Architecture

Architecture

System architecture & decision flows

How the settlement platform's components connect, and how a request moves through checks and decision points before it settles.

New to the wording on this page? 7 terms explainedShow

Orchestration

The coordinating layer that runs required steps in the right order and refuses to let anything skip ahead — so nobody can jump straight to moving money without passing the checks.

For example: Like an airport where you cannot reach the gate without passing check-in, security and passport control in that order. The orchestration layer is the airport layout that makes skipping impossible.

APIApplication Programming Interface

A structured doorway letting one computer system talk to another automatically — so software can instruct the bank directly, with nobody logging into a website.

For example: Instead of a treasury analyst typing a payment into online banking, the company's finance software sends the instruction straight to the bank overnight, and the bank's system replies with the outcome.

Permissioned network

A shared ledger where you must be approved and identified before taking part, as opposed to an open network anyone can join anonymously.

For example: Bitcoin is open — anyone can join with no identity check. A bank settlement network is the opposite: only vetted, licensed institutions are admitted, and everyone knows exactly who everyone else is.

DLTDistributed Ledger Technology

The broader family blockchain belongs to: any system where several parties keep synchronised copies of the same records without one party solely controlling them. Every blockchain is a distributed ledger, but not every distributed ledger is built as a chain of blocks.

For example: Think 'shared spreadsheet everyone can see and no one can secretly edit' as the general idea. Blockchain is one specific way of building that; there are others.

Smart contract

Code stored on a ledger that runs automatically when agreed conditions are met, without someone manually performing each step. Despite the name it is not a legal contract — a real contract still governs the arrangement.

For example: 'If the bond units are confirmed available AND the cash is confirmed available, release both at once; otherwise release neither.' That instruction runs by itself, with no operations staff pressing a button.

Reconciliation

Checking that two separate records of the same thing actually agree — for example that the token ledger and the bank's main account system show the same balance. A mismatch is called a break.

For example: Like comparing your receipts against your bank statement at month end. If the statement says HK$4,000 and your receipts total HK$4,200, you have a break and must find the missing HK$200 before closing the books.

HSMHardware Security Module

A tamper-resistant physical device that stores the secret cryptographic keys controlling digital assets, and signs transactions without the key ever leaving the box.

For example: Like a safe that will sign documents for you through a slot but will never hand the pen outside. If someone steals the whole machine, it destroys its own contents rather than surrender the keys.

See every term used across this site

System architecture

Client apps, the orchestration gateway, core settlement services, the system of record, and cross-cutting controls.

Client layerCorporate Treasury PortalWeb app · Treasury, DvP, PvP flowsOps & Compliance ConsoleWeb app · exceptions, screening review1GatewaySettlement Orchestration APIRequest routing, sequencing & orchestration2logsCore settlement servicesEntitlement &Access Serviceapproved entities, roles3Financial CrimeScreeningsanctions / AML / PEP4Tokenised Ledgerpermissioned DLT5Atomic SettlementEngineDvP / PvP6orchestrated check sequencepost settled transactionSystem of recordCore Banking LedgerHKD · USD · GBP · SGD accounts7Payment RailsRTGS / correspondent bankingCross-cuttingAudit & Event Logimmutable, append-only9Reconciliation Engineautomated, intraday8Risk & ComplianceCase Managementfinancial crime cases10readsreads core ledgeron match → raises case

1Numbered 1–7: the primary request path, in order8Numbered 8–10: cross-cutting reads/logging, continuous rather than sequential

Every client request enters through a single orchestration gateway, which sequences the entitlement, screening, ledger and settlement services rather than letting clients call them directly — so controls can never be bypassed by calling a downstream service out of order.

The tokenised ledger and the core banking ledger are kept consistent by an automated reconciliation engine, and every event across the platform is written to an immutable audit log — independent of whether the transaction ultimately settles or is rejected.

Tokenised transfer — decision flow

The path a treasury transfer takes from initiation to settlement, and where it can be stopped.

Client initiates transferEntitlement checkis beneficiary an approved group entity?Entity approved?YesNoRejectedentity not entitledSanctions & watchlist screeningoriginator, beneficiary, purposeScreening clear?YesNoBlockedcompliance case raisedAvailable funds checksufficient balance at origin entity?Sufficient balance?YesNoRejectedinsufficient fundsAtomic settlementdebit origin & credit beneficiary as one operationCore ledger postingAutomated reconciliationSettled & reconciled

Each control is a hard gate, not an advisory step: a failed entitlement, screening or funds check stops the transfer before any ledger movement occurs. Only a transfer that clears all three moves into atomic settlement, where the debit and credit happen as a single operation — never partially.

Atomic settlement — DvP / PvP

The same both-legs-or-neither mechanism underpins Bond DvP and FX PvP settlement.

Leg A · e.g. buyer cash / party A currencyLeg B · e.g. seller asset / party B currencyLeg A escrowedheld pending settlementLeg B escrowedheld pending settlementFunds / holdings checkLiquidity / holdings checkCounterparty approval on fileCounterparty approval on fileCompliance screeningboth parties, sanctions & eligibilityAll pre-settlementchecks pass?YesAtomic commitboth legs release simultaneouslySettlement finality + audit recordNoRollbackboth legs return to original holdersException — no leg transferred

Both legs are held in escrow until every pre-settlement check clears. If any check fails — insufficient funds, insufficient holdings, a missing approval, or a screening hit — the platform rolls back both legs to their original holders rather than settling one side. This is what removes principal and counterparty risk from the settlement window, for both a bond trade and an FX exchange.

Interoperability and Partner Selection Framework

The product does not start by choosing a network. It starts with the client problem.

Client use case
Settlement asset
Regulatory perimeter
Operating model
Partner selection

Partner and network selection scorecard

  • Client reach and network effects
  • Regulatory fit
  • Privacy / data controls
  • Settlement finality
  • ISO 20022 and API interoperability
  • Financial-crime tooling
  • Liquidity model
  • Resilience and business continuity
  • Vendor concentration / exit plan
  • Economics and implementation complexity

Illustrative operating models evaluated

Private bank-operated ledgerShared institutional networkRegulated digital-money interoperability layerTokenised asset platform / custodianExisting payment and market infrastructure

Technology selection follows the client use case, settlement asset and regulatory perimeter — it is not a blockchain-first decision. See Ecosystem & Market Landscape for the fuller capability landscape and market benchmarks.