A2A on enterprise ledgers

Shared pattern

The shared A2A pattern

All four designs move value between identified, supervised institutions on a permissioned ledger. Each bank or FMI runs its own node in its own data center or regulated cloud, holds signing keys in FIPS 140-2 Level 3 HSMs, and keeps authoritative control of its own liabilities or asset register. The three payment corridors (Besu, Corda, Fabric) settle tokenized commercial bank money and follow the same ten-stage flow. Canton applies the same atomic-settlement idea to securities and collateral.

1. Instruction. The corporate client submits an ISO 20022 pacs.008 instruction; the originating bank checks balance, AML risk score and transaction limits.
2. Screening and Travel Rule. Sanctions screening runs on structured name and LEI fields. Originator and beneficiary banks exchange FATF Recommendation 16 data (IVMS-101 format) as a Verifiable Credential or private payload; only its hash reaches shared state. The beneficiary bank checks the originator LEI against GLEIF.
3. FX quote. A liquidity bank runs the FX oracle and signs a mid, bid and ask quote from its treasury feed (Bloomberg or Refinitiv) valid for 90 seconds. One signed rate for everyone removes disputes about which rate governs the conversion; the network participation agreement names the oracle.
4. Atomic exchange. Both currency legs settle in a single ledger transaction that commits completely or reverts completely (payment versus payment). No partial-settlement state can exist, so principal risk is removed by construction.
5. Credit. The receiving bank's integration layer picks up the ledger event and credits the beneficiary's account in core banking in real time, before the RTGS cycle settles.
6. Audit trail. Each party holds an immutable, signed, timestamped record that ties the payload hash, KYC attestation hash, FX quote and signatures to the payment reference (UETR). Regulatory reporting is generated from it with no post-hoc reconstruction.
7. Netting. A netting cycle computes net interbank positions: every 4 hours, or on demand above €50M, in the Besu and Corda designs; once a day at 17:00 CET on Fabric.
8. RTGS settlement. Net positions settle in central bank money. For EUR that is TARGET2, the ECB's RTGS, on ISO 20022 since the March 2023 T2 migration, with pacs.009 instructions and settlement in claims on the ECB itself. The local leg uses SARIE (SAMA) or UAE RTGS (CBUAE).
9. Burn. Once both RTGS confirmations arrive, the tokens covering the settled amounts are burned, so on-ledger supply always equals the unsettled portion of obligations.
10. Reconciliation. The structured ISO 20022 data (invoice references, purpose codes, LEIs) stays bound to the payment, so both banks reconcile straight through. The designs target an exception rate under 2%; early ISO 20022 adoption cohorts report 20–30% fewer payment exceptions than MT workflows.

Why the pattern pays

• Netting replaces pre-funded nostro balances with just-in-time central bank money settlement.
• FX conversion happens on the ledger, so the spread moves from the correspondent chain to the banks that hold the client relationships. In the Besu and Corda examples the originating bank earns a flat 5 bp on the EUR leg.
• BIS CPMI (2022) found roughly one-third of global FX transactions, about $2.2 trillion in daily settlement value, still settle without PvP and so carry Herstatt-style risk. The 1974 Herstatt failure remains the canonical case.
• Structured ISO 20022 fields let banks screen against legal entity registries instead of free text. SWIFT's ISO 20022 Migration Progress Report (2024) and Accenture's "Transforming Financial Crime Compliance with AI and ISO 20022" (2023) document 30–50% fewer false positives than MT formats, which also shortens manual review queues.

EU rules common to the three payment corridors

Risks common to every design

• Consortium governance. Contour (trade finance, built on Corda), we.trade and Marco Polo failed on governance: commercial incentives among competing bank shareholders could not be kept aligned. The participation agreement must say who pays for maintenance when year-one volumes disappoint, who controls the upgrade roadmap, what happens if a bank exits, and who is liable for a settlement failure caused by a bug in shared code.
• Legal finality. Ledger finality is technical. Legal finality, the right to retain funds against counterparty insolvency, depends on the legal regime. Fnality's Sterling Fnality Payment System (£FnPS) received Bank of England Settlement Finality Designation in 2024, the first DLT-based payment system to do so. Equivalent engagement for these corridors is an 18–36 month regulatory process.
• Mint-key compromise. Whoever holds the issuer's minting key can create unbacked tokens. The standard mitigation is M-of-N HSM multi-signature minting split across treasury, compliance and technology teams, with disaster recovery for key material tested before production.
• Regulatory sequencing. EU-side banks should seek informal supervisor guidance, file a DORA ICT risk assessment covering the node, pilot with synthetic transactions, seek payment-system authorization (or a sandbox or SFD designation pathway), and only then go live bilaterally. Compressing this sequence is the most common error and adds 12–24 months.

Background reading: A2A payments overview, the A2A workflow, ISO 20022 in A2A, comparison framework, enterprise blockchain briefing and the glossary.

Shared sources: BIS CPMI, "PvP arrangements and the case for greater adoption", 2022, bis.org/cpmi/publ/d208.htm. SWIFT ISO 20022 and CBPR+, swift.com/standards/iso-20022. ISO 20022 schemas, iso20022.org. EBA/REP/2024/24. FATF Recommendation 16 (Wire Transfers). Bank of England Financial Market Infrastructure Annual Report 2024; fnality.org.

Why these FMIs and why Canton

These four touch most of the world's settled securities flow. Clearstream and Euroclear together hold roughly EUR 80 trillion in custody; DTCC clears and settles about USD 2.5 quadrillion of US securities transactions a year; Broadridge DLR, live on Canton since June 2021, has processed more than USD 1.5 trillion of intraday repo, with peak days above USD 50 billion. Each has committed production infrastructure to Canton.

Canton's distinguishing property is privacy-preserving atomic composability. One transaction can span independently operated applications, each running its own Daml logic on its own participant, while all sub-transactions commit together or none do and each party sees only what it is authorized to see. A bond settlement at Clearstream and a Treasury delivery at DTCC can settle as one event without either seeing the other's contract. Other enterprise ledgers force a trade-off: a shared global ledger (Ethereum, Besu, Quorum) where everyone sees all data unless zero-knowledge proofs are added at real cost, or bilateral partitioning (Corda) that cannot compose atomically beyond the parties to a single transaction. That is why four institutions whose competitive position depends on confidentiality chose Canton.

The four FMIs also map to four asset classes and regimes. Clearstream's D7 DLT went live in November 2025 issuing EUR debt under the German Electronic Securities Act (eWpG) and EU CSDR. DTCC's ComposerX targets Q2 2026 production for tokenized DTC-custodied Treasuries under SEC Rule 17Ad-22 and CFTC rules. Broadridge DLR is regulated as a US transfer agent and broker-dealer service. Euroclear, a Canton Foundation member and Super Validator, has tokenized gilts, Eurobonds and gold for collateral mobility under NBB supervision and, where applicable, the Luxembourg DLT Pilot Regime. Today, mobilizing Treasury collateral against a euro obligation needs triparty agents, several correspondent legs and hours or days; on Canton it settles in seconds, with each FMI keeping control of its own register.

Topology: participants and the Global Synchronizer

A Canton network is a federation of participant nodes, each owned by a legal entity and storing only contracts on which its hosted parties are stakeholders. Synchronizers order messages and provide finality but only ever handle encrypted payloads addressed to the relevant participants. Regulators (BaFin, SEC, FCA, NBB, ESMA) hold read-only Daml party rights, with a DORA-compliant audit trail and GDPR data minimization.

The Global Synchronizer is run by 13 Super Validators (as of 2026), including Goldman Sachs, DTCC, Broadridge, Euroclear, BNP Paribas, SBI Digital Markets, Tradeweb and Cumberland Labs, under the Global Synchronizer Foundation, a non-profit independent of any participant. It has three components: a sequencer that orders encrypted messages, a mediator that coordinates two-phase commit, and a topology manager that publishes the party-to-participant mapping. Consensus is Tendermint-style BFT with deterministic finality at the sequencer, and a global timestamp. Validator selection, rotation and slashing are governed on-chain through the Canton Coin governance module. An FMI can also run a local synchronizer for intra-application traffic (for example internal D7 settlement) and use the Global Synchronizer only for cross-FMI transactions, keeping control of its own latency, fees and governance.

Daml templates, choices and parties

Solidity describes computation on a replicated state machine and Corda's Kotlin contracts verify state transitions; Daml, created by Digital Asset, describes the rights and obligations of named parties. Each template names signatories (whose authority creates the contract), observers (who see but cannot act) and controllers (who may exercise a given choice). Clauses become choices, signature requirements become signatories, information rights become observer disclosures. At DTCC, UsTreasuryToken is a registered representation of a security that stays in DTC custody under the existing legal structure and the DTCC tokenization rulebook.

-- Daml 3.x: UsTreasuryToken.daml
module DtccComposerX.UsTreasuryToken where

template UsTreasuryToken
  with
    issuer        : Party           -- DTCC
    holder        : Party           -- current beneficial owner
    cusip         : Text            -- CUSIP identifier
    faceAmount    : Decimal         -- USD face value
    maturity      : Date            -- maturity date
    couponRate    : Decimal         -- annualized coupon
    custodian     : Party           -- always DTC
    rulebookHash  : Text            -- SHA-256 of governing rulebook
    regulators    : [Party]         -- SEC, FRBNY observers
  where
    signatory issuer, holder
    observer  custodian, regulators

    key (issuer, cusip, holder) : (Party, Text, Party)
    maintainer key._1

    -- Transfer of beneficial ownership; new holder must authorize
    choice Transfer : ContractId UsTreasuryToken
      with newHolder : Party
      controller holder, newHolder
      do create this with holder = newHolder

    -- Pledge to a Broadridge DLR repo contract; non-consuming so the
    -- token continues to exist but is encumbered by the pledge ref.
    nonconsuming choice PledgeToRepo : ContractId Pledge
      with
        repoCid : ContractId BroadridgeDLR.RepoAgreement
        pledgee : Party
      controller holder
      do create Pledge with
           collateral = self
           pledgor    = holder
           pledgee    = pledgee
           repoRef    = repoCid
           released   = False

Clearstream's template encodes both the security and its issuance and transfer rules under eWpG.

-- ClearstreamD7.EurCommercialPaper.daml
template EurCommercialPaper
  with
    issuer        : Party           -- corporate issuer
    csd           : Party           -- Clearstream Banking AG
    holder        : Party
    isin          : Text            -- ISIN under eWpG registry
    faceAmount    : Decimal         -- EUR face value
    maturity      : Date
    eWpGRegistry  : Text            -- crypto-securities registry ref
    payloadHash   : Text            -- ISO 20022 seev.031 hash
    regulators    : [Party]
  where
    signatory issuer, csd, holder
    observer  regulators

    key (csd, isin, holder) : (Party, Text, Party)
    maintainer key._1

    choice Transfer : ContractId EurCommercialPaper
      with newHolder : Party
      controller holder, csd, newHolder
      do create this with holder = newHolder

    -- Atomic DvP: deliver this CP against a UsTreasuryToken pledge
    -- spans Clearstream + DTCC + Broadridge in a single Daml tx
    choice DeliverAgainstTreasuryPledge : ContractId EurCommercialPaper
      with
        newHolder      : Party
        treasuryPledge : ContractId DtccComposerX.Pledge
        repoAgreement  : ContractId BroadridgeDLR.RepoAgreement
      controller holder, newHolder
      do
        -- exercise verifies the pledge exists and matches the repo
        pledge <- fetch treasuryPledge
        repo   <- fetch repoAgreement
        assertMsg "pledge must back this repo"
          (pledge.repoRef == repoAgreement)
        create this with holder = newHolder

Broadridge holds the repo contract (agreement, term, haircut, repurchase price, substitution and unwind) and references collateral on the other three FMIs by ContractId without copying their state.

-- BroadridgeDLR.RepoAgreement.daml
template RepoAgreement
  with
    cashProvider    : Party         -- AssetMgrUS
    collProvider    : Party         -- EuroDealer SA
    operator        : Party         -- Broadridge
    cashAmount      : Decimal       -- USD cash leg
    cashCurrency    : Text          -- "USD"
    haircut         : Decimal       -- e.g. 0.02 = 2%
    repoRate        : Decimal       -- annualized %
    openTime        : Time
    closeTime       : Time          -- intraday close
    collateralRefs  : [AnyContractId] -- pledged tokens (DTCC, EUC)
    masterAgreement : Text          -- GMRA 2011 reference + hash
    regulators      : [Party]
  where
    signatory cashProvider, collProvider, operator
    observer  regulators

    -- Substitute one collateral piece for another, mid-term
    choice Substitute : ContractId RepoAgreement
      with
        oldRef : AnyContractId
        newRef : AnyContractId
      controller collProvider, operator
      do create this with
           collateralRefs =
             newRef :: filter (/= oldRef) collateralRefs

    -- Unwind: release collateral, return cash + interest
    choice Unwind : ()
      controller cashProvider, collProvider, operator
      do return ()

Euroclear's D-FMI re-pledges a gilt or Eurobond across jurisdictions while the asset record stays on Euroclear's ledger; MobiliseToTriparty does the work.

-- EuroclearDFMI.CollateralMobility.daml
template TokenizedGilt
  with
    csd           : Party           -- Euroclear UK & International
    holder        : Party
    isin          : Text
    faceAmount    : Decimal         -- GBP face value
    maturity      : Date
    regulators    : [Party]         -- FCA, BoE, NBB
  where
    signatory csd, holder
    observer  regulators

    choice MobiliseToTriparty : ContractId TripartyAllocation
      with
        triparty   : Party         -- Euroclear acting as triparty agent
        receiver   : Party         -- collateral receiver
        repoRef    : ContractId BroadridgeDLR.RepoAgreement
      controller holder, triparty
      do create TripartyAllocation with
           gilt = self
           giver    = holder
           receiver = receiver
           agent    = triparty
           repoRef  = repoRef
           releasedAt = None

Sub-transaction privacy

When a transaction is submitted, the participant runtime splits it into a tree of sub-transactions, each with its informees (the parties that must see it to validate or be informed). It builds a per-participant view containing only the sub-transactions whose informees it hosts and encrypts each view under the receiving participant's key. The sequencer orders the encrypted blobs and the mediator coordinates commit without decrypting any of them, which is how DTCC, Clearstream and Euroclear settle one operation without seeing each other's books.

Transaction lifecycle: 18 steps

An intraday repo opens in the morning: USD 250 million face of Treasuries pledged through DTCC plus GBP 50 million of gilts mobilized through Euroclear, against EUR 230 million of commercial paper delivered from Clearstream. It unwinds at end of day after a mid-cycle substitution.

The step 06 command composes the four choices into one tree. Either all commit or none do; rollback is at tree level, and no FMI needs to trust another's middleware. Each FMI's Daml package is independently signed and version-pinned in the topology manager, and cross-package fetches require observer status.

-- Authored on BNP's participant on behalf of EuroDealer.
-- Single Daml command, four choices, four FMIs, one atomic commit.
submitMulti [eurodealer, assetMgr] [-- read-as: Broadridge regulators] do

  -- (1) Pledge USD 250M Treasury at DTCC
  pledgeCid <- exerciseCmd treasuryCid PledgeToRepo with
                  repoCid = repoProposalCid
                  pledgee = broadridgeParty

  -- (2) Mobilise GBP 50M gilts at Euroclear
  tripCid   <- exerciseCmd giltCid    MobiliseToTriparty with
                  triparty = euroclearTripartyParty
                  receiver = broadridgeParty
                  repoRef  = repoProposalCid

  -- (3) Deliver EUR 230M CP at Clearstream against the Treasury pledge
  newCpCid  <- exerciseCmd cpCid      DeliverAgainstTreasuryPledge with
                  newHolder      = eurodealer
                  treasuryPledge = pledgeCid
                  repoAgreement  = repoProposalCid

  -- (4) Activate the repo at Broadridge: only signs if 1-3 succeed
  activeRepoCid <- exerciseCmd repoProposalCid Activate with
                      treasuryPledgeRef = pledgeCid
                      giltAllocationRef = tripCid
                      cpDeliveryRef     = newCpCid

  return activeRepoCid

Today the same flow needs a tri-party agent (BNY Mellon or JPMorgan), bilateral SWIFT confirmations among four institutions, several end-of-day reconciliations and a settlement window of hours, with failed substitutions and breaks adding risk and capital cost. Canton compresses it into one atomic operation of about 6 seconds.

Cash leg and Canton Coin

Cash uses conventional RTGS (Fedwire for USD, TARGET2 for EUR) because deposit-token and CBDC infrastructure is still in pilot in both jurisdictions. A dedicated CashToken Daml application on the same network would later make the whole DvP intra-ledger. Canton Coin (CC), the Global Synchronizer's native asset, only meters and pays for sequencing, mediation and storage. Fees are computed deterministically from transaction size and complexity and paid by the submitting participant; Super Validators earn CC for correct validation. The Foundation governs supply on-chain: minting tied to usage growth, burning of unused balances, capped issuance. The FMIs hold CC only as operating reserves for fees, much like a SWIFT membership pre-fund; it is not a settlement asset.

ISO 20022 inside Daml contracts

Each contract stores the SHA-256 hash of a canonicalized ISO 20022 payload held off-ledger in the FMI's message store, so T+1 SFTR, MiFIR and CSDR reporting comes from the same source as the settlement record and the trade-versus-reporting reconciliation disappears.

KYC, AML and the Travel Rule

AML duties stay with each FMI: DTCC under the FinCEN Bank Secrecy Act, Clearstream under Germany's GwG and the EU AMLR (in force July 2027), Euroclear under Belgian AML law and the AMLR, Broadridge under FinCEN transfer-agent rules. Each FMI keeps a KycAttestation template signed by its compliance party and the counterparty, held privately on its participant. A cross-FMI proposal exercises the non-consuming VerifyAttestation choice, which returns only a boolean. Travel Rule data moves off-ledger through the Operator API in a Travel Rule Protocol envelope (e.g. TRISA, OpenVASP); its SHA-256 hash is bound to the settlement, and regulators with observer rights can request the envelope through supervision channels and check it against the hash.

Regulation: EU, US, Belgium and the UK

Each regulator holds Daml observer rights over contracts in its perimeter: real-time, read-only, integrity-guaranteed visibility of the same state the supervised entity sees. That is stronger than today's T+1 reporting feeds and answers a long-standing ESMA and SEC concern about post-trade data integrity. No FMI cedes supervisory authority and no party sees data outside its lawful basis.

Governance

Super Validator selection, parameter changes and protocol upgrades are voted through on-chain governance contracts written in Daml.

Canton-specific risks

• Synchronizer outage. If BFT quorum is lost (more than f Byzantine failures among the 13), nothing new commits. Local synchronizers keep intra-application flows running; cross-FMI flows pause but cannot half-settle. Foundation SLA target: 99.95% per quarter.
• Participant compromise. Keys are rotated and revoked through the topology manager with multi-signature approval from the FMI's governance and the Canton Foundation; affected contracts can be quarantined by a choice that needs the regulator observer's signature.
• Package version skew. Transactions are pinned to package hashes, so every affected participant must install an upgrade before old contracts retire; the Canton Foundation runs the upgrade ceremony.
• Stuck in flight. A mediator timeout rolls the transaction back; pending items such as pledges can be released by a time-bounded Cancel choice after a 24-hour expiry with no counterparty action.
• Recovery and resolution. DTCC stays under Title VIII of Dodd-Frank, Clearstream and Euroclear under the EU CCPR/CSDR resolution regime, Broadridge under SEC Reg SCI as a critical service provider. Observer rights give resolution authorities a real-time authoritative book of positions.

Canton sources: Canton institutional partner registry (canton.wiki/learn/canton-institutional-partners) and Foundation member list (canton.network), retrieved April 2026; Broadridge DLR statements and Q4 2025 earnings disclosures; Digital Asset, "Canton Network Architecture Whitepaper" (2024) and Daml documentation (docs.digitalasset.com/build/3.5); Clearstream, "D7 DLT: Clearstream Launches Tokenized Securities Platform", 4 November 2025; Canton Network, "DTCC and Digital Asset Partner to Tokenize DTC-Custodied U.S. Treasury Securities on the Canton Network", 17 December 2025; Digital Asset and Euroclear, "Unlocking Collateral Mobility through Tokenization: Gilts, Eurobonds and Gold" (2024 pilot whitepaper) and "Digital Asset and Euroclear Start First Project Phase", 25 February 2025; Global Synchronizer Foundation governance documentation (2025–2026; Super Validator list as of Q1 2026) and Canton Coin economic specification v1.x (2024–2026). The Daml shown is illustrative and simplified; production code adds substantially more validation, error handling and upgrade scaffolding, and real deployments differ by each FMI's architecture, rulebook and supervisor.

Back to comparison

Very few EU institutions hold direct riyal accounts and bilateral nostros are costly, so the EU–GCC relationship is structurally underbanked. A permissioned corridor lets a small group of correspondents net continuously and settle once a day without public-network infrastructure and without exposing counterparty identity outside the consortium.

Organizations, peers and orderers

Each bank runs one organization with two endorsing peers (active/standby) and one Fabric CA; peers expose Fabric Gateway over mTLS to the bank's payment hub and keep world state in CouchDB for rich JSON queries on payment metadata. The deployment runs Fabric 2.5.x LTS, maintained by IBM and the Linux Foundation. Container images are pinned by sha256 digest and signed with cosign; chaincode ships as a lifecycle v2 external-builder artefact approved under the channel's lifecycle endorsement policy.

The etcd/Raft ordering cluster has five nodes so no jurisdiction can censor the channel alone: orderer0.de, orderer1.fr and orderer2.sa (one per bank) plus orderer3.tech-fra and orderer4.tech-bah, run by an independent technical operator in a Frankfurt colocation facility and a Bahrain regional data centre. It is configured with quorum 3 (labelled f=1); as a crash-fault protocol, five Raft nodes keep making progress with up to two down. Logs are mirrored to WORM storage at each site. Block cutting: BatchTimeout=200ms, BatchSize.MaxMessageCount=500, BatchSize.AbsoluteMaxBytes=10MB.

Identity and MSP

Every peer, orderer, client and chaincode caller authenticates with an X.509 certificate from an organization's Membership Service Provider. Each bank runs an isolated CA whose root sits in the channel MSP stanza; there is no cross-signed root, and revocations propagate through periodic CRL updates committed by channel admins via UpdateConfig. Identities are partitioned by Organizational Unit, with a custom treasury attribute gating Mint and Redeem and a role=approver attribute driving dual control.

Keys live in FIPS 140-2 Level 3 HSMs reached through the PKCS#11 BCCSP. Treasury operators use smart-card-backed certificates valid for 12 hours, reissued by an online enrolment service that checks the bank's identity and access management directory first.

Channels and private data collections

Channels are independent ledgers ordered by the same orderers but isolated at the gossip layer. The shared eursar-corridor channel carries the token, FX oracle and netting contracts. Three bilateral channels (de-fr-bilateral, fr-sa-bilateral, de-sa-bilateral) carry position reconciliation and bilateral repo traffic hidden from the third bank. On the corridor channel, Travel Rule data and the ISO 20022 body sit in a private data collection visible only to the originating and beneficiary banks; its hash goes on the channel ledger so the liquidity bank can verify integrity.

# collections_config.json: registered at chaincode install
[
  {
    "name": "PDC_TR_DE_SA",
    "policy": "OR('Org1MSP.member','Org3MSP.member')",
    "requiredPeerCount": 1,
    "maxPeerCount": 2,
    "blockToLive": 1095,           # ~3 years; AML retention minimum
    "memberOnlyRead": true,
    "memberOnlyWrite": true,
    "endorsementPolicy": {
      "signaturePolicy": "AND('Org1MSP.peer','Org3MSP.peer')"
    }
  }
]

The token contract's endorsement policy is AND(OutOf(2,'Org1MSP.peer','Org2MSP.peer','Org3MSP.peer')): any two of three banks must endorse. The Validation System Chaincode enforces it at commit, after the orderer cuts the block and before peers update world state.

Go chaincode and atomicity

Three chaincodes run on the corridor channel, written in Go on contract-api-go: cbm-token (per-currency commercial bank money), fx-oracle (EUR/SAR mids signed by the liquidity provider) and a2a-router (the atomic construct tying a debit in one currency to a credit in the other).

// cbm-token/contract.go: relevant excerpts

type TokenContract struct { contractapi.Contract }

type Account struct {
    Owner    string  `json:"owner"`     // MSP-id::CN
    Currency string  `json:"ccy"`       // "EUR" | "SAR"
    Balance  uint64  `json:"bal"`       // minor units
    Frozen   bool    `json:"frozen"`
}

func (t *TokenContract) Transfer(
    ctx contractapi.TransactionContextInterface,
    from, to, ccy string, amount uint64, ref string,
) error {

    // 1. caller must own the debit account
    caller, _ := cid.GetID(ctx.GetClientIdentity())
    if caller != from && !hasAttr(ctx, "treasury") {
        return errors.New("unauthorized debit")
    }

    // 2. travel-rule witness must be present in transient map
    tMap, _ := ctx.GetStub().GetTransient()
    trHash, ok := tMap["travel_rule_hash"]
    if !ok { return errors.New("missing travel-rule witness") }

    // 3. atomic debit/credit against world state
    src, _ := getAccount(ctx, from, ccy)
    dst, _ := getAccount(ctx, to,   ccy)
    if src.Frozen || dst.Frozen { return errors.New("frozen") }
    if src.Balance < amount   { return errors.New("insufficient") }
    src.Balance -= amount; dst.Balance += amount
    putAccount(ctx, src); putAccount(ctx, dst)

    // 4. emit event for off-chain payment hub
    ev := TransferEvent{From: from, To: to, Ccy: ccy, Amt: amount,
        Ref: ref, TRHash: hex.EncodeToString(trHash)}
    payload, _ := json.Marshal(ev)
    return ctx.GetStub().SetEvent("Transfer", payload)
}

a2a-router puts a EUR Transfer and a SAR Transfer in one proposal, both conditional on an fx-oracle reading less than 90 seconds old. Fabric applies each transaction atomically against the read-write set from the endorsing peers, so both legs commit or neither does.

Token model: Fabric Token SDK

A minimal account model keeps one composite key per (owner, ccy) and serializes all transfers from an account, which becomes a contention bottleneck. The corridor instead uses IBM Research's Fabric Token SDK, a UTXO-style token: each EUR-CBM note is an unspent output bound to its owner by a Pedersen commitment, and transfers consume notes and create new ones. The consortium runs the plaintext fabtoken driver, accepting that amounts are visible to all three members in return for simpler audit; the zkat driver (Idemix and bulletproofs, hiding amounts and owners) is held back for when more banks join and amount confidentiality becomes commercially necessary.

Transaction lifecycle: 16 steps

The on-ledger portion completes in under one second; steps 15–16 are the end-of-day RTGS cycle.

Ordering: Raft now, SmartBFT later

Raft tolerates crashes but not Byzantine behaviour: a malicious orderer could withhold or reorder transactions within the batch timeout, though it cannot forge endorsements or alter committed state. Orderers are therefore spread across three bank sites (Munich, Paris, Riyadh) and two independent operators, with WORM-mirrored logs. Fabric 3.x adds the SmartBFT plug-in (SBFT-CHS) for full Byzantine tolerance; the consortium will migrate once Fabric 3.x reaches IBM enterprise support GA and a six-month parallel run on a staging channel completes. Raft is acceptable meanwhile because the threat model assumes Byzantine endorsing peers, and the 2-of-3 bank endorsement policy is the cryptographic anchor.

ISO 20022 pacs.008 in chaincode state

The corridor speaks ISO 20022 internally; both sides are moving cross-border traffic to MX ahead of SWIFT's MT discontinuation milestones. The full pacs.008.001.10 lives in the private data collection so compliance and auditors at the two end banks can reconstruct the payment context; the corridor ledger holds only the hash.

<!-- pacs.008.001.10: abbreviated -->
<FIToFICstmrCdtTrf>
  <GrpHdr>
    <MsgId>BHDLDE2M-20260421-887412</MsgId>
    <CreDtTm>2026-04-21T10:14:02.244+02:00</CreDtTm>
    <NbOfTxs>1</NbOfTxs>
    <SttlmInf><SttlmMtd>CLRG</SttlmMtd>
      <ClrSys><Prtry>FABRIC-EURSAR-CORRIDOR</Prtry></ClrSys>
    </SttlmInf>
  </GrpHdr>
  <CdtTrfTxInf>
    <PmtId><EndToEndId>PAY-IN-2026-04-21-887412</EndToEndId>
            <UETR>5e9c4e8a-2f1b-4b3a-9d0e-1c8f4a7b6d52</UETR></PmtId>
    <IntrBkSttlmAmt Ccy="EUR">4820000.00</IntrBkSttlmAmt>
    <ChrgBr>SHAR</ChrgBr>
    <Dbtr><Nm>Präzision Werkzeug GmbH</Nm>
          <PstlAdr><Ctry>DE</Ctry></PstlAdr></Dbtr>
    <DbtrAcct><Id><IBAN>DE89370400440532013000</IBAN></Id></DbtrAcct>
    <DbtrAgt><FinInstnId><BICFI>BHDLDE2M</BICFI></FinInstnId></DbtrAgt>
    <CdtrAgt><FinInstnId><BICFI>ALMDSARI</BICFI></FinInstnId></CdtrAgt>
    <Cdtr><Nm>Saudi Water Authority</Nm>
          <PstlAdr><Ctry>SA</Ctry></PstlAdr></Cdtr>
    <CdtrAcct><Id><Othr><Id>SA0380000000608010167519</Id></Othr></Id></CdtrAcct>
    <RmtInf><Ustrd>Desalination plant, milestone 3 of 7</Ustrd></RmtInf>
  </CdtTrfTxInf>
</FIToFICstmrCdtTrf>

The hub canonicalizes the XML with W3C Canonical XML 1.1 and hashes it with SHA-256; the 32-byte result is the trHash field of the transfer event. Any dispute is settled by replaying the private data from either bank's PDC and re-canonicalizing; a mismatch flags tampering.

KYC, AML, sanctions and the Travel Rule

Each bank runs KYC and CDD under its home regime (BaFin GwG, ACPR/AMF, SAMA AML/CFT Rules) and keeps identity in its own KYC vault. The ledger guarantees only that an authenticated gateway with a valid MSP identity attested, at submission, that the customer was screened. The Travel Rule, transposed through the TFR and Article 17 of the SAMA AML/CFT Rules, requires originator name, account, address and identifier plus beneficiary name and account; storing the full pacs.008 in the bilateral PDC satisfies it while Org2 sees only the block and the hash. Gateways screen against their own lists (EU Consolidated List, OFAC SDN where applicable, UN Security Council list, SAMA's domestic list) and assert the result in the transient map as a signed JSON Web Token whose subject is the customer's hashed identifier. The chaincode does not validate the JWT, which would mean sharing keys across the consortium, but rejects any transfer missing the witness and preserves it in the PDC.

Regulation: EU and Saudi Arabia

Neither side mandates daily on-ledger reporting, but each bank's auditor identity reads the corridor channel and its bilateral PDC. EU rules common to the corridors are in the shared pattern; Fabric adds:

• DORA: each bank lists its Fabric node in its register of ICT third-party providers, and IBM as platform vendor signs a DORA-compliant contractual addendum.
• BaFin: supervises Bayerische Handelsbank under the KWG; the tokenisation activity is notified under §32 KWG following BaFin's 2024 Merkblatt on crypto-securities business (DLT-based financial infrastructure).
• ACPR: approved the corridor for Banque Méridienne as a service ancillary to credit institution activity under Art. L.311-2 of the Code monétaire et financier.
• SAMA: Rules for Bank Account Opening (2023) govern onboarding, CDD and beneficial ownership; under the Payment Services Provider Regulations the corridor counts as ancillary to licensed banking rather than a stand-alone PSP service; the AML/CFT Rules' three-year retention matches the PDC's blockToLive; the Open Banking Framework is not invoked, though the gateway API uses OAuth 2.0 / FAPI 2.0 to ease future integration; Aber informs SAMA's view of permissioned ledgers as viable settlement infrastructure; SARIE provides the central bank money leg.

Net settlement against TARGET2 and SARIE

On-ledger tokens are liabilities of the issuing bank and are not legally final until central bank money moves. At 17:00 CET the netting chaincode produces a multilateral position per currency per bank. For 21 April 2026:

Bayerische Handelsbank sends an MT 202 / pacs.009 to the TARGET2-Bundesbank component for Banque Méridienne's PM account, final on Eurosystem books at 17:14 CET. Banque Méridienne instructs its Riyadh nostro provider to settle through SARIE to Bank Al-Madinah's SAMA settlement account, final at 18:14 AST (15:14 UTC). After both confirmations each hub submits a Burn for the settled amounts, and the next cycle starts at 17:00:01 CET. Gross RTGS settlement of each transfer would defeat the corridor: SARIE and TARGET2 fees and the mismatch in operating hours would make small payments uneconomic. Netting keeps on-ledger speed and finality while cutting central bank transactions to one per bank per currency per day.

Fabric-specific risks

• Orderer compromise: a compromised majority could censor within BatchTimeout; mitigated by five jurisdictionally diverse orderers, WORM logs and the planned SmartBFT move.
• HSM key compromise: a stolen treasury credential could mint or burn unbacked tokens; mitigated by dual-control endorsement (two approvers), 12-hour treasury certificates and a real-time issuance cap monitored off-chain against core banking.
• FX oracle staleness: if the oracle stops, swaps fail; if it misprices, the liquidity provider gains or loses. Chaincode rejects quotes older than 90 seconds and a circuit-breaker disables swaps if the oracle drifts more than 25 bp from the ECB reference rate.
• MVCC contention: heavy traffic on the same keys raises MVCC_READ_CONFLICT; the UTXO Token SDK spreads load across notes.
• Settlement failure: if a bank's RTGS leg misses cycle close, no Burn is sent and the tokens remain as a visible obligation; per-bank limits cap the build-up and the next day's cycle absorbs the carry.
• Chaincode upgrades: lifecycle v2 needs per-organization approval; every upgrade soaks 30 days on a sandbox channel and is gated on a notarised release attestation signed by the consortium technical committee.

Fabric sources: Hyperledger Fabric v2.5 LTS documentation, hyperledger-fabric.readthedocs.io; Androulaki et al., "Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains", EuroSys '18; IBM Research, Fabric Token SDK, github.com/hyperledger-labs/fabric-token-sdk; Ongaro and Ousterhout, "In Search of an Understandable Consensus Algorithm (Raft)", USENIX ATC 2014; SAMA AML/CFT Rules and PSP Regulations, sama.gov.sa; BaFin Merkblatt zum Tatbestand des Kryptowertpapiergeschäfts (2024).

Back to comparison