Architecture
System architecture & decision flows
How the settlement platform's components connect, and how a request moves through checks and decision points before it settles.
New to the wording on this page? 7 terms explainedShow
Orchestration
The coordinating layer that runs required steps in the right order and refuses to let anything skip ahead — so nobody can jump straight to moving money without passing the checks.
For example: Like an airport where you cannot reach the gate without passing check-in, security and passport control in that order. The orchestration layer is the airport layout that makes skipping impossible.
APIApplication Programming Interface
A structured doorway letting one computer system talk to another automatically — so software can instruct the bank directly, with nobody logging into a website.
For example: Instead of a treasury analyst typing a payment into online banking, the company's finance software sends the instruction straight to the bank overnight, and the bank's system replies with the outcome.
Permissioned network
A shared ledger where you must be approved and identified before taking part, as opposed to an open network anyone can join anonymously.
For example: Bitcoin is open — anyone can join with no identity check. A bank settlement network is the opposite: only vetted, licensed institutions are admitted, and everyone knows exactly who everyone else is.
DLTDistributed Ledger Technology
The broader family blockchain belongs to: any system where several parties keep synchronised copies of the same records without one party solely controlling them. Every blockchain is a distributed ledger, but not every distributed ledger is built as a chain of blocks.
For example: Think 'shared spreadsheet everyone can see and no one can secretly edit' as the general idea. Blockchain is one specific way of building that; there are others.
Smart contract
Code stored on a ledger that runs automatically when agreed conditions are met, without someone manually performing each step. Despite the name it is not a legal contract — a real contract still governs the arrangement.
For example: 'If the bond units are confirmed available AND the cash is confirmed available, release both at once; otherwise release neither.' That instruction runs by itself, with no operations staff pressing a button.
Reconciliation
Checking that two separate records of the same thing actually agree — for example that the token ledger and the bank's main account system show the same balance. A mismatch is called a break.
For example: Like comparing your receipts against your bank statement at month end. If the statement says HK$4,000 and your receipts total HK$4,200, you have a break and must find the missing HK$200 before closing the books.
HSMHardware Security Module
A tamper-resistant physical device that stores the secret cryptographic keys controlling digital assets, and signs transactions without the key ever leaving the box.
For example: Like a safe that will sign documents for you through a slot but will never hand the pen outside. If someone steals the whole machine, it destroys its own contents rather than surrender the keys.
System architecture
Client apps, the orchestration gateway, core settlement services, the system of record, and cross-cutting controls.
1Numbered 1–7: the primary request path, in order8Numbered 8–10: cross-cutting reads/logging, continuous rather than sequential
Every client request enters through a single orchestration gateway, which sequences the entitlement, screening, ledger and settlement services rather than letting clients call them directly — so controls can never be bypassed by calling a downstream service out of order.
The tokenised ledger and the core banking ledger are kept consistent by an automated reconciliation engine, and every event across the platform is written to an immutable audit log — independent of whether the transaction ultimately settles or is rejected.
Tokenised transfer — decision flow
The path a treasury transfer takes from initiation to settlement, and where it can be stopped.
Each control is a hard gate, not an advisory step: a failed entitlement, screening or funds check stops the transfer before any ledger movement occurs. Only a transfer that clears all three moves into atomic settlement, where the debit and credit happen as a single operation — never partially.
Atomic settlement — DvP / PvP
The same both-legs-or-neither mechanism underpins Bond DvP and FX PvP settlement.
Both legs are held in escrow until every pre-settlement check clears. If any check fails — insufficient funds, insufficient holdings, a missing approval, or a screening hit — the platform rolls back both legs to their original holders rather than settling one side. This is what removes principal and counterparty risk from the settlement window, for both a bond trade and an FX exchange.
Interoperability and Partner Selection Framework
The product does not start by choosing a network. It starts with the client problem.
Partner and network selection scorecard
- Client reach and network effects
- Regulatory fit
- Privacy / data controls
- Settlement finality
- ISO 20022 and API interoperability
- Financial-crime tooling
- Liquidity model
- Resilience and business continuity
- Vendor concentration / exit plan
- Economics and implementation complexity
Illustrative operating models evaluated
Technology selection follows the client use case, settlement asset and regulatory perimeter — it is not a blockchain-first decision. See Ecosystem & Market Landscape for the fuller capability landscape and market benchmarks.