Settlement never finished

Shortening the settlement cycle worked. When US equities moved to T+1, the industry review found the average clearing fund fell by $3 billion, around 23%, without fail rates getting worse.

Less time at risk meant less capital held against uncertainty.

Then digital markets arrived and broke the assumption underneath it. There is no end of day any more. Assets sit across chains, custodians, exchanges and new forms of money. Each one has its own clock, its own version of done and its own idea of the truth.

You cannot fix that by running the same batch faster.

T+0 is not T+1 with a quicker clock. It is a different control system.

Today we are setting out what we are building: OneClearing, a post-trade control plane for institutional digital finance.

Capital should be committed to obligations, not locations.

Not parked at every venue in case something happens. Committed to the trade that actually exists, for exactly as long as the risk is real, then released.

OneClearing is a control plane for what happens after the trade. It is not a venue, a custodian or an execution system. It sits above the ones you already use and coordinates the obligation they leave behind.

One consolidated margin view. Locked against free, across venue and custody relationships, instead of a different answer in every system. Resource locks reserve capacity so it is never promised twice in silence, and every lock names what created it. Channels and orchestration are named pipes to each surface, and an ordered queue of what moves next, with the blocker stated.

What it does not do: replace your order management system, your custodian, your venues or your liquidity relationships. Execution stays where it is. OneClearing starts after the trade.

In a pilot it runs in Shadow: it calculates locks and shows what it would instruct, without moving any assets.

Margin overview. One rollup. Locked versus free, utilisation, and a channel table with health and last sync. One answer to how much room the desk actually has, and which pipe is stale when the answer looks wrong.

Locks. Capacity reserved against a named obligation. Open a lock and you get a receipt sentence, not a mystery: this lock exists because a named venue reported a fill on a named trade, and a named rule reserved a named quantity. It cannot be promised elsewhere until the obligation settles or expires.

Orchestration. The ordered next steps. Move this from custody to venue. Return that before cut-off. Release this lock when delivery is proven. Each row names the preconditions and whether the step is ready, blocked, or would send. In Shadow, “would send” means exactly that.

Exceptions. Breaks routed to the channel that caused them. Duplicate fill, unmatched ticket, stale feed. A degraded channel makes the system more conservative, never more permissive.

Audit. Who did what, in order. Lock created, instruction approved, lock released, cap reviewed. The trail is the same data the system runs on, so close of day becomes a status check rather than a hunt across five systems.

A post-trade control plane that rolls up one margin picture across named channels, turns their feeds into locks, queues and, when live, approves moves between those channels, and makes exceptions, channel health and audit impossible to ignore.

After 2022, the industry did the right thing. Assets moved back behind qualified custody. Off-exchange settlement became the control pattern, and it worked.

It also built a market of safer gardens.

Every garden has its own account model, its own collateral view, its own settlement cycle, its own evidence. So an institution can be safer in every single relationship and still have no idea what it can actually use across all of them.

Well defended. Badly coordinated.

OneClearing is designed to sit above those gardens, not replace them. Keep your custodian. Keep your venues. Keep your rails.

A resource lock is a reservation with teeth. It says: this capacity is spoken for, by this obligation, until this moment. While the lock holds, that capacity cannot be promised to anything else.

The important word is without. No transfer of title. No moving assets to us. The commitment is recorded where the assets already sit.

That is the difference between “we think there is roughly ten million available” and “four million is committed to three live obligations, six million is genuinely free, and here is which is which.”

Every service in the design sits on this one primitive. Escrow, settlement credit and a clearing account are the same object with different rules on top. That is why the model gets simpler as it grows rather than sprawling into features.

Most post-trade stacks keep a database and print a report. Reconciliation is then the act of arguing about whose report is right.

This is built the other way round. A command is a request to change something, and accepting it means accepted, not done. Every real change of state is published as an event, and that sequence of events is the truth. Everything you read — positions, status, balances — is a view rebuilt from it.

The audit trail is the same data the system runs on. State can be replayed, so “what did we know, and when” stops being an investigation. Two systems can disagree about lag. They cannot disagree about history.

Two speeds of coordination. Anything that moves value or increases authority, such as paying a claim, releasing collateral or raising a limit, waits for proof. Everything else, such as position catch-up and status, updates asynchronously. Fast where fast is safe. Patient where patience is the whole point.

And when something breaks: stale input narrows, never widens. A system that loses a dependency keeps working inside the authority it already holds, and never assumes a larger one. Degradation makes it more conservative, not more permissive. Matching continues without new budgets. Clearing continues without settlement. Everything continues without the inspector surface.

That last property is unglamorous and it is the one risk committees care about most.

One canonical root, Ethereum. Custody in contracts rather than in a private database. Separated authorities, so no single system can be both the thing that spends capacity and the thing that says how much exists.

Being plain about status: cryptographic proofs are not in production, and we do not claim them. The point of the architecture is that the facts worth checking are being put where they can eventually be checked by someone who does not work here.

Most infrastructure asks you to trust the operator. This is designed so that, over time, you have to trust less of it.

The direction of travel is from “our dashboard says so” to “the record says so, and you can read it too.”

Traditional infrastructure already proved the prize.

NSCC nets down the value of payments exchanged by an average of 98% a day. CLS reports funding requirements reduced by more than 96% on eligible flows.

We are not claiming those numbers. We are not a CCP. We do not novate trades, we do not run a default fund, and we do not mutualise anyone’s losses.

When the market can see, govern and offset its obligations under shared rules, the capital it needs changes shape.

Digital markets have never had that layer. They went straight from no infrastructure to fast infrastructure, and skipped the part where the promise becomes dependable.

We are not announcing that OneClearing is live. It is not.

What is running today is narrower and more useful than a diagram: a bounded, credit-backed settlement workflow, with a real deadline and an explicit end state. Separate settlement legs. Not atomic delivery. Not a clearing house.

We are starting there on purpose. A live credit window forces the questions a whitepaper lets you avoid. Who is allowed to commit capacity. What counts as delivery. What happens when a route dies. When the risk is actually over. What evidence survives the exception.

Answer those on real flow, and you earn the right to build the bigger thing.

Operate. Prove. Govern. Then compress.

Netting is not the opening promise. Neutral infrastructure is not a launch-day label. Both get earned.