From c212a7724f5004d19df7dc3a001b0e149fa02ec2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Nu=CC=81n=CC=83ez?= Date: Mon, 2 Nov 2026 11:30:40 +0100 Subject: [PATCH 1/2] feat (use-case): add Private Tokenized Deposits --- CHANGELOG.md | 1 + GLOSSARY.md | 2 + approaches/approach-private-payments.md | 2 +- domains/payments.md | 1 + use-cases/private-stablecoins.md | 2 +- use-cases/private-tokenized-deposits.md | 96 +++++++++++++++++++++++++ 6 files changed, 102 insertions(+), 2 deletions(-) create mode 100644 use-cases/private-tokenized-deposits.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 56ca9c7..9895156 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] +- feat(use-case): [Private Tokenized Deposits](use-cases/private-tokenized-deposits.md), bank deposits as claims on a shared ledger: payment privacy between banks, the interbank settlement leg, and the link to the core banking system. Linked from [Private Stablecoins](use-cases/private-stablecoins.md), the [Private Payments](approaches/approach-private-payments.md) approach and the [Payments](domains/payments.md) domain. Adds RTGS to the [Glossary](GLOSSARY.md). - fix: factual audit of the [Private FX](use-cases/private-fx.md) entry. - fix: factual audit of the [Private Repo](use-cases/private-repo.md) entry and the Private Trade Settlement cards it builds on. - fix: factual audit of the [Private Identity](use-cases/private-identity.md) entry and the cards one hop out. diff --git a/GLOSSARY.md b/GLOSSARY.md index f5527b1..dcc3a0f 100644 --- a/GLOSSARY.md +++ b/GLOSSARY.md @@ -67,6 +67,8 @@ A dedicated network or service that publishes and stores the data required for D **NAV (Net Asset Value)**: Total value of a fund's assets minus liabilities. Per-share NAV = total NAV / shares outstanding. +**RTGS (Real-Time Gross Settlement)**: Central bank payment system in which banks settle payments with each other one at a time, as they arrive, in central bank money (e.g., Fedwire in the US, T2 in the euro area) + ### Standards & Protocols **[ERC-3643](https://eips.ethereum.org/EIPS/eip-3643)**: Ethereum standard for permissioned tokenized securities with built-in compliance framework diff --git a/approaches/approach-private-payments.md b/approaches/approach-private-payments.md index 9694b90..2201592 100644 --- a/approaches/approach-private-payments.md +++ b/approaches/approach-private-payments.md @@ -4,7 +4,7 @@ status: ready last_reviewed: 2026-10-05 use_case: private-stablecoins -related_use_cases: [resilient-disbursement-rails, private-treasuries] +related_use_cases: [resilient-disbursement-rails, private-treasuries, private-tokenized-deposits] primary_patterns: - pattern-shielding diff --git a/domains/payments.md b/domains/payments.md index 1dfac3f..54aed78 100644 --- a/domains/payments.md +++ b/domains/payments.md @@ -12,6 +12,7 @@ description: "Move value with stakeholder-scoped visibility, from institutional ## Primary use cases - [Private Stablecoins for Institutional Payments](../use-cases/private-stablecoins.md) +- [Private Tokenized Deposits](../use-cases/private-tokenized-deposits.md) - [Resilient Disbursement Rails](../use-cases/resilient-disbursement-rails.md) ## Shortest-path patterns diff --git a/use-cases/private-stablecoins.md b/use-cases/private-stablecoins.md index a664918..4f90add 100644 --- a/use-cases/private-stablecoins.md +++ b/use-cases/private-stablecoins.md @@ -9,7 +9,7 @@ secondary_domain: Institutions want to use stablecoins as settlement cash without exposing amounts, counterparties, or workflow metadata to non-participants. The solution requires stakeholder-only visibility with selective disclosure and atomic settlement capabilities with assets. -**Note:** In jurisdictions where stablecoins are restricted, these same privacy patterns apply to authorized digital currencies (e.g., CBDCs, tokenized deposits). +**Note:** In jurisdictions where stablecoins are restricted, these same privacy patterns apply to authorized digital currencies (e.g., CBDCs, tokenized deposits). Tokenized deposits have their own entry: [Private Tokenized Deposits](private-tokenized-deposits.md). ## 2) Additional Context diff --git a/use-cases/private-tokenized-deposits.md b/use-cases/private-tokenized-deposits.md new file mode 100644 index 0000000..1d99481 --- /dev/null +++ b/use-cases/private-tokenized-deposits.md @@ -0,0 +1,96 @@ +--- +title: Private Tokenized Deposits +status: ready +primary_domain: Payments +--- + +## 1) Use Case + +Banks represent customer deposits as tokens on a shared ledger so that their customers can pay each other, and customers of other banks, with on-ledger settlement. The deposit stays a liability of the issuing bank, booked in its core banking system, and the token is a claim on it. The banks sharing the ledger are often competitors, so each needs its customers' payments hidden from the other banks and from the public, while the core system, the ledger and the supervisor's view stay in agreement. + +Unlike [private stablecoins](private-stablecoins.md), the issuer is the depositor's own bank and the token is a deposit rather than a reserve-backed coin. The privacy patterns overlap; holder eligibility, the interbank settlement leg and the link to the core banking system are specific to deposits. + +## 2) Additional Context + +- **Stablecoin laws leave deposits out.** The US GENIUS Act excludes deposits, including deposits recorded using distributed ledger technology, from its definition of a payment stablecoin ([§ 2(22)(B)(ii)](https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm)). MiCA does not apply to crypto-assets that qualify as deposits ([Art. 2(4)(b)](https://eur-lex.europa.eu/eli/reg/2023/1114/oj)). +- **Banks already issue deposit tokens.** J.P. Morgan's JPMD deposit token runs on Base, a public Ethereum L2 ([November 2025](https://www.jpmorgan.com/payments/newsroom/jpm-coin-usd-deposit-token-institutional-clients)), where unshielded transfers are visible to any observer. Swift launched a live pilot of cross-border tokenized-deposit payments with 17 banks in [July 2026](https://www.theblock.co/post/407687/swift-launches-blockchain-ledger-for-tokenized-deposit-pilot-with-17-banks); final settlement still runs through existing systems. +- **Interbank settlement against tokenized central bank money is in testing.** In BIS [Project Agorá](https://www.bis.org/project/agora), banks issue tokenized deposits on a shared ledger and manage tokenized central bank reserves on each central bank's ledger. A real-value test in July 2026 moved about CHF 800,000 across 28 financial institutions and central banks. Data privacy is among the rule areas the project is still examining. +- **A public demonstration covers the bank-side flow.** Gateway.fm's [tokenized deposit issuance and redemption](https://gateway.fm/case-studies/tokenized-deposit-issuance-and-redemption/) demonstration runs on [Miden](../vendors/miden.md), with [Gateway Open Privacy Suite](../vendors/gateway-open-privacy-suite.md) for access control, against a simulated bank. The core system places a hold on the deposit before the claim is minted, redemption burns the claim and releases the held funds, and a reconciliation run compares ledger supply with the core liability. The ledger stores commitments rather than balances and amounts. The operator co-signs every movement and can list holders; the transaction graph, total supply and redemption amounts stay visible. The demonstration covers a single bank with no interbank transfer, and the page links no code. + +## 3) Actors + +Issuing bank · Receiving bank · Depositors (corporate, retail) · Ledger operator · Interbank settlement provider (central bank or settlement bank) · Supervisor · Auditor + +## 4) Problems + +### Problem 1: Payment Privacy on a Shared Ledger + +When several banks and their customers share one ledger, each transfer exposes payer, payee, amount and balances to competing banks on the same ledger and to any public observer. The issuing bank already sees its own customers' activity in its core system, so the privacy requirement is towards the other participants and the public. + +**Requirements:** + +- **Must hide:** amounts, balances, payer and payee identities, and the payment graph from other banks and from the public +- **Public OK:** existence of a transaction; contract code; validity proofs +- **Issuer access:** the issuing bank sees its own customers' transfers, including the payee, as it does for account payments today +- **Regulator access:** supervisory and AML/CFT access through scoped, logged and revocable disclosure; Travel Rule originator and beneficiary information for cross-border transfers ([FATF R.16, revised June 2025](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-Recommendation-16-payment-transparency-june-2025.html)) + +**Constraints:** + +- Holders are customers the issuing bank has onboarded; a transfer to an ineligible holder fails +- The issuing bank can freeze or block a holding where law requires, without a standing view of other banks' customers +- Throughput and finality are measured on the chosen stack, not taken from vendor claims + +### Problem 2: Transfers Between Banks + +A tokenized deposit is a claim on one bank. When a customer of bank A pays a customer of bank B, bank A's liability becomes bank B's, and the two banks settle with each other, usually in central bank money. On a shared ledger, that interbank leg reveals bilateral flows between banks unless it is shielded too. + +**Requirements:** + +- **Must hide:** interbank settlement amounts, and the customer payments behind them, from banks that are not party to them +- **Public OK:** existence of the settlement arrangement +- **Settlement:** the customer leg and the interbank leg settle atomically, or the design names who carries the risk between them + +**Constraints:** + +- Central bank money settles on systems the banks do not operate: today a real-time gross settlement (RTGS) system such as Fedwire or T2, or a central bank ledger as in Project Agorá + +### Problem 3: Binding the Ledger to the Core Banking System + +The deposit stays in the issuing bank's core system while the claim circulates on the ledger. The two records must never promise the same funds twice, and the bank must show that claims in circulation match the liability it books, without exposing each customer's balance on the ledger. + +**Requirements:** + +- Mint only against funds on hold in the core system; release held funds only after the claim is burned +- That order leaves two possible interrupted states: funds held with no claim minted yet, and a claim burned with funds not yet released. Neither promises funds twice, and each has an owner and a time limit to complete or roll back +- Prove to the auditor and supervisor that the issuer's ledger supply equals its booked liability, without opening individual balances +- Mint and burn link to the bank's ISO 20022 notifications and payment instructions + +**Constraints:** + +- The core banking system stays the book of record; the ledger reconciles to it + +## 5) Recommended Approaches + +See [Approach: Private Payments](../approaches/approach-private-payments.md) for the shielded-transfer architectures that cover Problem 1. Deposit-specific considerations: + +- Holder gating, issuer freeze and disclosure inside a shielded layer: [Private Stablecoin Shielded Payments](../patterns/pattern-private-stablecoin-shielded-payments.md) and [Selective Disclosure](../patterns/pattern-regulatory-disclosure-keys-proofs.md) +- Interbank leg: [Private PvP via ERC-7573](../patterns/pattern-private-pvp-stablecoins-erc7573.md) (amount privacy only when the escrow contracts run inside a shielded layer) and the cross-network recovery paths in [Approach: Atomic DvP Settlement](../approaches/approach-dvp-atomic-settlement.md) +- Link to core banking: [Private ISO 20022 Messaging & Settlement](../patterns/pattern-private-iso20022.md) +- A bank operating its own ledger: [Approach: White-Label Infrastructure Deployment](../approaches/approach-white-label-deployment.md) + +## 6) Open Questions + +- Should each bank's tokenized deposit supply be public, visible to the operator, or provable to supervisors only? +- Can hold-and-mint and burn-and-release commit atomically across the core banking system and the ledger, or do banks accept interrupted states with an owner and a time limit? +- Who settles the interbank leg, and in what asset: RTGS, tokenized central bank reserves, or a settlement bank? +- How do mandated freezes and court-ordered reversals work inside a shielded layer? +- Can a deposit token be held by someone who is not a customer of the issuing bank, and does it remain a deposit if it is? + +## 7) Notes And Links + +- Related: [private-stablecoins.md](private-stablecoins.md) (non-bank issuer; same privacy patterns) +- Related: [private-payments.md](private-payments.md) (payment privacy patterns) +- Related: [private-fx.md](private-fx.md) (cross-border settlement; Swift tokenized-deposit pilot) +- Related: [private-treasuries.md](private-treasuries.md) (corporate cash on bank-operated ledgers) +- Jurisdictions: [EU / MiCA](../jurisdictions/eu-MiCA.md) · [US / SEC](../jurisdictions/us-SEC.md) (GENIUS Act) +- Standards: [ISO 20022](https://www.iso20022.org/) (messaging) · [ERC-7573](https://ercs.ethereum.org/ERCS/erc-7573) (Draft; conditional settlement, hides no amounts or counterparties) From 5d6aaab61ca2904b96aeab5c864f64fd70d7b195 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Nu=CC=81n=CC=83ez?= Date: Wed, 4 Nov 2026 09:47:56 +0100 Subject: [PATCH 2/2] chore(changelog): Add PR#214 link to Private Tokenized Deposits line --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9895156..d0bbcee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] -- feat(use-case): [Private Tokenized Deposits](use-cases/private-tokenized-deposits.md), bank deposits as claims on a shared ledger: payment privacy between banks, the interbank settlement leg, and the link to the core banking system. Linked from [Private Stablecoins](use-cases/private-stablecoins.md), the [Private Payments](approaches/approach-private-payments.md) approach and the [Payments](domains/payments.md) domain. Adds RTGS to the [Glossary](GLOSSARY.md). +- feat(use-case): [Private Tokenized Deposits](use-cases/private-tokenized-deposits.md), bank deposits as claims on a shared ledger: payment privacy between banks, the interbank settlement leg, and the link to the core banking system. Linked from [Private Stablecoins](use-cases/private-stablecoins.md), the [Private Payments](approaches/approach-private-payments.md) approach and the [Payments](domains/payments.md) domain. Adds RTGS to the [Glossary](GLOSSARY.md) ([#214](https://github.com/ethsystems/map/pull/214)) - fix: factual audit of the [Private FX](use-cases/private-fx.md) entry. - fix: factual audit of the [Private Repo](use-cases/private-repo.md) entry and the Private Trade Settlement cards it builds on. - fix: factual audit of the [Private Identity](use-cases/private-identity.md) entry and the cards one hop out.