Fund units and private-credit instruments carried as programmable ledger objects — where subscription, servicing, waterfalls, and redemption execute as encoded logic rather than spreadsheet-and-email operations. The fund administrator's book and the register are the same object.
Ownership, class rights, and transfer restrictions travel with the unit as enforceable attributes on the ledger.
Management-fee terms, hurdle rates, and distribution preferences differ by class and are written into each class as logic the servicing engine reads. A class's economics cannot drift from what investors were sold.
Subscriptions are recorded against a NAV struck at a defined ledger height, giving an exact, non-repudiable link between capital in and units issued. The strike price and the allotment are one entry.
Accreditation, jurisdiction, lock-up, and side-letter constraints are enforced at transfer time, so an ineligible secondary transfer fails rather than requiring unwinding. The whitelist is the instrument, not a separate checklist.
The unit register is the administrator's book, eliminating the reconciliation between transfer agent, administrator, and custodian that today produces breaks. There is one holder record for everyone to read.
The full commitment lifecycle is modeled on-ledger so that called, funded, and uncalled amounts are always a current state.
Each investor's total commitment, drawn amount, and remaining uncalled capital are ledger states updated by every call and return. There is no separate capital-account spreadsheet to reconcile against the register.
A capital call moves committed CBDC and updates the investor's funded position atomically, so a call is never recorded as met while the cash is still in flight. Defaulting investors are identifiable at the moment of failure.
Return-of-capital and recallable distributions adjust remaining commitment according to the encoded LPA terms, keeping recycling provisions consistent with the documents. Recallable amounts are tracked, not remembered.
Subsequent-close equalization interest and true-up flows are computed from the same encoded terms across all investors, removing bespoke manual math per closing. Late-comers are equalized by rule.
Interest accrual, amortization, and covenant states are native to the instrument, so servicing is deterministic and the loan tape is always current.
Principal schedules, interest bases, PIK toggles, and step-ups are written into the loan and executed by the servicing engine on schedule. The loan tape is generated from the instrument, not maintained beside it.
Interest accrues against the encoded rate and day-count, giving every holder and auditor an identical accrued figure at any ledger height. Accrual disputes become impossible to sustain.
Floating-rate resets and margin ratchets tied to covenant tests update the instrument's terms as encoded conditions are met. A breach or a step is a ledger event with a timestamp, not a later discovery.
Loan participations and syndicated tranches are modeled as native sub-claims, so each participant's economics and voting rights are tracked without a lead-bank ledger of record. Secondary sales of participations settle atomically.
Priority of payments, hurdles, and carry are encoded once and applied identically every period, with the calculation itself auditable.
Senior fees, preferred return, return of capital, and catch-up execute in encoded sequence against available cash. The waterfall runs the same way every time, removing period-to-period modeling drift.
Carried interest accrues under the encoded hurdle and catch-up terms, with clawback exposure tracked as a running ledger state. The GP's carry and the LPs' clawback claim are two views of one computation.
Preferred-return hurdles and IRR gates are evaluated from the ledger's own cash-flow history, so the trigger for a tier is derived from settled facts. There is no external cash-flow file to trust.
Once computed, distributions to every investor settle atomically in CBDC against the register snapshot, so no investor is paid on stale ownership. The payout and the entitlement are the same event.
Investors, auditors, and regulators verify against one tamper-evident record while the fund's data stays within its jurisdiction.
Capital-account statements and position reports are derived directly from the ledger, so what an investor sees reconciles by construction to what the fund holds. Reporting is a read, not a reconstruction.
Fund auditors verify holdings, flows, and waterfall math against the hash-chained record without needing administrator extracts. The audit trail is continuous rather than assembled at year-end.
Long-lived closed-end vehicles are signed under ML-DSA-65 so that unit authenticity and servicing history remain verifiable across the fund's full term. The instrument's provenance outlives classical cryptography.
Investor identity data and the register reside within the mandated jurisdiction, keeping sensitive LP information under domestic control. Cross-border access is granted explicitly, never assumed.
Talk to us about funds and private credit in a sovereign deployment.