Is Fasset safe? How client assets, accounts and cards are protected
Fasset FZE states that it safeguards client virtual assets with Fireblocks multi-party computation (MPC) technology and hardware isolation. The Fasset Card can be frozen instantly and shows its details only after a biometric or PIN check, and Fasset never asks for your password, 2FA or recovery codes. Balances are not bank deposits and no deposit guarantee scheme covers them.
Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection. Read the risk disclosure for virtual assets.
Last reviewed . Reviewer: Head of Compliance.
Custody of client virtual assets
The Fasset company that deals in virtual assets is Fasset FZE, which is licensed by the Virtual Assets Regulatory Authority (VARA) for Broker-Dealer Services, licence VL/23/07/002. It is the company on the other side when you are buying USDT through the licensed Dubai entity.
On its disclosure page, Fasset FZE says it protects client assets through a partnership with Fireblocks, using multi-party computation (MPC) cryptography and hardware isolation. MPC is a way of signing a transaction in which the private key is never assembled in one place.
That is the custody statement found on fasset.com. The rows below set it beside what the site does not state: how client assets are segregated, how much is kept offline and whether any insurance applies.
The licence and the people behind it are covered on Fasset licences by entity and on the page about who is behind Fasset.
- Custody model
- Fasset FZE names Fireblocks as its partner for protecting client assets. Whether a separate licensed custodian holds them is not stated
- Stated by the company
- Key management
- Fireblocks multi-party computation (MPC) cryptography and hardware isolation
- Stated by the company
- Segregation of client assets
- Not stated on fasset.com
- Not published
- Share held in cold storage
- Not stated on fasset.com
- Not published
- Insurance
- No insurer, limit or scope is stated on fasset.com
- Not published
Account security
The security notice on fasset.com refers to three things that belong to you alone: your password, your two-factor authentication (2FA) code and your recovery codes. Fasset does not publish which 2FA methods the app offers or whether 2FA is switched on by default.
What you can do yourself:
- Use a password that you use nowhere else.
- Turn on 2FA and keep your recovery codes offline.
- Open the app from your phone’s home screen, not from a link in a message.
One rule to remember
Fasset will never ask for your password, your 2FA code or your recovery codes.
If a message, a caller or a website asks for any of them, do not answer. Report it to [email protected].
Card security
The Fasset Card is a prepaid virtual Visa card provided by Fasset Labuan Limited. The card page on fasset.com lists these controls:
- End-to-end encryption.
- Real-time fraud monitoring.
- Instant freeze and unfreeze.
- Card details shown only after a biometric or PIN check.
The same page lists “Visa-powered protection”. What that covers for a cardholder, such as dispute rights, is to be confirmed. The card is prepaid, so it spends only what you have loaded onto it. A refund from a merchant usually takes 10 to 30 business days, depending on the merchant and the network.
The daily limit and the top-up range are on Fasset Card controls and limits, and every published charge is on fees and limits.
Card controls
- Freeze and unfreeze
- Instant
- Card details
- After a biometric or PIN check
- Merchant refunds
- Usually 10 to 30 business days
- Provided by
- Fasset Labuan Limited
As published on fasset.com on .
Identity checks and financial-crime controls
Fasset’s user agreement names Jumio as its identity verification vendor. The privacy notice explains how personal data is handled.
The document library on fasset.com includes these policies: an Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) Policy, a Fasset FZE Anti-Bribery and Corruption Policy, a Fasset FZE Conflict of Interest Management Policy and a Fasset FZE Order Execution Policy. Each library page is a short abstract with a link to a PDF.
These policies describe how the company works. They say nothing about the protection of a single account, which depends on the controls above and on how you look after your own password and codes.
Certifications and audits: what is and is not verified
Each row has one of three states. Verified: the fact was read on a regulator’s own register. Stated: a Fasset page says so and no document backs it. Not published: nothing was found on fasset.com.
- VARA licence of Fasset FZE
- VASP Licence VL/23/07/002 for Broker-Dealer Services, status Active
- Verified on the register
- SOC 2 Type II report
- Named in blog posts on fasset.com. Auditor, period and report to be confirmed
- Stated by the company
- ISO 27001 certificate
- Named in the same blog posts. Certification body, scope and dates to be confirmed
- Stated by the company
- Penetration tests
- No tester, date or summary is published
- Not published
- Bug bounty
- No programme or reporting address for researchers is published
- Not published
- Proof of reserves
- No attestation or report is published
- Not published
What is not protected
Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.
Fasset is not a bank. The controls on this page lower the chance of theft and do nothing about a fall in value. Read the full risk disclosure and what the USD account is and is not.
The VARA licence covers Fasset FZE in or from Dubai. For readers in Pakistan: no page of fasset.com names a Pakistani regulator or a licence number for a Fasset company, and the global user agreement names Fasset Labuan Limited as the contracting party.
| What you hold | What applies | Source |
|---|---|---|
| Virtual assets | No form of financial protection | The VARA risk statement above |
| USDT | “USDT is a stablecoin issued by Tether. It isn’t a bank deposit and isn’t covered by a deposit guarantee scheme.” | Fasset’s disclosure on its Reserve page |
| USD account | The services “are powered by a third-party provider and do not form part of the regulated or licensed activities of Fasset Labuan Limited” | Global VIBAN Services terms on fasset.com |
Sources read on .
Official domains, apps and accounts
Fasset’s website is fasset.com. Treat any other domain, app listing or social account that uses the Fasset name as unverified until support has confirmed it, even when it looks right and ranks well in search.
The store listings, and the checks to run before you install, are on the page with the official app download links. Short answers are in the Fasset FAQ and longer explanations in the Fasset Learn guides.
- Website
- fasset.com
- iPhone app
- App Store ID 1599893605
- Android app
- Google Play package com.fasset.cashapp
- Help centre
- fassethelpsupport.zendesk.com, a support site hosted by a vendor
- [email protected]
- Social profiles
- Fasset on X, Fasset on YouTube, Fasset on Instagram, Fasset on LinkedIn, Fasset on Reddit and Fasset on Telegram
Report a problem
Stop the damage
If your card is involved, freeze it in the app. If someone may know your password, change it.
Tell Fasset
Write to [email protected], or report a security concern through the help centre form on the contact page.
Include the evidence
Say what happened and when. Add the address, number or account that contacted you, a screenshot and any transaction reference. Leave out your password, 2FA code and recovery codes.
If the answer does not settle the matter, the complaints procedure sets out the next steps.
Incident history
Not published
No security incident is listed on fasset.com. A dated list belongs here: what happened, who was affected and what changed afterwards.
Checked on fasset.com on
Seen something that looks wrong?
Tell Fasset before you reply, tap a link or pay. One message is enough, and you never need to share a password or a code to send it.
- [email protected]
- Never share
- Password, 2FA code, recovery codes