Overview
The Fireblocks policy engine governs which orders your workspace can create and execute. Before placing orders, you must configure the appropriate policy rules for your use case.
Policy types
The rules you need depend on your provider and the order direction.
Order Policy — all orders
Required for every on-ramp and off-ramp order. Controls which orders are permitted: defines the connected account, source, destination, and asset pair for each allowed order type.
Transfer Policy — off-ramp by standard transfer
Required for off-ramp providers that receive your digital assets through a standard vault-to-provider transfer (OpenPayd, Yellow Card, Alfred Pay, dLocal, Bridge, Mopay, and Banxa). It explicitly allows the transfer from your vault to the connected provider account. Without this rule, off-ramp transactions are blocked at the policy level.
Smart contract settlement rules — off-ramp by smart contract
Required for off-ramp providers that receive digital assets through a smart contract instead of a standard transfer (currently Circle Payments Network, CPN). These rules — Approve and Typed Message on EVM blockchains, or Program Call on Solana — authorize the transfer and replace the Transfer Policy rule; no separate Transfer Policy rule is needed.
Info: When you off-ramp from a vault, the transfer to the provider is an on-chain transaction in every case — standard transfers included. Your vault must hold the native blockchain asset (for example, ETH, MATIC, or SOL) to cover the gas fee.
How to add a rule
Go to Policies > Order Policy > Edit Policy > + Add rule. Set Action to Allow, then configure the scope and funds parameters for your use case.
You can create multiple rules for the same use case with different fund thresholds. For example, one rule allowing specific users to authorize orders below $10,000, and another requiring multi-user approval for orders above $10,000.
Rule scope parameters
| Parameter | Description |
|---|---|
| Connected account | The provider account that executes the order |
| Source | Where funds originate — a vault account, external bank account, or connected provider account |
| Destination | Where funds are delivered — a vault, whitelisted address, or connected provider account |
Rule funds parameters
| Parameter | Description |
|---|---|
| Base asset | The asset being bought or sold; set minimum and maximum amounts per transaction |
| Quote asset | The counter asset — what you pay with or receive; set minimum and maximum amounts |
| Buy / Sell / Any | Whether the rule covers buying, selling, or both directions of the base asset |
Rule templates
The Console shows a preview of the rule before you save it; use it to verify the scope and funds parameters match your intended use case. If you configure more than one rule that could apply to the same order (for example, a broad rule alongside a specific rule for the same account), Fireblocks evaluates rules top-down and applies the first match; order your rules accordingly. See How Policies Work for a full explanation of policy evaluation.
On-ramp — Funds on the fly (DVP)
Allows fiat-to-digital-asset orders where you transfer fiat from an external bank account after the order is created.
Scope
- Connected account: any, or a specific account
- Source: any external account (External list)
- Destination: vault account(s); optionally whitelisted addresses
Funds
- Base asset: the fiat currency (USD, EUR, MXN, etc.)
- Quote asset: any, or specific stablecoins (USDC, USDT)
On-ramp — Prefunded
Allows fiat-to-digital-asset orders where the provider draws from a fiat balance you hold with them in advance.
Scope
- Connected account: any, or a specific account
- Source: Balance held on your account with the provider
- Destination: vault account(s); optionally whitelisted addresses
Funds
- Base asset: the fiat currency (USD, EUR, MXN, etc.)
- Quote asset: any, or specific stablecoins
Off-ramp — Funds on the fly (DVP)
Allows digital-asset-to-fiat orders where you transfer digital assets from your vault to the provider after the order is created.
Scope
- Connected account: any, or a specific account
- Source: vault account(s)
- Destination: whitelisted address(es)
Funds
- Base asset: any, or specific assets (USDC, USDT)
- Quote asset: the fiat currency (USD, EUR, MXN, etc.)
Warning: Off-ramp also requires provider-specific rules. Providers that settle by standard transfer (OpenPayd, Yellow Card, Alfred Pay, dLocal, Bridge, Mopay, and Banxa) require a Transfer Policy rule allowing transfers from your vault to the connected provider account — go to Policies > Transfer Policy > Edit Policy > + Add rule. Providers that settle through a smart contract (CPN) do not need a Transfer Policy rule; instead they require the smart contract settlement rules — see Off-ramp — smart contract settlement below.
Off-ramp — Prefunded
Allows digital-asset-to-fiat orders where the provider draws from a digital asset balance you hold with them in advance.
Scope
- Connected account: any, or a specific account
- Source: the account under the connected provider
- Destination: whitelisted address(es)
Funds
- Base asset: any, or specific assets (USDC, USDT)
- Quote asset: the fiat currency (USD, EUR, MXN, etc.)
Off-ramp — smart contract settlement (CPN)
Some account-based providers settle through a smart contract rather than a standard transfer to receive digital assets for DVP off-ramp. These providers require additional policy rules beyond the standard Order Policy — one for each smart contract step involved. Circle Payments Network (CPN) uses this for USDC off-ramp on Ethereum, Polygon, and Solana; other providers may adopt it in the future.
Info: Required for all chains: The standard Off-ramp — Funds on the fly (DVP) Order Policy rule (see above). Smart contract settlement providers do not need a Transfer Policy rule — the rules below authorize the asset movement instead.
EVM chains — Approve
Grants the on-chain allowance required for the provider's Permit2-based token transfer. This is triggered once per vault and asset combination; subsequent orders on the same vault and asset do not require a new approval.
Scope
- Source: vault account(s)
- Destination: the Permit2 contract for the relevant chains, under Destination > Swap > Permit2; or select All Swap destinations
Funds
- Asset: the digital asset being off-ramped (for example, USDC)
EVM chains — Typed Message
Signs the EIP-712 structured authorization that specifies the transfer parameters for each order.
Scope
- Source: vault account(s)
Funds
- Asset: the native asset of the blockchain (for example, ETH on Ethereum, MATIC on Polygon)
Warning: Typed Message rules require the native blockchain asset. You cannot select the asset being off-ramped (for example, USDC) for this rule type.
Solana — Program Call
Authorizes the on-chain interaction with the provider's Solana program. A single Program Call covers the full transfer — no separate Approve step is required on Solana.
Scope
- Source: vault account(s)
- Destination: the provider's whitelisted Solana program address(es)
Funds
- Asset: the digital asset being off-ramped (for example, USDC on Solana)
Warning: Every Solana program your transaction touches must be whitelisted. See Policy rules for Solana program calls for instructions.