Working capital against bullion
A business borrows against a Bullion Depository Receipt without selling the metal. The middleware verifies the receipt is unencumbered, values it live, places a digital lien, signals funding, and lifts the lien on repayment.
The five steps, and why the order matters
| Step | What happens |
|---|---|
| 1. Verify | The receipt must be free of any other claim — checked against our ledger and against the depository. A disagreement between the two stops the loan rather than being reconciled away afterwards. |
| 2. Value | Live spot, a configured haircut, and the maximum advance that follows. A stale price feed refuses the loan outright. |
| 3. Lien | The digital lock goes on before money moves, so the lender is secured before there is anything to lose. The metal stays in the vault; the receipt becomes non-transferable. |
| 4. Fund | With the lien confirmed, the lender releases funds. If funding then fails, the lien is released by compensation and the loan ends rolled back — never leaving a borrower’s collateral encumbered against a loan they did not receive. |
| 5. Release | On repayment the lien lifts under a four-eyes approval, and the receipt returns to free circulation. |
What a single valuation would miss
Valuing collateral once, at origination, leaves a lender unsecured within weeks. At a 30% haircut, roughly a 25% fall in gold exhausts the buffer, and nothing in a value-once design notices.
So every live loan is marked continuously, and each mark is an append-only record. What did you believe the collateral was worth, when, and on whose price stays answerable after a disputed liquidation — which is the first question anyone asks.
A breach raises a margin call carrying a cure deadline and the shortfall figure that would fix it. Telling a borrower they are in breach without a number is not something anyone can act on inside a twenty-four hour window.
Three decisions worth stating plainly
Terms are frozen at origination
Haircut and thresholds are configuration, but they are copied onto each loan when the offer is issued, and the loan is priced against its own copy for the rest of its life. Reading them live would mean tightening policy on Monday silently margin-called every existing borrower on Tuesday, against terms they never agreed to. That is a contractual problem before it is a technical one.
A stale price feed cuts both ways
When the oracle is too old to trust, new lending stops — and existing loans are not marked, not called and not liquidated. Seizing collateral on data we have just declared untrustworthy would be indefensible. Failing safe points in opposite directions for the two cases, and a single “reject on stale” rule gets the second badly wrong. The cure clock does not run during an outage either: a borrower must not lose their window to our downtime.
Liquidation is never automatic
The monitor declares a default once a cure window has genuinely elapsed. Authorising the sale is a separate action requiring two named people, and the system refuses when both names are the same person. An automated path from “price moved” to “collateral sold” is a system that will one day sell someone’s gold because of a bad tick.
Non-custodial throughout. The platform does not hold the metal and does not lend the money. It provides the verification, the lien instruction, the valuation record and the audit trail that let a vault and a lender do both safely.