# What we ask committee members

> **SUPERSEDED — not in force.** This document is superseded by [ETP Foundry Methodology v1.0](/documents/methodology-v1.0.md) (28 Sep 2026) and by [What we ask committee members v2](/documents/what-we-ask-committee-members-v2.md). It is kept for the record only. Where it differs from Methodology v1.0, Methodology v1.0 governs.

**Version 0.1 — 28 September 2026.** Signer Protocol v3. A plain-English summary for firms
considering a seat on an ETP Foundry NAV committee. The rules themselves are in the committee
terms of reference (v1.0) and the signer protocol, published at etpfoundry.com/api/signer-protocol;
where this summary and those differ, they govern.

## In one paragraph

**You don't give us data. You run our checker on your own systems. Each day it confirms two or
three things you already know, and signs automatically. It costs nothing, and there is no daily
work.** The reference checker (signer-service) is free, you can read every line of it, and it
runs on your infrastructure. It reads your own records, answers a few yes/no questions, and sends
us only the answers. All yes: it signs. Any no: it records a refusal naming that question. If it
cannot read one of your systems, it stops and sends nothing until you fix it. Nothing is paid or
charged for a seat, now or later.

## What each seat confirms

| Seat | What is confirmed, yes or no | Why only this seat can say it |
|---|---|---|
| **Issuer** | Your reserves cover the token supply. · Your latest reserve attestation is under 24 hours old. · Redemptions are open right now, not paused. | Only the issuer sees its reserve accounts, its attestation schedule and whether redemptions are actually open today. |
| **Venue** | The token traded on your venue during the strike window. · Your window prices were within your tolerance of the proposed value. · There was no halt or outage in the window. | Only the venue has its own trade tape and uptime record. |
| **Lender** | You accept the asset as collateral today. · The proposed value is within your own marking tolerance. | Only the lender knows its eligible-collateral list and its own mark — and it says so against its own money. |
| **Custodian** | The fund's holdings in your custody match the ledger. | Only the custodian can see the account. |
| **Transfer agent** | Your share register matches the supply on the ledger. | Only the transfer agent keeps the register (fund products only). |

The questions, as the software names them: issuer `reserves-cover-supply`, `reserves-current`,
`redemptions-operating`; venue `traded-in-window`, `prices-within-tolerance`, `no-halt-in-window`;
lender `accepts-as-collateral`, `independent-mark-within-tolerance`; custodian
`holdings-match-ledger`; transfer agent `shares-outstanding-reconciled`. Every one must be
answered on every confirmation; a confirmation that leaves one out is refused.

## If you say no

- A no is normal and never held against you (terms of reference §11). It is the system working.
- It is recorded as a refusal naming the question, with your reason if you give one, so every
  member sees exactly what broke.
- Your signature is not added. If the other seats still reach the quorum, the value is
  published. If not, the day's value falls back openly — a benchmark × last-attested-factor value
  (tier 3), then the prior value flagged (tier 4), then a published gap (tier 5) — and the tier
  is printed next to the number. Nothing settles against a guess.

## What you never have to share

- No balances, wallet addresses, reserve reports, positions, marks, trade tapes, client names,
  registers or holdings. The checker reads them on your side and they stay there.
- Optional figures, only if you choose: a fill count (venue), a coverage ratio (issuer), the
  distance in basis points between the proposal and your mark (lender).
- One exception, stated plainly: a venue that answers *yes* on prices also sends the lowest and
  highest price traded in the window. These are market prints, not confidential, and the ledger
  itself checks the proposal sits between them. A venue that did not trade sends only "no".

## Common questions

**What is our liability?** You confirm facts about your own records — the kind of statement you
already make to auditors. You never confirm a price, give advice, or sign for anyone else. If you
are unsure, the rule is to say no. A knowingly false yes is on the record under your firm's name
and is grounds for removal (terms of reference §11). Please have your counsel read the terms of
reference before you accept a seat.

**How much work is it?** Wiring each question to a system you already have takes an afternoon;
after that the checker runs unattended. You can also answer the same questions in the web portal.

**Is anything confidential exposed?** No — see above. Your answers are visible to the committee
and to the published record; that is the purpose of the seat.

**What is in it for us?** A value you can rely on for an asset you already hold, lend against or
list, built from checks you control. Your firm on the committee of record. Early sight of problems:
when another seat says no, you see which fact broke. No fee, now or later.

**Can you sign for us?** On pilot seats hosted by the desk (level L1), technically yes — we say
so, log every act, and publish nothing signed that way as an attestation. With your own signing
key (L2) the desk can no longer sign for you through the ledger. Your own Canton node (L3) is not
built yet.

## How established benchmarks do this

- **Auditors** confirm cash by asking the bank directly (ISA 505, external confirmations). The bank
  confirms a fact from its own records — the role of a seat.
- **Proof-of-reserve attestations** state whether reserves covered the tokens in issue at a point
  in time: a yes or no with a date, not the books.
- **The LBMA Gold and Silver Prices** are formed by participants' actual orders in an electronic
  auction run by an independent administrator (ICE Benchmark Administration), not by a vote on a price.
- **After LIBOR**, which rested on banks' estimates, benchmarks moved to observed transactions:
  IOSCO's 2013 principles put transaction data first, and SOFR and reformed SONIA are calculated
  from actual overnight trades. Our seats confirm observable facts for the same reason.