The Compliant Liquidity Layer

00 · A note on disclosure

This paper describes an architecture at the level of layers, interfaces, guarantees and failure modes. It states what each component must be true of, and deliberately omits how it is achieved. Mechanism design — matching logic, attestation scoring, collateral models, and the identity construction — is withheld.

Readers should judge this document on whether the problem is correctly diagnosed, whether the layer boundaries are drawn in the right places, and whether the open problems in Section 12 are honestly stated. Those three things are testable without the implementation.

01 · Executive summary

Physical commodity trade is the largest market in the world still coordinated substantially by paper, telephone and trust. The Asian Development Bank’s January 2026 survey puts the global trade finance gap at $2.5 trillion — unchanged since 2023 and roughly 10% of world trade — with compliance cost identified by lenders themselves as a principal reason smaller firms are rejected. The gap is not a shortage of capital. It is a shortage of verifiability: capital that cannot confirm what a cargo is, where it is, who owns it, and whether touching it creates sanctions exposure will not finance it at any price.

Two things became true in the last eighteen months that were not true when the previous generation of trade platforms failed:

The legal rail for digital title now exists and works. Roughly a dozen jurisdictions have enacted MLETR-aligned law — the UK’s Electronic Trade Documents Act, Singapore, the UAE, and in 2025 France became the first EU member to transpose it, with India’s Digital Trade Facilitation Bill and Japan’s Commercial Code amendment following. In January 2026, a live electronic bill of lading completed issuance, multiple transfers, bank presentation and surrender across two different platforms without breaking the chain of title — the interoperability failure banks had named as their principal barrier. Nine of the ten largest container carriers are committed to 50% electronic bills by 2027; some bulk commodities already move at 60% electronic.

The regulated settlement leg now exists. The GENIUS Act (July 2025) created a federal framework for payment stablecoins; the OCC has chartered issuers; US banking agencies confirmed in March 2026 that capital treatment of tokenized instruments is technology-neutral; the CFTC permits tokenized real-world assets as derivatives collateral; and bank deposit tokens process billions of dollars daily. In Europe, MiCA’s transition for crypto-asset service providers completed on 1 July 2026.

What does not yet exist is the layer this paper describes: infrastructure that binds legally effective digital title, continuous compliance eligibility, physical attestation and regulated settlement into a single system for commodities in the real world — including in motion, including at their unbanked first mile. Tokenization to date has succeeded almost exclusively where custody is trivial: roughly $6 billion of tokenized commodities is 90% gold sitting motionless in accredited vaults. The hard problems — provenance, transformation, the first mile, the voyage — remain unsolved, and they are where the $2.5 trillion gap lives.

The thesis is unbundling, not elimination. Trading houses bundle six functions — risk transformation, capital provision, physical optimisation, information asymmetry, performance guarantee, and, increasingly since 2022, compliance absorption — and price them as one. The informational and administrative portion of that bundle collapses when state is shared and verifiable. The risk-bearing and capital portion does not collapse; it is forced into an open market where any qualified underwriter or lender can price it, rather than only those with a hundred-year name.

This is not a conceptual paper. The architecture described here is entering deployment: a first corridor in the artisanal and small-scale gold chain — doré through refinery to vaulted distribution — chosen because it is the hardest provenance environment in all of commodities, and because a system proven there is proven everywhere. Section 10 describes the deployment; the architecture it proves is commodity-agnostic by construction, and every section of this paper states the general design before its first application.

02 · What the intermediaries actually do

Any credible attempt to restructure this market must begin by being precise about the function it intends to displace. Trading houses perform six distinct functions, historically bundled and priced as one:

Functions three and five are genuine services that will continue to be provided and paid for. Functions one and two are risk and capital — they can be reallocated to a wider pool of underwriters, insurers and lenders, but they cannot be deleted by software; anyone claiming otherwise is describing a system that will fail the first time a counterparty defaults.

Functions four and six are the target. Information asymmetry is a toll collected on opacity. Compliance absorption is a toll collected on the cost of proving cleanliness by hand. Both are the reason the other functions must be bought as a bundle from a single large counterparty rather than sourced competitively. Industrialise verification, and the bundle breaks. That is the thesis of this paper — and it is why the system carries the name it does: in 2026, compliance is not a feature of the product. It is the product.

03 · Why the previous attempts failed — and what changed

Between 2018 and 2023, every major consortium attempting to digitise trade collapsed: TradeLens (Maersk/IBM, discontinued 2023 — competitors would not feed data to a platform controlled by their largest rival), we.trade (insolvent 2022), Marco Polo Network (insolvent 2023), Contour (closed 2023). None failed on cryptography. They failed on neutrality (a platform owned by a dominant participant is not joined by that participant’s competitors), cold start (value required simultaneous mass adoption; everyone’s rational move was to wait), and digitisation without legal effect (a digital copy of a document whose legal force still lived in the paper original forces participants to run both processes, which costs more than running one).

The survivor is instructive. Komgo — founded 2018 by a consortium of banks and traders — is now the most widely adopted digital trade finance platform in the sector, used by over 200 banks and corporates. It survived by solving a narrow, acutely painful problem for a jointly governing group, and expanding outward.

Three developments since 2023 change the terrain: legal effect arrived (MLETR-class law means a digital record can be the document); interoperability was demonstrated in production (January 2026); and the carriers committed to the electronic transition at scale. The implication is strategic: the title rail no longer needs to be invented — it needs to be built upon. A new platform issuing its own novel “digital title” instrument outside the recognised documentary ecosystem repeats Contour’s error with better cryptography. This platform’s title layer is the statutory electronic trade document — bill of lading or warehouse receipt as the commodity requires — with everything proprietary sitting above the document, never in place of it.

04 · The failures the system must prevent

Three incidents define the fraud risk, and they are of two distinct classes:

Qingdao and Hin Leong are uniqueness failures — the same asset represented more than once. The nickel case is an attestation failure — the representation was unique but false. A ledger solves uniqueness completely and attestation not at all; any paper conflating the two is selling the easy half of the problem. Sections 6 and 12 keep the two honest.

Since 2023 a third class has moved to the centre: facilitation failures — not being defrauded, but being used. Section 5 treats it as a first-order design constraint.

05 · The compliance battlefield, 2026

The environment this system operates in is materially harsher than the one the 2018-era platforms designed for.

Illicit flows are industrial-scale and woven through legitimate trade. In energy, analysts track well over a thousand shadow-fleet vessels — approaching a fifth of global tanker capacity — moving sanctioned crude under opaque ownership, disabled or spoofed transponders and covert transfers. In precious metals, more than $30 billion of gold leaves Africa undeclared in a single year, laundered into the legitimate chain through the smelter — a transformation step that destroys provenance by physics, not by paperwork.

Enforcement has moved from principals to facilitators. OFAC, the EU and the UK now explicitly target the ecosystem — insurers, brokers, registries, port operators, financiers and traders who handle sanctioned or illicit cargo — with the stated posture that wilful blindness is no longer tolerable. An infrastructure through which tainted cargo moves is exactly the category current enforcement reaches. Compliance is therefore not a feature offered to users; it is the platform’s own licence to exist, demonstrated transaction by transaction.

The regimes are diverging. US, UK and EU measures are no longer aligned and the divergence widens. “Compliant” is not a single state; it is evaluated per transaction as the union of applicable regimes, with the applied rule set recorded.

Sensing is adversarial. Transponders are spoofed, documents re-issued, origins misdeclared. Any monitoring layer that ingests these feeds as ground truth has built its risk model on data the adversary controls. Throughout this architecture, sensor and registry data are treated as claims with a manipulation model, corroborated across independent channels — including, where the commodity allows, the physical evidence of the material itself.

The commercial conclusion is the same as the enforcement conclusion: the compliance burden crushing mid-sized participants and driving banks out of commodity finance is the same burden the large houses absorb as their moat. Infrastructure that industrialises it — continuously, per-transaction, with an audit trail a regulator accepts — is the product.

06 · Architecture

Five layers. Each has a defined interface and a defined trust assumption, stated explicitly because the trust assumptions, not the technology, determine whether the system is safe. Each layer’s description states the general design; sector-specific load is noted where it shifts.

Layer 1 — Identity and eligibility

Participants are credentialed against national identity, corporate and sector registries (mining cadastres, licensing bodies, vessel registries as the corridor requires) in a tiered verification model calibrated to the depth each participant's formal structure supports, with field participation sponsored by accountable entities. This is how the system reaches the unbanked first mile that the trade finance gap lives in: identity is established for participants the banking system has never held, with accountability flowing to parties institutions can reach.

Eligibility is evaluated continuously against sanctions, permit, credential and conflict-event inputs — never checked once at onboarding — and every chain event carries a timestamped snapshot of the rules applied, proving each action was clean under the regimes as they stood. Adverse events escalate through defined materiality tiers to accountable human decision; automation raises flags, and no machine unilaterally changes a state with financial consequence.

Chain records are pseudonymous, with disclosure governed under the rulebook. In institutional markets this protects commercial positions — the confidentiality failure that helped kill the consortium platforms. At the first mile it protects something greater: a record naming who carries high-value cargo, on which route, on which day, is a physical-safety risk, and the system is built so that such records identify roles and credentials, never persons, outside governed disclosure.

Trust assumption: verifying institutions and sponsoring entities are honest and accountable; revocation is timely.

Layer 2 — Title

The title record is not a token that references a document. It is the document: a statutory electronic transferable record — an electronic bill of lading for seaborne chains, an electronic warehouse receipt for stored commodities — satisfying the exclusive-control requirements of MLETR-class law under the governing law of the transaction, carrying the same legal force as the paper it replaces.

This distinction decides whether cargo clears or sits impounded. A port authority, customs officer, carrier, vault operator or insurer confronted with a proprietary “digital title token” has no basis to act on it; confronted with a statutory electronic trade document, it does. Title instruments across all commodity classes present to the platform through a single integration interface, supporting industry eBL systems for seaborne chains and electronic warehouse receipts for stored commodities; in launch deployments the platform’s registry itself operates the receipt system under governing law. Everything proprietary sits above the document, never in place of it.

Uniqueness at this layer eliminates the Qingdao and Hin Leong fraud class outright: the encumbrance registry records and evidences security over the statutory title objects themselves, with perfection occurring under governing law through control of the document — not through the registry’s say-so. A registry entry never creates a security interest; it makes interests visible, sequenced, timestamped and checkable in seconds. The same cargo cannot be pledged twice, because the pledge is bound to the one legal object that is the cargo’s title.

Trust assumption: the governing law supports electronic transferable records; issuing entities issue faithfully.

Layer 3 — Attestation

The hard layer. Attestation is how claims about physical reality enter the system: verification (independent inspection at defined lifecycle points, as signed attestations carrying attestor identity, method, time and confidence), extraction (unstructured trade documents converted to structured claims with per-class confidence calibration and human escalation, every extraction traceable to a governed model version), and monitoring (continuous physical and positional observation treated as adversarial claims, corroborated across independent channels).

Four constraints govern the layer, in every corridor:

Attestations are evidence, not truth. Each carries source, method, timestamp and confidence; downstream participants weight them by their own risk policy. Collapsing imperfect observations into one authoritative claim would hide exactly the uncertainty a lender must price.

Transformation events are re-established, not tracked through. Every commodity chain has an event that destroys documentary continuity — the smelter’s melt, the cutter’s wheel, the blender’s tank, the aggregator’s silo. No ledger survives a furnace. Provenance across a transformation is established by a continuous signed evidentiary chain from registered origin through custody handoffs to an attested transformation event, corroborated by physical evidence of the material itself. The system’s claim at these points is accountable mass-balance, never atom-tracking, and the difference is stated to every counterparty.

Machine judgment does not take unilateral action. A model that can freeze an asset is a model whose compromise is a market attack. Automation flags and escalates; signed human action by an accountable party makes every state change with financial consequence.

Models are governed like infrastructure. Every machine-generated output with financial consequence is traceable to a versioned, adversarially tested model with a published error profile, under formal change control — because the model registry is the substrate of the diligence defence in every regulator conversation.

Trust assumption: the layer is as good as its attestors. It makes fraud costly, attributable and fast to detect; it does not make fraud impossible.

Layer 4 — Execution

Physical commodity contracts are not fungible instruments — quality specifications, tolerances, delivery windows, demurrage and force majeure vary by trade. The layer does not attempt general contract formalisation; settlement- and financing-gating terms are machine-readable through per-sector term libraries built on a shared formal core, while remaining terms stay as governed prose with human resolution. Obligations, contingencies and settlement conditions then execute without manual reconciliation between back offices — reconciliation, not execution, being the dominant administrative cost in physical trade.

Layer 5 — Capital and settlement

Settlement. Transfer of title and transfer of value complete as one event or not at all, removing principal risk from the exchange. Settlement achieves legal atomicity through conditional instructions under the platform rulebook, following the pattern of established payment-versus-payment systems, with a statutory finality track in supervised phases. The value leg is confined to regulated settlement assets: payment stablecoins from chartered issuers within the GENIUS perimeter, or bank-issued tokenized deposits inside the supervised banking system. An unregulated settlement asset would contaminate every transaction it touches; there is no version of this system that settles in one.

Financing. Where the unbundling thesis becomes concrete. When a lender can independently verify that an asset exists, is unencumbered, is where it is claimed to be, carries clean provenance evidence, and is owned by a verified counterparty — without relying on the borrower’s representation — credit assessment shifts from a judgment about the borrower to a judgment about the asset. That shift opens finance to the producers inside the $2.5 trillion gap, and it breaks the bundle: a producer who can finance production directly no longer sells at a discount to receive cash today. The regulatory ground is firm: technology-neutral capital treatment confirmed by the US banking agencies (March 2026), tokenized real-world assets accepted as derivatives collateral by CFTC guidance.

07 · The legal musts

Everything above depends on one question: does transferring the record transfer legal ownership of the goods? If not, the system is an expensive mirror of a paper process that retains all legal force.

The state of play: MLETR-aligned law is in force in roughly a dozen jurisdictions — the UK (whose Electronic Trade Documents Act is disproportionately significant because English law governs the largest share of international trade contracts), Singapore, the UAE, Bahrain, France, and others, with India and Japan in process and the US closing state by state through UCC Article 12. Approximately 37% of global GDP is now under MLETR-class law. Adoption is the starting line, not the finish: cross-border recognition mechanisms lag domestic statutes, dispute-forum precedent is immature, and actual electronic-document usage remains a small fraction of documents issued — the carriers’ 2027/2030 commitments are the curve this system rides.

The operating consequences are policy, stated to participants explicitly: full title transfer is offered only where the governing law of the transaction supports electronic transferable records; elsewhere the platform provides verification, compliance and financing support alongside a paper process, and says so — a platform that implies legal certainty it does not have loses its first contested case and its reputation simultaneously. Every trade records its governing law, the statutory basis of its title instrument, and the fallback if the record is challenged. Deployment corridors are selected where the governing-law and enforcement positions are strongest, expanding as legislation arrives — corridor activation is configuration, not construction.

08 · The financial musts

The counterpart constraints on the money side, each a condition of institutional participation:

Settlement in regulated money only, as specified in Layer 5.

Bank-recognisable capital treatment. A bank financing through this system books the exposure identically to its paper-world equivalent; the platform’s instruments are structured inside the technology-neutral position confirmed by the agencies, as a design constraint rather than an afterthought.

Insurance continuity. Underwriters must recognise the title instrument for cover to attach and claims to pay — which is why Layer 2 uses statutory documents the insurance market can assess, never novel instruments no underwriter has priced. An asset whose insurance is voidable because its title document is unrecognised is unfinanceable regardless of everything else.

Auditability without surveillance. A supervisor with appropriate authorisation can reconstruct any transaction’s complete history — who transacted, under which attestations, against which rule set. Supervisory reconstruction operates under threshold authorisation with no unilateral access by any party, and affected participants are informed after a defined interval unless a competent authority directs otherwise. More broadly: records are append-only with signed supersession; lawful supervisory and compelled access operates through tiered, logged, threshold-authorised procedures with participant disclosure where legally permitted; and personal data is minimised and segregated from chain records. The system makes no promise a lawful order can break — participants get truth, not theatre — and holds no more personal data than its function requires, because data that is not held cannot be exposed.

Regulatory classification, honestly stated. The system has characteristics of a trading venue, a registry, a settlement system and a market data provider, and maps cleanly onto no single licence category. The path is jurisdiction by jurisdiction: launch functions are structured so that every regulated activity is performed by an entity already licensed for it — verification by licensed providers, title under statute, lending by banks, settlement assets by chartered issuers — bound by a contractual rulebook of the kind that has governed multi-party trade systems for decades; venue functionality follows through the supervised sandbox regimes built for exactly this transition (UK, Singapore, UAE, EU), with full authorisation where volume justifies it.

09 · Governance

Governance is where consortium platforms die, so it is specified before adoption.

The operator is not a market participant. Any entity that both runs the infrastructure and trades on it has a conflict competitors will correctly refuse. The platform therefore takes no position in any commodity it records, at any stage, including its first deployment: the physical trade in the launch corridor is conducted by established operating partners — licensed exporters, accredited refiners, vault operators and lenders — who participate as credentialed users under the rulebook, while the platform supplies only the evidence, title and settlement layers. Partners are screened and credentialed on the same terms as any later participant, with no legacy-relationship exemptions, and the platform’s output is evidence about a partner’s lots, never a certification of the partner.

Distributed control. No single participant, including the operator, can unilaterally alter records, suspend a participant, or change protocol rules; changes with market consequence require defined multi-party authorisation with a published audit trail.

Separation. Infrastructure operation, attestation, and trading are performed by distinct entities with distinct economics — an attestor with a position in the cargo it attests is the nickel case waiting to recur.

Exit rights. Participants can extract their complete transaction history in portable form at any time. Credible exit is a precondition of entry.

10 · First deployment: the hardest chain first

The launch corridor is artisanal and small-scale gold — doré through refinery to vaulted distribution — and the choice is deliberate: it is the hardest provenance environment in all of commodities. More than $30 billion of gold leaves Africa undeclared each year; the smelter destroys documentary continuity by physics; the first mile is cash-based, unbanked and formally invisible; and accredited refiners largely refuse artisanal material because the due-diligence cost of a small lot exceeds its margin. Every difficulty this paper names — identity where none exists, provenance across transformation, adversarial evidence, compliance as the product — is present at maximum intensity. A system proven here is proven everywhere; a system proven only where custody is trivial is not proven at all.

The deployment runs the full stack end to end: sponsored field credentialing at origin; a continuous signed evidentiary chain from registered origin through custody handoffs to the attested refinery-gate event, corroborated by physical assay evidence of the material itself; statutory electronic receipts and the encumbrance registry from the vault onward; regulated-money settlement. The commercial proof is a single sentence: a lot arriving with its evidentiary dossier is a lot an accredited refiner can accept, and a lender can finance. Per Section 9, the deployment is conducted with established operating partners who trade their own material as credentialed participants; the platform holds no position and takes no principal risk in the corridor it records.

Two design principles of the deployment generalise to every future corridor. First, the compliant channel must win on the participant’s own terms rather than on compliance rhetoric — the formal channel beats the informal one on fairness and reliability, and the deployment is designed around that. Second, regulation is constructing the demand: mandatory sourcing-disclosure rules in precious metals took effect in January 2026; plot-level provenance becomes enforceable at the EU border for seven agricultural commodity groups from December 2026; diamond-origin verification phases in by stone size; facilitator-targeted sanctions enforcement widens by the quarter. Every one of these is a regulator legislating demand for exactly the evidence Layer 3 produces. Expansion proceeds corridor by corridor along that legislated demand, each corridor a configuration of the same five layers.

11 · Comparison to adjacent systems

12 · What this does not solve

Stated plainly, because the omissions in a whitepaper are what a sophisticated reader looks for first.

The oracle problem is reduced, not eliminated. A corrupt attestor with corrupt adjacent parties can still introduce false claims. The architecture makes such fraud require coordination, makes it attributable, and makes it detectable through physical cross-checks. Raised cost — not impossibility. The 2023 nickel case would have been caught faster, not made impossible.

Sensing is an arms race. Evasion techniques evolve against detection. The design goal is that evasion be demonstrably not facilitated — the platform’s records showing diligence performed — rather than never occurring.

Legal effect is jurisdictionally uneven. Roughly 37% of global GDP is under MLETR-class law; recognition and precedent trail the statutes. The full guarantee applies corridor by corridor, at legislative speed.

Regulatory classification is unresolved. No existing licence category fits; the staged structure of Section 8 is a path, not a destination, and pending market-structure legislation will move the answer.

Risk and capital are reallocated, not removed. Producers still need someone to bear price risk and provide working capital. The system widens who can, and improves what they price on. It does not make the function unnecessary.

Physical risk remains physical. Ships sink, vaults are robbed, states seize cargo, conflict erupts over a mine. No ledger addresses this; insurance and legal recourse remain load-bearing — and where conflict does erupt over a source already in the chain, the treatment of affected inventory is a governed decision under the rulebook rather than an automatic outcome.

13 · Summary of claims

Version 1.2, August 2026. Helen Chikezie, Christopher Barklem. Mechanism design, matching logic, attestation scoring and identity construction are withheld per Section 0. Market and regulatory facts as of the date above: ADB Global Trade Finance Gap Survey (January 2026); MLETR adoption records; the January 2026 cross-platform eBL transaction; GENIUS Act (July 2025) and implementing rulemaking; US banking agencies’ joint guidance on tokenized instruments (March 2026); CFTC staff guidance on tokenized collateral (December 2025); LBMA transparency requirements (January 2026); EUDR (Regulation (EU) 2023/1115, as amended, applying December 2026); SwissAid analysis of undeclared African gold flows; OFAC/EU/UK facilitator-targeted enforcement 2025–2026.