Branch Vault Security Best Practices
| Financial Services
Key Highlights
- The vault is the balance sheet: for a gold loan branch, physical vault security and asset security are the same thing - there is no other collateral record to fall back on.
- Construction and access design come first: fire rating, dual-lock or dual-combination access, and a segregated strong room set the ceiling on everything else a branch can do to secure gold.
- Dual custody is non-negotiable: no single employee should ever be able to open the vault alone, regardless of seniority.
- CCTV retention windows matter as much as coverage: footage that's overwritten before a dispute surfaces is functionally the same as no footage at all.
Why Vault Security Is the Foundation Every Other Gold Loan Control Sits On
A gold loan NBFC's balance sheet is, physically, a set of sealed packets sitting in branch vaults across the country. There's no central registry, no digital record that substitutes for the item itself - the vault is where the asset backing every outstanding loan actually lives. That makes vault security different in kind from most other branch controls: a weakness in disbursement workflow causes a bad loan, but a weakness in vault security can mean the collateral behind good loans disappears. Every other control in gold lending - appraisal discipline, maker-checker, surprise audits - assumes the vault itself is sound. If it isn't, none of the rest matters.
Our internal controls piece covers dual custody and CCTV as line items in a broader control framework. This post goes deeper into the vault specifically - the construction, access design, and monitoring standards we recommend a branch have in place before it opens, and the four areas that most commonly go wrong even at branches that think they've covered the basics.
The Branch Vault Security Framework
These are the vault security elements we recommend every gold loan branch have in place, from physical construction through to daily operating discipline.
| Area | What It Covers | Standard to Aim For | Why It Matters |
|---|---|---|---|
| Vault Construction & Fire Rating | Reinforced strong room walls, floor and ceiling, fire-rated door, independent of the branch's general structure | Purpose-built strong room, not a converted cabin or cupboard | Protects against both forced entry and fire - a branch fire that also destroys the collateral record compounds the loss |
| Dual Custody Access | Two independent keys, combinations, or biometric credentials required to open the vault; no single employee holds both | Two-person rule enforced without exception, including for senior staff | No individual can access collateral unsupervised, the single most important vault control |
| CCTV Coverage & Retention | Continuous recording of the vault door, appraisal counter, and cash counter, with a defined minimum retention period | Coverage with no blind spots, retention long enough to outlast the typical dispute or audit cycle | Creates the evidentiary trail that resolves disputes and supports fraud investigation after the fact |
| Access Logging | A logged record of every vault opening - who, when, and why - reconciled periodically against staff duty rosters | Tamper-evident physical or electronic log, reviewed by someone outside the branch | Turns "who opened the vault" from a memory into an auditable record |
| Alarm & Perimeter Security | Vault-specific intrusion alarm wired to a monitored response service, separate from the general branch alarm | 24x7 monitored alarm with a defined police or security-agency response time | Reduces the window between a breach attempt and a physical response |
| Cash and Gold Segregation | Cash held in a separate till or sub-vault from pledged gold, with independent access controls | Physically distinct storage, not just a labelled shelf within the same vault | A cash-motivated robbery or internal theft shouldn't automatically expose the gold, and vice versa |
| Insurance Cover | Adequate, continuously updated insurance for gold held at the branch, matched to peak holding value | Cover reviewed at least quarterly against actual average and peak vault holdings | Under-insurance turns a covered loss into a direct capital hit |
| Cash-in-Transit & Inter-Branch Movement | Secure, insured, logged procedure for moving gold between branches or to a central vault/auction venue | Armed or agency-escorted movement for any transfer above a defined value threshold | The vault's security is meaningless if gold is exposed the moment it leaves the building |
| Staff Rotation & Mandatory Leave | Periodic rotation of vault-access staff and enforced continuous leave with no vault access during it | Rotation cadence defined in policy, not left to branch manager discretion | Makes long-running collusion or concealment schemes far harder to sustain undetected |
| Vault Audit & Reconciliation | Scheduled and surprise physical verification of vault contents against system records | At least one unannounced audit per branch per quarter, independent of branch staff | The only reliable check that what's recorded in the system matches what's physically in the vault |
Four Areas Worth a Deeper Look
1. Construction Standards Set a Ceiling No Later Control Can Raise
NBFCs expanding quickly sometimes lease space and treat the vault as a fit-out line item rather than a design decision - a reinforced cupboard bolted into a rented shop is not the same as a purpose-built strong room, no matter how good the access controls layered on top of it are. Fire rating matters as much as forced-entry resistance: a branch fire that destroys both the collateral and the paper trail around it turns an insurable loss into a much harder dispute to resolve. Getting construction right before a branch opens is far cheaper than retrofitting a vault around live operations later - the same sequencing logic we cover for SOPs generally in our 30-day branch setup guide.
2. Dual Custody Has No Acceptable Exception
The two-person rule for vault access is simple to state and easy to quietly erode in practice - a trusted branch manager gets both keys "just for today" because the second custodian is on leave, and that exception becomes the norm. Dual custody only works as a control if it has zero exceptions, including for the most senior person in the branch. This is the same principle our internal controls piece treats as the single most important control in gold lending, and it's worth restating here: any workaround to dual custody, however operationally convenient, is a workaround to the control that protects the entire book.
3. CCTV Retention Windows Are Often Shorter Than the Disputes They Need to Cover
Coverage gets the attention during vault design, but retention is where branches most often fall short in practice. A customer dispute over what was actually pledged, an internal investigation, or a regulatory review can surface weeks or months after the transaction - and footage overwritten on a 15 or 30-day cycle to save on storage is functionally unavailable exactly when it's needed most. The retention period should be set against realistic dispute and audit timelines, not against the cheapest storage tier, and it should cover the appraisal counter and cash counter as thoroughly as the vault door itself.
4. Purity Testing Happens at the Vault's Edge, Not Inside It
Vault security and appraisal security are often designed separately, but the appraisal counter is where gold is most exposed - out of the vault, being handled, tested, and weighed before it's sealed and stored. The physical layout should keep this counter within the same CCTV coverage and access discipline as the vault itself, and the purity testing method used there matters just as much as who can open the vault door. See our companion piece on gold purity testing methods for how touchstone, XRF, and fire assay compare, and why the strongest branches pair methods rather than rely on one.
Key Takeaways
Vault security is the foundation every other gold loan control depends on - get construction, dual custody, and CCTV retention right, and the rest of the control framework has something solid to sit on.
- Build it right the first time: a purpose-built, fire-rated strong room is far cheaper than retrofitting one around live operations
- Zero exceptions to dual custody: the two-person rule only works if it applies to everyone, including branch managers
- Retention beats coverage: CCTV footage is only useful if it still exists when a dispute or audit actually needs it
- Extend the perimeter to the appraisal counter: gold is most exposed while being tested, not while sealed in the vault
Designing and fitting out a vault, and building the operating discipline around it, is exactly the kind of ground-level work Technovative Consulting does with gold loan NBFCs and banks entering or scaling this business. We help with core process design and branch fit-out, gold audit team setup and surprise verification cadence, and training programs for branch managers who carry the vault keys.