Both legs,
or neither.

Settle large stablecoin trades without showing the market your hand, and prove you're clean without showing who you are.

Open the app How it works

Private, atomic OTC settlement on Arc

The first side to move carries the risk.

Prefunding, side letters and chat confirmations leave one party exposed until the other delivers.

Agreed at 1.0765?
A 14:02
Yes.
B 14:03
No confirmation
Can you send first?
A 14:03
No, you send first.
B 14:04
Sent. Waiting for you…
A 14:05
Sent first
B 14:47
Still waiting
One side exposed

Three steps.
Both legs, or neither.

Prepare

Each side proves, from a credential, that it is valid and screened, without revealing who it is.

Commit

Both sides lock the same terms. They stay private until settlement.

Settle

If both proofs and both commitments match, both legs move in one transaction. Otherwise nothing moves.

Same trade.
Three different views.

Before it settles, the terms are a hash. After, they are public. Who is behind each side stays private, unless a regulator holds the key.

Market

Anyone watching Arc

Terms, before settlement: Hidden
Terms, after settlement: 25,000,000 USDC for 22,950,000 EURC
Who is behind each side: Hidden
Both proofs verified: yes
Lists and versions used: list v12, 14 Oct 2026

Counterparty

The other side

Terms, before settlement: 25,000,000 USDC for 22,950,000 EURC
Terms, after settlement: 25,000,000 USDC for 22,950,000 EURC
Who is behind each side: Hidden
Both proofs verified: yes
Lists and versions used: list v12, 14 Oct 2026

Regulator

Holding the key

Terms, before settlement: Hidden
Terms, after settlement: 25,000,000 USDC for 22,950,000 EURC
Who is behind each side: holder 7f3c…a9d2
Both proofs verified: yes
Lists and versions used: list v12, 14 Oct 2026

Synthetic example. The proofs are public inputs; the credential never is.

Proof, per trade.

Each side proves three things before anything moves, without saying who it is.

Trade
initiated

01Credential valid and not revoked.

02Not on the sanctions list in use.

03Bound to this trade and to the address that trades.

Proof
complete

Public inputsissuersRoot, revocationRoot, minTier

Public inputssanctionsRoot, validAt

Public inputstradeId, tradingAddress

25,378 constraints, 13 public signals. Proves in 879 ms, verifies in 8 ms. Measured with snarkjs on an Apple M4, 14 Oct 2026.

Built to be verified.

Open contracts, an SDK, and transactions your custody policy can approve.

Read the code Contracts SDK

TypeScript

// Public inputs of every proof, recorded on Arc
tradeId         the trade it belongs to
tradingAddress  the address that trades
issuersRoot     the issuers accepted
sanctionsRoot   the sanctions list in use
revocationRoot  the revocations in force
minTier         the policy tier required
validAt         when the proof was made
regulatorKey    the key that can open the subject

import { KeelsonClient, proveCompliance } from "@keelson/sdk";

const keelson = new KeelsonClient({ publicClient, walletClient, deployment });

const context = await keelson.loadContext(lists);
const proof = await proveCompliance({
  held, tradeId, tradingAddress, context, keys,
});

await keelson.attest(proof);
await keelson.commit(tradeId, termsHash);
await keelson.settle(tradeId, terms, salt);

// The calls a party signs, and nothing else
ComplianceRegistry.attest(a, b, c, signals)
Settlement.commit(tradeId, termsHash)
Settlement.settle(tradeId, terms, salt)