Prerequisites

• Introduction

Overview

In this article, we discuss how to choose the Vault structure that suits your business needs and requirements.

Think of the Fireblocks Vault as a safe room in a bank. The safe room contains many drawers, each with a different lock and key. As a Fireblocks customer, you control the Vault (safe room) and can organize the vault accounts (drawers) to your preference. Inside each vault account, you can create a wallet for each crypto asset. These wallets contain unique keys and addresses on the blockchain.

Vault Structures

When handling retail accounts there are two common approached for managing the vault structure and we will describe both of them in this article. While there are fundamental differences between them, both structures use the blockchain as a single source of truth ledger.

Segregated Vault Structure

The segregated Vault structure consists of individual vault accounts for each end client. Funds are stored in and invested from these individual accounts.

In a segregated Vault structure:

• Reconciliation is not needed since funds are kept directly in the individual vault accounts and never transferred to other vault accounts within your Vault.
• Tracking and auditing are simplified. Compliance is made easier since each transaction can be associated with the person who made it.
• On-chain transaction fees are usually considered the cost of doing business.
• Since funds can be invested directly from the end client's vault accounts, funds are available immediately in order to respond to changes in the market.

Omnibus Vault Structure

The sweep-to-omnibus Vault structure consists of a central vault account in addition to vault accounts for each end client.
Funds are deposited into the individual vault accounts and then swept to the central vault account, where the funds can be kept or invested.

A common vaults structure for this architecture would be:

• Intermediate vault accounts: These are the vault accounts assigned to each end client. Because you could have numerous end clients, you can use the Fireblocks API to automatically generate as many intermediate vault accounts as needed.
• Omnibus Deposits: This is the central vault account where end-client funds are swept and stored.
• Withdrawal Pool: This is the vault account containing funds allocated for end-client withdrawal requests. More than one Withdrawal Pool vault account may be required due to blockchain limitations.

In an Omnibus Vault Structure:

• Reconciliation is completed during the on-chain sweeping transaction.
• Account management is simplified by using a single vault account for treasury management and investing.
• Treasury management capabilities are unlocked as funds are co-mingled and this allows for TradFi like trading (OTC Desks etc) and investments for multiple clients in a single transaction for operational costs saving.
• End-client deposit addresses remain private and unexposed to third parties since outbound transactions are sent from the Omnibus Deposits vault account.
• Since fund must be transferred twice (deposited then swept), you pay transfer fees on two occasions before you can invest the funds. To optimize the cost of transfer fees, you can sweep funds on a periodic schedule when fees are low. By doing so, you can deduct the expected fees from the originally deposited amount when crediting your end clients.
• Funds are not immediately available to respond to market changes since they should be swept only when transfer fees can be optimized.

The following diagram explains the Omnibus Vault Structure in a visual manner:

Use Cases

You can structure vault accounts based on your specific business use case. The following example structures are taken from common business use cases on Fireblocks. However, you can customize your Vault structure as needed to match your best practices.

Crypto-trading Business Segment

For the crypto-trading business segment, it's common to use a Segregated Vault Structure. In this structure, your company creates a vault account for each of your end clients or business use cases.

Example vault account structure:

• Proprietary assets
  • Treasury
  • Market making
  • OTC trading
• Customer assets
  • Collateral (for lending)
  • Withdrawals
  • Deposits
  • DeFi
  • Vault accounts for each corporate client, family office, etc.

A Segregated Vault Structure allows you to easily track each transaction for auditing, compliance, and Know Your Customer (KYC) purposes. This structure also allows you to keep your company's assets separate from its end-clients' assets and oversee different branches, strategies, and operations in the same workspace.

Retail Business Segment

For the retail business segment, It's common to use an Omnibus Vault Structure since retail customers mostly use API to automate scaling their business.

On Fireblocks, you can use API keys to generate intermediate vault accounts, identify incoming transactions, and sweep funds to the Omnibus Deposits vault account. We will later cover the creation of an Omnibus Vault Structure in the following article: Creating an Omnibus Vault Structure.

We will also cover the sweeping process in the following article: Sweeping within an Omnibus Vault structure.

When using the Omnibus Vault Structure, we do however need to consider the different asset types:

• UTXO
• Account Based
• Tag / Memo Based

You can further read on the following topics in order to have a holistic understanding of the Omnibus Vault Structure:

• Creating an Omnibus Vault Structure - to get a clearer picture on how to create and manage the deposit addresses & process.
• Sweeping within an Omnibus Vault structure - to get an example of a sweeping process.