# NAV Committee — Terms of Reference, seat criteria, code of conduct

**Version 1.3 — 28 September 2026** (v1.0, 24 September 2026; v1.1, 28 September 2026, moved the
committee to Signer Protocol v3; v1.2, 28 September 2026, moved it to Signer Protocol v4 and ETP Foundry
Methodology v1.0; v1.3 aligns it with the final Methodology v1.0: the lender's risk-side challenge
(basis check), the venue conditions of eligibility, the preconditions for any value above tier 0, and
the seats' duties for the 24/7 fixing family, §6A–6B). Published alongside the rulebook. Precedents: IBA PMOC
Terms of Reference (Jul 2026), WMR Terms of Reference (Sep 2026), CF Benchmarks Charter v13.8
and Constituent Exchange Criteria v8.5, and the FTSE appointment-letter template, all read
24 Sep 2026. Methodology v1.0 is the sole governing methodology; the Rulebook v0.2 describes process only where it is consistent with it, and where any text differs, Methodology v1.0 governs. This document
governs the *people*.

What each seat is asked is the **Signer Protocol v4** (28 September 2026; served at
etpfoundry.com/api/signer-protocol once the v4 desk is deployed), which implements **ETP Foundry
Methodology v1.0** §4: one numeric submission per seat, from the member's own systems, signed and
timestamped. A venue submits its trades in the observation window (`window-trades`); a lender the
mark its own risk system uses, with its method (`independent-mark`: a risk-side challenge, which is a
cap on basis to the underlying, not an independent valuation, where the mark derives from a public
reference); an issuer a reserves/supply snapshot with its evidence
reference and redemption and mint/burn status (`reserve-snapshot`); a custodian and a transfer agent
a reconciliation with both numbers (`custody-reconciliation`, `register-reconciliation`). The
administrator computes the fixing from the venues' submissions (the volume-weighted median of
eligible venue VWAPs) and gates it on the lender's mark and the issuer's snapshot; it never attests.
For assets that trade 24/7, seats also submit automatically for **OFF-HOURS SIGNED fixings** at
00:00, 08:00 and 16:00 UTC (Methodology v1.0 §3A; specified, not built), intended for margin and
liquidation once attested, and **never a NAV** (§6A).
Members send aggregates and statements, never their trade tapes, books, client identities or keys.
What the ledger enforces since Daml package 3.0.0:
the administrator signs every proposal; `K ≥ 2` and `K ≤ N`; the administrator is never a member; a
venue's confirmation carries the window's low and high and is refused if the price lies outside them;
one fixing per instrument, session and as-of date. Everything else below is a rule of the committee,
kept by people and by the records, and it says so.

## Context: why ETP Foundry exists (not part of the terms)

**The problem today.** A traditional exchange-traded fund (ETF) is a chain of separate firms.
Before the first share exists it needs an index provider for the price, a fund administrator for
the net asset value (NAV), a transfer agent for the share register, a custodian, authorised
participants (APs) to create and redeem shares, and a clearing agency: **five or more firms**, each
with its own contract, its own system and its own daily reconciliation. Launching one takes
**months**. Creations and redemptions settle **T+1**, the next business day. And for tokenised
assets on Canton we know of no administrator publishing a fixing (for CBTC, for example), so **every new asset starts the paperwork again**.

**How we fix it: four steps on one ledger** (the Canton Network).

1. **Onboard a tokenised asset.** Any Canton token built on the CIP-56 token standard is added by
   configuration, not code: four facts from its issuer.
2. **The committee supplies the data; the administrator computes the price.** Once a day, firms that
   already hold a position in the asset each submit numbers only they hold. **Venues** submit their
   own trades in the observation window (VWAP, volume, trade count, low and high), and the fixing is
   the volume-weighted median of those VWAPs. A **lender** submits the mark its own risk system uses, and the
   value publishes only inside its declared tolerance (a risk-side challenge: where that mark comes
   from a public reference, it caps the token's basis to its underlying). The **issuer** submits a signed, timestamped
   reserves-and-supply snapshot, and nothing publishes while the peg is in doubt. With **K of N**
   signatures and every gate passed, the day's official price, the *fixing*, exists. Otherwise a
   labelled fallback or a gap is published. (ETP Foundry Methodology v1.0, Signer Protocol v4.)
3. **Create and redeem in one transaction.** An AP delivers the basket and receives fund shares at
   the signed NAV, or the reverse, all or nothing. No T+1 and no failed leg; custodian and register reconciliations still gate the NAV.
4. **Shares go out on many chains.** Fund shares are carried to other chains through *vaults*, so
   investors hold them where they already are.

**Why each next fund is faster.** A committee is seated once per asset and serves every fund that
holds that asset. A second fund holding CBTC settles against the same signed CBTC price: no new
committee, no new contracts with its members. A new fund adds only what is its own (any asset
nobody covers yet, and its share register), so the more assets are covered, the less each new
fund has to set up.

## Context: where we are today (not part of the terms)

| | |
|---|---|
| Ledger | Our own Canton **DevNet** validator (Canton's public test network), live since 24 September 2026. It holds DevNet registry assets (BitSafe CBTC, Canton Coin), which have no monetary value. Not on MainNet. |
| Other chains | Vaults on **10 public EVM testnets**. On Solana the program is deployed on devnet (28 September 2026), but **no Solana vault** exists yet. Nothing on any mainnet. |
| Prices | **Tier 0, indicative only**: live market observations, signed by nobody. No fixing has been published for commercial use. |
| Committee | **No third-party seat yet.** Every seat today is operated by ETP Foundry, and every value says so. |
| Methodology | **ETP Foundry Methodology v1.0** and **Signer Protocol v4** (28 September 2026) are implemented and unit-tested in the desk. No venue, lender or issuer has submitted real data yet. |
| Regulation | **Not a regulated benchmark administrator.** Not authorised or registered in any jurisdiction. |
| Governing text | Methodology v1.0 is the sole governing methodology; the Rulebook v0.2 describes process only where it is consistent with it, and where any text differs, Methodology v1.0 governs. |
| Audit | The Daml contracts and the vault contracts have **not yet been independently audited**. |

---

## 1. Purpose

The NAV Committee exists so that a published fixing is **attested by parties who lose money
if it is wrong**, and so that no single interest can set it. It is not an
advisory board. Each member submits numbers only its firm holds, from its own systems, and
confirms or refuses the proposed fixing on the strength of them.

Members act **for their firm on the data they submit**. This is a deliberate difference from
IBA and WMR oversight committees, whose members act as individuals. Ours are contributors
in the IOSCO sense (Principle 14) and the contributor obligations apply to us, not the
"no contributed data" exemption CF and WMR use.

## 2. Composition

| Seat | Submits (Signer Protocol v4) | Bias, stated | Minimum |
|---|---|---|---|
| Issuer (peg-integrity gate) | `reserve-snapshot`: reserves, supply, as-of time, evidence reference, redemptions open, mint/burn paused. Gates publication; never sets the price | high | exactly one per instrument |
| Lender (risk-side challenge) | `independent-mark`: its risk-system mark and time, collateral eligibility, haircut, `markSource` (required) and `markFromPublicReference` (required). The value publishes only within its declared tolerance (default 25 bp). Where the mark derives from a public reference, the check is a **basis check** (a cap on the token's basis to its underlying), not an independent valuation, and each fixing says so | low | ≥ 1 lender **or** venue in every `K` |
| Venue (price contributor) | `window-trades`: trade count, volume, VWAP, low, high, halt seconds (or time-weighted quotes if nothing traded), and `selfTradesExcluded` (required). Its VWAP feeds the volume-weighted median. Counts toward level (a) only under the conditions of §3 (data-sharing, self-trade exclusion, surveillance) | where its book is | pilot: 1, flagged single-source and **never above tier 0** (`minVenues` = 1); **2 independent operators required** for any tier 1 or tier 2 value (§6B) |
| Custodian / reserve holder | `custody-reconciliation`: holdings, ledger holdings, encumbered units, statement time | neutral, liable | mandatory when the native network is not the settlement ledger (rulebook §4.8) |
| Transfer agent | `register-reconciliation`: register shares, ledger shares, register time | neutral | fund products only |
| Administrator (ETP Foundry) | proposes, computes, publishes | — | **not a member** (enforced on-ledger) |

`N` and `K` per committee are declared in the committee's on-ledger record and printed on
every value. Pilot minimum is `N=3, K=2` with three seats whose interests differ (rulebook §6);
the pilot label is printed on every value and sunsets when a fourth seat is filled.

**Independence tests** (from CF "independent = different operators", IBA PMOC §6):
- parties the issuer controls or is affiliated with may never reach `K` together;
- the issuer may not also hold the custodian or venue seat for its own instrument;
- a venue owned by the issuer or the administrator is disclosed and does not count toward
  the independent venues;
- a lender that is an issuer affiliate counts as issuer-controlled.

## 3. Eligibility — entity, individual, arrangements

Every seat, before a credential is issued:

1. **Entity**: a named legal entity, disclosed principals, disclosed licence or regulatory
   status, balance sheet at risk on the data submitted. No oracles, no data vendors, no
   "neutral attestors for a fee" (rulebook §6).
2. **Individuals**: the people who will confirm are named, have "appropriate experience,
   skill and training" (WMR ToR wording) in the function they attest, and have completed
   the protocol walkthrough (signer portal "Your seat" panel or a 30-minute call).
3. **Arrangements**: a written data/attestation agreement; a named alternate; an escalation
   contact reachable at the strike; declared tolerance in basis points (default 25 bp,
   rulebook §6) and, for issuers and custodians, declared attestation cadence (default
   freshness 24 h).
4. **Signed appointment letter and code of conduct** (§6 and §7 below).
5. **Public disclosure** in the roster table (§5).

Seat-specific entity tests, taken from the closest TradFi analogue:

| Seat | Must show at onboarding | Re-checked |
|---|---|---|
| Issuer | the four on-ledger facts of rulebook §4.1; declared **reserve model** (`attested` / `onchain-verifiable` / `custodial`) — which decides what its `evidenceRef` points to; attestation cadence; redemption window terms | annually, and on any change of reserve model |
| Lender | actually holds the instrument as collateral (position evidence); a liquidation engine or risk book that consumes a mark; declared tolerance | quarterly position re-confirmation |
| Venue | all six rulebook §4.0 tests plus CF's four: executed data-sharing agreement, API exposing trade **and order** data, KYC/AML programme, cooperation with inquiries; 90 days of trading history in the token; volume share ≥ 5 % of observed 30-day volume trending to 3 % over 90–180 days (threshold a founder decision). Methodology v1.0 §4.1a conditions: (1) **data-sharing and audit right**: the trade-level records behind any submission produced to the administrator (and the oversight function once constituted) within **5 business days** of a request; (2) **self-trade exclusion** (self-matched, affiliated-account and venue-as-principal trades excluded) attested on every submission as `selfTradesExcluded`; (3) **surveillance** of the token's book (at least spoofing, layering, wash and marking-the-close alerts), with any alert that touches an observation window reported within **1 business day** | annual conformance review, presented to the committee and minuted |
| Custodian | regulated custodian (or protocol-controlled contracts under `onchain-verifiable`); client assets segregated; independent control report (SOC 1 / ISAE 3402) or on-chain proof; statement age ≤ freshness | annually; immediately on any lien or rehypothecation |
| Transfer agent | appointed under the fund's governing documents; maintains the register; daily reconciliation; SLA with the administrator | annually |

## 4. Terms of office

Copied from IBA's selection document, because indefinite seats are the thing to avoid:

- initial term **six months** from appointment (the pilot's shadow run of about 90 days, under the
  pilot letter, comes before appointment), auto-extended to **three years** on the
  committee's first annual review if the seat has met its obligations;
- maximum **nine consecutive years**, then a minimum one-year gap;
- **annual membership review** at the fourth quarterly meeting: obligations met, conflicts
  re-declared, tolerance re-declared, trust level reviewed;
- alternates act only with the administrator's prior written agreement and are disclosed in
  the fixing record like any other signer.

## 5. Public roster and conflicts disclosure

No seat is real until it is on the public roster page. The table follows IBA's "Composition
and Disclosure of Conflicts of Interest" format, with two columns of ours:

| First name | Surname | Company | Market position | Seat & instruments | Voting | Directorships & interests | Date of COI declaration | **Trust level** | **Declared tolerance** |
|---|---|---|---|---|---|---|---|---|---|

Printed under the table, verbatim in spirit from IBA: *members may themselves use the
benchmark, may provide input data to it, and may hold a commercial interest in the assets
it prices. That is the design: differing interests, disclosed.*

The administrator's own conflicts are disclosed on the same page (the way CF discloses
Kraken): any position in a priced asset, any commercial relationship with a member, and the
impersonation capability of rulebook §6.7.

**The administrator's own conflicts, disclosed.** The fund and ETP issuer licence includes a component linked to the assets under management of funds that reference ETP Foundry fixings. AUM rises with the fixing level, so this is a conflict of interest for the administrator. It is disclosed; the controls are that the administrator computes but never attests, cannot sign (the ledger refuses it as a member), and does not trade the instruments. Those controls do not address a fee that rises with the level; the mitigation for that is Methodology v1.0 §6.4: no value above tier 0 without an independent oversight function, K signatures by third parties with their own keys, and no administrator seats. The administrator also operates the settlement desk and creation/redemption, and today operates every committee seat on DevNet; both are disclosed conflicts.

## 6. Ongoing obligations (all seats)

1. Confirm or refuse **every** fixing for the instruments the seat covers, within the
   confirmation window; silence is recorded as silence, not as consent.
2. **Send the seat's required submission, from the firm's own systems.** Under Signer Protocol v4
   each seat sends one numeric submission per strike (Methodology v1.0 §4). A malformed submission,
   or a confirmation that omits the seat's required submission, is refused (422) naming the field,
   and nothing is recorded. A well-formed submission that fails its gate is recorded as the seat's
   refusal, with the numbers. A figure the firm's systems cannot produce is not estimated: the
   checker halts and nothing is sent.
3. **Tolerances are declared, not adjusted per fixing.** Widening a tolerance is a change
   to the seat's record, dated and disclosed.
4. **Declare conflicts** before any fixing they touch; **annual re-attestation** of fitness
   and propriety, conflicts and confidentiality (WMR ToR §2.3).
5. **Notify** any change of control, licence status, role, reserve model, custodian or
   material position within five business days.
6. **Cooperate with inquiries** into any fixing, complaint or surveillance alert.
7. **Confidentiality** of other members' submissions and of unpublished proposals. The public
   record shows who signed, under which protocol, and the determination (input level, method,
   venues used and excluded); per-venue figures are published only with that venue's consent.
8. **Key custody at the declared trust level** (L1 pilot, L2/L3 official). A seat at L1 is
   told, in writing, that the administrator could technically act as its party.
9. **Off-hours submissions** (seats on an instrument in the 24/7 family, §6A): the same submission
   over a 15-minute window, sent automatically by the seat's checker by the fixing time + 10 minutes.
10. **Venues:** keep the §3 conditions of eligibility in force (records within 5 business days;
   self-trades excluded and attested; surveillance alerts reported within 1 business day). A venue
   that does not produce requested records is suspended from level (a) until it does.

## 6A. The 24/7 fixing family: what a seat signs up to (Methodology v1.0 §3A)

*Specified, not built. Applies only to instruments the administrator has put on the 24/7 schedule;
the first candidates are tokenised index stocks (e.g. SPYx, QQQx).*

1. **Three layers, always labelled.** A live indicative value (unsigned, tier 0; "indicative" means
   only this); **OFF-HOURS SIGNED fixings** (label `OFFHOURS`) **at 00:00, 08:00 and 16:00 UTC every
   day**, weekends and holidays included, each published with a data-quality band `± b`; and the
   **OFFICIAL** fixing (Methodology v1.0 §3–§6; for equities and any basket with an equity leg, 16:00
   America/New_York on NYSE trading days; for crypto, **16:00 Europe/London daily, adopted 28
   September 2026**).
2. **Never a NAV.** An OFF-HOURS SIGNED fixing is for margin, liquidation, health factors and
   collateral haircuts once attested. It is never a NAV and never the basis for creation or
   redemption, and no member or licensee may present it as one. Until the four conditions of §6B
   hold, it is published at tier 0 labelled `pilot — not attested`, and the licence forbids its use
   for liquidation.
3. **The submission.** Venues, lenders and issuers submit as for the OFFICIAL fixing, over the
   **15 minutes** ending at the fixing time. The lender's mark is at most 15 minutes old, and its gate
   is **`markBpsOffHours`, the off-hours tolerance the lender declares in advance** in its seat
   settings (default: its `markBps`). The published band is shown beside the lender's result but never
   widens the lender's tolerance. At least one venue signature must be among the `K` for any
   off-hours fixing, because the lender gains from a low value when it liquidates (a disclosed
   conflict). The issuer gate still applies; off hours a custodial snapshot may be up to 96 hours old.
   The custodian and transfer agent do not sit.
4. **Timing.** Submission cut-off: the fixing time **+ 10 minutes**; a late submission is recorded as
   late. If `K` is not reached by the fixing time **+ 30 minutes**, the result is `NO FIXING`. The
   seat's checker runs this automatically; no person is required per fixing, and silence is recorded
   as silence.
5. **`NO FIXING`.** Published, with the reason, when fewer than two live inputs of distinct signal
   types remain (token trades on any number of venues count as one type, and only above their size
   floor),
   when two inputs disagree beyond the published tolerance, when fewer than `K` sign, when the issuer
   gate fails, while the underlying is halted, or while a corporate action's terms are not final. The
   last good fixing stays visible with its age. There is no tier 3 or tier 4 fallback, and nothing is
   guessed.
6. **`EXCEPTIONAL`.** A move of more than 10% since the previous OFF-HOURS SIGNED or OFFICIAL value is
   published, flagged `EXCEPTIONAL`, and every member and licensee is notified. It is not suppressed.
   `EXCEPTIONAL` has this one meaning only; chain events are flagged `EVENT-<type>`.
7. **Corrections, never restatements.** An OFF-HOURS SIGNED fixing is never restated. An error is
   corrected by a **new, linked record**. Any member or licensee may raise a challenge within **24
   hours**, and the outcome is recorded. What to do about liquidations made against the original is
   the consumer's decision.

## 6B. Before any value above tier 0 (Methodology v1.0 §6.4, a hard precondition)

No value is published at tier 1 or tier 2, and no OFF-HOURS SIGNED fixing is published as attested,
unless all of the following hold on the strike date. Until then every value is tier 0, and pilot
attestations by administrator-operated seats are labelled "pilot — administrator-operated seats".

1. **Oversight.** An oversight function of at least three members, a majority independent of the
   administrator and of every seat holder, has been constituted and has approved the methodology
   version (§9). The approval is countersigned by each approving independent member from that
   member's own authenticated account, and published with the members' names and declared
   affiliations; an entry made by the administrator alone does not satisfy this condition. The
   venue records of §3 likewise count only once a majority of the independent oversight members
   have countersigned them from their own accounts.
2. **Own keys.** At least `K` of the signatures are made by third parties at trust level **L2** or above.
3. **No administrator seats.** No seat counted toward `K` is operated by the administrator or its
   affiliates (ETP Foundry, Lucilla, Inc., CrossDesk), whatever its trust level. Each seat carries an
   operator of record (the legal entity that controls the signing key); a seat whose operator is the
   administrator or an affiliate, or which is flagged operator-run, never counts toward `K`, at L1,
   L2 or L3.
4. **Venues.** The venue conditions of §3 are met, including at least two independent venue
   operators for level (a).

A value at input level (c) (reference × par) is never tier 1 or tier 2: the committee's signatures
stand behind the par factor only, and the value would be published at tier 3. Level (c) and tier 3
**require a licensed reference**; none is licensed today, so neither is published, and the fallback
is tier 4 or `NO FIXING`. No tier 3 value is published unless the issuer's latest snapshot passed its
gate within the instrument's freshness limit (a refusal or a silent issuer both block it).

## 7. Suspension and removal

| Trigger | Consequence | Who decides |
|---|---|---|
| Missed attestation for one full cadence (issuer, custodian) | seat suspended; `NO FIXING` (issuer gate not met, Methodology §3A.7 rule 6 / §6.2; chain-event policy v0.2 §2.1) | administrator, immediately; committee at next meeting |
| Three consecutive unexplained silences | membership review (IBA "three consecutive meetings") | committee |
| Refusal three times without stated cause (rulebook §7.3) | membership review | committee |
| Lender position falls to zero | seat lapses at next quarterly review | committee |
| Venue volume below threshold | takes effect at next review; anyone may nominate removal | committee, decision published |
| Venue does not produce requested trade records within 5 business days, or a submission is not attested `selfTradesExcluded` | suspended from level (a) until it does (Methodology v1.0 §4.1a) | administrator, immediately; committee at next meeting |
| Any regulatory or court sanction for market manipulation | **mandatory resignation** (IBA PMOC §6) | automatic |
| A knowingly false submission | removal; the fixing is reviewed under the restatement policy | committee; published |
| Insolvency or loss of licence | immediate suspension (chain-event policy §2.3) | administrator |
| Disagreeing with a fixing | **never a ground** (operations runbook, §6) | — |

The administrator may **suspend** ad hoc; only the committee makes a removal permanent; every
suspension and removal is published with its reason (CF process).

## 8. Meetings, quorum, minutes

- **Quarterly**, fixed agenda (the operations runbook, §4); the administrator attends
  without a vote.
- **Quorum**: `K` of `N` present, including at least one lender or venue.
- **Minutes** within eight working days; a **public summary** within fifteen; the full
  minutes to members and licensees. Where the administrator acts against a committee
  decision, the minutes record it and the reason.
- **Annual self-review** of these terms at the fourth meeting.

## 9. Responsibilities (the standing list)

The committee of seats is **not** an oversight function (Methodology v1.0 §9.1): its members hold
positions. The list below is review by interested parties. No independent oversight function exists
yet; once constituted it takes the methodology, cessation and complaints decisions (items 7–9), and
until then the administrator performs those reviews, publishes them and says that it does.
Complaints are acknowledged within 2 business days and answered within 20, with reasons.

1. Review every `NO FIXING`, carry-forward and restatement of the quarter.
2. Authorise a response after **three consecutive carry-forwards** on any instrument (CF
   charter duty).
3. Review the constituent venue list; decide additions, suspensions, removals (policies document, §4).
4. Admit and remove members (§3, §7); decide whether `K` moves when `N` changes.
5. Review the conflicts register and the administrator's impersonation log.
6. Review surveillance alerts and venue conformance reports.
7. Review complaints escalated under the policies document, §1.
8. Approve methodology consultations and their feedback statements (policies document, §2).
9. Approve cessation or transfer of any benchmark (rulebook §9).
10. Oversee third parties involved in calculation or dissemination, including the transfer
    agent and any data provider.
11. Report suspicious input data to the administrator, and where required, to the relevant
    authority.
12. Review the quarterly error table (policies document, §3).
13. Review tolerances in aggregate and the trust-level mix of the quarter's fixings.
14. Review these terms annually.

## 10. Appointment letter (template)

> **Appointment to the ETP Foundry NAV Committee — [Instrument(s)] — [Seat]**
>
> [Firm] is appointed to the [Seat] seat of the NAV Committee for [instrument(s)] from
> [date], for an initial term of six months under the Terms of Reference v1.3, the
> Signer Protocol v4 and ETP Foundry Methodology v1.0, all attached.
>
> Named signers: [name, role, e-mail], alternate [name]. Trust level at appointment: [L1/L2/L3].
> Declared tolerance: [n] bp. Reserve model (issuers): [attested / onchain-verifiable / custodial].
> Attestation cadence (issuers, custodians): [n] hours.
>
> Nothing is paid or charged for this seat, now or later. [Firm] may resign on thirty days'
> written notice (during the pilot, before this appointment, either side may stop at any time); the
> administrator may suspend under ToR §7.
>
> [Firm] confirms that the conflicts declared in the attached schedule are complete and
> agrees to the code of conduct in ToR §11.
>
> Signed for [Firm] ______  Signed for ETP Foundry ______  Date ______

## 11. Signer code of conduct

Modelled on IOSCO Principle 14 and BMR Art. 15, and identical in substance to Methodology v1.0
§9.3; signed before the first credential is issued.

1. I submit only data my firm's own systems produced for the stated window or time: executed
   trades, our own mark, our own reserve, custody or register records. I never submit an estimate
   or someone else's number as our own; if a figure cannot be produced, the checker halts and
   nothing is sent.
2. I keep my declared tolerances and cadence. They are set in advance in the seat settings; I never
   widen one at submission time to make a check pass, and any change goes through the
   administrator, dated and disclosed.
3. I declare every conflict before a fixing it touches, and re-declare annually. Where my firm
   also trades the instrument, those who submit are not those who trade it, or the conflict is
   declared and managed.
4. I keep unpublished proposals and other members' submissions confidential.
5. Each submission is produced by an automated checker or a documented manual procedure, by named
   people and credentials under my firm's control; changes to the checker's data sources are
   recorded. I rotate a credential on any suspicion of exposure, and I do not share a seat.
6. I will resign the seat if my firm or I are sanctioned for market manipulation.
7. I understand that a knowingly false submission is grounds for removal and public disclosure.
8. I understand that at trust level L1 the administrator could technically act as my party,
   that every such act is logged and disclosed, and that L2 or L3 is required before any
   OFFICIAL fixing settles a third party's product.
9. I keep the data behind each submission for five years and produce it to the oversight function
   or an authority on request; I cooperate with inquiries into any fixing I confirmed or refused;
   and I report to the administrator any attempt to influence a submission, and any trading I
   believe was intended to move a window's prints.
10. I understand refusing a fixing is the mechanism working and is never held against me.

---

*Status: v1.3, drafted from verified precedents; not yet adopted by a committee because none
has met. It becomes effective on adoption at the first quarterly meeting and is printed with
that date on the public roster page.*