Japan-based TOPPAN, a subsidiary of TOPPAN Holdings, and NYSE-listed digital asset infrastructure provider BitGo have conducted a joint proof-of-concept (PoC) testing a Decentralised Key Management Scheme for digital assets. The trial ran from August to October 2026 and combined distributed control of private keys across three parties with corporate identity verification based on verifiable Legal Entity Identifiers (vLEI).
The scheme pairs the key management infrastructure and operational experience TOPPAN has built through its card issuance business with BitGo’s multi-signature key distribution technology and digital asset operations. Private keys were managed jointly by the client, TOPPAN, and BitGo. TOPPAN’s vLEI-Gateway, a service for issuing vLEIs, was used to verify the identity and authority of corporations and their representatives when keys are used or when addresses are added to transfer whitelists.
How the three-party model works
Signing authority is split across the three participants. The client holds the main signing key and initiates transactions. BitGo provides a countersignature that prevents unilateral execution, while TOPPAN stores a backup key in a secure environment such as a hardware security module (HSM). If one party’s key or environment is compromised, a transaction still cannot be completed, because approval from another key is required.
According to the companies, this structure addresses several risks. It limits the impact of external cyberattacks on a single key holder. It reduces the scope for internal fraud or abuse of authority by the client. The vLEI checks during whitelist registration and transaction execution are designed to reduce the risk of spoofing and of transfers to unauthorised addresses. The backup key also supports business continuity, allowing assets to be moved if a client’s or BitGo’s key becomes unavailable because of a natural disaster or system failure.
The PoC covered several elements: the companies created wallets supporting three-party management, integrated them with the vLEI-Gateway, set up secure key storage, and ran standard transfer tests following a multi-approval workflow. They also tested failure scenarios in which one key was lost or unusable.
The parties report that keys were generated and managed as designed, and that corporate verification functioned during whitelist registration and transfers. Standard transfers were completed without issues. In the failure scenario, assets were transferred using two of the three keys, which confirmed the business continuity design.
Market context and next steps
The initiative responds to leaks and cyberattacks that exploit weaknesses in digital asset management systems, both in Japan and internationally. The companies also point to attacks becoming more varied through the use of AI. Governance requirements, including the prevention of internal fraud and KYC/AML checks on counterparties, add further pressure. In addition, the companies note that building strict key management and corporate authentication environments in-house requires significant cost and specialist expertise. In their view, this may restrict participation to a limited number of large enterprises.
TOPPAN and BitGo plan to offer the scheme to regional banks, municipalities, and corporations that are seeking to enter the digital asset space but face challenges in key management and compliance. They aim to launch a service as early as 2028, as any launch remains subject to definitive agreements, regulatory requirements, and technical and commercial readiness.
