How Canton Solves the Privacy Problem for Institutional On-Chain Finance

Firms want shared, programmable settlement, but they can’t expose their financing activity or client relationships. Moving to closed networks protects that data, yet brings back the isolated systems blockchain was meant to replace.

So how do you get global connectivity without public exposure?

Canton is built around a different idea: participants can share one synchronized transaction without sharing the same view of it. Through sub-transaction privacy, each party receives only the information required for its role, without exposing the full trade to others.

Why institutions can’t trade in full public view

A trading desk moves $50 million in tokenized Treasuries on a public ledger to cover an intraday loan. Because activity recorded on a public blockchain is visible across the network, rival market participants can analyze that transaction almost immediately.

To a competitor, that single transaction may reveal clues about leverage, timing, and liquidity needs. Competitors can infer why the firm may be moving funds, anticipate a possible rebalancing move, and adjust their own positions in response. What works in retail DeFi as a trust mechanism can become a source of financial exposure in institutional markets.

This simple example highlights three reasons why public blockchains create problems for institutions:

1. Strategy exposure. The timing and size of collateral movements may reveal a firm’s balance sheet strategy – whether it’s managing margin pressure, raising liquidity, or executing a macro position.
2. Pseudonymity is a myth. Public wallet addresses don’t display company names, but on-chain history is permanent. Using standard blockchain analytics, competitors can easily link addresses to specific institutions and map out their counterparties and trade frequencies over time.
3. No role-based visibility. A typical financial trade may concern the borrower, lender, custodian, and perhaps a regulator. On a public chain, transaction details may also become visible to unrelated participants, including direct competitors, creating serious confidentiality and potential legal or regulatory concerns.

This is not a hypothetical concern; the cost of the status quo is already measurable. In its study of on-chain Treasury financing, The ValueExchange put hard numbers on where the friction sits:

• 58% of surveyed market participants reported problems managing collateral and margin, driven by manual work and over-provisioning.
• Margin delivery may lag a call by up to 18 hours on weekdays and 64 hours over a weekend.
• The report estimates that U.S. clearing participants and member firms spend around $54 million annually on collateral movements and reconciliation.

Moving these workflows on-chain could reduce some of that delay. A fully transparent ledger, however, would make each collateral movement visible to competitors as it happened. Privacy is what allows institutions to improve the workflow without publishing the strategy behind it.

For trading firms, this is a fundamental dealbreaker. In an industry report analyzing on-chain Treasury financing, Chris Zuehlke, Partner at DRW, summarized the problem plainly:

“The problem is that I don’t want people to be able to see my collateral move.” – Chris Zuehlke, Partner at DRW (Treasuries On-Chain: An Industry Case for Change – downloadable report)

Institutional privacy is not about hiding a trade from the organizations responsible for it. It’s about keeping sensitive information within the authorized circle of parties involved in or overseeing the transaction. The real question is which network model can actually deliver that.

Public vs private blockchain: Why both force a compromise

The instinct, once you accept that privacy is a major blocker, is to think it’s a simple choice: go public or go private. The uncomfortable truth is that both options fall short for institutions, but for opposite reasons.

Public blockchains: Strong connectivity, limited privacy

Public networks such as Ethereum work like a shared public spreadsheet. Everyone relies on the same ledger and can verify what happened without trusting one central operator.

This makes it easy for assets, users, and applications to interact across one network. But that connectivity comes with broad visibility into transaction activity. Privacy tools such as zero-knowledge proofs can reduce the exposure, but adding role-specific confidentiality to complex multi-party trades still requires specialized blockchain development and custom architecture.

Private blockchains: Strong privacy, limited connectivity

Private blockchain development takes the opposite approach. It creates restricted environments where only approved participants can access the transaction data.

While this keeps trades confidential, it can leave assets and liquidity isolated inside separate systems. An asset sitting in Bank A’s private environment may not easily interact or settle against cash sitting in Bank B’s. Instead of a single connected financial market, institutions can end up with disconnected “digital islands,” requiring additional integrations, reconciliation, and off-chain workarounds.

The institutional trade-off

Neither traditional model gives institutions everything they need. They need the confidentiality of private networks and the shared connectivity and settlement of public ones.

Canton was designed to move beyond that binary choice.

Blockchain architecture comparison: Public, private, and Canton

Sub-transaction privacy: How Canton works

Canton addresses the traditional blockchain trade-off through sub-transaction privacy, powered by Daml – Digital Asset’s multi-party smart contract language.

Simply put: Canton doesn’t broadcast a single, complete transaction record across the network. Instead, Daml defines each party’s rights and access rules at the code level, while Canton delivers to each party only the specific views it’s authorized to see. The separate parts still settle as one coordinated transaction.

How it works in practice: A simple atomic flow

Suppose a single transaction involves an investor, a prime broker, a depository, and a cash provider. All parties contribute to the same atomic settlement, but no participant needs to see every contract, balance, or client relationship involved.

Consider a simple three-party chain within a single trade:

• Alice pays Bob, and Bob pays Charlie in one coordinated step.
• Bob sees both transfers because he is a direct party to both.
• Alice sees only her payment to Bob.
• Charlie sees only the payment he receives from Bob.
• Unrelated market participants see nothing at all.

Each participant gets the visibility needed to execute and verify their part of the trade without exposing broader commercial relationships.

Two consequences matter for institutions.

1. Composability survives: Because Canton synchronizes need-to-know views rather than one shared public state, independent applications can still transact atomically without any single business participant needing to see the full workflow.
2. Privacy is scoped, not absolute: The application can give an auditor, regulator, or counterparty access to the specific contracts their role requires. Confidentiality from competitors doesn’t mean opacity to oversight, making the model viable for regulated capital markets.

What happens underneath

When a party submits a command, the submitting validator builds the full transaction locally, splits it into encrypted views, and passes them to Canton’s synchronization layer. The sequencer routes those views and the mediator coordinates confirmations, but neither can read the underlying contents. They handle ciphertext, not business positions.

The visibility rules themselves live directly in the Daml contract:

• Signatories must authorize an action.
• Observers receive read access to the contracts assigned to them.
• Controllers are permitted to trigger specific choices.

Because these rules are part of the smart contract code, Canton enforces them throughout the workflow rather than relying on a separate manual permission layer.

That puts real weight on testing. Proving that the right party can see its view is only half the work; smart contract audit services must also verify that unauthorized parties can’t access it. A single over-broad observer can expose the exact information the privacy model was meant to protect.

That level of control ultimately depends on precise Daml development and secure validator infrastructure.

Who saw what in a live Treasury trade

The Alice–Bob–Charlie flow explains the architecture. To see how sub-transaction privacy functions in a real institutional workflow, let’s look at how Canton handled live institutional trades in 2025.

In July and October 2025, regulated institutions completed short-term repo trades involving tokenized U.S. Treasuries and stablecoins on Canton. The workflow connected Treasuries held in accounts at DTCC’s Depository Trust Company (DTC) with Tradeweb’s financing application and on-chain cash.

What made these trades different was that the participants didn’t receive the same view:

• DTC knew that a prime broker held U.S. Treasuries on behalf of its clients. It couldn’t see which repo clients were transacting.
• The prime broker retained visibility into its own client repo activity, consistent with its legal agreements and existing market role.
• Tradeweb’s financing app received only the data needed to process the repo. It did not see the clients’ broader holdings at the prime broker.

The trades settled atomically, giving the relevant parties confirmation that the coordinated transaction had completed. The business participants received role-specific views rather than unrestricted access to the entire workflow.

Ben Milne, Founder and CEO of the stablecoin infrastructure firm Brale, described the significance of putting this privacy into production:

“Privacy elements are now in production all day every day – giving people access to on-chain funding, in private.” – Ben Milne, Founder and CEO, Brale (Treasuries On-Chain Report)

The result was one connected trade in which each organization received the information required for its role without gaining access to broader client positions.

The cash leg: Why stablecoins had to grow up first

A repo has two sides: securities move as collateral, while cash moves in return. Tokenizing the Treasuries solves only half the problem if payment still travels later through separate rails. In the July 2025 trade, USDC served as the on-chain cash leg; the October round expanded the model to multiple stablecoins, including SBC and USDM1. This kept the collateral and payment inside one coordinated settlement flow.

Stablecoins opened another source of liquidity

The ValueExchange pointed to $268 billion in stablecoin issuance as of October 2025 as a potential new collateral pool. That doesn’t mean the full amount was immediately available to institutions, but it shows the scale of on-chain liquidity that private financing workflows could eventually reach. This is also where stablecoin development services matter: the cash instrument needs suitable controls for issuance, redemption, compliance, and integration with the wider transaction.

Privacy covered the cash, not just the asset

The cash leg didn’t sit outside Canton’s privacy model. The report states that stablecoins and on-chain Treasuries moved atomically while the transaction retained the same role-based visibility as the securities leg, so the cash movement was not exposed to participants outside the trade. Participants could therefore use on-chain funding without making the complete trade or sensitive balance-sheet information visible across the network.

What the 2025 trades proved

What made the July and October 2025 transactions different is that real cash changed hands, on two separate weekends, between institutions that answer to risk committees and regulators. The roster was not a startup crowd: Bank of America, Citadel Securities, Société Générale, Circle, Tradeweb, and DTCC were among the firms involved.

Scaling from 1 to 5 trades proved an operating model

In July 2025, participants executed one live Treasury repo trade. By October, the group had completed five coordinated transactions with broader participation and multiple stablecoins. Repeating and expanding the workflow showed that the first transaction was more than a one-off success.

The technology worked, but firms still had to operationalize it

Participants described production as an ongoing process, not a one-time launch. Firms still had to coordinate compliance, credit, legal, operations, and technology teams around each transaction. The infrastructure worked; the harder part was getting every organization ready to support it in real time.

Both transaction rounds settled on Saturdays

The weekend timing mattered because conventional securities and cash infrastructure remains less available outside normal market hours. The trades showed that tokenized Treasuries and on-chain cash could settle together outside standard settlement windows. This doesn’t guarantee that weekend liquidity will always be available, but it shows that the infrastructure can support out-of-hours financing.

Privacy as an enabler, not a constraint

As the live Treasury trades showed, controlled visibility can work in production. Broadridge’s Distributed Ledger Repo platform shows that the same model can also support activity at institutional scale.

Running on Canton, DLR processed $7.5 trillion in repo transactions in June 2026, averaging $357 billion per day, according to Broadridge. That volume reflects recurring financing activity rather than a one-off pilot, showing that Daml-based workflows operate at institutional scale rather than pilot scale.

The next question is whether the same model can mobilize assets beyond U.S. Treasuries. Earlier Canton pilots suggest that it can.

Beyond Treasuries: Putting idle collateral back to work

Treasuries are the obvious starting point, but they are not the whole prize. Institutions hold a much larger pool of assets that remain difficult to mobilize. SIFMA data puts the universe of marketable securities at around $230 trillion. Even high-quality assets may sit idle because transferring, reconciling, and reusing them across institutions remain slow and expensive.

The Euroclear, Digital Asset and gold pilot

A 2024 pilot run by Euroclear and Digital Asset, with participation from the World Gold Council, tested what changes when a broader range of assets moves on-chain. A total of 27 institutions tokenized UK Gilts, Eurobonds, and physical gold, then used them across more than 500 interlinked repo, margin, and securities-lending transactions on Canton.

Gold illustrates the opportunity clearly. It’s accepted as collateral, but its physical custody and transfer requirements can make it harder to mobilize than securities already moving through digital market infrastructure.

Tokenization turns stored assets into movable collateral

Once an asset such as gold is represented on-chain, it can potentially be pledged, recalled, and reallocated within the same day rather than moved through separate manual processes. In the pilot, tokenized assets could be used across several connected workflows while participants retained the privacy boundaries required for their own positions and transactions. That combination is the point: mobility without scoped visibility would mean advertising every pledge and recall to the market. Reuse only becomes attractive if the reuse itself stays private.

Mobility could reduce settlement costs

Analysis cited in the pilot estimates that tokenization could remove 35% to 65% of costs across the settlement value chain, including approximately $4.1 billion associated with settlement failures. These are estimated industry-wide opportunities, not savings already achieved by the pilot. The figures illustrate the potential value of replacing fragmented transfers and reconciliation with a shared digital workflow. Those savings assume institutions are willing to route the activity through a shared workflow in the first place, which returns to the same precondition: the workflow has to be confidential before it can be shared.

What happens when a counterparty defaults

Moving collateral efficiently is valuable only if the secured party can still take control of it when the other side fails. The Euroclear and Digital Asset pilot tested that scenario by carrying a transaction through a simulated prime-broker default and closeout.

The pilot tested default and closeout

After the required legal closeout steps, the workflow allowed the secured party to take control of the pledged cash and tokenized gold through an atomic, auditable transfer. This showed that the system could support not only normal settlement, but also the point at which collateral rights had to be enforced.

Why the digital twin mattered

The tokens represented assets already held in traditional custody rather than created unrelated new assets. That helped connect the on-chain record to existing ownership and legal agreements. ICMA and ISLA’s Digital Assets Annex also gives repo and securities-lending firms a common contractual framework for transactions involving tokenized collateral.

For builders, the lesson is simple: default, closeout, and transfer rights must be designed into the Daml workflow from the beginning, not added after the normal transaction path is complete.

The payoff: What collateral mobility could unlock

As noted earlier, collateral delivery can lag a weekday margin call by hours. Shortening that delay could make margining more responsive and reduce the capital held against market moves while settlement is still pending.

Faster mobility may support lower haircuts

Haircuts partly protect collateral takers against price changes and the difficulty of selling an asset during market stress. If collateral can move and be liquidated more quickly, that risk may be priced more precisely. Justin Peterson, CTO of Tradeweb, highlighted the ability to see settlement happen in real time as an important operational benefit for trading platforms.

Collateral could be reused more efficiently

Faster delivery may also allow eligible collateral to be returned, substituted, or redeployed sooner. Instead of remaining locked in one workflow until the next settlement window, the same asset could potentially support several financing or risk-management needs during the day.

The gains are not automatic

Faster settlement can shift liquidity requirements rather than remove them, because cash and collateral may need to be positioned earlier in the day. The gain is optionality, not a guarantee, and realizing it depends on getting the permission design right – the same design question that made the Treasury trades possible.

Conclusion: What this means for firms building on Canton

Every advantage described above rests on one thing: getting the visibility rules right in code. As the observer model shows, a single permission defined too broadly can expose exactly the information the architecture was built to protect, which makes implementation a risk surface.

A Canton product must translate real financial workflows into precise Daml logic, then connect that logic to secure infrastructure and an application people can actually use.

As an official partner providing enterprise-grade Canton development services, PixelPlex has delivered products across the network’s wallet, data, and identity layers:

• Console Wallet: A multi-chain, self-custodial wallet for Canton and EVM networks, built around passkey security, clear signing, and integrated risk checks. In its first 30 days, it generated 31M+ Canton rewards and climbed to #4 on Canton’s rewards leaderboard.
• CC View: An enterprise data engine that indexed 96M+ transfers and processed 6M+ requests with a reported 100% success rate.
• 5N ID: A consent-driven identity MVP delivered in 2.5 months, enabling businesses to onboard previously verified users in under two minutes through two custom Daml contracts for verification and consent.

For firms building a real-world asset tokenization platform, private financing flows, or cross-application settlement systems, PixelPlex can turn real access and disclosure requirements into production-ready Daml workflows, so each participant sees what its role requires, and nothing more.