Duties and governance

Risks addressed

One person completes a sensitive act alone.
A limit is loosened without notice.
The venue intervenes in the register.
Unapproved code runs.

Controls

A second person at the venue approves every sensitive change the venue makes, and the riskiest take two approvers besides the maker. The four-eyes check is by person, so holding two roles never lets anyone approve their own act. The auditor never approves.
Interventions on an investor (freezing, forced transfer and recovery) sit with their own role, compliance, apart from the operator who runs the book and sets it up. Risk may also freeze, as an incident’s first responder.
Every mint and burn carries the register keeper’s signature, given for the act or in a consent the ledger checks. The venue prepares and settles orders. It acts on the register only where the register keeper agreed in advance, and the table below names each case.
The venue makes each policy change under four eyes, and every version is on the record. A change to the supply terms the ledger enforces (the fund size cap, the daily issuance and redemption limits, and wind-down) reaches the ledger only when the register keeper accepts it, and so does a change to the eligibility terms of an asset on the register keeper’s credential. A tightening binds the venue’s own acts at once; a loosening needs two approvers and applies only after a delay.
Each party’s node approves a contract package version before acting on it. A new asset needs no new code.

Who decides

	Decides	Prepares	Checks
A mint or burn	, for the act or under its consent		The ledger, in the same transaction
Who may hold the asset	Whoever issues the credential the asset requires: , whose own credential its standing admission consent creates, or	asks for the admission	The ledger, against the admission consent’s terms at the admission; the registry, on every mint, burn and transfer
A transfer between investors, outside the venue	The registry, on who may hold	The sending investor	Reconciliation, against the asset’s policy
A block on the registry	, following the venue’s freezes	publishes its freezes	The registry, wherever a transfer starts
A freeze or a hold, on the venue’s own acts			Two approvers at , to lift or release it
A backed instrument’s reserve and its terms	and the reserve’s holder accept it, and each change of its terms	, under four eyes	The ledger, on every mint, redemption and change of terms
A forced transfer or a recovery	Two approvers at , under a standing agreement signed and the investor’s prior consent		Reconciliation, against the approved operation
Who a distribution pays	The plan, approved at ; pays its lines		The price source’s list, where it sends one; reconciliation, each mint against a line
A price		None	Reconciliation, against the official NAV
A policy change	, for its own acts; accepts a change to the supply terms, and to the eligibility terms of its admission consent	, under four eyes	The delay, for a loosening

The register keeper’s keys can sit in MPC custody, under its own approval policies. Those govern what it signs; the asset’s rules on the ledger govern what any order may do.

Evidence

Operations and approvals: maker, role, each approver and when, the decision.
Every policy version, with its approvers and effective time, and the register keeper’s acceptance of each change to the supply terms or to its admission consent’s terms.
The register keeper’s consents and agreements, and the signatories of each mint and burn.
The package versions each node approved.

Matrix rows CTL-13 to CTL-15: see the control matrix.

How it works: roles

Role	Kind	May
`operator`	Person	Day to day: registers holders and offers admissions, takes orders and settles them, executes distributions, posts statements. Setup: records assets, changes policies, proposes the issuer’s consents and powers, and opens, amends and closes a backed instrument’s reserve
`approver`	Person	Approves four-eyes actions, never one it made
`risk`	Person	Runs reconciliation and a reserve’s report; pauses and freezes at once; asks for releases; changes policies
`compliance`	Person	Freezes an investor or limits it to leaving, at once; asks for a restriction’s lift, a forced transfer between consenting holders citing an order, and a consenting holder’s recovery to its registered successor
`auditor`	Person	Reads everything; writes nothing, and never approves
`investor`	Person	Its own holder’s records and orders only
`app`	System	An integrating application: orders and reads for any holder, no controls
`monitor`	System	Health, status, the reconciliation verdict and redacted control events
`feed`	System	An outside source: posts statements, reads nothing
`registrar`	System	The register keeper’s own systems: read the parties the venue asks it to block, and the distributions it pays; nothing else

A role decides whether the venue will ask the ledger for an act. The ledger decides whether it happens: each counterparty authorizes its own part on its own node. Your identity provider assigns the roles; a deployment does not change what a role may do.

How it works: who may do what

Area	Who asks	Approvers besides the maker
Assets	`operator`	One
Reserves: opening, terms, lock agreements, closing	`operator`	One
Policies	`operator` or `risk`	One to tighten; two, and the delay, to loosen
Holders	`operator`	One for attributes, outside KYC, closing and succession
Restrictions	`compliance` or `risk`, at once	Two to lift
Forced transfer and recovery	`compliance`	Two
Distributions	`operator`	One to execute; two for a standing approval
Reconciliation	`risk` runs one	Two to release a hold
The pause	`risk`, at once	Two to release its hold

How it works: four eyes

A four-eyes call is recorded with its maker and the request, and runs only when an approver approves it. What runs is the stored request.
The approver must be a different person from the maker, so holding two roles never lets anyone approve their own act.
A decision is final: an approved action runs once, and a rejected one never runs. A maker may withdraw its own request.

How it works: changing a policy

A policy is replaced whole and checked whole, under four eyes, against the version it was written for. A version at least as strict as the policy in effect, and every pending one, needs one approver and applies at once, cancelling any pending loosening. Anything else needs two approvers and applies only after the delay, 24 hours by default (Configuration reference), so holders, staff and webhooks see it coming. The register keeper accepts each change to the supply terms on the ledger: the fund size cap, the daily issuance and redemption limits, and wind-down. Where an asset requires the register keeper’s credential, the register keeper accepts each change to the eligibility terms into its admission consent too: the KYC providers it trusts, the claims an admission needs, and the residencies and investor types admitted. The rest of the policy binds the venue’s own acts. A tightening binds the venue’s own acts as soon as the venue approves it; a loosening of the supply terms or the eligibility terms applies on the ledger only once the register keeper has accepted it and the ledger’s delay has passed.

The story

Control families

For auditors

Duties and governance

Risks addressed

Controls

Who decides

Evidence

​Risks addressed

​Controls

​Who decides

​Evidence

Risks addressed

Controls

Who decides

Evidence