Cash-in-transit (CIT) chain-of-custody platform
Custody CIT follows each bag from the moment a customer requests a pickup until the cash vault counts and credits it, on a tamper-evident chain of custody. Banks, armored carriers, cash vaults and commercial customers work from a single source of truth, each with their own access.
Who it is for
Every party signs in to the same system and sees exactly what belongs to them, and nothing else.
Supervision, administration, compliance and planning: validate requests, plan routes, close discrepancies, credit, audit and receive accounting entries ready to import.
In-house or outsourced: see their routes, assign their crews, manage their fleet and fuel, and bill per stop served with the collection report.
Issue the manifest, receive, count by denomination under dual control, open a case on any discrepancy and work alerts from a single screen.
Request pickups and deliveries, seal bags, track them live, settle discrepancies and download their own reports. Only their own data, in their language.
How it works
Five moments, each with who did it, where, at what time and with what evidence. None can be corrected without leaving a trace.
The customer asks for a pickup or a delivery. Hold rules (legal thresholds, unusual amounts, hours) stop it when needed, and a different person releases it.
Dual approval to relax the legal rulePlanning with recurring templates, nearest-first ordering with live traffic, crew and vehicle from the fleet. The driver gets notified.
Up to 45 stops per journeyThe driver scans the signed QR, both parties sign, seal photo. GPS records the trip and the geofence marks the real arrival.
Works offlineSigned receipt, count by denomination, automatic reconciliation when two people agree, discrepancy case when they don't.
Dual control requiredSupervision closes and credits. The accounting entry is generated, the chain is sealed and its root is published outside the system every day.
Evidence that outlives the systemThe platform
Not a catalog of modules to buy: one system, one database and one chain of custody.
Every act carries the hash of the previous one, the fingerprint of its evidence, and who, where and when. Rewriting one breaks the chain forward.
Optimization with real road durations, a position every 30 seconds, arrival geofence and a deviation alert with the approximate address.
Scans, signatures and seal photos go to a queue on the phone and upload by themselves when the network returns. It never shows amounts.
Green, amber and red per stop; bags not received, routes not started, lost bags. On screen, in the bell and by email, grouped by situation.
Configurable AML thresholds per currency, unusual amounts, off-hours activity, new customers. Adjustable per institution and per customer, with a CTR-style report as PDF.
Ten reports with totals, comparison against the previous period and a link to every record. Excel, PDF, CSV, TXT; scheduled by email and bundled in a pack with a cover.
Carrier fees, fuel, shortages and overages become journal entries with the bank's own accounts, ready to import into its accounting system.
Documented REST API, signed webhooks per event, a read-only role for BI and custom fields for the bank's own identifiers.
Intra-shift vault counts with a balance derived from the chain, import of the counting machines' signed file, and the ATM replenishment cycle with dispensed cash computed.
The next service per site based on its real cadence, with expected volume and a confidence signal, to decide where to send a route this week.
The deposits reported by each site's smart safes, with the accumulated balance awaiting pickup in the field.
The amount comes from what happened —stops, bags and charges—; invoices with their numbering, credit notes and aged receivables.
Eight system roles plus custom roles per entity, with separation-of-duties guardrails the engine enforces and a role audit.
Live operations
Position is no longer a phone call to the driver. It records itself, marks the real arrival and leaves the mileage that prices the route.
Reports and accounting
Each report is computed once and comes out the same on screen, in Excel and in a PDF with the bank's logo. No manual exports, no reconciling two versions.
Security by design
Nothing below depends on someone remembering. The database, the protocol or the signature demands it.
Row-level policies in PostgreSQL: one entity never reads another's data, not even through a programming error.
Mandatory for drivers and carriers, enforceable institution-wide with one checkbox. Devices and sessions can be revoked remotely.
Nothing is overwritten or deleted: every change keeps its actor, origin and exact moment.
TLS everywhere; AES-256 with key rotation for sensitive data. Keys live in a secrets manager, never in code.
The receipt can be verified publicly without signing in and without revealing amounts, customers or addresses.
The chain's root is emailed every day to an address outside the database administrator's control. Rewriting it would show.
Whoever records doesn't release; whoever counts doesn't close the discrepancy or credit; the driver never receives the amount.
Daily, weekly and monthly with ten-year retention, and tested restores, not just the file.
Compliance
Cash that moves through a carrier is still the bank's reporting obligation. These are the requirements that touch cash-in-transit, and where the platform answers them — with no side spreadsheets and no reminder sitting in somebody's calendar.
| Requirement | The number | Where it is handled |
|---|---|---|
| Currency Transaction Report FinCEN Form 112, filed for cash transactions above the threshold. |
$10,000 filed within 15 days |
The request that crosses the threshold is held automatically, and the report comes out with every operation in the window — not only the one that crossed it. |
| Structuring Breaking one transaction into smaller ones to stay under the reporting threshold (31 U.S.C. 5324). |
24 hours aggregated per customer and currency |
The threshold is evaluated on the sum of the window, per customer and per currency. Three five-thousand-dollar pickups in one day do not slip through. |
| Suspicious Activity Report FinCEN Form 111, counted from initial detection. |
30 days | Alerts are kept in a log with their case file and their trail, so whoever signs the report has in front of them what happened, when, and who did it. |
| Recordkeeping | 10 years | Daily, weekly and monthly backups with tested restores, and an append-only audit log: nothing is edited, nothing is deleted. |
| Separation of duties | 2 people | Releasing a hold or relaxing the legal rule requires a second account to approve it. Whoever counts does not close the discrepancy or post the credit. |
Civil penalties for a missed filing reach $100,000 per violation, and a willful violation carries up to five years — ten when it is part of a pattern or exceeds $100,000 in twelve months. The compliance officer has a role of their own, with access to what they need and no operational permissions. Thresholds and windows are configured per institution, so the same platform serves a different jurisdiction by changing a number, not by changing the product.
About us
Custody CIT is owned by E&J Support IT LLC (Massachusetts, USA): engineering of multi-tenant SaaS platforms, with the same discipline of data isolation and automated testing in every project. We design, build and operate what we deliver.
Deployed on AWS with encryption, automatic backups and alarms. A demo runs in under an hour on real, low-risk data.
Role-based user manual with screenshots, end-to-end technical manual, data dictionary and accounting file contract.
Other platforms by the same team
Demo
Seal a bag, move it along a route, receive it, count it and reconcile it, with the whole chain in view. Under an hour, with your operations and technology teams.
Massachusetts, USA · Available in English and Spanish.