A term sheet for a tokenized dollar product names one counterparty and quotes one rate. The position behind it commonly rests on four contracts, two price feeds and a bridge, all of them absent from the sheet and all of them selected by somebody else. Each of those parties can fail on its own terms while the counterparty named on the sheet continues to perform exactly as promised.

Any financial market performs a small number of jobs: it records who owns what, matches parties who want to trade or borrow, prices and enforces credit, values positions, and settles obligations with finality. 

• Traditional markets assign those jobs to identifiable institutions: exchanges, central counterparties, custodians, transfer agents, market makers and pricing vendors. 

• Onchain markets assign the same jobs to a different mix of parties, some of them code, some of them economically motivated third parties paid per action, and some of them managers exercising discretion under a published mandate. 

Tracking that assignment is what makes a product assessable.

This guide uses onchain financial markets to describe the field. The reader will encounter the same space elsewhere as . 

Onchain financial markets, also referred to as decentralized finance or DeFi, share one defining property: the record of ownership, the rules governing a product, and the settlement of obligations under it all execute on shared public infrastructure that no single participant operates. Every structural feature described below follows from that property, including the advantages an institution might want and the exposures it will have to govern.

The Four Layers Beneath a Position

A return quoted on an onchain position describes the topmost layer of the arrangement. Locating the three layers underneath it is how an institution works out which internal function owns which exposure.

• The settlement layer is the network whose validators agree the ordering of state changes and the point at which they become irreversible. It functions as a registry and a clock, recording that a transfer happened and when. Institutions used to a central counterparty performing novation and default management should locate those risk-absorbing functions elsewhere in their own framework.

• The execution environment is where transactions are processed. Most activity relevant to a fintech now runs on rollups, which batch transactions and post results back to a settlement network. The arrangement reduces cost substantially and creates dependencies on whoever sequences the batches and on the timing of withdrawals back to the base layer.

• The application layer holds the capital and defines the commercial arrangement. A credit market contract records deposits and debt and computes rates. A share-accounting contract issues claims on a pool of assets. Two exposures need separate treatment here: 

  • The possibility of a defect in the code.

  • The discretion available to whoever can change the parameters after capital is committed.

• The access layer is the part the institution builds and is examined on. Custody, signing policy, transaction screening, position monitoring and reconciliation all sit here. These controls reach the institution's own people and systems, and their reach stops at the contract boundary.

Figure 1. The four layers beneath an onchain position, with the traditional market equivalent alongside each one. The access layer is the only tier the institution operates.

Assigning an internal owner to each layer is the practical output of this model, because an exposure that nobody has been given is an exposure nobody is monitoring.

The Participants: Who Performs Each Function

Participation in an onchain market is open to any address, without membership, licensing or identification. Functional roles remain well defined, and mapping them is how an institution works out who it depends on.

• Suppliers deposit assets into a market and receive a claim that accrues return. In a credit market they are the lenders. Their claim runs against the market's contracts, and no identified borrower stands behind it.

• Borrowers post collateral and draw against it. Most designs leave them unidentified and unassessed. The market only cares about the quality of what they posted.

• Curators select markets, set or accept risk parameters, and manage the composition of a pooled vehicle on behalf of depositors. The role corresponds closely to a delegated investment mandate, with the scope of discretion defined in contract code and not in an agreement the depositor negotiated.

• Liquidators close distressed credit positions in exchange for a defined bonus paid out of the borrower's collateral. Automated systems competing on speed perform almost all of this work.

• Market makers and solvers provide the inventory and the routing that allow a trade to execute. In intent-based designs, solvers compete to fill an order and the winning solver's price is what the trader receives.

• Oracle providers supply the prices that contracts use to value collateral and compute solvency. They are a distinct counterparty in almost every credit position, and diligence lists frequently omit them.

• Sequencers and validators determine which transactions are included and in what order. Their discretion over ordering reaches the end user as an execution cost.

• Governance participants hold the rights to change parameters, upgrade contracts and, in some designs, pause the market. The composition of this group and the delay imposed before a change takes effect are counterparty facts with a technical surface.

Reading that list against a familiar market structure shows what has moved. Functions that a regulated market assigns to an authorised entity carrying capital requirements and conduct obligations are here assigned either to code, which executes deterministically and holds no capital of its own, or to an economically motivated party that acts only when it is profitable. 

That reassignment is the substance of the structural difference, and it is what a risk committee is being asked to approve.

Figure 2. The eight functional roles in an onchain market, grouped by the kind of party that performs them. Obligation to act attaches to none of them.

The Instruments: What an Institution Can Hold

The product set is narrower than the volume of terminology suggests. Almost everything an institution encounters reduces to one of five forms, and identifying the constituent forms is usually more informative than the product name.

• Tokenized cash, commonly known as stablecoins, is a transferable claim intended to hold a fixed value against a reference currency, usually the dollar. Reserve-backed models hold cash and short-duration government instruments against the tokens issued. Overcollateralised models are backed by other digital assets held in excess of the tokens issued. Synthetic models maintain value through an offsetting derivatives position. What backs the claim and how it redeems matter more than the shared label suggests.

• Credit positions are the deposit and borrowing sides of an overcollateralised lending market. The deposit side is the closest onchain analogue to a money market instrument, with two distinctions: a published function produces its rate, and its liquidity depends on borrowers choosing to repay.

• Exchange positions are inventory supplied to a trading venue. They earn fees from trading activity and carry exposure to the relative movement of the assets in the pair.

• Pooled vehicles, commonly called vaults, issue a share token representing a proportional claim on assets deployed across one or more underlying markets by a curator. Most institutions take this route, because it delegates market selection and parameter management to a specialist. It also introduces a discretionary counterparty whose mandate deserves the review a fund mandate would receive.

• Tokenized traditional assets are claims on offchain instruments, most commonly government securities and money market fund shares, issued in a form that can be held and transferred onchain. The token represents a legal claim, and the strength of the arrangement rests on the wrapper connecting the two. This is what the industry refers to as real-world assets, or RWAs.

A product presented to an institution is frequently a composition of several of these forms. A tokenized dollar balance paying a return may be a pooled vehicle holding credit positions, funded by tokenized cash, valued using an oracle, with the whole arrangement wrapped in a share token.

Figure 3. A single marketed product decomposed into its constituent forms. Each layer contributes return and adds a dependency.

The Mechanics of Settlement: What Replaces the Clearing House

Settlement is where the structural difference has the most operational consequence, and it cuts in both directions.

Transfer of an asset and transfer of the corresponding payment occur in the same transaction, which either completes in full or reverts in full. Settlement risk in the conventional sense, meaning the risk that one leg completes while the other fails, is eliminated by construction. Delivery and payment are the same event, so no delivery versus payment process exists to break down. Nothing sits in a netting cycle overnight, and no cut-off time applies.

The same property withdraws the accommodations that a netted, deferred system provides. Intraday credit, transaction reversal and operator intervention are all unavailable, so a payment sent to the wrong address stays sent, and a transaction that interacts with a contract on unfavourable terms stands on those terms. An institution moving from a system where an operations team can recall a payment before the cycle closes has to relocate its controls to the point before submission, which means transaction allowlists, quorum signing and simulation.

Figure 4. Where the control window sits under each settlement model. Atomic settlement removes settlement risk and removes the recall window with it.

A central counterparty absorbs the default of a member using margin, a default fund and its own capital, and an onchain credit market reaches a comparable outcome without holding any of those resources. Overcollateralisation does that work. The market requires every borrower to post more collateral than they borrow, monitors the ratio continuously, and pays third parties to close positions before the collateral falls below the debt. The mechanism is fast, impersonal and unfunded. Where enforcement recovers less than the full amount owed, the shortfall falls directly on the suppliers to that market.

Finality arrives in stages, which makes the confirmation threshold an institutional policy decision. The number of confirmations required before crediting a customer balance is a control the institution sets and documents. 

Rollups add a second timing question, because a transaction can be confirmed inside the execution environment well before the corresponding state is accepted at the settlement layer, and withdrawals from an optimistic rollup conventionally wait through a seven-day challenge window.

How the System Prices and Enforces Risk

Pricing committees, credit functions and valuation teams inside an institution have onchain counterparts, and the three mechanisms depend on each other in sequence.

The rate paid to a depositor in a credit market is computed from utilization, meaning the proportion of supplied capital that has been borrowed, using a published function whose parameters can be read from the contract. That function exists to manage withdrawal capacity, which explains why rates rise steeply once utilization passes a target point, and why a single large withdrawal can move a customer-facing rate by tens of percentage points while borrowing demand holds constant.

Borrowers paying that rate are never underwritten, which places the full weight of the credit decision on the collateral and on the mechanism that seizes it. Solvency is expressed as a health factor, and once it falls below one, any third party can repay the debt and take the collateral at a discount. The design substitutes collateral liquidity for borrower assessment, and it holds whenever the collateral can be sold quickly enough to cover the debt.

Both the rate and the enforcement trigger consume a price that the contract cannot observe for itself. Every credit position therefore carries a named oracle dependency with its own update frequency, deviation threshold and manipulation surface, and the price determining solvency can diverge from the price at which collateral would transact.

How the System Executes and How Deep the Market Is

Execution quality is measurable onchain, using metrics that differ from the ones a best-execution policy currently references, and three questions follow one from the next.

The first question is how a trade clears at all, since no broker stands between the institution and the market and no duty of best execution applies. Trading clears against automated market makers holding inventory, against onchain or hybrid order books, or through intent-based systems where solvers compete to fill an order. Each model prices a large order differently.

Knowing how a trade clears leads directly to how much can clear at an acceptable price. The figure usually quoted for a market is capital deployed within it, and that number says nothing about how much can move in or out without moving the price. Exit capacity scales with the size of a deployment, and answering it requires depth at a given price band.

Even where depth is sufficient, the order in which transactions execute changes the price obtained. Whoever builds a block chooses the sequence of transactions in it, and that discretion can be used to trade ahead of a pending order or to sandwich it. The cost reaches the institution as slippage on the fill, which keeps it out of the fee line and inside the execution price. Mitigations exist through private order flow and intent-based routing.

How the System Compounds Dependency

Composability is the property that most distinguishes these markets commercially, and it creates the exposure institutional reviewers most often miss. 

A claim token issued by one market can be posted as collateral in a second and wrapped by a third, with each layer adding return and adding a dependency the institution did not select. A product described as a single position can rest on four contracts, two price feeds and a bridge. The diligence response is a dependency map produced before deployment, naming every contract, feed and bridge the position touches.

Functional Map Against a Traditional Market

Figure 5. Functional mapping of market structure. The right-hand columns describe the general pattern and not any specific venue.

Testing the Structure Before Capital Is Committed

Everything described above assumes a market clearing under ordinary conditions, and the assumption is doing more work than it appears to. Three situations degrade the account, and a reviewer should test each one against the specific position under consideration.

• Automated enforcement depends on profitability. Every credit position relies on third parties choosing to act, and they act when the bonus on offer exceeds the cost of the transaction plus the market impact of selling the collateral. Large positions in thin collateral, correlated distress across many positions at once, and network congestion during the same event that caused the price move all break that condition together. The mechanism is designed for the case where selling is easy and is least reliable when it stops being easy.

• Layer-level diversification leaves shared inputs concentrated. Positions spread across separate execution environments and separate venues can still consume the same price feed, hold the same tokenized cash instrument as a reserve asset, or depend on the same bridge. Diversification measured by venue count says nothing about the number of distinct dependencies, and the second count is the one that governs correlated loss.

• The absence of an intermediary withdraws the accommodations alongside the friction. Atomic settlement eliminates settlement risk and eliminates recall. Permissionless access removes onboarding delay and removes any duty owed to the institution. Immutable code removes discretion and removes the ability to correct an error. Each property that makes these markets attractive carries a corresponding accommodation that is no longer available, and budgeting for the first without planning for the second understates the operational work required.

Given these operational and structural trade-offs, performing due diligence requires a targeted assessment of the specific risks inherent in each position. To evaluate whether these risks are managed effectively, consider the following questions:

• Which of the five instrument forms does this product actually consist of, and how many of them are stacked inside it?

• Which named parties can change the terms of this position after we have committed capital, and what delay applies before a change takes effect?

• Which price feeds does this position depend on, and are those feeds shared with anything else we hold?

• If enforcement of the underlying credit positions became unprofitable, where would the resulting shortfall land, and does anything sit ahead of us in the loss waterfall?

• How much capital can we withdraw from this position within one business day at an acceptable price, and what evidence supports that figure?

• Which internal function owns each of the four layers in our own structure, and has each of them reviewed the exposure sitting in their layer?

Structure is what makes an opportunity assessable. Sentora provides the deployment, risk and reporting infrastructure that regulated institutions use to operate in these markets under a governed mandate.