WORM ledger › Banks, credit unions and fintech
The WORM ledger for banks, credit unions and fintech companies
Keep the records you will one day have to show an examiner, an auditor or a court in a write-once ledger, so that a changed figure or a missing day shows up. The records stay on your own computers. Try both checks below with your own files or with our fictional sample. Nothing is uploaded.
Two free checks, in your browser
These run on this page with your browser's built-in cryptography. The files are not sent anywhere, and the page makes no network requests.
1. Is this the file that was sealed?
Take a statement, an ACH or wire file, a report or any document, and the SHA-256 fingerprint recorded when it was sealed. If one byte changed, they will not match.
To check the receipt itself (its signature and its outside timestamp), use the receipt verifier.
2. Is this run of business days unbroken?
Each day's posted totals are signed as a day-close record that carries a fingerprint of the day before. Choose a run of day-close files. The check shows whether any day is missing, out of place or changed after it was signed.
Or try the fictional sample:
The sample is "Sample Federal Credit Union (fictional)", signed with a throwaway key made only for it. Every figure is invented.
How it works for an institution
- Your desk signs the records. Best Pay Institution Desk runs on your own computer and signs four kinds of record with your institution's key (below).
- Each record is sealed. A record's fingerprint goes into a Best Pay Receipt and the WORM ledger, with an independent timestamp, using a separate key that is not on the desk computer. We can run that step for you on fingerprints alone, so the records themselves never leave your institution.
- Anyone you choose can check them. An examiner, an auditor or the other side of a dispute can repeat both checks above with your public key, offline, without an account and without asking us.
Pricing
Priced per institution and agreed in writing, after a review of what you want to record and how your team works. We expect your information security team to look at the desk before anything is installed, and we welcome it.
Who it is for
- A bank.
- A credit union.
- A fintech company. It may be a state-licensed money transmitter, a money services business, or a program manager for a bank. Which of those applies is the company's to know.
The four records
- A refusal of one item, bound to that item's reference.
- A two-party record. Until the second key signs, it is only a proposal.
- A document as of a date. The signed record holds the digest. The document stays beside it.
- The business day's posted totals, linked to the previous day signed on that register.
What a record shows, and what it does not
A record shows that the holder of the signing key stated those exact bytes, and that the bytes were not altered afterward. Anyone who holds the file and the public key can check that with no account and no network.
- It does not show that the statement is true, lawful, or the real reason.
- A name in a record is only a claim. The desk puts a role and a reference in those fields. It does not put a person's name in a record.
- Two software keys on one computer do not prove two people acted.
- Times in a record are the signer's own clock. Only the outside timestamp added when a record is sealed is independent.
- A run of days that checks out shows the days you were given are continuous. It cannot show that a second version of some day was also signed, or that there are later days you were not shown. Sealing each day promptly, with an independent timestamp, is what catches that.
- It does not file a currency transaction report, a suspicious activity report, or a call report. It does not decide whether one is required.
- Do not write a suspicion, a person's name, or the fact that a report was considered into a record. A record can be shown to the person it concerns.
- A large cash item is only a reminder to look at the currency-transaction rules. The reminder is not written into the record.
- It is not a regulator's system. It is not your compliance program, and it is not legal advice. How long you keep the records is your decision.
Where it runs
The desk holds signing keys, so it stays on the institution's computer. It is not a page on this website, and the records are not sent here. The samples that come with it are fictional. Every figure in them is invented.
A bank is examined by its chartering authority. A credit union's federal regulator is the NCUA. This desk is not one of those systems, and it is not endorsed by them. For a fintech company, this desk is not a state licensing system, not a money-services registration, and not the sponsor bank's program.
What we do not receive
Asking for a review does not send us customer files, names, account numbers, or the text of a record. The button opens an email on your own computer. There is no form on this page.
Email ibg@bestfortifiedpay.com. Please do not include a customer's name, an account number, or anything about a report.