The systems we built and run.
Not brokered access to somebody else's infrastructure. These are ours, which is why the specifications below are exact rather than approximate. Three ways in: an operator console, a desktop terminal, and an interface for machines.
Protocol
A server based execution environment for Protocol 101.x and 201.x transactions. Operators work from a fixed screen sequence, approval codes are entered under validation, and funds are retrieved from the cloud through privileged network functions on a dedicated processing path.
Every run writes a complete record: what was entered, who approved it, which path it took, and what came back.
- Cloud fund download through privileged functions
- Handling for both 4 digit and 6 digit approval codes
- Dedicated processing path, separate from standard authorization
- Transaction status visible in real time
- Complete audit trail and exportable documentation
- Protocols
- 101.1 to 101.5, and the 201.x family
- Approval codes
- 4 digit and 6 digit
- Fund retrieval
- Cloud download, privileged functions
- Banking rails
- Major global networks
- Crypto payout
- Leading chains
- Record
- Full audit trail per transaction
Separate families, separate processing paths.
Which one a transaction takes depends on whether it needs to settle live or be pre authorized and completed later.
Protocol 101.x
Online style flows, numbered 101.1 through 101.5. Each variant maps to a different processing path tuned for live settlement, so the operator picks the variant that matches the corridor rather than forcing every transaction down one route.
Use when the transaction has to settle in the same session.
Protocol 201.x
Offline and pre authorization flows. Used where the transaction is approved at one point and completed at another, which is the normal pattern when the receiving side needs its own review window before funds land.
Use when approval and completion happen at different times.
From operator input to settled funds.
-
Operator input
Transaction data is keyed in from the black screen and blue screen displays. Each field is validated as it is entered, so malformed instructions never reach the processing stage.
-
Card data verification
Cardholder name, issuing bank, and the associated metadata are revealed for checking. The operator confirms the transaction is pointed at the account they expect before anything is authorized.
-
Authorization and cloud retrieval
The approval code is supplied, 4 digit or 6 digit depending on the protocol. Once accepted, the server retrieves funds from the cloud through privileged network functions.
-
Settlement and record
The result is returned immediately. Successful transactions proceed to settlement on the chosen rail, and the full documentation set is written and available for export.
IPIP Terminal
A standard wire sends a message between banks and settles the debt later. IPIP works the other way around: value is written straight into a shared ledger, and the linked receiving server reflects it almost immediately.
IPIP Terminal is the command line front end for that workflow. Authenticate, run an inquiry against a transaction reference, then download the funds into a sub account, all from one screen.
- Secure operator login on an encrypted channel
- Transaction inquiry against a TRN, with ledger match and status
- TRN and UETR download, reflected into a sub account
- Windows desktop client, launched from the member dashboard
- Inquiry and download capacity extended as an engagement requires
SESSION SECURE · CHANNEL ENCRYPTED
$global_server/start> login ••••••
[OK] Operator authenticated
$global_server/start> inquiry TRN 8829-1147-2201
[OK] Ledger match · RECEIVABLE
$global_server/start> download UETR a1b2c3...
[OK] Funds reflected to sub account
$global_server/start>
StoS, IPIP, and IPID.
These three get used interchangeably and they should not be. One is the road, one is the movement, one is the key.
A dedicated encrypted line between two organisations, host to host. The servers shake hands, authenticate, and exchange data packets that represent value. Automated, built for volume, no human teller anywhere in the loop.
A ledger to ledger transfer. Rather than routing through a central bank clearing chain, the movement happens inside the shared ledger as an internal reallocation, which is what skips the usual correspondent delay.
If IPIP is the movement, IPID is the address. A unique transactional code identifying one specific incoming packet of funds, so the receiver can claim it into the correct sub account instead of parking it in suspense.
A direct link, not a messenger.
- Bank A sends a message saying it owes the money
- The debt settles later through correspondent accounts
- Multiple intermediaries, and a delay at each one
- Funds are written directly to the server, which is the IPIP part
- The linked server reflects the value almost immediately, which is StoS
- The receiver uses the IPID to lock the funds into the right account
Even an internal transfer leaves a traceable digital footprint. Legitimate transactions always carry a verifiable data trail, and IPIP Terminal is built around making that trail visible rather than hiding it.
API to API
Protocol and IPIP Terminal both put an operator in front of a screen. API to API takes the operator out of it. A counterparty institution authenticates against our v1 interface, posts an instruction, and the value is credited to a beneficiary account held here. On that call we are the receiving institution.
The engine underneath is the same one the other two platforms use, addressed by machine rather than by hand. Instructions travel as an ISO 20022 pacs.008, the message an MT103 became, and each one is tracked end to end by its UETR until a pacs.002 confirms it landed.
- One key per partner institution, with its own ceiling and its own off switch
- Keys bound to a registered network, so a stolen key alone gets nowhere
- Beneficiary numbers carry a check digit, so a mistyped account fails rather than misroutes
- A sandbox that answers exactly like production and moves nothing
- Every refusal written to a log the account holder can read, origin address included
// base URL is issued with your credentials
$ curl -X POST <base>/v1/transfers \
-H 'Authorization: Bearer <partner-key>' \
-H 'Content-Type: application/json' \
-d '{ "sender_swift": "<bic>",
"receiver_account": "<beneficiary>",
"amount": 2500000.00,
"currency": "USD" }'
[201] uetr a1b2c3d4-e5f6...
[201] status PROCESSING
$ curl <base>/v1/transfers/a1b2c3d4...
[200] status COMPLETED · pacs.002
$
Four addresses, and nothing hidden behind them.
- GET /v1
- The discovery document. Everything described on this page, in the form a machine can read, so an integration team can start without waiting on a person. Public.
- GET /v1/health
- Operational or degraded, with no authentication required, so a partner can watch the interface from inside their own monitoring rather than taking our word for it. Public.
- POST /v1/transfers
- Initiate a transfer. The response carries the UETR, our transaction reference, and the settlement date the instruction is expected to land on, which is what the sending side reconciles against.
- GET /v1/transfers/{uetr}
- Track one transfer: the status now, the settlement phase it is sitting in, and the tracker showing each institution that has acted on it and when.
The base URL is issued with your credentials rather than published here. Status URLs inside a response are built from the host the request arrived on, so an institution fronting the interface under its own domain hands its own clients addresses on that domain, and nothing in the payload points anywhere else.
Three checks before a single field is read.
The key
Each partner institution holds its own key, with its own daily ceiling and its own status. One partner can be suspended without touching anybody else, and a key only ever sees the transfers it created.
The network
A key works only from the address ranges registered against it. A valid key presented from an unlisted address is refused, and a call claiming to be an institution we know while arriving from outside that institution's network is refused as impersonation.
The signature
Optional, and we recommend it: an HMAC signature over the timestamp and the raw body, sent as a header. A signed request has to verify, and a stale one is rejected, which closes replay. A partner can be set to require it on every call.
From accepted instruction to credited funds.
-
Accepted
The instruction is validated, assigned a UETR, and acknowledged. This is where the API response comes back, so the sending side has a reference before anything else happens.
-
Screened
Sanctions and anti money laundering screening runs at the receiving institution before value moves. A file that fails here stops here, and the reason is recorded rather than left as a silence.
-
Routed
Value moves through the correspondent chain across nostro and vostro accounts. This is the part of a cross border leg that takes real time, and the tracker shows which institution is holding it.
-
Credited
On the value date the funds are posted to the beneficiary account and a pacs.002 confirmation is written against the UETR. The transfer reads as completed from that moment.
Every partner starts in the sandbox, which answers with the same payloads and the same error codes as production and settles nothing. Integrate there, prove the failure paths as well as the happy one, and move across when both sides agree the integration is finished. Live credentials are issued after that, not before.
Who these platforms are built for.
Neither platform is a self service product. Access is granted per engagement, after we understand what you are settling and have completed diligence on both the party and the funds. That order is deliberate and it is not negotiable.
- Institutions, trusts, family offices, and professional clients
- Operators acting under a mandate we have documented
- Counterparties whose source of funds can be evidenced
- Credentials tied to one account, never shared between operators
-
Tell us the transaction
Amount, currency, the jurisdictions on both sides, and the outcome you need. We will say at this point whether the platform is the right instrument for it.
-
Diligence
Identity, beneficial ownership, and source of funds are verified before anything is provisioned. Files that cannot be evidenced do not proceed.
-
Provisioning
Credentials are issued against your account and scoped to the engagement, with the operators you have named recorded against it.
-
Operate
Run transactions with a named contact on our side throughout, and pull the audit record and documentation whenever you need them.
Already have an account?
Sign in to run transactions, track status, and pull documentation. New to the platforms? Ask us about onboarding first.