The interesting question is not how to tokenise the asset.It is how to tokenise the obligation.
INTERLOCC is a clearing oracle for interbank settlement. It registers bilateral obligations, nets them multilaterally, and instructs settlement on whichever rail is cheapest, fastest or most regulated.
- Multilateral netting
- Obligations offset inside the protocol, so only the residual settles.
- Immediate credit
- Beneficiaries are funded at instruction, not at settlement.
- Rail-agnostic
- Settle on-chain, against reserves, or across a bridge.
- Institutional-grade
- Upgradeable, access-controlled and auditable by construction.
THE PROBLEM
Wholesale rails were designed for human-speed bilateral exchange.
Of every unit that moves between large counterparties, only a small fraction represents new economic exposure. The rest is offsettable noise that, in a properly netted system, never needs to settle at all. Today it settles anyway, and every institution in the chain pays for it four times over.
Capital sits idle
Correspondent accounts must be funded against gross daily volume, not net exposure. For institutions whose flow is highly bilateral, most of that balance is non-productive.
Finality lags execution
Settlement completes days after the trade, because it waits on a counterparty's back office to post the entry rather than on a state transition.
Reconciliation is an industry
Each party keeps its own book, then pays people to argue about the differences. The authoritative record is assembled after the fact, by hand.
Counterparty risk is negotiated
Bilateral credit limits are agreed annually between treasury teams and enforced by relationship and goodwill, not by the system that executes against them.
THE THESIS
A clearing oracle, not another payment rail.
Payment is the act of instructing value to move. Settlement is the act of value actually moving. Clearing is what sits between them: the netting, novation and obligation-tracking that determines what, in the end, must actually settle.
A stablecoin is a faster, programmable representation of a dollar. It is not a faster, programmable representation of an obligation. Naïvely on-chain payments keep the gross-settlement model and add a public ledger to it, moving the same bilateral exchange onto a different rail without reducing float or reconciliation overhead.
INTERLOCC inverts the order of operations. A payment instruction does not transfer value; it registers a bilateral liability between the debtor's bank and the creditor's bank, decoupled from any movement of funds. Funds are proven locked, held in a custody contract with cryptographic evidence visible to all participants, but not yet released. The lock attests to capacity, not to execution.
WHAT IT IS NOT
- It does not move money.
- It does not issue tokens.
- It does not replace your settlement rails.
The obligation becomes the protocol's unit of account. Custody, execution and issuance all stay where they already sit, under the institutions and regulators that already govern them.
HOW IT WORKS
Five steps, from instruction to finality.
Every payment moves through a deterministic state machine. Each transition is an on-chain event, and the sequence of events is the audit trail.
- 01
Instruct
A payment instruction registers a bilateral liability on-chain. No value moves. The obligation, not the asset, is what the protocol tracks.
- 02
Screen & lock
Compliance screening gates the instruction. Debtor funds are locked in a custody contract and proven so: capacity attested, execution deferred.
- 03
Issue ILO
An interbank liability obligation is issued against the debtor bank's bilateral credit limit. Exceed the limit and the protocol refuses. The beneficiary is credited provisionally, at once.
- 04
Net
Obligations accumulate in time-bounded windows. At close, bank pairs are ordered canonically, opposing flows cancel, and only the residual per pair survives.
- 05
Settle
The residual settles on the rail the participants nominate, chosen at settlement time rather than at instruction time. Escrow releases conditionally; cancelled obligations refund in full.
The netting happens at the protocol layer, automatically. No separate netting service, no overnight batch, and no reconciliation exercise afterwards to establish what actually settled.
WHAT IT BENDS
Four variables a treasurer or chief risk officer already cares about.
Liquidity stops sitting idle
A bank funding correspondent accounts against gross daily volume can, under net-settlement-by-default, fund only against net exposure. A balance-sheet effect, not an operational one.
Finality stops waiting on a back office
Settlement finality becomes a function of when the protocol's state transitions, rather than of when a counterparty gets around to posting the entry.
Counterparty risk moves into code
Bilateral exposure caps are enforced as preconditions on obligation issuance, consumed and released atomically. A slow, relationship-mediated control becomes a mechanical one.
Reconciliation collapses into the audit trail
The record of which obligations composed which settlement is the reconciliation. Regulator, auditor and counterparty read the same authoritative state. The function does not get faster. It gets smaller.
CAPABILITIES
Central counterparty, custodian and back office, collapsed into executable code.
The novelty is not in any single dimension. Central counterparties net. Custodians escrow. Smart contracts execute. The novelty is in the combination.
Multilateral netting engine
Time-bounded windows open, accumulate obligations, and close on demand. Canonical bank-pair ordering cancels opposing flows and emits only the residual as a settlement item.
Token escrow with conditional release
Debtor funds are locked in a custody vault before an obligation is issued. Reverse-side obligations cancelled by netting refund in full; forward-side obligations refund proportionally to the volume offset.
Compliance screening checkpoint
A screening gate sits between instruction and liability issuance, with deadlines tracked per payment. Nothing becomes an obligation until it has cleared.
Attested escrow proofs
Escrow evidence is published through a proof hub and validated against configurable attestor quorums, so a lock can be verified by counterparties without trusting the custodian.
Multi-rail settlement tickets
Net residuals become tickets executable across on-chain ERC-20 transfers, off-chain reserve movements, bridges or RFQ, with coverage verified before execution.
Protocol-enforced credit limits
Bilateral exposure caps live in the risk-policy registry and are consumed and released atomically. A bank over its limit cannot issue an obligation.
Immutable audit log
Every state transition writes an on-chain event. The full history is searchable in the console and traceable to the transaction that produced it.
Structural privacy
Bank-pair data lives on-chain because the protocol requires it. Customer-level data does not. Regulators are served by Merkle-rooted proofs linking a net settlement to its constituent obligations without exposing the parties beneath them.
ARCHITECTURE
Institutional-grade architecture, built to give institutions room to move.
Infrastructure earns its place in a bank by adapting to the institution rather than the other way round. Every structural decision here exists to widen what an institution can change later, without asking it to commit to anything irreversible today.
Upgradeability
EIP-2535 Diamond with a kernel-tracked module registry
Independently deployed modules sit behind a single address, registered and routed through a kernel. Capability can be added without migrating state or re-pointing integrations.
Storage
ERC-7201 namespaced storage
Every module owns a collision-free storage namespace. Upgrades cannot silently corrupt a neighbour's layout, which is the failure mode that makes most upgradeable systems unsafe.
Authorisation
On-chain RBAC with per-bank agent ledgers
Roles are held and checked on-chain rather than inferred by the application layer. Each participating bank operates through its own agent ledger and liability contract.
Optionality
Rails are nominated, not hard-wired
Obligations are recorded independently of how they eventually settle. A new corridor, currency or settlement venue can be introduced without disturbing the clearing logic or re-papering the institutions already using it.
Adoption
Runs alongside what an institution already has
Custody, core banking and correspondent relationships stay exactly where they are. Because INTERLOCC integrates at the obligation layer, participation can begin with a single counterparty pair and widen at whatever pace the institution chooses, with no migration event.
ASSURANCE
Institutional-grade by construction, not by policy.
Wholesale infrastructure is judged on what it refuses to do. Controls that live in a policy document depend on everyone reading it. Controls that live in the protocol apply to every participant, on every transaction, without exception and without anyone needing to be asked.
INTERLOCC puts authorisation, exposure limits, custody evidence and the audit record inside the contract system itself. The operator console is a window onto that state, never a privileged path around it.
CONTROL SURFACE
- Role-based access control enforced on-chain
- Hardware-backed key custody for protocol operations
- Attestor quorums gating escrow and settlement proofs
- Bilateral credit limits enforced at issuance
- Segregated ledgers and liability contracts per institution
- Immutable event log behind every state transition
The clearing layer becomes programmable either way.
The question for an institution is whether it is at the table while that happens. Access to the INTERLOCC console is provisioned per institution.