Overview
On-ramp and off-ramp orders use account-based providers, which require a connected account before you can place orders. Complete the following setup steps before creating your first order.
Info: Your organization must complete onboarding and Know Your Business (KYB) verification, a compliance process, directly with the provider before connecting the account in Fireblocks. This includes signing agreements and any other steps the provider requires, and is handled entirely outside of Fireblocks.
Step 1: Obtain your provider credentials
Contact your provider to obtain an API key and API secret. Each provider has its own process for issuing credentials.
Step 2: Connect the account
- In the Fireblocks Console, go to Accounts > Connected accounts.
- Select + Connect Account.
- Select your provider from the list.
- Enter your API key and your API secret.
- Select Connect Account.
Depending on your workspace configuration, the Admin Quorum may need to approve the new account before it is available for orders.
Step 3: Whitelist your destination address
Required when the destination is outside of Fireblocks — for example, a bank account for off-ramp, or an external crypto address for on-ramp.
When whitelisting a fiat bank account for off-ramp, under the Whitelisted addresses section in the left panel of the Console, select an External Wallet as the wallet type. Do not use Internal Wallet — fiat bank accounts are always external destinations.
Providers may require specific bank details on the destination, such as the bank address, city, country, postal code, tax ID, and SWIFT/BIC code. The required fields depend on your provider and the destination currency.
Learn more on Whitelisted Addresses.
Step 4: Configure your policy rules
Before placing orders, configure the policy rules required for your provider and use case. They fall into three layers, each applies in addition to the one before:
- Order Policy — all orders. The policy engine checks every on-ramp and off-ramp order against an Order Policy rule that allows it. This applies to all providers and both directions.
- Transfer Policy — off-ramp by standard transfer. Off-ramp providers that receive your digital assets through a standard vault-to-provider transfer also require a Transfer Policy rule allowing that transfer. This applies to OpenPayd, Yellow Card, Alfred Pay, dLocal, Bridge, Mopay, and Banxa.
- Smart contract settlement rules — off-ramp by smart contract. Off-ramp providers that receive digital assets through a smart contract instead of a standard transfer require additional rules — Approve and Typed Message on EVM blockchains, or Program Call on Solana. These rules replace the Transfer Policy rule. Circle Payments Network (CPN) uses smart contract settlement for USDC off-ramp on Ethereum, Polygon, and Solana.
When you off-ramp from a vault, the transfer to the provider is an on-chain transaction in every case, so your vault must hold enough of the native blockchain asset (for example, ETH, MATIC, or SOL) to cover gas — whether the provider settles by standard transfer or by smart contract.
For step-by-step instructions on adding each rule, see Policy rules for on-ramp and off-ramp orders.