Inside Project Acacia: our read on the RBA × DFCRC final reportacacia.rem.money
Reference Architecture · 01

A tokenised corporate bond, reconciled to the books.

Investors settle the primary in USDC and receive notes registered on a private Tempo Zone. Coupons pay in USDC on schedule, principal redeems at par at maturity, and balances are private to other participants. This reference architecture shows the bond rail and the integration layer REM adds around it: every allocation, coupon, transfer, and redemption becomes a canonical lifecycle event, synced to books and records and reconciled against the custodian and paying-agent records.

Canonical
Lifecycle events
DvP
Primary settlement
Same-day
Coupon payment
View-keyed
Auditor access
The Product

In one sentence.

USDC in at primary settlement, fixed-coupon CORPBOND notes out. Coupons pay on schedule, principal redeems at par at maturity, and the notes only ever move between allow-listed qualified investors. The selling restrictions live at the protocol layer. Not in your contract, not skippable, and updateable within one block of a sanctions list change.

Cast of Characters

The six parties that make it work.

A tokenised bond is more than a smart contract. Six counterparties co-operate, and knowing where each one sits (on-chain or off) is the first design decision.

Issuer / Corporate Treasury

Sells the notes and services the debt. Holds the master operator key for the Zone and prefunds every coupon.

Lead Arranger / Dealer

Structures the deal, runs the bookbuild, and allocates the primary. A regulated investment bank or debt-capital-markets desk.

Trustee & Paying Agent

The trustee represents noteholders and enforces covenants. The paying and calculation agents fix and pay each coupon — on a Zone, mostly contracts plus a signing key.

Investors

KYC'd qualified investors seeking fixed income without public-chain exposure.

Auditor / Regulator

View-key access for compliance audits. Read-only, scoped, revocable.

REM

Provides the integration layer: connectors to the Zone, canonical lifecycle events, books-and-records sync, reconciliation, and audit evidence. REM does not issue the notes, hold keys, or operate the Zone.

Technological Roadmap

How the rail comes online.

Eight phases across parallel tracks. The legal and deal scaffolding gates production launch; the on-chain build gates the technical milestones. REM's scope is the integration phase: connecting the Zone to the systems that have to agree with it.

  1. Phase 00
    Legal & deal scaffolding
    Off-chain
    • ›Choose the legal form: a digitally native registered note under a DLT-securities framework (UK Digital Securities Sandbox, Germany's eWpG, Luxembourg's DLT laws, Japan's security-token regime), or a conventional global note mirrored on-chain.
    • ›Draft the deal documents: offering memorandum, trust deed or indenture, agency agreements, and the selling restrictions for each target jurisdiction.
    • ›Mandate the lead arranger, engage a rating agency if the issue is rated, and fix the term sheet: 5.25% semi-annual, 30/360 day count, five-year bullet.
    • ›Select the KYC/KYB workflow, codify the qualified-investor policy, and connect the onboarding portal: identity verification, subscription documents, allow-listed wallets.
  2. Phase 01
    Stand up the Zone
    On-chain
    • ›Generate the sequencer key set, deploy the Zone portal on Tempo, initialise genesis.
    • ›Provision per-environment chain IDs (testnet, staging, production) with isolated keys.
    • ›Mirror the TIP-403 compliance policy from Tempo L1, replicated continuously to the Zone.
    • ›Wire observability: block explorer, sequencer health, compliance event stream, on-call paging.
  3. Phase 02
    Configure the qualified-investor policy
    On-chain
    • ›Author TIP-403 policy CORPBOND_QUALIFIED_INVESTORS on Tempo L1 with the deal's jurisdictional selling restrictions baked in.
    • ›Wire the KYC vendor's webhook to push approved wallet addresses into the policy.
    • ›Plug in the approved screening workflow for ongoing wallet risk scoring and de-listing.
    • ›Validate at the protocol layer: non-allow-listed wallets cannot hold, send, or receive the notes — primary or secondary.
  4. Phase 03
    Issue the note token
    On-chain
    • ›Mint the note token through the Zone's TIP-20 factory: 1,000-unit par denomination, supply fixed at the issue size, ISIN carried in token metadata.
    • ›Bind the qualified-investor TIP-403 policy as the immutable transfer hook.
    • ›Set the mint authority to the IssuanceController address; lock the upgrade path behind a multi-sig.
    • ›Pre-flight with an external audit firm before the primary settles.
  5. Phase 04
    Build the bond contract suite
    On-chain
    • ›IssuanceController: DvP primary settlement — notes mint only against USDC received, with a refund path on policy failure.
    • ›CouponAgent: record-date snapshots, 30/360 coupon fixings, issuer prefunding, pro-rata distribution with a claims fallback.
    • ›MaturityAgent: par redemption at maturity, plus an optional issuer call with make-whole pricing.
    • ›SubscribeFromTempo: one-shot L1 on-ramp, encrypted subscriptions, refund path on policy failure.
    • ›Full test coverage, invariant fuzzing, and an audit-ready release package against the production tag.
    $forge build && forge test --gas-report
  6. Phase 05
    Wire the coupon operating model
    Hybrid
    • ›Codify the coupon calendar on-chain; the calculation agent signs each fixing before it is accepted.
    • ›Issuer prefunds the CouponAgent ahead of each payment date; every holder is paid the same day, with no agent chain in between.
    • ›Treasury operations dashboard streams Zone events into back-office and the trustee's and auditor's view-keyed feeds.
    • ›Incident playbooks for missed prefunding (grace-period mechanics), screening hits, and acceleration on default.
  7. Phase 06
    Connect the lifecycle to books and records
    Integration · REM
    • ›Deploy REM Edge against the issuer's authorised view of the Zone, inside the issuer's boundary, with checkpoints, finality handling, and replay.
    • ›Map IssuanceController, CouponAgent, MaturityAgent, and transfer events to canonical lifecycle objects: allocation, accrual, coupon, transfer, redemption.
    • ›Deliver lifecycle events to the issuer's general ledger, the trustee's and paying agent's records, and the reporting warehouse through APIs, webhooks, or streams.
    • ›Reconcile the token register against custodian statements and the calculation agent's shadow book, with explainable breaks and recovery evidence.
  8. Phase 07
    End-to-end rehearsal
    On-chain
    • ›Full lifecycle run by test wallets: primary DvP, coupon fixing and payment, secondary transfer between allow-listed wallets, maturity redemption at par.
    • ›A simulated coupon period confirms the 30/360 accrual math against the calculation agent's shadow book.
    • ›Auditor view-keys issued, scoped, exercised, and revoked. Compliance event log signed and archived.
    • ›Issuer, arranger, and regulator walkthroughs of the live testnet environment, pre-launch.
The Contract Suite

Four contracts. That is the whole bond.

The Zone supplies the heavy machinery: the TIP-20 token factory, sequencing, compliance enforcement, and settlement to Tempo L1. The contracts encode the deal-specific terms: primary settlement, coupons, and redemption. Each implementation should ship with test coverage, invariant checks, and an audit-ready release package.

IssuanceController.solPrimary Market

DvP settlement of the primary. Notes mint only against USDC received, allocations follow the arranger's book, and any subscription that fails the policy check refunds automatically.

subscribe(uint256 usdcAmount)allot(address investor, uint256 units)refund(bytes32 id)
CouponAgent.solCoupons

The paying-agent function as a contract. Record-date snapshots, deterministic 30/360 coupon fixings signed by the calculation agent, issuer prefunding, and same-day pro-rata distribution with a claims fallback.

fixCoupon(uint32 period)fund(uint32 period, uint256 amount)claim(uint32 period)
MaturityAgent.solRedemption

Principal repayment engine. Burns notes against a par-plus-final-coupon USDC payout at maturity, and supports an optional issuer call with make-whole pricing for callable structures.

redeem(uint256 units)callNotes(uint64 date, uint256 price)
SubscribeFromTempo.solL1 Bridge

One-transaction on-ramp from Tempo L1 into the Zone. Encrypted subscription payloads, policy pre-check, automatic refund on compliance failure.

subscribeFromMainnet(addr, usdc, bytes proof)refund(bytes32 id)
End-to-End Flow

One test wallet, twelve lines.

The full lifecycle — primary, coupon, secondary transfer, maturity — reproduces every time. This is exactly what an issuer or regulator sees in the demo.

zone://corp-bond/testnet
01Alice → IssuanceController.subscribe(100,000 USDC)02↳ TIP-403 policy check: Alice ∈ CORPBOND_QUALIFIED_INVESTORS ✓03↳ DvP: 100,000 USDC ⇄ 100 CORPBOND notes (1,000 par) at issue price 100.0004↳ Alice's balance: 100 CORPBOND (private)05// 6 months pass — first coupon date (5.25% s.a., 30/360)06Issuer → CouponAgent.fund(period 1)07↳ Fixing: 26.25 USDC per note → Alice receives 2,625 USDC same day08Alice → CORPBOND.transfer(Bob, 40)09↳ Policy check: Bob ∈ CORPBOND_QUALIFIED_INVESTORS ✓ — register updated atomically10// at maturity — final coupon + principal11Alice → MaturityAgent.redeem(60)12↳ Burn 60 CORPBOND, pay 61,575 USDC. Settlement finalised in the next Zone→Tempo batch (<60s)
The Build Split

Who ships what.

The Zone concentrates the technical rail (register, privacy, transfer policy, settlement) into a reusable primitive, run by its operator. The issuer, arranger, and custodian keep the deal, the keys, and the investors. REM supplies the layer in between that makes the rail agree with everyone's books.

Integration layer · REM supplies
  • Connectors to the Zone's authorised participant view, deployed in your boundary
  • Canonical lifecycle events: allocation, accrual, coupon, transfer, redemption
  • Sync to the issuer ledger, trustee and paying-agent records, and reporting
  • Continuous reconciliation of register, custodian, and calculation-agent records
  • Audit evidence from raw ledger record to every downstream action
Deal, network & custody · You and your providers
  • Deal documentation: offering memorandum, trust deed, agency agreements
  • Governing-law election and the DLT-register framework
  • Credit rating, bookbuild, and investor marketing
  • KYC and qualified-investor onboarding
  • Zone operation, token issuance, and contract deployment
  • Custody, keys, and signing
  • The issuer's covenants and use of proceeds
Economics

Where the operating model changes.

The technology is the easy half. The hard half is the operating model. A Zone-native bond changes four servicing lines in a conventional debt programme: the registrar, the paying-agent chain, per-transfer compliance review, and investor servicing. Each still needs its records to agree with the issuer's books, which is the part REM makes continuous.

Registrar & transfer agent

The Zone is the register

No separate registrar, no transfer agent, no immobilised global note sitting in a vault. Where the legal framework recognises a DLT register, the token ledger is the register of noteholders, and every transfer updates it atomically. The register still has to agree with custodian statements and the issuer's ledger; REM keeps that reconciliation continuous instead of periodic.

Paying-agent ops

Coupons without the agent chain

A conventional coupon hops from the issuer to the paying agent to the clearing system to custodians to beneficial owners, and takes days end to end. Here the issuer prefunds the CouponAgent once per payment date and every holder is paid the same day. The fixing is deterministic, signed, and verifiable on-chain.

Compliance ops

Selling restrictions enforced at the protocol

Qualified-investor checks happen once at onboarding, and the policy travels with the note. Per-transfer compliance review goes away, and so does the risk of a secondary trade breaching the deal's selling restrictions — a non-allow-listed wallet cannot hold the notes at all.

Investor servicing

Self-service corporate actions

Position statements come straight from the explorer. Coupon claims and maturity redemption are self-service against the contracts. Payment-instruction files give way to lifecycle events, and any trustee-versus-register position break surfaces with evidence the day it happens.

The Credibility Milestone

An investor-ready demo before the lawyers finish drafting.

The on-chain rail can come up before the deal documents are signed. You can show an issuer's board, an arranger, or a regulator a working testnet environment without the offering memorandum in place. The primary settles DvP, the coupon fixes and pays, a secondary transfer clears between allow-listed wallets, maturity redeems at par, and compliance fires at every hop. The slide deck becomes a walkthrough, and the credibility loop closes in days instead of quarters.

Connect your bond platform to the books.

Bring the platform, the destination systems, and the records that have to agree. REM scopes one lifecycle workflow: authorised ledger view to canonical events to your ledger, with reconciliation and an audit trail.

Book a call Next architecture