The Anatomy of a Custody Policy Failure: The Eight TAP Misconfigurations Every VARA VASP Must Audit
Most VASP custody breaches in the last three years were not cryptographic failures — they were policy failures. ITSEC's forensic team has now seen the same eight Transaction Authorization Policy misconfigurations across nearly every major incident. This is the definitive operational guide for VARA-licensed VASPs: what each failure looks like, how attackers exploit it, and the quarterly audit cadence that prevents the next one.