Deployment patterns

The venue runs NodeAsset. Every other party is internal, a desk of the venue’s own organization, or external, another firm. Which applies is a property of each asset, not of the deployment: one bank can issue its own deposit token and distribute another firm’s fund.

Who can be internal or external

Party	Who it can be
Register keeper	Internal: the organization’s own issuance desk, such as a bank issuing its own products. External: an issuer, or the transfer agent it appoints, such as an offshore transfer agent
Treasury, the fund’s cash account	Follows the register keeper, and signs the fund’s consent beside it
Price source	Always a party of its own, such as the fund’s administrator
Bank, the payment registry	The venue’s own bank, another bank, or none, when orders are paid by bank transfer
Custodian	The venue, holding its customers’ accounts, or the investors’ own custodians
KYC provider	The venue’s own KYC, or a provider
DA’s operator	Always Digital Asset

Each role’s page says what that party runs, signs and approves, in both cases: Register keeper · Price source · Bank and payment registry · Custodians and investors.

The rules every combination keeps

The engine signs only as the venue. It holds the venue’s party alone, and never signs for another party. Where the venue also holds its customers’ accounts, its custody signs for them, apart from the engine.
The venue never holds a register keeper’s, a treasury’s or a price source’s key. Such a party is never a local party on the venue’s Canton node. Where the venue’s node hosts one, it is an external party that signs with its own key, and the venue’s node only confirms. In production, host it on a second Canton node the venue does not run as well, with a confirmation threshold the venue’s node cannot meet alone.
An internal register keeper keeps its own key and staff. Its issuance desk and the venue desk are different people, with different roles and keys, even in one organization.
The price source is a party of its own. NodeAsset refuses the venue’s party as a fund’s price source. Keep it apart from the register keeper’s and the treasury’s parties too.
The register keeper authorizes every order. For a fund paid on the ledger, it signs the fund’s standing consent once, with the treasury, and each order then settles within the consent’s terms, checked on the ledger in the same transaction. For an order paid off the ledger, it mints the units itself once its bank confirms the cash, and burns a redemption’s units on the investor’s request; the fund then pays the proceeds by bank transfer.

Named patterns

A distributor with an outside issuer and transfer agent


Who is who	The venue is a distributor. The fund’s transfer agent is the register keeper, with the fund’s treasury; the fund’s administrator is the price source; a bank’s deposit token, or a bank transfer, pays
What each runs	The distributor runs NodeAsset on its own Canton node. The transfer agent, the administrator and the bank each run their own node; the investors’ custodians run their wallets
What each signs	The transfer agent and the treasury sign the fund’s consent once. The administrator signs each NAV and each order’s price. Each investor signs its own payment
Mode	Standing consent for orders paid on the ledger; the transfer agent mints each order paid by bank transfer
Control matrix	As written: the register keeper’s row of Shared responsibility is the transfer agent’s

A bank issuing its own products, its own deposit token included


Who is who	The bank is the venue and, through its issuance desk, the register keeper of its products. It issues its deposit token on its own registry, so it is the payment registry too
What each runs	One NodeAsset install for the venue desk. The issuance desk’s party signs with its own key, kept apart from the venue’s
What each signs	The issuance desk signs each product’s consent, and mints and burns the deposit token. A price source of its own signs the price of each priced product
Mode	Standing consent
Control matrix	Read the register keeper’s row as the issuance desk’s: see Where your organization keeps the register

An asset manager selling its own fund


Who is who	The asset manager is the venue for its own fund. Its registry desk, or the transfer agent it appoints, is the register keeper; the fund’s administrator is the price source
What each runs	NodeAsset at the asset manager. An internal register keeper’s party signs with its own key; an outside transfer agent runs its own node
What each signs	The register keeper and the treasury sign the fund’s consent. The administrator signs each NAV and each order’s price
Mode	Standing consent for orders paid on the ledger; the register keeper mints each order paid by bank transfer
Control matrix	Internal: read the register keeper’s row as the registry desk’s. External: as written

A bank distributing third-party funds against its own deposit token


Who is who	The bank is the venue and the payment registry. Each fund’s transfer agent is its register keeper, and each fund’s administrator its price source
What each runs	The bank runs NodeAsset and its deposit token’s registry. Each transfer agent and administrator runs its own node
What each signs	The bank mints and burns its deposit token on its own registry. Each fund’s transfer agent and treasury sign that fund’s consent
Mode	Standing consent: every order settles units and deposit token in one transaction
Control matrix	As written: each fund’s register keeper row is its transfer agent’s

Backed issuance


Who is who	A register keeper issues a backed instrument, such as a stablecoin or a note, minted against deposits into a reserve on the ledger. The reserve’s assets can be the register keeper’s own, such as units of a fund whose register it keeps, or another registrar’s
What each runs	The venue runs NodeAsset; the register keeper runs its own node, or is the venue’s issuance desk, and hosts the reserve’s holder party. Another registrar runs its own node
What each signs	The register keeper and the reserve’s holder accept the reserve once: their standing consent to every mint and redemption. Another registrar signs its lock agreement once. The reserve’s holdings are the holder’s own, locked to the venue, the issuer and the holder together
Mode	Standing consent on the reserve
Control matrix	As written, with CTL-6 for the cover rule

See Backed issuance. Related: Architecture · Parties and the DA Registry · Control matrix

Architecture

Who runs what

Deploy

Operate

Deployment patterns

Who can be internal or external

The rules every combination keeps

Named patterns

A distributor with an outside issuer and transfer agent

A bank issuing its own products, its own deposit token included

An asset manager selling its own fund

A bank distributing third-party funds against its own deposit token

Backed issuance

​Who can be internal or external

​The rules every combination keeps

​Named patterns

​A distributor with an outside issuer and transfer agent

​A bank issuing its own products, its own deposit token included

​An asset manager selling its own fund

​A bank distributing third-party funds against its own deposit token

​Backed issuance

Who can be internal or external

The rules every combination keeps

Named patterns

A distributor with an outside issuer and transfer agent

A bank issuing its own products, its own deposit token included

An asset manager selling its own fund

A bank distributing third-party funds against its own deposit token

Backed issuance