# What we ask of each fund seat (v3)

**Version 3, 19 October 2026.** A plain-English summary, per seat, for firms considering a seat on a tokenized fund run with ETP Foundry on Canton. The rules are in Methodology v1.1 (etpfoundry.com/methodology), which governs where this summary differs. Exact fields are served at etpfoundry.com/api/signer-protocol.

> **In short.** Each fund is run by its own parties. Once a day, at the fund's valuation time, ETP Foundry calculates the value of one share (the NAV) from the fund's holdings on the ledger and prices from existing providers such as Chainlink or Kaiko, and proposes it. Each seat checks it against a few numbers it already holds, from its own systems, and signs on the ledger or refuses. A small checker on your side does this automatically. Nobody is asked for an opinion, seats are free, and ETP Foundry never signs.

> **What changed from v2.** v2 (28 September 2026) was written for the retired price-fixing product: venues set a token's price from their trades, a lender challenged it, and the issuer gated it. In the fund model, prices come from existing providers, and the seats check and sign the fund's NAV and its other actions. v3 adds the sponsor and administrator seats, keeps the reserve snapshot, custody and register checks (unchanged fields), changes the lender's check to the fund's NAV, limits venues to fair value where an asset has no feed, and drops off-hours fixings, strikes and observation windows.

**Status, stated plainly.** Canton DevNet only (a test network; nothing has money value). No outside party holds a seat yet, and no NAV has been signed by one. ETP Foundry is not authorised or registered with any regulator. Our code has not been independently audited.

**Rules for every seat.**
- Numbers carry at most 10 decimal places; times are UTC.
- A **malformed** submission is refused with an error naming the field, and nothing is recorded.
- A **well-formed** submission that fails its check is recorded as your **refusal**, with the numbers.
- A figure your systems cannot produce is never estimated: your checker sends nothing.
- Every accepted submission is stored with a SHA-256 digest.
- Your tolerances are declared in advance in your seat settings, never per submission.

## 1. Sponsor

**Who:** the company whose name is on the fund. **You sign:** basket changes, the fee schedule, compliance actions (approving market makers, who may hold shares, pausing transfers), suspensions and the wind-down. You co-sign the NAV. **The one limit:** the sponsor can never reach the signing number (K) alone; another party always has to sign too. The ledger enforces this.

## 2. Administrator: NAV recomputation

**Who:** an independent fund administrator. **Why you:** you check a fund's value against your own numbers today; here the holdings come straight off the ledger instead of statements.

| You send | Rule |
|---|---|
| `navPerShare` | Your own recomputation; > 0 |
| `netAssets` | Holdings × prices + cash − accrued fees − liabilities |
| `sharesOutstanding` | At the valuation point; navPerShare × shares = net assets |
| `valuationPoint` | The point the NAV describes; not in the future |
| `oldestPriceAsOf` | Time of the oldest price you used; at most 24 hours before the valuation point |

**The check:** your NAV must be within your declared tolerance of the proposal (`navBps`, default 1 bp). Outside it is your refusal. You also sign fee accruals and corrections, and your signature is needed for a stale price to be carried forward.

## 3. Reserve signer (token issuer): reserve snapshot

**Who:** operations or treasury at the issuer of a token the fund holds (BitSafe for cBTC, onRails for cETH). **Why you:** only you can state, with accountability, what your reserves and redemption desk looked like at a given time. **Why it matters to you:** every share created locks your token into the fund.

| You send | Rule |
|---|---|
| `reserves` | Units of the underlying (e.g. BTC); ≥ 0 |
| `supply` | Tokens outstanding; > 0 |
| `asOf` | Not in the future; no older than your freshness limit (default 24 h) |
| `evidenceRef` | Proof-of-reserve report, contract addresses and block, or custodian statement reference |
| `redemptionsOpen` | Redemptions open to holders now |
| `mintBurnPaused` | Minting or burning paused now |

**The check:** reserves ≥ supply, fresh, redemptions open, minting and burning not paused. Any failure is your refusal, naming each reason; every party is alerted, and you (or another seat) may pause creations. Your snapshot is your own statement on a permanent record, not an audit. A wrapped token is valued at par with its underlying only while you confirm the backing. Canton Coin has no issuer, so a Canton Coin fund has no reserve signer.

## 4. Custodian: holdings reconciliation

**Who:** the custodian holding the fund's assets off the ledger. **You send:** `holdings` (units you hold for the fund), `ledgerHoldings` (units the ledger shows), `encumbered` (pledged or lent), `statementAsOf` (fresh, default 24 h). **The check:** the two holdings match and nothing is encumbered. **Never sent:** the statement, account numbers, other clients.

## 5. Transfer agent: register reconciliation (optional)

**You send:** `registerShares`, `ledgerShares`, `registerAsOf` (fresh, default 24 h). **The check:** they match. You also co-sign compliance actions. **Never sent:** the register, holder identities.

## 6. Lender (optional)

**Who:** a firm lending against the fund's shares. **You check:** that the fund's NAV is within a tolerance of your own value for the shares, declared in advance in your seat settings. Outside it is your refusal, recorded with both numbers. **Why it matters to you:** you lend against a value signed by the fund's own parties.

## 7. Venue or valuation agent (only where an asset has no feed)

Venues and market makers sign a fair value from their own trades (totals for a short window: count, volume, average, low and high) for an asset with no usable price feed, such as a tokenized stock outside market hours. A valuation agent marks private-credit loans from the servicer's loan tape. How several venue submissions are combined is not yet restated for funds (Methodology v1.1 §14).

## Why this is not a rubber stamp

1. **Every submission is a number that can be wrong in a checkable way**, against the proposal and against your own declared tolerance.
2. **The parties check different things**: the administrator the arithmetic, each issuer its own backing, the custodian and transfer agent the holdings and shares.
3. **Disagreement is visible.** A refusal is recorded with its numbers; without enough signatures the NAV is not struck that day.
4. **ETP Foundry cannot fill the gap.** It calculates and proposes but cannot sign, and no seat it runs counts.

**What this does not solve.** ETP Foundry cannot audit your source systems. A false number is a false statement on a permanent record, under your name.

## Objections, and honest answers

- **"Liability?"** You state numbers about your own records and nothing else. You do not certify the other seats, the NAV as a whole, or ETP Foundry. A knowingly false submission is grounds for removal. We offer no indemnity; send counsel the committee terms first.
- **"Effort?"** An engineer points the checker at your own systems once; then it runs unattended. It sends nothing if a source cannot be read and never widens a tolerance. You can start hosted and move later.
- **"Confidentiality?"** Your submission goes to ETP Foundry's desk and its append-only record. It is shown to the fund committee and its auditor. That is our access policy, not a property of the ledger: ETP Foundry can read every submission. Your order book, trades, clients, keys and statements stay with you.
- **"Cost?"** None. Seats are never charged and never paid. Only the fund sponsor pays ETP Foundry.
- **"Your conflicts?"** If a fund pays a fee in basis points, our fee rises with the fund's value, which we calculate. We also run creation and redemption, and today operate every seat on DevNet. The controls: we never sign, the ledger refuses us as a member, and we do not trade the fund's assets. See the conflicts policy (v0.3).
- **"Can you sign for us?"** On a hosted seat (L1), technically yes; it is disclosed and never counts. With your own key (L2), not through the Ledger API; we can still delay or refuse to submit. L2 was proven on DevNet on 26 September 2026 and is switched off on the running desk today. Your own node (L3) is not built.
- **"Is this regulated?"** ETP Foundry is not authorised or registered anywhere. Where a jurisdiction requires a licensed firm in your role, that firm keeps the role. Questions about your own obligations are for your counsel.

---

*ETP Foundry is a trading name of Lucilla, Inc., Toronto. Nothing in this document is investment advice or an offer of any financial product or service. committee@etpfoundry.com*