# NAV Committee — Terms of Reference, seat criteria, code of conduct

> **SUPERSEDED — not in force.** This document is superseded by [ETP Foundry Methodology v1.0](/documents/methodology-v1.0.md) (28 Sep 2026) and by [Committee terms v1.3](/documents/committee-terms-v1.3.md). It is kept for the record only. Where it differs from Methodology v1.0, Methodology v1.0 governs.

**Version 1.1 — 28 September 2026** (v1.0, 24 September 2026; v1.1 moves the committee to Signer
Protocol v3). Published alongside the rulebook. Precedents: IBA PMOC
Terms of Reference (Jul 2026), WMR Terms of Reference (Sep 2026), CF Benchmarks Charter v13.8
and Constituent Exchange Criteria v8.5, and the FTSE appointment-letter template, all read
24 Sep 2026. Where this document and the rulebook differ, the rulebook governs the *number*; this document
governs the *people*.

What each seat is asked is the **Signer Protocol v3** (28 September 2026, served live at
etpfoundry.com/api/signer-protocol): one to three **yes/no questions** per seat, answered from the
member's own records, never the data behind them. What the ledger enforces since Daml package 3.0.0:
the administrator signs every proposal; `K ≥ 2` and `K ≤ N`; the administrator is never a member; a
venue's confirmation carries the window's low and high and is refused if the price lies outside them;
one fixing per instrument, session and as-of date. Everything else below is a rule of the committee,
kept by people and by the records, and it says so.

## Context: why ETP Foundry exists (not part of the terms)

**Our mission: put every asset worth owning into a fund people can trust — and make launching one take days, not months.**

**The problem today.** A traditional exchange-traded fund (ETF) is a chain of separate firms.
Before the first share exists it needs an index provider for the price, a fund administrator for
the net asset value (NAV), a transfer agent for the share register, a custodian, authorised
participants (APs) to create and redeem shares, and a clearing agency: **five or more firms**, each
with its own contract, its own system and its own daily reconciliation. Launching one takes
**months**. Creations and redemptions settle **T+1**, the next business day. And for tokenised
assets nobody offers the price at all, so **every new asset starts the paperwork again**.

**How we fix it: four steps on one ledger** (the Canton Network).

1. **Onboard a tokenised asset.** Any Canton token built on the CIP-56 token standard is added by
   configuration, not code: four facts from its issuer.
2. **The committee signs the price.** Once a day, firms that already hold a position in the asset
   (its issuer, a lender, a venue, a custodian) each answer a few yes/no questions only they can
   answer. With enough signatures (**K of N**) the day's official price, the *fixing*, exists.
   Without them nothing is published, and the gap is shown as a gap.
3. **Create and redeem in one transaction.** An AP delivers the basket and receives fund shares at
   the signed NAV, or the reverse, all or nothing. No T+1, no failed leg, nothing to reconcile.
4. **Shares go out on many chains.** Fund shares are carried to other chains through *vaults*, so
   investors hold them where they already are.

**Why each next fund is faster.** A committee is seated once per asset and serves every fund that
holds that asset. A second fund holding CBTC settles against the same signed CBTC price: no new
committee, no new contracts with its members. A new fund adds only what is its own (any asset
nobody covers yet, and its share register), so the more assets are covered, the less each new
fund has to set up.

## Context: where we are today (not part of the terms)

| | |
|---|---|
| Ledger | Our own Canton **DevNet** validator (Canton's public test network), live since 24 September 2026. It holds real registry assets (BitSafe CBTC, Canton Coin), which have no monetary value on DevNet. Not on MainNet. |
| Other chains | Vaults on **10 public EVM testnets**. On Solana the program is deployed on devnet (28 September 2026), but **no Solana vault** exists yet. Nothing on any mainnet. |
| Prices | **Tier 0, indicative only**: live market observations, signed by nobody. No fixing has been published for commercial use. |
| Committee | **No third-party seat yet.** Every seat today is operated by ETP Foundry, and every value says so. |
| Regulation | **Not a regulated benchmark administrator.** Not authorised or registered in any jurisdiction. |
| Audit | The Daml contracts and the vault contracts have **not yet been independently audited**. |

---

## 1. Purpose

The NAV Committee exists so that a published fixing is **attested by parties who lose money
if it is wrong**, and so that no single interest can set it or block it. It is not an
advisory board. Each member confirms or refuses a proposed fixing on the strength of a fact
its firm uniquely knows, with evidence.

Members act **for their firm on the fact they attest**. This is a deliberate difference from
IBA and WMR oversight committees, whose members act as individuals. Ours are contributors
in the IOSCO sense (Principle 14) and the contributor obligations apply to us, not the
"no contributed data" exemption CF and WMR use.

## 2. Composition

| Seat | Fact attested | Bias, stated | Minimum |
|---|---|---|---|
| Issuer | reserves cover supply · the latest reserve attestation is under 24 h old · redemptions are open | high | exactly one per instrument |
| Lender | it accepts the asset as collateral today · the value is within its own marking tolerance | low | ≥ 1 lender **or** venue in every `K` |
| Venue | the asset traded in the window · window prices within its tolerance · no halt or outage | where its book is | ≥ 2 independent operators at launch |
| Custodian / reserve holder | the fund's holdings in its custody match the ledger | neutral, liable | mandatory when the native network is not the settlement ledger (rulebook §4.8) |
| Transfer agent | its share register matches the supply on the ledger | neutral | fund products only |
| Administrator (ETP Foundry) | proposes, computes, publishes | — | **not a member** (enforced on-ledger) |

`N` and `K` per committee are declared in the committee's on-ledger record and printed on
every value. Pilot minimum is `N=3, K=2` with three genuinely opposed seats (rulebook §6);
the pilot label is printed on every value and sunsets when a fourth seat is filled.

**Independence tests** (from CF "independent = different operators", IBA PMOC §6):
- parties the issuer controls or is affiliated with may never reach `K` together;
- the issuer may not also hold the custodian or venue seat for its own instrument;
- a venue owned by the issuer or the administrator is disclosed and does not count toward
  the two independent venues;
- a lender that is an issuer affiliate counts as issuer-controlled.

## 3. Eligibility — entity, individual, arrangements

Every seat, before a credential is issued:

1. **Entity**: a named legal entity, disclosed principals, disclosed licence or regulatory
   status, balance sheet at risk on the fact attested. No oracles, no data vendors, no
   "neutral attestors for a fee" (rulebook §6).
2. **Individuals**: the people who will confirm are named, have "appropriate experience,
   skill and training" (WMR ToR wording) in the function they attest, and have completed
   the protocol walkthrough (signer portal "Your seat" panel or a 30-minute call).
3. **Arrangements**: a written data/attestation agreement; a named alternate; an escalation
   contact reachable at the strike; declared tolerance in basis points (default 25 bp,
   rulebook §6) and, for issuers and custodians, declared attestation cadence (default
   freshness 24 h).
4. **Signed appointment letter and code of conduct** (§6 and §7 below).
5. **Public disclosure** in the roster table (§5).

Seat-specific entity tests, taken from the closest TradFi analogue:

| Seat | Must show at onboarding | Re-checked |
|---|---|---|
| Issuer | the four on-ledger facts of rulebook §4.1; declared **reserve model** (`attested` / `onchain-verifiable` / `custodial`) — which decides which conditions it is asked for; attestation cadence; redemption window terms | annually, and on any change of reserve model |
| Lender | actually holds the instrument as collateral (position evidence); a liquidation engine or risk book that consumes a mark; declared tolerance | quarterly position re-confirmation |
| Venue | all six rulebook §4.0 tests plus CF's four: executed data-sharing agreement, API exposing trade **and order** data, KYC/AML programme, cooperation with inquiries; volume share ≥ 5 % of observed 30-day volume trending to 3 % over 90–180 days | annual conformance review, presented to the committee and minuted |
| Custodian | regulated custodian (or protocol-controlled contracts under `onchain-verifiable`); client assets segregated; independent control report (SOC 1 / ISAE 3402) or on-chain proof; statement age ≤ freshness | annually; immediately on any lien or rehypothecation |
| Transfer agent | appointed under the fund's governing documents; maintains the register; daily reconciliation; SLA with the administrator | annually |

## 4. Terms of office

Copied from IBA's selection document, because indefinite seats are the thing to avoid:

- initial term **six months** from appointment (the pilot's shadow run of about 90 days, under the
  pilot letter, comes before appointment), auto-extended to **three years** on the
  committee's first annual review if the seat has met its obligations;
- maximum **nine consecutive years**, then a minimum one-year gap;
- **annual membership review** at the fourth quarterly meeting: obligations met, conflicts
  re-declared, tolerance re-declared, trust level reviewed;
- alternates act only with the administrator's prior written agreement and are disclosed in
  the fixing record like any other signer.

## 5. Public roster and conflicts disclosure

No seat is real until it is on the public roster page. The table follows IBA's "Composition
and Disclosure of Conflicts of Interest" format, with two columns of ours:

| First name | Surname | Company | Market position | Seat & instruments | Voting | Directorships & interests | Date of COI declaration | **Trust level** | **Declared tolerance** |
|---|---|---|---|---|---|---|---|---|---|

Printed under the table, verbatim in spirit from IBA: *members may themselves use the
benchmark, may provide input data to it, and may hold a commercial interest in the assets
it prices. That is the design: opposed interests, disclosed.*

The administrator's own conflicts are disclosed on the same page (the way CF discloses
Kraken): any position in a priced asset, any commercial relationship with a member, and the
impersonation capability of rulebook §6.7.

## 6. Ongoing obligations (all seats)

1. Confirm or refuse **every** fixing for the instruments the seat covers, within the
   confirmation window; silence is recorded as silence, not as consent.
2. **Answer every required question, from the firm's own records.** Under Signer Protocol v3 each
   required question is answered yes or no; a confirmation that leaves one out is refused (422) and
   nothing is recorded, and a no is recorded as a refusal naming the question. A venue answering
   yes on prices adds the window's low and high. Unsure means no: a firm never answers yes to a
   fact it has not checked.
3. **Tolerances are declared, not adjusted per fixing.** Widening a tolerance is a change
   to the seat's record, dated and disclosed.
4. **Declare conflicts** before any fixing they touch; **annual re-attestation** of fitness
   and propriety, conflicts and confidentiality (WMR ToR §2.3).
5. **Notify** any change of control, licence status, role, reserve model, custodian or
   material position within five business days.
6. **Cooperate with inquiries** into any fixing, complaint or surveillance alert.
7. **Confidentiality** of other members' answers and of unpublished proposals. The public record
   shows who signed and which questions they answered; any optional figures are published in
   aggregate only.
8. **Key custody at the declared trust level** (L1 pilot, L2/L3 official). A seat at L1 is
   told, in writing, that the administrator could technically act as its party.

## 7. Suspension and removal

| Trigger | Consequence | Who decides |
|---|---|---|
| Missed attestation for one full cadence (issuer, custodian) | seat suspended; fixing moves to `EXCEPTIONAL`, then `NO FIXING` (chain-event policy §2.1) | administrator, immediately; committee at next meeting |
| Three consecutive unexplained silences | membership review (IBA "three consecutive meetings") | committee |
| Refusal three times without stated cause (rulebook §7.3) | membership review | committee |
| Lender position falls to zero | seat lapses at next quarterly review | committee |
| Venue volume below threshold | takes effect at next review; anyone may nominate removal | committee, decision published |
| Any regulatory or court sanction for market manipulation | **mandatory resignation** (IBA PMOC §6) | automatic |
| False evidence | removal; the fixing is reviewed under the restatement policy | committee; published |
| Insolvency or loss of licence | immediate suspension (chain-event policy §2.3) | administrator |
| Disagreeing with a fixing | **never a ground** (operations runbook, §6) | — |

The administrator may **suspend** ad hoc; only the committee makes a removal permanent; every
suspension and removal is published with its reason (CF process).

## 8. Meetings, quorum, minutes

- **Quarterly**, fixed agenda (the operations runbook, §4); the administrator attends
  without a vote.
- **Quorum**: `K` of `N` present, including at least one lender or venue.
- **Minutes** within eight working days; a **public summary** within fifteen; the full
  minutes to members and licensees. Where the administrator acts against a committee
  decision, the minutes record it and the reason.
- **Annual self-review** of these terms at the fourth meeting.

## 9. Responsibilities (the standing list)

1. Review every `NO FIXING`, carry-forward and restatement of the quarter.
2. Authorise a response after **three consecutive carry-forwards** on any instrument (CF
   charter duty).
3. Review the constituent venue list; decide additions, suspensions, removals (policies document, §4).
4. Admit and remove members (§3, §7); decide whether `K` moves when `N` changes.
5. Review the conflicts register and the administrator's impersonation log.
6. Review surveillance alerts and venue conformance reports.
7. Review complaints escalated under the policies document, §1.
8. Approve methodology consultations and their feedback statements (policies document, §2).
9. Approve cessation or transfer of any benchmark (rulebook §9).
10. Oversee third parties involved in calculation or dissemination, including the transfer
    agent and any data provider.
11. Report suspicious input data to the administrator, and where required, to the relevant
    authority.
12. Review the quarterly error table (policies document, §3).
13. Review tolerances in aggregate and the trust-level mix of the quarter's fixings.
14. Review these terms annually.

## 10. Appointment letter (template)

> **Appointment to the ETP Foundry NAV Committee — [Instrument(s)] — [Seat]**
>
> [Firm] is appointed to the [Seat] seat of the NAV Committee for [instrument(s)] from
> [date], for an initial term of six months under the Terms of Reference v1.1 and the
> Signer Protocol v3, both attached.
>
> Named signers: [name, role, e-mail], alternate [name]. Trust level at appointment: [L1/L2/L3].
> Declared tolerance: [n] bp. Reserve model (issuers): [attested / onchain-verifiable / custodial].
> Attestation cadence (issuers, custodians): [n] hours.
>
> Nothing is paid or charged for this seat, now or later. [Firm] may resign on thirty days'
> written notice (during the pilot, before this appointment, either side may stop at any time); the
> administrator may suspend under ToR §7.
>
> [Firm] confirms that the conflicts declared in the attached schedule are complete and
> agrees to the code of conduct in ToR §11.
>
> Signed for [Firm] ______  Signed for ETP Foundry ______  Date ______

## 11. Signer code of conduct

Derived from the Signer Protocol; signed before the first credential is issued.

1. I answer only what my firm knows from its own records or systems, yes or no, to the questions
   the protocol asks my seat. If I am unsure, I answer no.
2. I keep my declared tolerance and cadence; changes go through the administrator, dated.
3. I declare every conflict before a fixing it touches, and re-declare annually.
4. I keep unpublished proposals and other members' evidence confidential.
5. I keep my credential (API key or signing key) under my firm's control and rotate it on
   any suspicion of exposure; I do not share a seat.
6. I will resign the seat if my firm or I are sanctioned for market manipulation.
7. I understand false evidence is grounds for removal and public disclosure.
8. I understand that at trust level L1 the administrator could technically act as my party,
   that every such act is logged and disclosed, and that L2 or L3 is required before any
   OFFICIAL fixing settles a third party's product.
9. I cooperate with inquiries into any fixing I confirmed or refused.
10. I understand refusing a fixing is the mechanism working and is never held against me.

---

*Status: v1.0, drafted from verified precedents; not yet adopted by a committee because none
has met. It becomes effective on adoption at the first quarterly meeting and is printed with
that date on the public roster page.*