The bond lifecycle layer the tokenized market is missing.
Goldman tokenizes the cap table. BNP issues digital bonds. DTCC will tokenize $1T+ in Treasuries. We're building the layer that runs them — auto coupons, calls, sinking funds, maturity — atomic, private, settled in JPMD or USDCx.
Tokenization without lifecycle is half a product.
Goldman DAP, BNP Neobonds, Société Générale FORGE, and DTCC + Digital Asset are tokenizing bonds at scale on Canton today. But once the cap table is on-chain, the lifecycle that runs it is still 1990.
Coupons
Still flow through SWIFT and paying agents on T+2 settlement. Batch reconciliation. Manual NACHA files.
Calls & puts
Require 30-day notices, holder lookups in legacy registries, and hand-reconciled par+accrued calculations.
Defaults
Operational nightmares. Notify trustees by email. Wait for legal. Settle in days, not seconds.
Goldman tokenizes the cap table. The lifecycle is still SWIFT, paying agents, and PDFs. We're building the part that's missing.
One Canton transaction. All holders. Settled.
A bond auto-pays its coupon on schedule, to every current holder, in a single atomic Daml transaction. Calls, puts, sinking funds, maturity — all programmable, all atomic, all settled in JPMD or USDCx. The settlement layer your paying agent will eventually become.
Atomic coupons
N holders, one transaction, one hash. Either every holder gets paid or no money moves.
Programmable optional clauses
Calls, puts, sinking funds, makewhole. Encoded in Daml; exercised with one choice; settled atomically.
Bank-grade settlement
JPMD (JPMorgan deposit token) or USDCx (Circle). Real institutional cash, not testnet ETH.
Privacy-preserving
Bondholder identities are private to the paying agent. Holders cannot see each other's positions. Native to Canton.
Time-triggered
A Rust scheduler watches active bonds and fires lifecycle events on schedule. Idempotent. Replayable. Production-grade.
Audit-trail native
Every event is a Canton transaction with a hash. Compliance and accounting export with selective disclosure.
Three steps. Then the bond runs itself.
Issue
Issuer defines face, coupon rate, coupon schedule, maturity, optional clauses. Bond contract created on Canton in one transaction.
Distribute
Bondholdings allocated to current owners. Holders see their position in the investor portal; secondary transfers preserve accrued interest.
Run
Rust scheduler watches the bond's calendar. On each coupon date, it fires a CouponPayment that atomically settles to every holder. Calls, puts, maturity work the same way.
template CouponPayment
with
bondId: ContractId Bond
payingAgent: Party
issuer: Party
couponDate: Time
couponAmount: Decimal
holderSnapshot: [(Party, Decimal)]
where
signatory payingAgent, issuer
-- THE ATOMIC MULTI-HOLDER PAYOUT
choice ExecutePayment : ()
with issuerCashHolding: ContractId AssetHolding
controller payingAgent
do
-- For each holder, compute proportional coupon
-- Transfer from issuer's JPMD wallet to holder atomically
-- Either every holder gets paid, or none does.
forA_ holderSnapshot $ \(holder, parHeld) -> do
let holderCoupon = (parHeld / totalIssued) * couponAmount
exercise issuerCashHolding Transfer with
newOwner = holder
transferAmount = holderCoupon
pure ()Canton is the only chain where bond lifecycle works.
Public EVM chains have the programmability but no privacy. TradFi paying agents have the privacy and bank money but no programmability. Canton has all three.
| Property | Canton | EVM (Ethereum, Solana) | TradFi paying agents |
|---|---|---|---|
| Atomic multi-holder coupons | ✓ One Daml transaction. All holders. | — Gas scales with N. MEV risk. | — Batch, T+2 settlement. |
| Privacy from other holders | ✓ Native via signatory/observer. | — Public ledger. | ✓ Off-chain databases. |
| Bank-deposit money | ✓ JPMD live (Kinexys, 2026). | — USDC only. Not bank money. | ✓ Yes. |
| Programmable lifecycle | ✓ Daml templates model it natively. | ✓ Solidity, no privacy. | — SWIFT + paying agents. |
| Already accepted by regulators | ✓ DTCC, Goldman, JPM live. | — Public chain settlement uncertain. | ✓ Yes. |
| Lifecycle automation | ✓ Time triggers + atomic execution. | — Keeper pattern; gas / MEV concerns. | — Manual / batch. |
Built for the world's bond market.
Tokenized bonds are moving from rounding error to material. Once $T of tokenized Treasuries, MMFs, and corporate bonds are live on Canton, the lifecycle layer is critical infrastructure.
Live or imminent on Canton: Goldman DAP (bond issuance), BNP Neobonds, DTCC + Digital Asset (US Treasury tokenization, pilot Jul 2026 / launch Oct 2026), Franklin Templeton BENJI, Société Générale FORGE, Broadridge DLR ($280B/day repo).
Designed for paying agents and trustees.
We're not trying to replace the institutions that run today's bond market. We're building the Canton-native settlement layer those institutions will need as tokenization scales — and we want to partner with the ones already on Canton.
The largest paying agent in the world, Broadridge Financial Solutions (NYSE: BR, ~$28B market cap), is already on Canton with their DLR repo product. They process 80% of US shareholder communications and $7T+ in daily fixed-income trades in TradFi. Bond lifecycle automation is the natural Canton-native extension to their existing client base.
Honest answers.
- For the v1 demo: zero external feeds. Bond terms come from issuers (UI input), holders come from the Canton ledger, math is deterministic finance, cash is mock JPMD or USDCx. For a real pilot: real cash via JPM Kinexys sandbox or Circle, plus a CUSIP/ISIN registration — both commercial integrations, neither novel.
- Not yet. We are in active development on v1. The MVP targets Canton DevNet deployment. Production deployment requires a paying-agent partnership (Broadridge or similar) and audited Daml.
- Not yet. The demo issues mock bonds with mock cash legs on Canton DevNet/LocalNet. Real bonds require ISIN/CUSIP registration, real bank settlement integration, KYC for holders, and audited day-count math. That is a 6-12 month path post-MVP.
- The off-chain scheduler decides when to call atomic coupon payments. Rust's type system, memory safety, and concurrency primitives are meaningfully more robust than Node.js for a daemon that moves money. Institutional buyers also recognize Rust as a signal of operational seriousness.
- Daml's signatory/observer model. A BondHolding contract has the paying agent and the specific holder as signatories — Daml's visibility rules cryptographically prevent other holders from seeing it. We don't promise privacy in a UI layer; the ledger refuses to show the contract.
- Not yet. Production deployment requires third-party audit (Trail of Bits, ConsenSys Diligence, or similar) of both the Daml contracts and the Rust scheduler. Estimated $100-250K and 6-12 weeks for the full audit. This is part of the post-pilot roadmap.
- We integrate with them, we don't compete. Goldman DAP issues bonds. We run their lifecycle. The natural workflow: bond minted on DAP → registered with our lifecycle layer → coupons auto-pay → mature → archive. We are downstream of issuance, upstream of any secondary trading venue.
- Three reasons: (1) Privacy — bondholders can't see each other's positions on Canton; on EVM they can. (2) Atomic multi-holder settlement — one Canton transaction pays N holders; on EVM gas scales with N and MEV is a risk. (3) Bank-deposit money — JPMD is live on Canton via Kinexys; EVM only has USDC, which is great but not bank money.
Where does the financial data come from?▾
Is this live in production?▾
Can I issue a real bond on this today?▾
Why is the backend written in Rust?▾
How does the privacy actually work?▾
Is the Daml audited?▾
What's the relationship to Goldman DAP, BNP Neobonds, DTCC Treasuries?▾
Why Canton over Ethereum or Solana?▾
Building, exploring, or hiring?
We're actively building v1 and looking for design partners, advisors, and acquirer conversations. Especially if you're from a paying agent, trustee, or transfer agent.