What a fund needs every day, and who does it.
A fund needs a defensible price for what it holds, a NAV, a share register, creations and redemptions, custody and a legal wrapper. In a traditional ETF each of those is a different firm. On a shared ledger, three of the daily jobs become one piece of software — and the rest stay exactly where they are.
Role by role.
The firm names on the left come from the funds’ own prospectuses and annual reports (IBIT, FBTC, GBTC). Bundling is normal there too — BNY Mellon is both administrator and transfer agent for GBTC — the cure being disclosure, not separation.
| What has to happen | Traditional ETF: who does it | With ETP Foundry |
|---|---|---|
| Publish a defensible price for each asset | A benchmark administrator or index provider — CF Benchmarks for IBIT, CoinDesk Indices for GBTC | We compute it from the committee’s data, and a committee of parties with positions in the asset signs it (K of N). Today no value is published above tier 0, and no exchange-derived price is published at all; no fixing is published for use. |
| Strike the NAV, keep the books, accrue fees | A fund administrator — BNY Mellon for IBIT and GBTC, Fidelity Service Company for FBTC | Our software does it, from the fixing of each holding, gated by the custodian’s and transfer agent’s reconciliations. |
| Keep the share register; process creation and redemption orders | A transfer agent and the distributor’s order desk — State Street for FBTC; BNY Mellon and Continental Stock Transfer for GBTC | Our software does it. Where the fund’s regulator requires a registered transfer agent, that firm stays — and can hold the transfer-agent seat. |
| Settle the basket against the shares | A clearing agency — NSCC and DTC, next business day (T+1) | The ledger does it: basket and shares move in one transaction, or not at all. |
| Create and redeem shares to keep the price near NAV | Authorised participants — Jane Street and Virtu for IBIT | Still authorised participants. They now settle atomically, at the signed NAV. |
| Reach investors | A listing exchange and market makers | Fund shares carried to other chains through vaults (testnets only today: ten internal mechanism tests on MOCK tokens, and one vault on Robinhood Chain Testnet’s own test stock tokens). Where to list stays the issuer’s choice. |
| Hold the assets | A custodian — Coinbase Custody and Anchorage for IBIT, Fidelity Digital Assets for FBTC | Unchanged. The issuer keeps its custodian. We never hold anyone’s assets. |
| Legal wrapper, prospectus, trustee | The sponsor, the trustee and their lawyers | Unchanged. The issuer’s. |
| Authorise and supervise | The fund’s regulator | Unchanged. We are not authorised for any of these roles anywhere — see Regulatory. |
Time, settlement and cost
| Traditional ETF | With ETP Foundry | |
|---|---|---|
| Firms to contract with | Index provider, fund administrator, transfer agent, custodian, authorised participants, clearing agency — each a separate contract and system | One service for price, NAV, register and creation/redemption. You keep your custodian, your authorised participants and your lawyers. |
| Time to launch | Months | The goal is days. An asset already covered by a committee needs no new set-up, and a new asset is configuration, not code. Not yet shown with a live fund. |
| Settlement of creations | T+1 through NSCC and DTC | Atomic: in the same transaction, with any fee charged in it too |
| Reconciliation | Daily, between each firm’s own systems | One ledger. The transfer agent confirms its register matches it, as part of the signed NAV. |
| When the market is shut | An auction has no bidders and an average has nothing to average | A venue that did not trade reports zero trades, and the fixing falls to quotes or a reference price, labelled as such |
| Cost of the price and the NAV | A separate fund-accounting fee and a separate index licence | One licence for the fund or ETP issuer, pricing on request. Committee members pay nothing. |
Who pays what: who pays.
We are not replacing the wrapper, the regulator or the custodian.
The legal wrapper
The fund’s structure, prospectus, sponsor and trustee are the issuer’s, drafted by its lawyers. What a fund does on a day with no price is written in its own governing documents, not ours.
The regulator
Benchmark administration is licensed in the UK and EU, and transfer agency is registered in the US. We hold neither. Where a regulator requires a licensed firm in a role, that firm stays — and can sit on the committee.
Real-world custody
The custodian holds the backing. Creation and redemption move holdings between the authorised participant and the fund on the ledger; nothing passes through us.
Also not: an exchange, a price feed, or a trader in what we price. Why each of those matters →
Submit. Compute. Check. Publish.
ETP Foundry Methodology v1.0. The price comes from the committee’s own data; we only compute it. The full methodology, with the precedent behind every rule. Methodology v1.0 is the sole governing methodology; the Rulebook v0.2 describes process only where it is consistent with it, and where any text differs, Methodology v1.0 governs.
Venues submit their trades
At the strike, each venue where the asset trades submits its own trades from the hour before: how many, the volume, their VWAP, the low and high, and any halt time. These are the price inputs. Nobody else holds them. (The strike time is set per asset: equities at the home-market close; for crypto, see the note below.)
We compute the price
The fixing is the volume-weighted median of the eligible venues’ VWAPs. A venue far from the others is excluded as an outlier and named. If no venue traded, we fall to executable quotes, then to a licensed reference price × the par factor, and the value says which. We compute; we never sign.
The other seats check it
A lender submits its own mark from its own risk system: the value publishes only within the tolerance it declared in advance: a risk-side challenge modelled on independent price verification. Where the lender’s mark comes from a public reference price, it is a basis check, and the fixing says so. The issuer signs its reserves and supply as of a stated time, and whether redemptions are open: a peg-integrity gate that can stop publication but never moves the price. For a fund, the custodian and transfer agent reconcile holdings and shares.
The venue’s range is enforced by the ledger itself: a venue cannot sign a price its own book never traded.
At K signatures and every gate passed, the price exists
The signed price carries who signed, what each submitted, the input level and the rules version. Once it is published above tier 0 (which needs an independent oversight function, third-party seats with their own keys, no administrator seats and two independent venues), funds re-mark, and creation and redemption settle against it. Otherwise there is a labelled fallback, or a gap published as a gap, and every value says which tier produced it.
Crypto strike time: 16:00 London, adopted 28 September 2026 (the time of the CME CF Bitcoin Reference Rate). Why.
Schedule at a glance: three layers, 24/7
A tokenised stock such as SPYx trades around the clock, but the NYSE is open about 32.5 of the 168 hours in a week, and a lender still needs a number at 02:00 on a Sunday. Every value ETP Foundry publishes carries one of three labels (methodology §3A.0):
| Layer | When | Who stands behind it | Use it for | Never use it for | Status |
|---|---|---|---|---|---|
1. LIVE indicative | Continuous | Nobody: tier 0, unsigned. Venue dispersion shown, no band | Screens, monitoring | Anything contractual | not published: no licensed source (exchange prices are never shown) |
2. OFF-HOURS SIGNED fixing | 00:00, 08:00 and 16:00 UTC, every day, weekends and holidays included | K of N seats, signing automatically, at least one of them a venue, with a published data-quality band (± b; uncalibrated until back-tested) | Margin, liquidation, health factors, collateral haircuts, once attested; until then tier 0, labelled pilot — not attested, and not for liquidation | NAV, creation, redemption, fund reporting | specified, not built |
3. OFFICIAL fixing | Once a day. Crypto: 16:00 London, adopted 28 Sep 2026 (why). Any equity, and any basket with an equity leg: 16:00 New York on NYSE trading days | K of N seats and every gate; published with its tier and input level | NAV, creation and redemption, reporting | — | built for wrapped crypto and funds on DevNet; equities planned |
If fewer than two live inputs of distinct signal types remain (token trades on any number of venues count as one), nothing is guessed: the result is NO FIXING, and the last good value stays visible with its age. A move of more than 10% since the previous value is published and flagged EXCEPTIONAL, never suppressed; that is the word’s only meaning. Nobody may present an off-hours or indicative value as a NAV, and the licence says so.
How you run it: hosted, own cloud, or self-run
You choose where your checker runs. You can start hosted and move later; the seat stays the same.
| Hosted by ETP Foundry (default) | Own cloud, one click | Self-run (advanced) | |
|---|---|---|---|
| Your effort | Done in the dashboard: sign in, connect your data, and confirm daily. No install, no servers, no Docker. Your own legal and compliance review will take longer, and we go at your pace | A developer deploys our ready template into your own Google Cloud (Cloud Run) or AWS (ECS Fargate) account, once your cloud and security teams approve it. It restarts itself; a second, standby instance is optional | Our Docker image on your own server |
| Your data | Issuers often connect nothing: we read your public reserve proof or on-chain reserves, and you set two status toggles (redemptions open, mint/burn paused). Venues and lenders paste a read-only API link or key | Read inside your own cloud account | Read on your own server |
| Signing | L1 (we sign for your seat, disclosed on every value), or your own Google Cloud KMS key (one-click permission; the key never leaves your vault) | Your Ed25519 key in your own KMS (Google Cloud KMS or AWS KMS) | Your Ed25519 key, generated on your server |
| Counts as | Operator-run: tier 0 (not attested), even with your own key, because we fetch the inputs. Ideal for the pilot | Counts toward tier 1 | Counts toward tier 1 |
In every mode: a readiness alert 15 minutes before the 16:00 London strike (by webhook, and by e-mail once e-mail notices are on), live status in the dashboard, and manual submission in the dashboard as a last resort. A missed strike is not fatal: three unexplained misses in a row trigger a review. Stated plainly: hosted and own-cloud modes are built and live on the desk since 29 Sep 2026. No third-party member has run either yet. Level 2 own-key signing stays switched off on the running desk until the ledger JSON API is opened to it. Members’ read-only data credentials are encrypted (AES-256-GCM); the encryption key is held in Google Secret Manager, not in the code or on disk. The cloud templates have not yet been applied in a member’s account. Tier 1 also needs the other §6.4 conditions, so today every value is tier 0 whatever the mode.
Try it first: the sandbox
Anyone signed in to the desk can flip Sandbox and, in a private practice world of their own, launch a tokenised ETF in three steps, act as the sponsor, the authorised participant and each of five committee seats, and watch a sandbox committee strike it through the same determination and gate described above. The inputs are scripted, so every sandbox value is labelled SANDBOX — demo inputs, operator-run, tier 0, not a price; sandbox ETPs never appear in the public record, and nothing reaches the ledger or a real committee.
Words you will see
- VWAP
- Volume-weighted average price: the average price of a venue’s trades in the window, each trade weighted by its size. More
- Volume-weighted median
- Line the venues’ VWAPs up from low to high and take the one where half the total volume is reached. One odd venue cannot drag it the way it drags an average. More
- Outlier
- With three or more venues, a venue whose VWAP is more than 300 bp from the simple median of the venue VWAPs. It is excluded, and named on the record. More
- IPV
- Independent price verification: a bank checks a price against its own number, with a threshold set in advance. The lender seat’s check is modelled on it. More
- Basis check
- What the lender’s check is when its mark comes from a public price for the underlying (BTC for CBTC): a cap on how far the token may trade from that price, not an independent valuation of the token. Disclosed on every fixing. More
- Peg-integrity gate
- The issuer’s check that a wrapped token is still worth its underlying: reserves cover supply, and holders can redeem. It can stop the price, never set it. More
- OFF-HOURS SIGNED fixing
- A signed value at 00:00, 08:00 or 16:00 UTC, with a data-quality band, for margin and liquidation once attested. Never a NAV. Specified, not built. More
- Hosted / own-cloud checker
- Hosted: we run your seat’s checker, nothing to install; it counts as operator-run, so tier 0 (not attested). Own cloud: our template in your Google Cloud or AWS account, your key in your own KMS; counts toward tier 1. More
- NO FIXING / EXCEPTIONAL
- NO FIXING: too few live inputs of distinct types, so no value is guessed. EXCEPTIONAL: a move of more than 10%, published and flagged; nothing else. More
Committees are per asset. Funds reuse them.
Members who sign the cBTC price once a day sign it for every fund that holds cBTC. A new fund brings only what is new: an asset nobody has covered yet, and its own share register. That is how launching the fifth fund is meant to take days rather than months.
Words used here: glossary. The full rules: methodology and documents. What is live today: status.