A2A tokenization on Canton: four FMIs, one synchronized ledger

Section 01

Why these four FMIs, and why Canton is the right substrate

The four institutions in this network — Deutsche Börse's Clearstream, DTCC, Broadridge, and Euroclear — collectively touch the overwhelming majority of the world's settled securities flow. Clearstream and Euroclear together hold roughly EUR 80 trillion of assets under custody. DTCC clears and settles approximately USD 2.5 quadrillion of US securities transactions annually. Broadridge's Distributed Ledger Repo (DLR) platform, live in production on Canton since 2021, has cumulatively processed more than USD 1.5 trillion in intraday repurchase agreements. They are not pilot participants. They are the post-trade backbone of global capital markets, and each has independently committed production infrastructure to the Canton Network.^[1]

The case for using Canton as the connective substrate rests on a property no other enterprise ledger offers at this scale: privacy-preserving atomic composability. Canton allows transactions to span multiple independently operated applications, each running its own Daml smart-contract logic on its own participant node, while guaranteeing two things simultaneously: (i) all sub-transactions either commit together or none commit, giving genuine atomicity across application and trust domains, and (ii) each party sees only the sub-transactions and contract data they are explicitly authorized to see. A bond settlement at Clearstream and a treasury delivery at DTCC can settle as a single atomic event without DTCC ever seeing the bond contract, and without Clearstream ever seeing the treasury contract. The Global Synchronizer orders and confirms the transaction; it never sees any payload.^[2]

This property is structural, not architectural decoration. Every other enterprise ledger forces a trade-off: either share a global ledger (Ethereum, Besu, Quorum) and accept that all participants see all data — solved partially by zero-knowledge proofs but at significant complexity and cost — or partition the ledger into bilateral subnets (Corda) and lose the ability to compose transactions atomically across more than the parties to a single transaction. Canton's sub-transaction privacy resolves the trade-off, which is precisely why four institutions whose competitive position depends on data confidentiality have all chosen it.

The four FMIs in this scenario also map onto four distinct asset classes and four distinct regulatory regimes. Clearstream's D7 DLT platform, launched in production in November 2025, issues and settles EUR-denominated debt securities under the German eWpG (Electronic Securities Act) and the EU CSDR.^[3] DTCC's ComposerX platform, with a Q2 2026 production target, tokenizes DTC-custodied US Treasuries under SEC Rule 17Ad-22 and CFTC clearing rules.^[4] Broadridge DLR has been operating intraday repo flows on Canton since 2021, regulated as a US transfer agent and broker-dealer service.^[5] Euroclear, as a Canton Foundation member and Super Validator, has tokenized gilts, Eurobonds, and gold for collateral mobility, operating its D-FMI under Belgian NBB supervision and the Luxembourg DLT Pilot Regime where applicable.^[6]

Section 02

Network topology and participant architecture

A Canton network is not a single ledger. It is a federation of independently operated participant nodes, each owned by a legal entity, communicating through one or more synchronizer domains. Each participant maintains its own private contract store containing only the contracts to which its hosted parties are stakeholders. The synchronizer orders messages and provides finality but never sees contract content — only opaque, encrypted payloads addressed to the relevant participants.

2.1 — Roles in this network

2.2 — Counterparties on the network

In addition to the four FMIs, this scenario assumes two trading counterparties whose Daml parties are hosted on dedicated bank participant nodes:

Section 03

Daml templates, choices, and the party model

Daml is the smart contract language created by Digital Asset and the lingua franca of the Canton Network. Where Solidity describes computation on a globally replicated state machine, and Corda's Kotlin contracts describe verification of state transitions, Daml describes the rights and obligations of named parties. Every Daml template names its signatory parties (whose authority is required to create the contract), observer parties (who can see it but not act), and controller parties (who can exercise specific choices on it). This party-and-authority model maps directly onto the legal structure of an FMI agreement — each clause becomes a choice, each signature requirement becomes a signatory, each information right becomes an observer disclosure.

3.1 — Tokenized US Treasury at DTCC

The DTCC ComposerX Daml application defines a UsTreasuryToken template representing a digital twin of a DTC-custodied US Treasury security. The security itself remains in DTC custody under the existing legal framework; the Daml contract is a registered representation that conveys the same beneficial interest, governed by the DTCC tokenization rulebook.

-- Daml 3.x: UsTreasuryToken.daml
module DtccComposerX.UsTreasuryToken where

template UsTreasuryToken
  with
    issuer        : Party           -- DTCC
    holder        : Party           -- current beneficial owner
    cusip         : Text            -- CUSIP identifier
    faceAmount    : Decimal         -- USD face value
    maturity      : Date            -- maturity date
    couponRate    : Decimal         -- annualized coupon
    custodian     : Party           -- always DTC
    rulebookHash  : Text            -- SHA-256 of governing rulebook
    regulators    : [Party]         -- SEC, FRBNY observers
  where
    signatory issuer, holder
    observer  custodian, regulators

    key (issuer, cusip, holder) : (Party, Text, Party)
    maintainer key._1

    -- Transfer of beneficial ownership; new holder must authorize
    choice Transfer : ContractId UsTreasuryToken
      with newHolder : Party
      controller holder, newHolder
      do create this with holder = newHolder

    -- Pledge to a Broadridge DLR repo contract; non-consuming so the
    -- token continues to exist but is encumbered by the pledge ref.
    nonconsuming choice PledgeToRepo : ContractId Pledge
      with
        repoCid : ContractId BroadridgeDLR.RepoAgreement
        pledgee : Party
      controller holder
      do create Pledge with
           collateral = self
           pledgor    = holder
           pledgee    = pledgee
           repoRef    = repoCid
           released   = False

3.2 — Tokenized EUR commercial paper at Clearstream

Clearstream's D7 application defines a parallel template for EUR-denominated debt securities. The legal basis is German eWpG; the Daml template encodes both the security and the issuance/transfer rules under that statute.

-- ClearstreamD7.EurCommercialPaper.daml
template EurCommercialPaper
  with
    issuer        : Party           -- corporate issuer
    csd           : Party           -- Clearstream Banking AG
    holder        : Party
    isin          : Text            -- ISIN under eWpG registry
    faceAmount    : Decimal         -- EUR face value
    maturity      : Date
    eWpGRegistry  : Text            -- crypto-securities registry ref
    payloadHash   : Text            -- ISO 20022 seev.031 hash
    regulators    : [Party]
  where
    signatory issuer, csd, holder
    observer  regulators

    key (csd, isin, holder) : (Party, Text, Party)
    maintainer key._1

    choice Transfer : ContractId EurCommercialPaper
      with newHolder : Party
      controller holder, csd, newHolder
      do create this with holder = newHolder

    -- Atomic DvP: deliver this CP against a UsTreasuryToken pledge
    -- spans Clearstream + DTCC + Broadridge in a single Daml tx
    choice DeliverAgainstTreasuryPledge : ContractId EurCommercialPaper
      with
        newHolder      : Party
        treasuryPledge : ContractId DtccComposerX.Pledge
        repoAgreement  : ContractId BroadridgeDLR.RepoAgreement
      controller holder, newHolder
      do
        -- exercise verifies the pledge exists and matches the repo
        pledge <- fetch treasuryPledge
        repo   <- fetch repoAgreement
        assertMsg "pledge must back this repo"
          (pledge.repoRef == repoAgreement)
        create this with holder = newHolder

3.3 — Repo agreement at Broadridge DLR

Broadridge DLR holds the repo contract itself: the agreement, term, haircut, repurchase price, and the substitution and unwind logic. The repo references the collateral contracts on Clearstream, DTCC, and Euroclear by ContractId, but does not duplicate their state.

-- BroadridgeDLR.RepoAgreement.daml
template RepoAgreement
  with
    cashProvider    : Party         -- AssetMgrUS
    collProvider    : Party         -- EuroDealer SA
    operator        : Party         -- Broadridge
    cashAmount      : Decimal       -- USD cash leg
    cashCurrency    : Text          -- "USD"
    haircut         : Decimal       -- e.g. 0.02 = 2%
    repoRate        : Decimal       -- annualized %
    openTime        : Time
    closeTime       : Time          -- intraday close
    collateralRefs  : [AnyContractId] -- pledged tokens (DTCC, EUC)
    masterAgreement : Text          -- GMRA 2011 reference + hash
    regulators      : [Party]
  where
    signatory cashProvider, collProvider, operator
    observer  regulators

    -- Substitute one collateral piece for another, mid-term
    choice Substitute : ContractId RepoAgreement
      with
        oldRef : AnyContractId
        newRef : AnyContractId
      controller collProvider, operator
      do create this with
           collateralRefs =
             newRef :: filter (/= oldRef) collateralRefs

    -- Unwind: release collateral, return cash + interest
    choice Unwind : ()
      controller cashProvider, collProvider, operator
      do return ()

3.4 — Collateral mobility at Euroclear D-FMI

Euroclear's D-FMI Daml application provides the cross-border mobility layer: it can take a tokenized gilt or Eurobond and re-pledge it across legal jurisdictions while the original asset record stays on Euroclear's authoritative ledger. The choice MobiliseToTriparty is the workhorse.

-- EuroclearDFMI.CollateralMobility.daml
template TokenizedGilt
  with
    csd           : Party           -- Euroclear UK & International
    holder        : Party
    isin          : Text
    faceAmount    : Decimal         -- GBP face value
    maturity      : Date
    regulators    : [Party]         -- FCA, BoE, NBB
  where
    signatory csd, holder
    observer  regulators

    choice MobiliseToTriparty : ContractId TripartyAllocation
      with
        triparty   : Party         -- Euroclear acting as triparty agent
        receiver   : Party         -- collateral receiver
        repoRef    : ContractId BroadridgeDLR.RepoAgreement
      controller holder, triparty
      do create TripartyAllocation with
           gilt = self
           giver    = holder
           receiver = receiver
           agent    = triparty
           repoRef  = repoRef
           releasedAt = None

Section 04

Sub-transaction privacy and the Global Synchronizer

The single most important property of Canton for an FMI network is sub-transaction privacy. In a single atomic transaction that touches three FMIs and two counterparties, each party sees only the projection of the transaction relevant to it. The synchronizer orders the encrypted views and confirms commit, but cannot read any of them. This is what makes it possible for DTCC, Clearstream, and Euroclear to settle a single atomic operation without ever seeing each other's books.

4.1 — Projections, views, and informees

When a Daml transaction is submitted, the participant's runtime decomposes it into a tree of sub-transactions, each with its own set of informees — the parties who must see that sub-transaction to validate or be informed of it. The runtime then constructs a per-participant view containing only the sub-transactions whose informees include parties hosted on that participant. Each view is encrypted under the receiving participant's key. The synchronizer's sequencer orders the encrypted blobs; the synchronizer's mediator coordinates a two-phase commit confirmation across the involved participants without ever decrypting them.

4.2 — The Global Synchronizer

The Global Synchronizer is the canonical synchronizer domain on the Canton Network. It comprises three logical components — a sequencer (orders encrypted messages), a mediator (coordinates two-phase commit), and a topology manager (publishes party-to-participant mapping) — operated together by 13 Super Validators. Consensus among the Super Validators uses a Tendermint-style BFT algorithm with deterministic finality at the sequencer level. The synchronizer fee model is paid in Canton Coin (CC) to incentivize honest validation; fee burn and minting are governed by on-chain rules.^[7]

Section 05

Full transaction lifecycle: 18 steps from negotiation to atomic settlement

The end-to-end flow involves an intraday repo opened in the morning between AssetMgrUS (cash provider) and EuroDealer SA (collateral provider), with USD 250 million face of US Treasuries pledged through DTCC, an additional GBP 50 million of gilts mobilized through Euroclear, against EUR 230 million of commercial paper delivered from Clearstream — all settled atomically across the four FMIs. The repo unwinds at end-of-day with substitution rights exercised mid-cycle.

Section 06

Cross-application atomic composability

The single Daml command authored by EuroDealer in step 06 is the technical heart of this architecture. It composes four choices on contracts owned by four different FMI applications into one atomic transaction. This section describes how Daml's package-by-package authorization model and Canton's two-phase commit make that possible without any FMI surrendering control over its own application.

-- Authored on BNP's participant on behalf of EuroDealer.
-- Single Daml command, four choices, four FMIs, one atomic commit.
submitMulti [eurodealer, assetMgr] [-- read-as: Broadridge regulators] do

  -- (1) Pledge USD 250M Treasury at DTCC
  pledgeCid <- exerciseCmd treasuryCid PledgeToRepo with
                  repoCid = repoProposalCid
                  pledgee = broadridgeParty

  -- (2) Mobilise GBP 50M gilts at Euroclear
  tripCid   <- exerciseCmd giltCid    MobiliseToTriparty with
                  triparty = euroclearTripartyParty
                  receiver = broadridgeParty
                  repoRef  = repoProposalCid

  -- (3) Deliver EUR 230M CP at Clearstream against the Treasury pledge
  newCpCid  <- exerciseCmd cpCid      DeliverAgainstTreasuryPledge with
                  newHolder      = eurodealer
                  treasuryPledge = pledgeCid
                  repoAgreement  = repoProposalCid

  -- (4) Activate the repo at Broadridge — only signs if 1-3 succeed
  activeRepoCid <- exerciseCmd repoProposalCid Activate with
                      treasuryPledgeRef = pledgeCid
                      giltAllocationRef = tripCid
                      cpDeliveryRef     = newCpCid

  return activeRepoCid

Daml semantics ensure that either all four choices commit, or none do. The transaction is a single tree; rollback is at the tree level. There is no two-out-of-four state, no half-settled trade, and crucially no need for any FMI to trust any other FMI's middleware. Each FMI's Daml package is independently signed and version-pinned in the topology manager. Cross-package fetch calls are explicit and require the fetcher to be an observer of the fetched contract.

Section 07

Cash leg, Canton Coin, and on-ledger fees

Canton handles the securities leg atomically on-ledger. The cash leg in this scenario uses conventional RTGS rails (Fedwire for USD, TARGET2 for EUR) because deposit-token CBDC infrastructure remains in pilot phase in both jurisdictions. The Canton Coin (CC) is used only for synchronizer fees, not as a settlement medium. As wholesale CBDC rolls out, the cash leg can migrate on-ledger by introducing a dedicated CashToken Daml application running on the same network — at which point the entire DvP becomes truly intra-ledger atomic.

7.1 — Canton Coin and synchronizer fees

Canton Coin (CC) is the native asset of the Global Synchronizer. Its sole purpose is to meter and pay for synchronizer services: sequencing, mediation, and storage. Fees are computed deterministically from transaction size and complexity and are paid by the submitting participant. Super Validators receive CC rewards for honest validation. CC supply is governed by the Global Synchronizer Foundation under transparent on-chain rules: minting tied to network usage growth, burning of unused balances, and capped issuance.^[8]

Critically, Canton Coin is not a settlement asset and is not intended to be one. The four FMIs in this network do not hold CC as inventory; they hold operating reserves (similar to a SWIFT membership pre-fund) used solely to pay synchronizer fees on behalf of their applications.

7.2 — Path to on-ledger cash

Section 08

ISO 20022 payloads inside Daml contracts

Every Daml contract in this network carries a content-addressed reference to an ISO 20022 XML payload. The full XML lives off-ledger (in each FMI's existing message store) but the SHA-256 hash of the canonicalized payload is stored on-ledger as an immutable binding. This satisfies T+1 SFTR, MIFIR, and CSDR reporting obligations from the same authoritative source as the settlement record itself, eliminating the trade-vs-reporting reconciliation that consumes substantial back-office cost today.

Section 09

KYC, AML, and Travel Rule compliance

AML obligations attach to each participant FMI under its own jurisdiction's framework — DTCC under FinCEN Bank Secrecy Act rules, Clearstream under Germany's GwG and the EU AMLR (in force July 2027), Euroclear under Belgium's anti-money-laundering law and EU AMLR, Broadridge under FinCEN's transfer-agent rules. The Canton architecture lets each FMI continue to run its own onboarding stack while sharing only the cryptographic attestation needed to prove a counterparty has been verified.

Each FMI maintains a KycAttestation Daml template signed jointly by the FMI's compliance party and the counterparty. The attestation is held privately on the FMI's participant; only the attestation's hash is referenced from settlement contracts. When a cross-FMI transaction is proposed, a non-consuming choice VerifyAttestation is exercised on each FMI's attestation contract, returning a boolean to the proposing transaction. The attestation content itself is never disclosed; only the verification result.

The FATF Travel Rule (recommendation 16) requires originator and beneficiary information to travel with the value transfer. In this network, the originator/beneficiary VC is exchanged off-ledger via the Canton Operator API using a TRP (Travel Rule Protocol) compliant envelope (e.g. TRISA, OpenVASP), and the SHA-256 hash of the TRP envelope is bound on-ledger to the settlement transaction. Regulators (SEC, FCA, BaFin, NBB) holding observer party rights can request the off-ledger envelope through the standard supervision channel and verify it against the on-ledger hash.

Section 10

Regulatory framework: EU, US, UK, and Belgium

Each of the four FMIs operates under a distinct supervisory framework. The Canton architecture is compatible with all four because it gives each FMI authoritative control over its own asset register while enabling cross-FMI atomic settlement. No FMI cedes supervisory authority to another, and no party sees data outside its lawful basis.

Section 11

Governance, super-validators, and the Canton Foundation

The Canton Network operates under a deliberately decentralized governance model. The Global Synchronizer Foundation, a Switzerland-domiciled non-profit, governs the synchronizer rules. The Canton Foundation, with founding members including Goldman Sachs, DTCC, Broadridge, Euroclear, BNP Paribas, and Digital Asset, governs network-wide standards and the Canton Coin economic parameters. Super Validator selection, on-chain parameter changes, and protocol upgrades are voted on through transparent on-chain governance contracts written in Daml.

Section 12

Operational risks and recovery design

No infrastructure is risk-free. The Canton design has explicit failure modes that must be governed at the network and per-FMI level. The four most important are: synchronizer outage, participant compromise, Daml package version skew, and cross-application transaction stuck-in-flight.