Last Updated: 10.10.2025
Odin Pay s.r.o., a company registered in the Czech Republic, registration number 223 56 312 and having its official registered address at Olšanská 54/3 Prague 3 Žižkov 130 00, Czech Republic (the “Company”) implements proper safeguarding measures of protection of ownership rights of clients to their crypto-assets.
According to Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (the “MICA”), The Company shall implement adequate arrangements to safeguard the ownership rights of clients, and prevents the use of clients’ crypto-assets for its own account and The Company shall ensure that clients are informed in clear, concise and non-technical language about the key aspects of the Company’s systems, policies, and procedures to comply with what is mentioned above.
For this purpose, the Company has properly implemented the following measures, processes, policies, and procedures.
1. Segregation Of Crypto-Assets
1.1 The Company has established a comprehensive and secure framework for the segregation of clients’ crypto-assets from own crypto-assets of the Company.
1.2 The Company procures that the ownership rights of clients’ crypto-assets between clients are safeguarded and segregated.
1.3 The Company ensures that clients’ crypto-assets are not used for its own account and that the clients’ segregated crypto-assets are different to the Company’s operating crypto-assets.
1.4 The Company has developed and implemented proper processes in the Company, as well as developed and implemented proper installation in its internal systems, Odin Pay’s Platform, to ensure that the clients’ crypto-assets are distinct from the Company’s own crypto-assets.
1.5 Odin Pay’s Platform is related to the internal software platform of the Company, developed based on or linked to various third party software. It allows it to identify, verify and onboard clients, open account at the Odin Pay’s Platform, initiate instructions, orders, make exchanges and store crypto-assets.
1.6 Odin Pay’s Platform does not store clients’ crypto-assets, but the Company stores clients’ crypto-assets at a top-rated custody third party providers.
1.7 Regular checks are conducted to verify the separation of crypto-assets, ensuring ongoing compliance with the segregation requirement. These checks are coordinated by the Compliance Officer and Risk Manager.
1.8 Odin Pay’s Platform ensures that all clients’ crypto-assets it receives are transferred directly into clients segregated crypto wallet(s), rather than being first received into the Company’s operating crypto wallet(s) and then segregated.
1.9 The Company could consider diversifying placements of client crypto-assets with more than one crypto exchange where the amounts are, for example, of sufficient size to warrant such diversification.
1.10 In order that the Company may check that it has sufficient crypto-assets segregated in clients segregated crypto wallet/s to meet its obligations to clients, the Company calculates periodically the amount which should be segregated (the crypto-assets requirement) and compares this with the amount shown as its clients’ crypto-assets resource. The CFO is responsible for the calculation and reconciliation process, supported by the Risk Manager for risk control. Any discrepancies are promptly investigated and resolved.
1.11 The Company ensures that only limited and trusted personnel members have access to the separate wallet addresses where the clients’ crypto-assets are stored, as defined by the Access Management Policy, under the supervision of the CISO.
1.12 The Company has in place the Procedure on segregation of clients’ crypto-assets, Record Keeping Policy etc. which are duly implemented.
2. Customer Agreement Does Not Impact Ownership Rights Of Clients
2.1 Customer Agreement does NOT contain any clause, provision, any hidden wording, that could impact the ownership rights of clients to their crypto-assets saved at wallets opened by us to the clients.
2.2 When a client keeps crypto-assets at the Company, the client remains the owner of these crypto-assets.
2.3 In case of relations termination with a client, if a positive crypto-assets balance remains safe-kept by the Company, the Company is entitled to close the client’s account with Odin Pay’s Platform. The Company will transfer and keep the client’s crypto-assets separately until receipt of the client’s instructions on their transfer to the address provided by such client. And if such instruction is not delivered by the client, the Company is entitled to keep the balanced crypto-assets at a segregated crypto-assets wallet till receipt of the client’s instructions on their transfer to the address provided by the client, following the terms of the Customer Agreement.
3. Internal Control Measures
3.1 The Company implements internal control measures, including proper processes, ICT assets, and responsible personnel. The main areas of internal control in the Company are assigned to relevant Function Holders (e.g., AML Officer, Risk Manager, Compliance Officer) and include, among other things:
3.1.1 control over the safeguarding of the Company’s, its clients’ assets;
3.1.2 control over the achievement of the Company’s services;
3.1.3 control over the fulfilment by the regulatory requirements (MICA, DORA among them);
3.1.4 control over the effectiveness of the risk management system;
3.1.5 management of information security, crypto-assets safety, flows, including receiving and transmitting information, transactions, ensuring the functioning of the information security management system, which is led by the CISO and overseen by the ICT Security Officer.
3.2 The Company has in place the Internal Control Policy, Whistleblowing Policy, Conflict of Interest Policy etc. which are duly implemented.
4. Security And Information Security Measures
4.1 The Company employs appropriate and proportionate resources and procedures, including resilient and secure information and communication technology (ICT) systems.
4.2 The ICT risk management framework of the Company, overseen by the CISO and ICT Security Officer, includes strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all crypto-assets, personal data of clients, information assets and ICT assets.
4.3 The Company establishes specific requirements for protecting clients’ crypto-assets against unauthorized access. The Company has effectively implemented the access control.
4.4 The Company regularly backs up ICT assets, information assets.
4.5 The ICT risk management framework supports the Company’s business strategy and objectives by:
4.5.1 Aligning the management of the ICT risks with the Company’s core goals and business strategy;
4.5.2 Protection of crypto-assets of client and the Company. The ICT risk management framework helps protect these critical assets by identifying and mitigating risks, a process led by the Risk Manager and implemented by the CISO;
4.5.3 Compliance with the regulatory requirements governing the information security and clients’ crypto-assets protection;
4.5.4 Resilience and business continuity, enhancing the Company’s resilience by proactively identifying and mitigating these risks, ensuring business continuity even in challenging circumstances etc.
4.6 The Company has implemented the processes which enable addressing ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.
4.7 The Company has developed a sound, comprehensive and well-documented ICT risk management framework, which enables the Company to address ICT risk quickly, efficiently, and comprehensively. It also helps to ensure a high level of digital operational resilience that matches the Company’s business needs, size, and complexity.
4.8 The Company has implemented the following information security policies and procedures (including, but not limited to):
4.8.1 Acceptable Use Policy For Information And IT Assets;
4.8.2 Clear Desk And Clear Screen Policy;
4.8.3 Information Security Policy;
4.8.4 Information Security Internal Audit Procedure;
4.8.5 Asset Management Policy;
4.8.6 Business Impact Analysis Methodology;
4.8.7 ICT Disaster Recovery Plan;
4.8.8 Crisis Management Plan;
4.8.9 Backup Policy;
4.8.10 ICT Continuity Plan;
4.8.11 RACI Responsibility Matrix For It Service Disaster Recovery Phases;
4.8.12 Change Management Policy;
4.8.13 Digital Operational Resilience Strategy;
4.8.14 Digital Operational Resilience Testing Policy;
4.8.15 Information Classification Policy;
4.8.16 Human Resources Security Policy;
4.8.17 Access Management Policy;
4.8.18 Password Policy;
4.8.19 Remote Work Policy;
4.8.20 Risk Level Matrix (Heatmap);
4.8.21 ICT Risk Management Policy;
4.8.22 ICT Systems Procurement, Development, And Support Policy;
4.8.23 Encryption Policy;
4.8.24 Bring Your Own Device Policy;
4.8.25 Capacity And Performance Management Procedure;
4.8.26 Network Security Policy;
4.8.27 Information Security Incident Response And Business Continuity Plan;
4.8.28 Information Transfer Policy;
4.8.29 Incident Management Policy;
4.8.30 Incident Criticality Assessment Table;
4.8.31 Logging Policy;
4.8.32 RACI Matrix For Information Security Incident Response;
4.8.33 Supplier Security Policy;
4.8.34 ICT Service Exit Strategy;
4.8.35 Vulnerability And Patch Management Policy.
5. Business Continuity And Recovery Measures
5.1 The Company takes all reasonable steps to ensure continuity and regularity in the performance of its crypto-assets services.
5.2 The purpose of the business continuity processes is to:
5.2.1 Ensure that the Company has a framework in place to continue providing services to clients, in the event of an unexpected event or emergency;
5.2.2 Maintain high levels of services availability, data integrity, and resilience;
5.2.3 Continuously improve the Company’s business continuity strategies to adapt to evolving threats and risks.
5.3 The business continuity arrangements intend to:
5.3.1 Ensure the continuity of the Company’s critical or important functions;
5.3.2 Quickly, appropriately and effectively respond to, and resolve, all ICT and other incidents in a way that limits damage and prioritizes the resumption of activities and recovery actions;
5.3.3 Implement business continuity plan, where business continuity in relation to general business, and in particular, in relation to ICT as the part of the general business continuity etc.
5.4 The Company has allocated proper resources to ensure that the Company develops and implements appropriate prevention, reaction, and recovery models in alignment with business continuity objectives. The Management oversees resource allocation, while the Risk Manager ensures the models address identified threats.
5.5 The business continuity processes are designed to ensure that the Company can continue to operate while minimizing the impact of the disruption.
5.6 The Company procures that the systems critical to the operation of its business functions have sufficient stability by having an effective business continuity processes to address disruptive incidents or performance issues.
5.7 The Company has implemented the following documentation (including, but not limited to):
5.7.1 Business continuity policy;
5.7.2 Business continuity plan;
5.7.3 Response and recovery plan;
5.7.4 Communication plan.
6. Wind Down Measures
6.1 For the cases of the activity termination by the Company for various reasons, the Company has processes in place for settling financial obligations with clients, including the return of remaining balances.
6.2 The Company has effective procedures in place to return the clients’ crypto-assets in a timely manner. The CFO, supported by the COO, is responsible for managing the timely return of assets.
6.3 In case of wind-down implementation, the Company has developed the wind-down timelines, including the term of the crypto-assets return to clients, with risk validation performed by the Risk Manager.
6.4 The Company has in place the Wind Down Policy, which is duly implemented.
If you have further requests on the safeguarding measures, please contact us: [email protected].