The issuer wants the wrapper marked at par. The lender wants it marked conservatively —
it is the one under-collateralised if the mark is too high. The venue wants it marked where the
asset actually traded. The custodian and the transfer agent are neutral and liable. A committee
of three issuers is not a committee. The conditions below are the exact names the API accepts;
the evidence fields are what the server checks before anything reaches the ledger.
seat · issuer
Issuer
Who sits here. The party that issues the wrapped asset. TradFi analogue: a
benchmark contributor under a code of conduct (IOSCO Principle 14 / BMR); an LBMA direct
participant with the ability to settle.
“The wrapper can actually be redeemed right now.”
Conditions · reserve model attested (e.g. cBTC)
attestor-quorumAt least your own threshold of attestors are online and signing.quorumSigners (integer) · quorumThreshold (integer) · rule: quorumSigners ≥ quorumThresholdreserves-currentThe most recent proof-of-reserve attestation is less than 24h old.reservesAsOf (instant, ISO-8601) · rule: within 24h of the confirmationreserves-cover-supplyAttested reserves are at least the circulating supply of the wrapped token.reserves (number) · supply (number) · rule: reserves ≥ supplyredemption-queue-clearNo redemption request is unfilled beyond its stated window.queueDepth (integer) · maxQueueDepth (integer) · rule: queueDepth ≤ maxQueueDepth
Other reserve models. If the reserve is on-chain verifiable (e.g. cETH,
locked in protocol-controlled contracts) there is no attestor set: you assert your own on-chain
verification < 24h, locked ≥ supply, queue clear. If it is custodial (e.g. a
tokenised equity): custodian statement < 24h, holdings ≥ supply, queue clear. You are never
asked for a number your model does not produce; an undeclared model is held to attested,
the strictest profile.
On refuse
You do not sign at par. Refuse naming the failed condition; the administrator either restrikes
with a factor below par and a rationale naming that condition, or no fixing is struck.
Eligibility and ongoing obligations
- A named legal entity with disclosed principals and licence; the four on-ledger facts (registrar party, instrument id, registry URL,
HoldingV1); a declared reserve model and attestation cadence; a signed attestation agreement.
- Publish reserve attestations on cadence (< 24h); evidence-backed conditions only — no ticks; annual re-attestation of fitness, conflicts and confidentiality; notify any change of control.
- Exactly one issuer seat per instrument. Issuer-controlled parties may never reach K. The issuer may not also hold the custodian or venue seat for its own instrument.
- Suspension on a missed attestation; mandatory resignation if sanctioned for manipulation; removal for false evidence; three consecutive unexplained silences trigger a review.
Cost
$0 — never charged, never paid
Time
Automated: minutes/day · Manual: one confirmation/day
Checker
Reference config shipped (examples/issuer.yml)
seat · lender
Lender / risk taker
Who sits here. A platform holding the asset as collateral. TradFi analogue: a
financial-intermediary / auction-participant member of a price oversight committee (IBA PMOC);
a direct participant with bilateral credit lines.
“I will carry this number on my own book.”
Conditions
independent-mark-within-toleranceThe proposed mark is within your declared tolerance of your own valuation.independentMark (number) · rule: |mark − proposal| / proposal ≤ tolerances.markBps (default 25 bp)liquidations-consistentNo liquidation you ran in the session cleared materially away from the mark.liquidationsToday (integer) · worstDeviationBps (number) · rule: worstDeviationBps ≤ tolerances.liquidationBpsbook-acceptanceYou will mark your own collateral at this level for the period the fixing governs.acceptedAt (instant) · rule: a timestamp not in the future
This is the strongest signature in the protocol: the only one asserted against the signer’s
own money. A lender that signs book-acceptance and then marks its book elsewhere has
made a false statement, on-ledger, with its own signature on it.
On refuse
Refuse naming the condition — “my mark is 41 bp from the proposal; my tolerance is
25” is actionable, a vote of no confidence is not. Below K, no fixing exists for the day.
Eligibility and ongoing obligations
- Actually holds the instrument as collateral (position evidence at onboarding, re-checked quarterly); balance sheet at risk; disclosed licence and principals; a declared tolerance in bp.
- Numbers behind every condition; the tolerance may not be widened silently; quarterly position re-confirmation.
- Position drops to zero: the seat lapses at the next quarterly review. Three refusals without cause trigger a review. Same manipulation-sanction rule as every seat.
- At least one lender or venue in every K. A lender that is an affiliate of the issuer counts as issuer-controlled.
Cost
$0 — never charged, never paid
Time
Automated: minutes/day · Manual: one confirmation/day
Checker
Reference config shipped (examples/lender.yml)
seat · venue
Venue
Who sits here. A venue where the wrapped asset actually trades. TradFi analogue:
a constituent exchange under CF Benchmarks’ Constituent Exchange Criteria; a regulated
electronic trading venue at the first tier of the ICE Swap Rate waterfall.
“The mark sits inside the range my own book printed.”
Conditions
traded-rangeThe proposed mark lies within the high/low your own book traded in the window.low (number) · high (number) · rule: low ≤ proposal ≤ high — enforced by the ledger itselfspread-within-toleranceBest bid/ask spread at the strike is inside the declared tolerance.recorded, not checkedsufficient-volumeTraded volume in the window meets the declared minimum.recorded, not checkedno-prints-attestedYour book showed no trades in the window; you state the best bid/ask at the strike and do not contradict the proposal.bestBid (number) · bestAsk (number) · rule: bestBid ≤ proposal ≤ bestAsk when quoted; mutually exclusive with traded-range
This is the sharpest guard in the system: a venue cannot sign a price its own book never
printed. The ledger refuses a range that does not contain the price, an inverted range, and a
half-specified one. On Canton a window with no trades is the normal case, so a venue attests the
absence instead of staying silent — and the band widens to carry it.
On refuse
Outside your range: refuse naming traded-range. No prints: do not refuse and do not
stay silent — attest no-prints-attested with your best bid/ask. Never claim both.
Eligibility and ongoing obligations
- An admitted constituent venue: all six rulebook §4.0 tests plus an executed data-sharing agreement, an API with trade and order data, KYC/AML compliance, and cooperation with inquiries. Volume above 5% over 30 days, trending to CF’s 3% over 90–180 days.
- Annual conformance review presented to the committee; surveillance alerts reviewed as a standing item;
traded-range or no-prints-attested, never both.
- The administrator may suspend ad hoc; the committee decides permanence; the decision is published. Anyone may nominate an addition or removal.
- At least two independent venues (different operators) at launch. A venue owned by the issuer or the administrator is disclosed and does not count toward the two.
Cost
$0 — never charged, never paid
Time
Automated: minutes/day · Manual: one confirmation/day
Checker
Reference config shipped (examples/venue.yml)
seat · custodian
Custodian / reserve holder
Who sits here. Whoever actually holds the backing — a regulated custodian, or
the protocol-controlled contracts for an on-chain-verifiable asset. TradFi analogue: an LBMA direct
participant with the ability to settle and clear; the custodian and securities-lending communities
FTSE Russell draws committees from.
“This is what is actually in the account.”
Conditions
holdings-currentYour most recent holdings statement is less than 24h old.statementAsOf (instant) · rule: within freshnessHours of the confirmation (24h default, declared per asset)holdings-cover-supplyHoldings you actually custody are at least the issued supply.holdings (number) · supply (number) · rule: holdings ≥ supplyno-encumbranceThe holdings are unencumbered — not pledged, lent or rehypothecated.encumbered (number) · rule: encumbered == 0
On refuse
A stale statement, a shortfall, or any encumbered units: refuse naming the condition. A missed
statement moves the fixing to EXCEPTIONAL, then NO FIXING. Notify any lien or rehypothecation
immediately.
Eligibility and ongoing obligations
- A regulated custodian (or protocol-controlled contracts); holdings segregated from own assets; statement age within the declared freshness; an independent control report (SOC 1 / ISAE 3402) or on-chain proof.
- Numbers behind every condition; immediate notice of any lien or rehypothecation.
- Insolvency: immediate suspension. Must not be the issuer or an issuer affiliate.
- Mandatory for any asset whose native network is not the settlement ledger.
Cost
$0 — never charged, never paid
Time
Automated: minutes/day · Manual: one confirmation/day
Checker
Same API and body; reference seat rules not yet shipped for this seat
seat · transfer-agent
Administrator / transfer agent
Who sits here. The party appointed under the fund’s governing documents that
keeps the share register and does the fund’s accounting today — already liable for it,
which is exactly why its signature carries information. TradFi analogue: a calculation or
dissemination agent overseen under a benchmark oversight committee’s terms of reference.
“This is the share count the NAV is divided by.”
Conditions
shares-outstanding-reconciledShares outstanding on your register match the ledger at the strike instant.registerShares (number) · ledgerShares (number) · rule: registerShares == ledgerSharesfees-accruedAccrued fees and liabilities deducted are those the fund’s published schedule requires.accruedFees (number) · rule: accruedFees ≥ 0
On refuse
A register that does not reconcile: refuse naming shares-outstanding-reconciled and
report the break the same day. An unreconciled register is a NO FIXING for a fund NAV.
Eligibility and ongoing obligations
- Appointed under the fund’s governing documents; maintains the share register; reconciles shares outstanding daily; an SLA with the administrator.
- Numbers behind every condition; breaks reported the same day.
- Replacement by the fund, notified to licensees. Cannot be the benchmark administrator.
- Where the fund self-administers, the seat is disclosed as issuer-controlled and excluded from K for issuer-majority purposes.
Cost
$0 — never charged, never paid
Time
Automated: minutes/day · Manual: one confirmation/day
Checker
Same API and body; reference seat rules not yet shipped for this seat
Every member discloses conflicts. The public roster follows IBA’s
table: name, company, market position, seat and instruments covered, directorships and interests, date of
the conflict-of-interest declaration — plus trust level and declared tolerance band. Tolerances are
published in aggregate. Terms of office: six months initial, extended, maximum nine consecutive years, with
an annual membership review. Removal is mandatory on a manipulation sanction, for any seat.