Risks addressed
- An investor holds more or less than allowed.
- The fund grows past its size, or flows exceed their limits.
- Units are issued without payment.
- Units move during a lock-up or outside a transfer window.
- A backed instrument loses its cover, or its reserve’s assets are released.
Controls
- Each asset has one policy, setting holding limits, fund size, daily limits, lock-ups, dealing and transfer windows, countries, investor types and wind-down. The venue checks it before every act it takes, and a refusal carries a stable code. The rules the ledger enforces are the register keeper’s: it accepts the supply terms its consent charges on every mint and burn.
- For a fund paid on the ledger, the issuer’s consent checks the fund size cap, the daily issuance and redemption limits and wind-down in the same transaction as every mint and burn.
- No unit is issued without payment. When the payment is on the ledger, units and payment settle in one transaction across two registries; when it is off the ledger, the issuer confirms the cash before it mints.
- A transfer between investors outside the venue’s settlement is checked by the registry for who may hold, and reconciliation finds and grades any that breaks the policy’s amounts or times.
- A backed instrument’s reserve checks its cover in the same transaction as every mint, redemption, top-up, withdrawal and change of terms, and its holdings are locked to the venue, the issuer and the reserve’s holder together, so none of them can release them alone.
Evidence
- Every policy version, with its approvers and effective time, and, for the supply terms, the register keeper’s acceptance on the ledger.
- Refusals, each with the rule’s code and the policy version that refused.
- The settlement transaction of each order, and the cash reference on each order paid off the ledger.
- Each reserve’s holdings, outstanding units and terms, and its reports on the ledger.
How it works: the policy
How it works: the policy
Each asset has one policy: a document of optional modules, versioned and append-only. The version in effect is the newest whose effective time has come.
The venue judges each module on the acts it takes, as the table says. On the ledger, a fund’s consent charges every mint and burn of an order paid on the ledger against the supply terms the register keeper accepted: the fund size cap, the daily issuance and redemption limits, and wind-down. Where the asset requires the register keeper’s credential, the register keeper’s admission consent judges every admission against the admission, countries and investor types modules, as the register keeper accepted them.A refusal names the rule, a stable numeric code and the policy version; the codes are listed in How the API works. A dry run answers the codes an act would meet, without acting.
How it works: the issuer's consent
How it works: the issuer's consent
- For a fund paid on the ledger, every mint and burn runs under the consent the issuer signed once. The consent checks the price the asset’s price source signed, the fund size cap, the daily issuance and redemption limits and wind-down. An order over a limit is refused with the next window’s start.
- When an order is paid off the ledger, the issuer mints its units itself once its bank confirms the cash. The venue then books the order against that mint, in a transaction of its own: only a mint of exactly its units, to its investor, made after the order, and only once.
How it works: what the registry checks on its own
How it works: what the registry checks on its own
The DA Registry checks who may hold: credentials and the block list, on every mint, burn and transfer. A transfer between two custodians commits whatever the policy says about amounts or times. The venue refuses its own acts outright. For the rest, reconciliation reports a holder over or under its limits, a fund over its size, a holder the policy no longer admits, and a transfer outside its window, during lock-up or under wind-down. A holder no longer admitted, or a fund over its size, is a blocking finding: the venue holds the asset.