# NAV Committee — Terms of Reference, seat criteria, code of conduct

> **SUPERSEDED — not in force.** This document is superseded by [ETP Foundry Methodology v1.0](/documents/methodology-v1.0.md) (28 Sep 2026) and by [Committee terms v1.3](/documents/committee-terms-v1.3.md). It is kept for the record only. Where it differs from Methodology v1.0, Methodology v1.0 governs.

**Version 1.0 — 24 September 2026.** Published alongside the rulebook. Precedents: IBA PMOC
Terms of Reference (Jul 2026), WMR Terms of Reference (Sep 2026), CF Benchmarks Charter v13.8
and Constituent Exchange Criteria v8.5, and the FTSE appointment-letter template, all read
24 Sep 2026. Where this document and the rulebook differ, the rulebook governs the *number*; this document
governs the *people*.

What the ledger enforces since Daml package 3.0.0 is in the signer protocol (published at
etpfoundry.com/api/signer-protocol): the administrator signs every proposal; `K ≥ 2`; the administrator is never a member;
a venue confirmation must carry a traded range or `no-prints-attested`; one fixing per
instrument, session and as-of date. Everything else below is a rule of the committee, kept
by people and by the records, and it says so.

---

## 1. Purpose

The NAV Committee exists so that a published fixing is **attested by parties who lose money
if it is wrong**, and so that no single interest can set it or block it. It is not an
advisory board. Each member confirms or refuses a proposed fixing on the strength of a fact
its firm uniquely knows, with evidence.

Members act **for their firm on the fact they attest**. This is a deliberate difference from
IBA and WMR oversight committees, whose members act as individuals. Ours are contributors
in the IOSCO sense (Principle 14) and the contributor obligations apply to us, not the
"no contributed data" exemption CF and WMR use.

## 2. Composition

| Seat | Fact attested | Bias, stated | Minimum |
|---|---|---|---|
| Issuer | redemption integrity of the wrapper | high | exactly one per instrument |
| Lender | the mark is safe to lend against | low | ≥ 1 lender **or** venue in every `K` |
| Venue | the mark sits where the asset traded | where its book is | ≥ 2 independent operators at launch |
| Custodian / reserve holder | the reserve exists, is unencumbered, covers supply | neutral, liable | mandatory when the native network is not the settlement ledger (rulebook §4.8) |
| Transfer agent | shares outstanding reconcile; fees accrued | neutral | fund products only |
| Administrator (ETP Foundry) | proposes, computes, publishes | — | **not a member** (enforced on-ledger) |

`N` and `K` per committee are declared in the committee's on-ledger record and printed on
every value. Pilot minimum is `N=3, K=2` with three genuinely opposed seats (rulebook §6);
the pilot label is printed on every value and sunsets when a fourth seat is filled.

**Independence tests** (from CF "independent = different operators", IBA PMOC §6):
- parties the issuer controls or is affiliated with may never reach `K` together;
- the issuer may not also hold the custodian or venue seat for its own instrument;
- a venue owned by the issuer or the administrator is disclosed and does not count toward
  the two independent venues;
- a lender that is an issuer affiliate counts as issuer-controlled.

## 3. Eligibility — entity, individual, arrangements

Every seat, before a credential is issued:

1. **Entity**: a named legal entity, disclosed principals, disclosed licence or regulatory
   status, balance sheet at risk on the fact attested. No oracles, no data vendors, no
   "neutral attestors for a fee" (rulebook §6).
2. **Individuals**: the people who will confirm are named, have "appropriate experience,
   skill and training" (WMR ToR wording) in the function they attest, and have completed
   the protocol walkthrough (signer portal "Your seat" panel or a 30-minute call).
3. **Arrangements**: a written data/attestation agreement; a named alternate; an escalation
   contact reachable at the strike; declared tolerance in basis points (default 25 bp,
   rulebook §6) and, for issuers and custodians, declared attestation cadence (default
   freshness 24 h).
4. **Signed appointment letter and code of conduct** (§6 and §7 below).
5. **Public disclosure** in the roster table (§5).

Seat-specific entity tests, taken from the closest TradFi analogue:

| Seat | Must show at onboarding | Re-checked |
|---|---|---|
| Issuer | the four on-ledger facts of rulebook §4.1; declared **reserve model** (`attested` / `onchain-verifiable` / `custodial`) — which decides which conditions it is asked for; attestation cadence; redemption window terms | annually, and on any change of reserve model |
| Lender | actually holds the instrument as collateral (position evidence); a liquidation engine or risk book that consumes a mark; declared tolerance | quarterly position re-confirmation |
| Venue | all six rulebook §4.0 tests plus CF's four: executed data-sharing agreement, API exposing trade **and order** data, KYC/AML programme, cooperation with inquiries; volume share ≥ 5 % of observed 30-day volume trending to 3 % over 90–180 days | annual conformance review, presented to the committee and minuted |
| Custodian | regulated custodian (or protocol-controlled contracts under `onchain-verifiable`); client assets segregated; independent control report (SOC 1 / ISAE 3402) or on-chain proof; statement age ≤ freshness | annually; immediately on any lien or rehypothecation |
| Transfer agent | appointed under the fund's governing documents; maintains the register; daily reconciliation; SLA with the administrator | annually |

## 4. Terms of office

Copied from IBA's selection document, because indefinite seats are the thing to avoid:

- initial term **six months** (the shadow run), auto-extended to **three years** on the
  committee's first annual review if the seat has met its obligations;
- maximum **nine consecutive years**, then a minimum one-year gap;
- **annual membership review** at the fourth quarterly meeting: obligations met, conflicts
  re-declared, tolerance re-declared, trust level reviewed;
- alternates act only with the administrator's prior written agreement and are disclosed in
  the fixing record like any other signer.

## 5. Public roster and conflicts disclosure

No seat is real until it is on the public roster page. The table follows IBA's "Composition
and Disclosure of Conflicts of Interest" format, with two columns of ours:

| First name | Surname | Company | Market position | Seat & instruments | Voting | Directorships & interests | Date of COI declaration | **Trust level** | **Declared tolerance** |
|---|---|---|---|---|---|---|---|---|---|

Printed under the table, verbatim in spirit from IBA: *members may themselves use the
benchmark, may provide input data to it, and may hold a commercial interest in the assets
it prices. That is the design: opposed interests, disclosed.*

The administrator's own conflicts are disclosed on the same page (the way CF discloses
Kraken): any position in a priced asset, any commercial relationship with a member, and the
impersonation capability of rulebook §6.7.

## 6. Ongoing obligations (all seats)

1. Confirm or refuse **every** fixing for the instruments the seat covers, within the
   confirmation window; silence is recorded as silence, not as consent.
2. **Evidence-only attestation.** A confirmation carries the evidence fields for each named
   condition; the API rejects a bare tick for every seat except a venue's range. A number
   the firm does not actually produce is never entered to satisfy a check — refuse instead.
3. **Tolerances are declared, not adjusted per fixing.** Widening a tolerance is a change
   to the seat's record, dated and disclosed.
4. **Declare conflicts** before any fixing they touch; **annual re-attestation** of fitness
   and propriety, conflicts and confidentiality (WMR ToR §2.3).
5. **Notify** any change of control, licence status, role, reserve model, custodian or
   material position within five business days.
6. **Cooperate with inquiries** into any fixing, complaint or surveillance alert.
7. **Confidentiality** of other members' evidence and of unpublished proposals; the fixing
   record is public, individual evidence values are published in aggregate only.
8. **Key custody at the declared trust level** (L1 pilot, L2/L3 official). A seat at L1 is
   told, in writing, that the administrator could technically act as its party.

## 7. Suspension and removal

| Trigger | Consequence | Who decides |
|---|---|---|
| Missed attestation for one full cadence (issuer, custodian) | seat suspended; fixing moves to `EXCEPTIONAL`, then `NO FIXING` (chain-event policy §2.1) | administrator, immediately; committee at next meeting |
| Three consecutive unexplained silences | membership review (IBA "three consecutive meetings") | committee |
| Refusal three times without stated cause (rulebook §7.3) | membership review | committee |
| Lender position falls to zero | seat lapses at next quarterly review | committee |
| Venue volume below threshold | takes effect at next review; anyone may nominate removal | committee, decision published |
| Any regulatory or court sanction for market manipulation | **mandatory resignation** (IBA PMOC §6) | automatic |
| False evidence | removal; the fixing is reviewed under the restatement policy | committee; published |
| Insolvency or loss of licence | immediate suspension (chain-event policy §2.3) | administrator |
| Disagreeing with a fixing | **never a ground** (operations runbook, §6) | — |

The administrator may **suspend** ad hoc; only the committee makes a removal permanent; every
suspension and removal is published with its reason (CF process).

## 8. Meetings, quorum, minutes

- **Quarterly**, fixed agenda (the operations runbook, §4); the administrator attends
  without a vote.
- **Quorum**: `K` of `N` present, including at least one lender or venue.
- **Minutes** within eight working days; a **public summary** within fifteen; the full
  minutes to members and licensees. Where the administrator acts against a committee
  decision, the minutes record it and the reason.
- **Annual self-review** of these terms at the fourth meeting.

## 9. Responsibilities (the standing list)

1. Review every `NO FIXING`, carry-forward and restatement of the quarter.
2. Authorise a response after **three consecutive carry-forwards** on any instrument (CF
   charter duty).
3. Review the constituent venue list; decide additions, suspensions, removals (policies document, §4).
4. Admit and remove members (§3, §7); decide whether `K` moves when `N` changes.
5. Review the conflicts register and the administrator's impersonation log.
6. Review surveillance alerts and venue conformance reports.
7. Review complaints escalated under the policies document, §1.
8. Approve methodology consultations and their feedback statements (policies document, §2).
9. Approve cessation or transfer of any benchmark (rulebook §9).
10. Oversee third parties involved in calculation or dissemination, including the transfer
    agent and any data provider.
11. Report suspicious input data to the administrator, and where required, to the relevant
    authority.
12. Review the quarterly error table (policies document, §3).
13. Review tolerances in aggregate and the trust-level mix of the quarter's fixings.
14. Review these terms annually.

## 10. Appointment letter (template)

> **Appointment to the ETP Foundry NAV Committee — [Instrument(s)] — [Seat]**
>
> [Firm] is appointed to the [Seat] seat of the NAV Committee for [instrument(s)] from
> [date], for an initial term of six months under the Terms of Reference v1.0 and the
> Signer Protocol v2, both attached.
>
> Named signers: [name, role, e-mail], alternate [name]. Trust level at appointment: [L1/L2/L3].
> Declared tolerance: [n] bp. Reserve model (issuers): [attested / onchain-verifiable / custodial].
> Attestation cadence (issuers, custodians): [n] hours.
>
> Nothing is paid or charged for this seat, now or later. [Firm] may resign on thirty days'
> written notice; the administrator may suspend under ToR §7.
>
> [Firm] confirms that the conflicts declared in the attached schedule are complete and
> agrees to the code of conduct in ToR §11.
>
> Signed for [Firm] ______  Signed for ETP Foundry ______  Date ______

## 11. Signer code of conduct

Derived from the Signer Protocol; signed before the first credential is issued.

1. I attest only what my firm knows from its own records or systems, with the evidence
   fields the protocol asks for. I refuse rather than estimate.
2. I keep my declared tolerance and cadence; changes go through the administrator, dated.
3. I declare every conflict before a fixing it touches, and re-declare annually.
4. I keep unpublished proposals and other members' evidence confidential.
5. I keep my credential (API key or signing key) under my firm's control and rotate it on
   any suspicion of exposure; I do not share a seat.
6. I will resign the seat if my firm or I are sanctioned for market manipulation.
7. I understand false evidence is grounds for removal and public disclosure.
8. I understand that at trust level L1 the administrator could technically act as my party,
   that every such act is logged and disclosed, and that L2 or L3 is required before any
   OFFICIAL fixing settles a third party's product.
9. I cooperate with inquiries into any fixing I confirmed or refused.
10. I understand refusing a fixing is the mechanism working and is never held against me.

---

*Status: v1.0, drafted from verified precedents; not yet adopted by a committee because none
has met. It becomes effective on adoption at the first quarterly meeting and is printed with
that date on the public roster page.*