> ## Documentation Index > Fetch the complete documentation index at: https://musubinetwork.com/llms.txt > Use this file to discover all available pages before exploring further. # Trust Model > Multi-party signing authority, dual control, and the role-based trust model. **Updated 2026-06-19 for the member-owned / operator-less pivot.** Musubi is a member-owned, operator-less, atomic & private settlement rail with no on-ledger compliance layer (per-participant compliance is off-ledger). Content below verified current as of this date; for the governance model see [ADR-0024](../../adr/0024-member-owned-operator-less-governance.md). Musubi enforces trust through a multi-party signing model. No single party can move assets or execute settlements unilaterally. Every settlement requires cryptographic agreement from four independent parties. Musubi is **operator-less**: the Core coordinator co-submits on every settlement (a protocol *mechanic* — see [ADR-0001](../../adr/0001-operator-cosubmission.md)), but no standing operator *owns* or unilaterally *controls* the network (a *governance* property — see [ADR-0024](../../adr/0024-member-owned-operator-less-governance.md)). The network is member-owned; Core coordinates, it does not govern. Musubi carries no KYC/AML or compliance data on-ledger — it is entirely each participant's own off-ledger concern. ## Four-Party Settlement Signing Before any atomic DvP executes, all four parties must authorize: | Party | What They Authorize | TradFi Parallel | | ---------------------- | --------------------------------------------------------------------------------------- | ----------------------------------- | | **Core coordinator** | Coordinates the 4-party settlement and co-submits — does not own or control the network | Exchange/CCP coordinating a trade | | **Sender Custodian** | Releases sender's source stablecoin | Custody bank releasing funds | | **Market Maker** | Commits target stablecoin liquidity | Counterparty committing to delivery | | **Receiver Custodian** | Confirms receipt capability | Custody bank accepting inbound | If any party refuses or fails to respond, settlement does not proceed and no assets move. This is more conservative than most traditional settlement systems — CLS Bank requires only the two commercial banks to pre-fund; Musubi requires all four participants to explicitly authorize. ## Dual Control: Institution + Custodian Every trade requires two independent authorizations from the sending side: | Step | Who | What | Enforcement | | --------------------- | ----------- | -------------------------------------------------------- | -------------------------- | | 1. Select quote | Institution | Reviews competing quotes, picks the best rate | API call | | 2. Authorize movement | Custodian | Co-signs the quote acceptance, authorizing asset release | Cryptographic co-signature | Neither party can act alone: * The **institution** cannot move assets without the custodian's co-signature * The **custodian** cannot initiate a trade — only authorize one the institution requested This maps directly to the **maker-checker / four-eyes principle** used in institutional operations, enforced by the settlement protocol rather than by internal procedure. The custodian's co-signature is cryptographic — it cannot be forged, bypassed, or retroactively granted. ## Who Holds What Authority | Authority | Held By | Purpose | | --------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------- | | **Intent signing** | Institution | Proves the institution authorized the payment (non-repudiation) | | **Asset movement** | Custodian | Controls when and how much stablecoin leaves custody | | **Liquidity commitment** | Market Maker | Commits target currency for the swap | | **Settlement coordination** | Core coordinator | Coordinates settlement and co-submits the atomic DvP (coordination only — no ownership or control of the network) | The institution proves *intent*. The custodian controls *assets*. These are separate keys held by separate organizations — neither can impersonate the other. ## Musubi: Coordinator, Not Counterparty | What Musubi Does | What Musubi Does NOT Do | | ----------------------------------------------------- | ------------------------------------------------ | | Co-submits on the order and verifies party signatures | Hold or custody any assets | | Broadcasts anonymized RFQs to market makers | Set or influence FX rates | | Coordinates the 4-party settlement signing | Move assets without custodian authorization | | Executes the atomic DvP transaction | Access participants' internal systems | | Provides settlement confirmations | Act as counterparty to any trade | | | Own, govern, or unilaterally control the network | **TradFi parallel**: Musubi is to stablecoin settlement what CLS Bank is to FX settlement — it coordinates simultaneous delivery of both currency legs without ever taking ownership. The critical difference: settlement completes in seconds, not hours. ## Comparison to Traditional Settlement | Aspect | Traditional (CLS/Correspondent) | Musubi | | ------------------------ | ------------------------------------- | ------------------------------------------- | | **Who authorizes** | Bank's internal approval chain | Cryptographic co-signatures from 4 parties | | **Settlement guarantee** | CLS PvP within settlement window | Atomic DvP — single transaction | | **Pre-funding** | Required during CLS window | Not required — instant atomic execution | | **Counterparty risk** | Mitigated by CLS, not eliminated | Eliminated — no time gap between legs | | **Authorization bypass** | Possible via internal process failure | Impossible — cryptographically enforced | | **Audit trail** | SWIFT messages + internal logs | Single `transaction_hash` covering all legs |