Trust Model

Musubi is a member-owned, operator-less, atomic & private settlement rail with no on-ledger compliance layer — per-participant compliance is entirely off-ledger.

Musubi enforces trust through a multi-party signing model. No single party can move assets or execute settlements unilaterally. Every settlement requires cryptographic agreement from four independent parties. Musubi is operator-less: the Core coordinator co-submits on every settlement (a protocol mechanic), but no standing operator owns or unilaterally controls the network (a governance property). The network is member-owned; Core coordinates, it does not govern. Musubi carries no KYC/AML or compliance data on-ledger — it is entirely each participant’s own off-ledger concern.

Four-Party Settlement Signing

Before any atomic DvP executes, all four parties must authorize:

Party	What They Authorize	TradFi Parallel
Core coordinator	Coordinates the 4-party settlement and co-submits — does not own or control the network	Exchange/CCP coordinating a trade
Sender Custodian	Releases sender’s source stablecoin	Custody bank releasing funds
Market Maker	Commits target stablecoin liquidity	Counterparty committing to delivery
Receiver Custodian	Confirms receipt capability	Custody bank accepting inbound

If any party refuses or fails to respond, settlement does not proceed and no assets move. This is more conservative than most traditional settlement systems — CLS Bank requires only the two commercial banks to pre-fund; Musubi requires all four participants to explicitly authorize.

Dual Control: Institution + Custodian

Every trade requires two independent authorizations from the sending side:

Step	Who	What	Enforcement
1. Select quote	Institution	Reviews competing quotes, picks the best rate	API call
2. Authorize movement	Custodian	Co-signs the quote acceptance, authorizing asset release	Cryptographic co-signature

Neither party can act alone:

The institution cannot move assets without the custodian’s co-signature
The custodian cannot initiate a trade — only authorize one the institution requested

This maps directly to the maker-checker / four-eyes principle used in institutional operations, enforced by the settlement protocol rather than by internal procedure. The custodian’s co-signature is cryptographic — it cannot be forged, bypassed, or retroactively granted.

Who Holds What Authority

Authority	Held By	Purpose
Intent signing	Institution	Proves the institution authorized the payment (non-repudiation)
Asset movement	Custodian	Controls when and how much stablecoin leaves custody
Liquidity commitment	Market Maker	Commits target currency for the swap
Settlement coordination	Core coordinator	Coordinates settlement and co-submits the atomic DvP (coordination only — no ownership or control of the network)

The institution proves intent. The custodian controls assets. These are separate keys held by separate organizations — neither can impersonate the other.

Musubi: Coordinator, Not Counterparty

What Musubi Does	What Musubi Does NOT Do
Co-submits on the order and verifies party signatures	Hold or custody any assets
Broadcasts anonymized RFQs to market makers	Set or influence FX rates
Coordinates the 4-party settlement signing	Move assets without custodian authorization
Executes the atomic DvP transaction	Access participants’ internal systems
Provides settlement confirmations	Act as counterparty to any trade
	Own, govern, or unilaterally control the network

TradFi parallel: Musubi is to stablecoin settlement what CLS Bank is to FX settlement — it coordinates simultaneous delivery of both currency legs without ever taking ownership. The critical difference: settlement completes in seconds, not hours.

Comparison to Traditional Settlement

Aspect	Traditional (CLS/Correspondent)	Musubi
Who authorizes	Bank’s internal approval chain	Cryptographic co-signatures from 4 parties
Settlement guarantee	CLS PvP within settlement window	Atomic DvP — single transaction
Pre-funding	Required during CLS window	Not required — instant atomic execution
Counterparty risk	Mitigated by CLS, not eliminated	Eliminated — no time gap between legs
Authorization bypass	Possible via internal process failure	Impossible — cryptographically enforced
Audit trail	SWIFT messages + internal logs	One Canton transaction covering all four legs, with an on-ledger settlement record in each counterparty’s own participant

Overview

Security & Privacy

Technical

Four-Party Settlement Signing

Dual Control: Institution + Custodian

Who Holds What Authority

Musubi: Coordinator, Not Counterparty

Comparison to Traditional Settlement

​Four-Party Settlement Signing

​Dual Control: Institution + Custodian

​Who Holds What Authority

​Musubi: Coordinator, Not Counterparty

​Comparison to Traditional Settlement

Four-Party Settlement Signing

Dual Control: Institution + Custodian

Who Holds What Authority

Musubi: Coordinator, Not Counterparty

Comparison to Traditional Settlement