Skip to main content
As a sender custodian, you’re a co-signer in a multi-party FX settlement — not just a send/receive operator. No assets move without your cryptographic co-signature.

​
Dual Authorization: Institution + Custodian

Every trade requires two independent authorizations from the sending side:
StepWhoWhat They Do
1. Select quoteInstitution (your client)Reviews competing quotes, picks the best rate
2. Authorize movementYou (the custodian)Co-signs the quote acceptance, authorizing asset release
Neither party can act alone. The institution cannot move assets without your co-signature. You cannot initiate a trade — only authorize one that your client has requested.

​
How This Differs from Standard Multisig

If you’re used to threshold multisig (2-of-3, 3-of-5), the Canton model works differently:
Standard Multisig (EVM)Canton 4-Party Approval
SignersAnonymous key holders (any 2 of 3)4 named parties with specific roles
ThresholdN-of-M (any combination)All 4 required — no substitutes
OrderingSignatures collected simultaneouslyRolling approval — each party signs sequentially
MechanismOn-chain signature aggregationDAML choice exercise — each Approve creates an updated contract
VisibilityAll signers see the same on-chain dataEach party sees only what they’re authorized to see
VetoAny signer can refuse (blocks threshold)Any of the 4 parties can refuse (blocks settlement)
The four required signatories for every settlement:

​
Why You See Quotes

On most custody platforms, you sign outbound transactions — you don’t evaluate competing offers. On Musubi, you see all market maker quotes for orders you custody. This is intentional:
  • You’re the authorization gate for best execution — your co-signature confirms the rate is acceptable
  • You can reject a bad quote — if the rate doesn’t meet the cost guard or looks off-market, refuse to co-sign
  • Audit trail — your quote_accepted_at timestamp documents when you authorized the specific rate
This is a new responsibility compared to standard crypto custody, where you typically just validate destination addresses and amounts.

​
The Authorization Flow

1

Order Proposal Arrives

Your client creates an FX order referencing you as their custodian. The order appears on your system with:
  • Target currency and amount (e.g., 100,000 USDCx)
  • Target currency (USDCx)
  • Receiver institution and their custodian
  • KYC/AML clearance reference
  • Optional cost guard (source_amount_max)
You can accept the proposal (order proceeds to quoting) or reject it (order is cancelled).
2

Market Maker Quotes Arrive

After you accept the proposal, market makers submit competing quotes. You see all quotes for orders you custody:
QuoteFX RateUSDCx OfferedValid Until
MM-A112.011,200,00030s
MM-B8.895088,950,00030s
MM-C8.920089,200,00020s
You and your client review these independently. The institution selects the best one; you co-sign.
3

You Co-Sign the Quote Acceptance

When the institution selects a quote, the acceptance requires your co-signature:
  • Your co-signature authorizes the JPYSC0 release from your custody
  • Without your co-signature, the quote acceptance fails and no assets move
  • Musubi validates: quote still valid (valid_until not passed), cost guard met, order still PENDING
After your co-signature, the order transitions to QUOTED and settlement proceeds automatically.
4

4-Party Settlement Approval

Your approval from the previous step carries forward into the rolling approval process. The settlement protocol collects the remaining approvals (market maker, receiver custodian) automatically. Once all four have signed, the atomic DvP executes.
5

Settlement Confirmation

The atomic DvP completes in ~4 seconds. You see the settled order with:
  • transaction_hash — single proof covering all four legs
  • settled_at — settlement timestamp
  • Final amounts and executed rate
Your client’s JPYSC0 balance decreases; the receiver custodian’s USDCx balance increases. Both changes are atomic.

​
Receiver Custodian Workflow

As a receiver custodian, your workflow is simpler:
  1. Settlement confirmation arrives — USDCx deposited in your custody by the atomic DvP
  2. Update client balance — credit the receiver institution’s account
  3. Reconcile — match transaction_hash, amounts, and timestamps against your records
No approval is required from you during the trade flow. Your consent is established through your whitelist configuration (see Compliance).

​
What You Can Block

As a sender custodian, you have veto power at two points:
ActionEffect
Reject order proposalOrder is cancelled immediately. No quotes are solicited.
Refuse to co-sign quote acceptanceQuote acceptance fails. Order remains PENDING until another quote is accepted or it expires.
If something looks wrong — unusual amount, unfamiliar receiver, suspicious timing — you can stop the trade.