Before a lender advances against a custody-held asset, the parties need to agree who controls it, what the lender may rely on, and when it may be released.
One asset, three positions, one controlled lifecycle.
The owner retains the economic interest. The custodian holds the asset and performs the immobilisation or the release. The lender needs to know what it can rely on and what must happen before anything moves.
Recording an asset is easy. Maintaining the permissions, evidence and exceptions around it is the work, and each party may see only its own part.
We make that lifecycle work in a private test environment. The ordinary path and the failure paths can both be run before anybody relies on them.
What you bring decides where the build starts.
- A shared control arrangement
- A proposed facility between an owner, a custodian and a lender, examined before anybody signs.
- A collateral instrument
- An allocated-metal pledge, a borrowing base, warehouse-controlled inventory finance, controlled release against repayment, collateral substitution, a margin top-up and cure. The same lifecycle, under the conditions that instrument carries.
- A change in parties or conditions
- Admitting a second lender, replacing a custodian, adding an origin, altering a release condition. What moves, what breaks, and what nobody had settled.
- What one party must rely on
- The lifecycle from a single seat. What that party has to see, approve or be told before it can rely on the arrangement, and what it carries when something fails.
Different starting points, and the same five conditions underneath.
Five conditions the arrangement runs on.
- Eligibility
- Which assets may support the arrangement, and what disqualifies one.
- Evidence
- The records, attestations and dates a decision rests on, and whether they are still current.
- Control
- Who may earmark, pledge, substitute, release or enforce, and on whose instruction.
- Capacity
- What remains available once an asset is committed elsewhere. The same parcel cannot support two arrangements, including two it entered at different times.
- Exceptions
- Expired evidence, margin shortfall, substitution, repayment, default, and a release that must be refused.
Capacity does not sit in the asset alone. A parcel may be valuable, insured and physically present, and it supports a facility only while these conditions hold. The prototype shows whether the proposed capacity stays inside them. It does not decide a lender’s appetite.
Nothing runs until every condition is named.
A workshop, a walkthrough or a well-drawn diagram will get you most of the way. All three have the same weakness: the people in the room supply what the description leaves out, without noticing they are doing it. A condition nobody stated is filled by whoever is talking.
Something that has to run will not fill anything in. Every act needs a party permitted to take it, a state it is permitted from, and a condition that has to hold. Where one of those is missing it will not run, and it says which one.
Not because a ledger is the right place for a commodity operation. Because building it for one is how you find out what was never decided.
What happens when several things go wrong at once.
Prices fall and the borrowing base shrinks. A certificate expires and a release should stop. A second lender joins and the consent chain changes. Each of those is understood on its own. Together they produce a position nobody has worked through.
We run them together and show what the arrangement permits at each point, and where somebody has to be asked.
Shared control, without a copy of everybody’s book.
Canton is designed for private multi-party workflows. Each institution authorises its own actions and sees the information relevant to its role, and that is enforced at the participant, not by an application deciding what to display.
That matters where shared control is required and no party should hold a copy of everybody else’s records.
No public token or production network is required. The asset stays in custody and what is modelled is the control over it: who may immobilise, who may release, on whose instruction, and against what evidence.
Canton fits where several parties need the same record and none of them should hold the others’.
What arrives, and what we need to start.
A few sessions with the people responsible for the owner, custody and lending positions. Nothing from your systems, and no legal review.
We use only the materials needed to test the scenario. Starting with the people means the account is not simply the paper restated, which is what makes it worth holding the paper against.
Then you put your own figures in. Tonnes, grades, advance rates, dates, the parties. It holds them and applies your rules to them, and where a sequence is not permitted it refuses and names the rule that stopped it.
It runs beside your sheet. The sheet says what the numbers come to. This says whether the sequence was allowed.
What arrives
- A private working prototype of one custody and collateral lifecycle, with your own figures in it.
- Role-specific actions and views for the owner, the custodian and the lender.
- The normal path, and the exceptions that matter: expired evidence, substitution, margin shortfall, a refused release, default.
- A record of every refusal, and the rule that caused it.
- What is agreed, what needs confirming, and what nobody has answered yet.
- The repository, and a single command that runs it. No licence, no account, no server. It works on a laptop and it still works in five years.
It runs on what you told us. It does not verify any of it.
It runs the arrangement your people described, under the rules they stated. Where something outside that has to be true, it takes it as given.
- It does not verify that a cargo exists, that a certificate is genuine, or that a party did what they said.
- It is not a production system, and nothing should be settled on it.
- It does not perfect a security interest, prove reserves, operate custody, transfer title or move money.
- It is not legal advice and it does not guarantee credit approval.
- It does not establish that a proposed counterparty accepts the arrangement. It shows what that party would have to accept, see or confirm for the lifecycle to work.
It will not tell you your arrangement is right. It will tell you whether the account you gave holds together.
Every refusal it makes traces back to a rule one of your people stated.
Three things, and all three have to be true.
- A custody-held physical asset
- is meant to support credit or a controlled release. We start with allocated metals, and the same shape holds for concentrate, energy in tank and grain in store. Not a receivable, not a fund, not a book entry.
- An owner, a custodian and a lender
- have to accept the lifecycle, or the same shape under other names. Two parties settle it in a meeting.
- A real decision is pending.
- A facility, a new custodian, a client proposition, a credit-committee review or a pilot.
If there is no live arrangement, this is premature and we will say so.
Not for a review of an operation that already runs, a product idea with no counterparty, production software, or legal advice.
Start with one arrangement.
Tell us the asset, the parties you propose, and the decision that is waiting on it. We will say whether there is a real path here, and we are prepared to say there is not.