The blockchain built
for regulated markets
Canton is a public network where participants can transact without publishing their positions to the world. Welcome to our guide on how that actually works, and why it changes what an exchange can be.
Independent educational material.
What is the Canton Network?
Most blockchains work by telling everyone everything. Every node keeps a copy of every transaction, and that shared copy is what makes the system trustworthy. It is an elegant trade: you get verifiability, and you pay for it with total transparency.
That trade is fine for a public payment. It is unworkable for a bank. If a pension fund rebalances a £400m book, publishing the size, the timing and the counterparty to a global audience is not a feature — it moves the market against them, and in many cases it breaches a duty of confidentiality they are legally bound to keep.
Canton was designed around that problem. It describes itself as “the only public blockchain with real privacy built for regulated markets” — an open network where independent applications interoperate and settle against each other, while each participant only ever holds the data they are actually entitled to see.
Rather than one monolithic chain, Canton is a network of connected applications. Each runs its own validator node holding its own contracts and data. A coordination layer — the synchronizer — orders the encrypted messages that pass between them without being able to read any of it. The result is a system that behaves like one ledger when transactions need to settle together, and like separate private ledgers the rest of the time.
Network of networks
Independent applications, each with their own node, that can still transact atomically with one another.
Global Synchronizer
The shared ordering service, run by super validators under the governance of the Canton Foundation.
Daml contracts
Canton’s smart contract language, designed to express who is a party to what — and therefore who sees what.
Institutional pull
Names including DTCC, HSBC and S&P have run or announced tokenisation work on Canton.
“Fast” is the wrong word. The word is final.
There are two clocks running on every trade, and people routinely confuse them. The first is execution — the moment your order is matched. The second is settlement — the moment the asset and the cash have actually, irreversibly changed hands.
In traditional equity markets, execution takes microseconds and settlement takes a day or two (the familiar T+1 or T+2). In between, your counterparty owes you something. That gap is not a technicality; it is the reason clearing houses, margin requirements and default funds exist.
Public blockchains shortened the gap but introduced a different problem: probabilistic finality. A Bitcoin or Ethereum transaction becomes progressively harder to reverse as blocks pile on top of it, which is why exchanges ask for a number of confirmations before crediting you. You are waiting for a probability to become acceptable.
Canton gets there through what it calls proof-of-stakeholder consensus. Instead of the whole network racing to validate everything, “only the parties involved in a transaction (the stakeholders) are responsible for validating it.” A trade between two counterparties does not queue behind unrelated activity elsewhere on the network, and validators do not need to stake capital to participate.
- Execution — your order is matched against liquidity. Milliseconds.
- Settlement — the ledger records the change of ownership. Seconds on Canton.
- Finality — the point past which it cannot be undone. Deterministic, not a countdown.
Need to know, not broadcast to all
Blockchain privacy is widely misunderstood because pseudonymity looks like privacy from a distance. Your name is not on a public chain — but your address is, and every transaction it has ever made is permanently readable by anyone with a browser. Chain analysis firms exist precisely because linking an address to an identity is tractable, and once it is done, your entire history is retrospectively exposed.
For a bank, an asset manager or a market maker, that is disqualifying. Order flow is proprietary. Counterparty relationships are commercially sensitive. Client positions are confidential by law.
Canton’s answer is structural rather than cosmetic. There is no global copy of the ledger to read. Each participant’s node stores only the contracts they are a party to, and transactions are decomposed so that “each party only receives and records the parts of a transaction that apply to them.”
Consider a delivery-versus-payment settlement — shares moving one way, cash the other. The cash bank sees the payment leg. The securities registrar sees the share transfer. Neither sees the other. The buyer and seller see the whole thing, because it is their trade. And the infrastructure operator coordinating it sees encrypted traffic and minimal metadata.
Crucially, this is not privacy at the cost of auditability. Because visibility is defined by who is a party to a contract, an auditor or regulator can be given a durable, verifiable view of exactly what they are entitled to see — rather than either everything or nothing.
Who can actually move your assets?
Strip away the branding and every venue answers one question: if you hold an asset here, whose signature is required to move it?
On a custodial exchange, the answer is theirs. You hold a claim on the venue — an entry in their internal database saying they owe you. That claim is only as good as the institution behind it, which is the lesson repeatedly and expensively taught by exchange failures over the last decade.
On a non-custodial venue, the answer is yours. Assets sit in an account you control, and the venue’s infrastructure can facilitate a trade but cannot unilaterally move your holdings.
On Canton, assets are held by a party — your identity on the network — and authorisation happens through keys you hold. Application operators run the validator infrastructure that hosts contract data, but running infrastructure is not the same as controlling assets.
It is worth being honest about the trade-off. Self-custody transfers responsibility along with control: lose the key material and there is no support desk that can reverse it. This is why passkeys, hardware-backed signing and institutional custody partners matter — they preserve the property that only you can authorise a move, while making the key itself harder to lose. For institutions, a regulated qualified custodian can hold keys without the venue ever gaining the ability to move assets.
You hold an IOU against the venue. Convenient, recoverable, and exposed to that venue’s solvency and conduct.
Assets sit in your own on-ledger account. Nobody else can move them — including you, if you lose the keys.
A regulated third party holds key material under mandate. Common for institutions with fiduciary duties.
All legs, or none at all
A trade has at least two legs. You give up one thing and receive another. The dangerous question is what happens if one leg completes and the other does not.
Finance has an expensive name for this: principal risk — sometimes Herstatt risk, after the 1974 collapse of a German bank that had taken in Deutschmarks in the morning and failed before paying out the dollars that afternoon. An enormous amount of financial plumbing, from central counterparties to escrow agents, exists to manage the window in which one side has paid and the other has not.
Atomic settlement removes the window rather than managing it. Both legs are parts of a single transaction with a single outcome: either the whole thing commits, or none of it does. There is no intermediate state in which one party is exposed.
What makes this genuinely difficult is doing it across applications. In most ecosystems, moving value between two systems means a bridge: lock here, mint there, and trust the machinery in between — a design that has been responsible for some of the largest losses in the industry.
Canton handles it in the ledger itself. Every active contract is assigned to exactly one synchronizer at a time. When a transaction needs contracts that live on different synchronizers, the network reassigns them first: unassign from the source, then assign to the target. The documentation is precise about the guarantee — “the contract is never on two synchronizers at once, and it is never in a state where it could be lost.” Applications built by different companies can therefore settle against each other atomically, without a bridge.
A market you can address in code
Serious market participation is not done by hand. Market makers quote continuously, treasury desks rebalance on schedules, funds execute against benchmarks, and increasingly, software agents act within mandates set by a human. All of it requires an interface that a program can drive.
That is partly an API question and partly a settlement question. Automation is only safe when outcomes are unambiguous. If a settlement might half-complete, or might reverse after the fact, then every automated strategy has to carry reconciliation logic and a risk buffer for states that should not exist.
Canton’s validator nodes expose APIs for building and submitting transactions, with contract logic written in Daml — a language built around explicitly declaring who the parties to an agreement are, which is what drives both the authorisation rules and the privacy model.
Applications on top add their own SDKs. Cantex, for instance, publishes an open-source Python SDK for programmatic and agentic trading. The wider point is architectural: when the ledger guarantees that a transaction either happened or did not, a machine can act on it without a human checking afterwards.
# Illustrative pseudocode — not a real API result = venue.submit_swap( give="1000 USDC", take="CC", max_slippage=0.005, ) # Two outcomes. Never a third. if result.settled: book.record(result.tx_id) else: # nothing moved. safe to retry. retry()
Anatomy of a Cantex settlement on Canton
Five ideas, one sequence. Here is what actually happens between pressing a button and owning a different asset.
You authorise, off-ledger
Your client builds the transaction and you sign it with a key only you hold. Nothing has settled yet — and nothing has been published. On Cantex, this step takes 5–10 milliseconds.
The transaction is decomposed
The ledger works out who is a party to which part. Each participant will receive only their own view — the sub-transaction privacy model, applied concretely.
Stakeholders validate
The validator nodes of the parties involved check their portion against the contract rules. Unrelated participants are not consulted, do not queue, and learn nothing.
The synchronizer orders it
Encrypted packages are sequenced so everyone agrees on ordering. The synchronizer coordinates without being able to decrypt what it is coordinating.
All legs commit, atomically
Both sides of the exchange land in a single on-ledger transaction, or neither does. Settlement is final at that moment — no confirmation count, no reversal window.
Glossary
The terms you will meet most often, in one place.
- Atomic settlement
- All parts of a transaction commit together or none do. Removes the window in which one party has paid and the other has not.
- AMM (Automated Market Maker)
- A venue where trades price against a pool of deposited liquidity using a formula, rather than matching against a counterparty’s resting order.
- Daml
- The smart contract language used on Canton. Contracts declare their parties explicitly, which drives both authorisation and who can see what.
- Deterministic finality
- Settlement is final the moment it is confirmed, rather than becoming progressively harder to reverse as blocks accumulate.
- DvP (Delivery versus Payment)
- A settlement structure in which the asset moves if and only if the payment moves. The canonical use case for atomicity.
- Global Synchronizer
- Canton’s main ordering service, operated by super validators under the governance of the Canton Foundation.
- Party
- An identity on the Canton ledger that can be a stakeholder to contracts and authorise actions with its keys.
- Principal risk
- The risk that you deliver your side of a trade and your counterparty fails before delivering theirs. Also called Herstatt risk.
- Proof-of-stakeholder
- Canton’s consensus approach: only the parties to a transaction validate it, rather than the whole network.
- Sub-transaction privacy
- Privacy enforced on parts of a transaction, so each party records only the portion that applies to them.
- Synchronizer
- The routing and ordering layer between validators. Sequences encrypted messages it cannot read.
- Validator
- A node that hosts contract logic and data for its parties, and validates the transactions they are stakeholders in.
Where an exchange fits
Canton is settlement infrastructure. Turning settled assets into a liquid, tradeable market is a separate job — and it is the job Cantex was built to do.
Cantex is a Canton-native automated market maker — an exchange that inherits the network’s properties rather than working around them. Canton brings institutional assets on-chain: equities, bonds, funds and real-world assets. The layer that makes those assets liquid and tradeable is being built now.
Every concept on this page shows up in how it is built:
- Speed — sign and submit in 5 to 10 ms off-chain, settle on-chain in seconds, with no gas.
- Privacy — Canton’s need-to-know model keeps balances and trades visible only to the parties involved.
- Self-custody — assets stay in your own Canton account. Cantex runs infrastructure; you keep control.
- Atomic settlement — every trade settles in a single on-ledger transaction.
- Programmatic access — a public SDK in production for automated and agentic strategies.
- Built with CaviarNine, Digital Asset and Bitsafe, on the Canton Network.
Frequently asked
If nobody can see the ledger, how do I know it is correct?
Because you can see your own part of it, and every party to a transaction independently validates their part against the contract rules before it commits. Correctness comes from the parties who have something at stake verifying it — not from strangers replicating data they have no interest in. Auditors and regulators can be granted a verifiable view of exactly the scope they are entitled to.
Is Canton a public or a private blockchain?
Public, in the sense that it is an open network that anyone can build on and connect to, with a decentralised ordering layer run by many independent operators. What is private is the data, not the network. That combination is unusual and is the main thing that distinguishes it from both public L1s and closed consortium chains.
How is this different from a privacy coin or a zero-knowledge rollup?
Privacy coins obscure a transparent ledger with cryptography. Zero-knowledge systems prove statements without revealing inputs. Canton takes a third route: the data is never distributed in the first place. Each node only ever holds contracts it is a stakeholder in, so there is no global dataset to obscure or prove things about.
What does “non-custodial” actually guarantee?
That the venue cannot move your assets. It does not guarantee the asset will hold its value, that a smart contract is free of bugs, or that you cannot lose access by losing your keys. It removes one specific risk — the venue absconding with or freezing your holdings — and hands you the responsibility that comes with that.
Why do institutions care about atomic settlement so much?
Because the alternative is expensive. Managing the gap between one leg and the other requires capital: margin, default funds, credit lines and a clearing house to sit in the middle. If settlement is atomic, a large part of that machinery has nothing left to protect against, and the capital it ties up is freed.
What is being tokenised on Canton?
Canton is aimed at institutional assets — equities, bonds, funds and other real-world assets, alongside cash instruments. DTCC has work underway on tokenising U.S. Treasury securities, HSBC has completed a tokenised deposit pilot, and S&P has been tokenising a Treasury index. Across the wider market, on-chain tokenised real-world asset value passed $36bn in late 2025, excluding stablecoins.
Where should I go to read primary sources?
Start with the Canton Network site and its technical primer, the Canton documentation, and Canton’s note on institutional-grade privacy. This page is a summary written for people meeting these ideas for the first time, and it simplifies in places.