviewed as one system.
- **Launch & operating readiness**: Monitoring, incident response, change control, and remediation ownership before you go live.

## Engagement team

The team brings experience leading security inside operating companies.

- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Michal Bajor**, Specialist Advisor: Exchange, funding, custody, API, web application, red-team, and L1 security.
- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.

## Relevant services

- [Digital Asset Program Advisory](https://www.guvenkaya.co/services/digital-asset-program-advisory.md): Start here when custody, vendors, and architecture decisions need one independent security view.
- [Signing & Custody Security Reviews](https://www.guvenkaya.co/services/signing-custody-security-review.md): Use this when the signing stack, approval paths, or recovery model need focused challenge.
- [Risk Assessment](https://www.guvenkaya.co/services/risk-assessment.md): Use this when leadership needs to know the material exposure and what to address first.

## Tell us what you need to secure.

Describe the program, vendors you are considering, and decision deadline. We will help define the scope.

Discuss your scope: https://www.guvenkaya.co/contact