NCC Group to secure 21X’s regulated digital asset bourse

Cybersecurity consultancy NCC Group has been chosen by 21X to secure what the companies describe as Europe's first fully regulated exchange for digital assets.

21X is the first financial institution licensed to run a regulated trading and settlement venue under the EU's Distributed Ledger Technology (DLT) Pilot Regime. The regime covers market infrastructures that use blockchain and other distributed ledger systems.

NCC Group will supply managed detection and response services for the new platform. The service is branded Intelligent Managed Extended Detection and Response, or iMXDR.

The company will also provide incident response services for 21X. These services cover investigation and containment of cyber attacks.

21X plans to operate a trading venue built on a public permissionless blockchain. The firm says this model will support a broad range of tokenised financial instruments.

The exchange aims to attract institutional clients that seek regulated access to digital asset trading. The licence under the DLT Pilot Regime places it within the EU's regulatory perimeter.

Regulatory focus

The partnership comes as European rules for digital finance tighten. The Digital Operational Resilience Act, known as DORA, sets uniform standards for ICT risk management in financial services.

DORA has acted as a compliance driver for the design of 21X's platform. The rules cover incident reporting, testing, and oversight of third-party ICT providers.

The DLT Pilot Regime imposes further requirements on licensed venues. These include obligations around operational security, transparency, and market integrity.

Both sets of rules increase scrutiny of cyber security controls at trading platforms. They also extend expectations for monitoring and response capabilities.

NCC Group positions its iMXDR service as a way to address continuous monitoring and threat detection needs. The service combines technology and a staffed Security Operations Centre.

21X will use NCC Group's incident response team alongside the monitoring service. The combined setup is intended to handle both day-to-day threats and major incidents.

Chantal Constable, Head of Financial Services & Insurance at NCC Group, said the agreement builds on the firm's work in the sector.

"I'm genuinely excited about this strategic partnership with 21X, the first regulated digital asset exchange in Europe, which builds on NCC's 25 years' experience in securing financial services innovation. Through our shared understanding of enterprise cyber resilience enabling innovation, NCC will be delivering our Intelligent MXDR service to support full regulatory compliance for the 21X trading platform - the first of its kind in Europe. With our unique mix of people powered, tech enabled SOC (Security Operations Centre) capability, NCC's iMXDR solution will be able to rapidly flex capability and cyber transparency with 21X's expanding platform and ecosystem of partners," said Constable, Head of Financial Services & Insurance, NCC Group.

Blockchain infrastructure

21X is designing its market infrastructure around distributed ledger technology. The company plans to use a public permissionless blockchain as the core settlement layer.

This structure differs from many incumbent exchanges. Most established markets use centralised databases and private networks.

Public blockchains introduce new security considerations for regulated markets. Attack surfaces can extend beyond traditional perimeter defences.

NCC Group said its experience includes work on public blockchain environments. The firm has tested and secured smart contracts, consensus mechanisms, and related components in previous projects.

21X cited this experience as a factor in its selection of NCC Group. The company also referred to NCC Group's work in other regulated industries.

The iMXDR service will sit as a security monitoring layer around 21X's systems. It will gather signals from endpoints, networks, cloud environments, and blockchain-related infrastructure.

NCC Group analysts will review alerts and investigate anomalies. The team will coordinate with 21X staff on containment and remediation.

21X expects its operations and customer base to grow under the DLT Pilot Regime. The firm plans to extend its services to clients in multiple European markets.

Thomas Zraunig, Chief Information Security Officer at 21X, said the company assessed providers against its expansion plans.

"NCC Group stood out as a cyber resilience partner thanks to both their deep financial services industry expertise and their ability to meet our changing needs. Their global reach and scale also align with our expansion plans and growth trajectory.

"Securing Europe's first digital asset exchange is a unique cyber security challenge to which NCC Group's experts are applying decades of experience and ingenuity. NCC Group's services provide our customers with world class assurance," said Zraunig.

Both companies expect the demand for regulated digital asset venues in Europe to increase as more institutions explore tokenised instruments under the DLT Pilot Regime and related frameworks.