Services

Consulting for custody, wallets and tokenization

I work with firms that hold or move digital assets on behalf of their clients: custodians, exchanges, stablecoin issuers, tokenization platforms and banks entering digital assets. The engagements below are fixed-scope and fixed-fee: the deliverables and the price are agreed in writing before work begins.

I build these systems in production for regulated financial institutions, including tokenized deposit infrastructure inside a global bank. Remote, CET timezone, B2B. Everything I learn about your systems stays under NDA. How I think about these problems is public: field notes on custody engineering.

Engagements

Custody architecture review 2 weeks · fixed fee
I review your custody or wallet stack end to end: key management and signing flows, deposit detection, transaction lifecycle and reorg handling, ledger integrity, segregation of client assets. You receive a written report with findings ranked by severity, remediations in the order I would apply them, and a walkthrough session. Firms commission this before an audit, after an incident, or when they inherit a system nobody fully understands.
Evidence-readiness assessment 1-2 weeks · fixed fee
Supervisors and auditors will ask a MiCA-licensed CASP or EMT issuer to show, on demand, that its register of positions matches what sits on-chain. I assess how you reconcile internal ledgers against chain state today and map the gaps against Article 75, the record-keeping RTS and DORA recovery requirements. You receive a reconciliation policy document and an evidence format your auditor can work with.
Fractional custody engineering retainer · limited capacity
I stay on retainer for teams that need custody expertise without a full-time hire: architecture decisions, code review of signing and ledger paths, incident support, build-vs-buy guidance on wallet infrastructure vendors. I take one engagement at a time.

How it works

Scope first
We start with a 30-minute call about your setup, then you receive a one-page scope with a fixed price. Discovery is part of the engagement, never a separate line on an invoice.
Read-only by default
Reviews and assessments require read access to code and documentation, and no access beyond that. I never take custody of keys or client assets.
Deliverables you keep
Reports, policy documents and evidence formats are yours. I write them so you can hand them to your auditor or your regulator without me in the room.

Contact

Write to contact@maciejlewandowski.dev with a short description of your setup and what prompted the request, or reach me on LinkedIn. I reply within one business day.