Two sovereign currencies exchange with payment-versus-payment finality: neither leg moves unless both do. Settlement is a single atomic event on tamper-evident ledgers, not a chain of correspondent promises.
The exchange of one currency for another is bound into one all-or-nothing operation across two independent ledgers.
The debit on the sending currency and the credit on the receiving currency are conditioned on each other. The state machine only advances both legs to final together; a failure on either side rolls both back to their pre-trade state.
Because value on one currency is never released before the counter-currency is irrevocably committed, neither central bank nor participant is ever exposed to having paid without being paid. This is the Herstatt-risk failure mode, engineered out at the protocol level.
Settlement finality is a defined ledger state, not a probabilistic assumption. Once the atomic commit is recorded and hash-chained, the transfer is legally and technically irreversible on both currencies.
Every settlement instruction resolves to exactly one of committed or aborted, with a signed reason. There is no indeterminate in-flight state where funds are neither at the sender nor the receiver.
The architecture supports bilateral corridors and shared multi-currency platforms without concentrating value in a single operator.
Each central bank retains control of its own currency's ledger and keys. Cross-border settlement coordinates state changes across ledgers; it never requires either currency to be held in an intermediary's custody during the exchange.
Two central banks can stand up a direct corridor governed by a shared settlement contract, with agreed participants, hours, and limits, without routing through a third-country correspondent or a global hub.
Where several jurisdictions choose to share infrastructure, the same PvP primitive extends to a common platform where each currency remains a sovereign ledger and settlement is coordinated across them.
Signing authority for each currency stays with its issuing authority. No corridor operator can move a participant's balance or mint on their behalf; the keys that authorize settlement remain in-nation.
The exchange rate and the funding of each leg are inputs to the atomic settlement, recorded on-ledger.
The agreed rate for a settlement is captured in the settlement instruction and committed with it. The rate that governed the exchange is auditable from the hash chain rather than reconstructed from external records.
Corridors can operate on pre-funded liquidity pools per currency or on liquidity sourced at settlement time. The protocol enforces that the required funds exist and are locked before the atomic commit proceeds.
Instructions that cannot settle immediately for want of liquidity enter a deterministic queue. Where design permits, offsetting flows in a corridor can be netted to reduce the liquidity each participant must hold.
Because each currency ledger is sovereign, corridors define their own settlement windows and cut-off behavior rather than inheriting a single global timetable. Extended or continuous windows are a policy choice, not a platform limit.
Cross-border rules — screening, limits, reporting — are enforced before the atomic commit, where they can still stop a trade.
Sanctions and AML checks are evaluated as settlement conditions. A trade that fails a required check aborts cleanly; there is no settled transaction to unwind after the fact.
Value limits, participant eligibility, and reporting thresholds are defined in the shared settlement contract for each corridor and enforced uniformly on every instruction it governs.
Every settlement produces a hash-chained record binding the instruction, the conditions checked, the rate, and the final state. Supervisors on both sides read the same tamper-evident history.
Settlement instructions and finality records are signed with ML-DSA-65 (FIPS 204), so the authorization on a cross-border transfer stays verifiable against a harvest-now-decrypt-later adversary.
Talk to us about cross-border settlement in a sovereign deployment.