Secondary transfer of tokenized assets that carries its own compliance logic. Eligibility, restrictions, and settlement finality are enforced at the ledger, not bolted on at the venue.
Compliance is a precondition of state change, not a report generated after the fact.
Each proposed transfer is evaluated against issuer-defined rules — investor accreditation, jurisdiction, holding caps, lock-up windows — before the ledger accepts it. A transfer that fails any rule is rejected atomically and leaves no partial state.
Holders and counterparties are bound to identity records established at onboarding. The ledger will only move a token between addresses that both remain in good standing under the asset's transfer policy.
Lock-ups, vesting schedules, and regulatory holds are encoded as time- and condition-bound restrictions on the token itself. Restrictions expire, escalate, or lift on defined triggers rather than manual intervention.
Where law requires it — court order, succession, sanctioned-address remediation — an authorized issuer can reassign holdings through a signed, logged administrative action that is itself subject to policy and appears permanently in the audit trail.
Trades either complete in full or do not occur, removing counterparty settlement risk from the secondary market.
Asset delivery and cash-leg settlement are committed in a single atomic transaction. There is no window in which one party has delivered and the other has not.
When the payment leg settles in non-custodial CBDC on the same ledger, DvP becomes truly on-chain end to end — no external correspondent, no deferred net settlement, no reconciliation break.
Settlement finality is defined by ledger commitment, not by probabilistic confirmation. Once written, a trade is legally and technically final and cannot be reversed except by a new, separately authorized transaction.
A rejected leg unwinds cleanly with no locked funds or orphaned positions. Participants see an explicit failure reason drawn from the policy engine rather than a silent timeout.
The engine supports the negotiation and matching patterns real secondary markets use, not only spot swaps.
Two counterparties can agree terms off-ledger and submit a jointly signed trade for atomic settlement. This suits large blocks and relationship-driven institutional flow where public order books are unsuitable.
The same settlement primitive underpins order-book matching and scheduled auctions. Price discovery mechanics are pluggable while DvP and transfer-control guarantees stay constant beneath them.
Orders can carry conditions — minimum fill, time validity, dependency on a linked leg — that the engine evaluates deterministically so that composite trades settle as a coherent unit.
Every authorization and every state transition is cryptographically bound and independently verifiable.
Trade authorizations are signed with ML-DSA-65 (FIPS 204), so the instruction to move an asset is protected against both classical and quantum forgery for the life of the record.
Trades are recorded in a tamper-evident hash-chained ledger. Any alteration to a historical trade breaks the chain and is detectable by any party holding the chain head.
The keys that authorize transfers remain with the asset owner or their delegated custodian. The operator can run the venue without ever holding the authority to move participant assets.
A regulator can replay the ordered, signed sequence of transfers and reconstruct the exact holding of any address at any block — supervision without a separate reporting pipeline.