Markets that settle what they cannot read.
zkFMI is a family of protocols for financial market infrastructure where the venue never sees the order, the settlement layer never sees the amount, and anyone can still check that the price was the best one offered and that both legs moved together. Every number here has an artifact behind it. Every limit is written down.
2026-09-12 · Note settlement and privacy · PQC research progress · Latest execution evidence and limits
Decide anywhere, instruct once, settle without reading
Whatever decides a transfer, a venue such as a quoting market or an order book, or an application such as a fund administrator, a collateral engine or a bank's checks, puts its decision on one sealed instruction. The settlement layer verifies the instruction's proofs and moves both legs, or neither, without learning what was decided. The worked example on this site is a request for quote: the winning price leaves the venue as a commitment, the same commitment is proved minimal, signed by the quorum, carried by the instruction and consumed by the ledger's product proof. One value, four proofs, never opened. Fund subscription, collateral calls and two-currency payments take the same path from a different instruction source.
What settlement never reads
- the amounts
- the price
- which instrument
- who paid whom
- the maker's pricing rule and the losing quotes
What hides it
- Pedersen commitments plus range proofs
- a blinded asset tag, fresh at every transfer
- a note ledger with a one-of-many ring
- Shamir shares across seven nodes, honest majority, malicious security
- per-venue handles derived from one seed
What settlement does check
- value is neither created nor destroyed
- no balance goes negative
- cash leg = quantity × price
- both legs move, or neither does
- one instruction settles once, signed by a 3-of-7 quorum
The stack
The protocol core is the instruction and the ledger, with eligibility and clearing beside them. Venues and applications sit above as interchangeable instruction sources. Eight repositories under the zkFMI organisation, composed through explicit ports rather than shared state.
zkPI
Zero-knowledge payment instruction. A venue's decision, provable without the inputs that produced it: committed amount, price and asset, a nullifier, a deadline, a FROST quorum signature, two threshold range proofs. 9,726 bytes on the wire.
DeFMI
Decentralized financial market infrastructure. Delivery versus payment and payment versus payment over committed balances, notes with ring signatures, asset tags, netting, a default waterfall, reconciliation against a book of record. Runs as a dedicated non-EVM Avalanche L1.
DeKYX
Decentralized know-your-X. Anonymous presentations that prove only the qualifications one action needs, bound to audience, action, nonce and expiry. Scope-specific nullifiers, signed revocation lists, key rotation. Pseudonymous per scope, not yet issuer-unlinkable.
DeCCP
Decentralized central counterparty. Threshold-governed clearing books, gross-gross to net-net cycles, margin, confidential guarantee facilities, a deterministic loss waterfall. Advances state only against a DeFMI receipt for the exact proposal. Novation costs 0.53 µs a trade.
Aethel
Programmable payment-stream receivables. A signed payment stream becomes a financeable receivable; independent providers supply credit decisions, guarantees, funding and servicing through scoped capabilities. Settles by issuing a typed zkPI.
Other applications
zkPI and DeFMI are not QOMM parts. Fund subscription and redemption, collateral and margin calls, two-currency PvP, issuance and coupons, receivables, environmental certificates. Any system that decides may issue the instruction.
Where it sits among the alternatives
Six axes, stated in both directions. On most of them somebody else is stronger; on two of them nobody else is present.
| Conventional FMI chain | DvP on DLT pilots | Canton (Daml applications) | MPC dark pools (Rialto, P2DEX, Renegade) | Prime Match (J.P. Morgan) | Auditable MPC (BDO 2014, Rivinius 2022) | zkFMI | |
|---|---|---|---|---|---|---|---|
| venue sees the order | yes | yes | own validator and app do | a delegated relayer does | semi-honest hub | no | no |
| settlement sees amount and price | yes | yes | the parties' validators | mostly | yes | out of scope | no |
| best execution provable by an outsider | reports, abolished as unverifiable | no | parties re-execute the rules | matching proof, not the order set | no | circuit correctness | yes, the mechanism |
| clearing: novation, netting, waterfall | CCP | partly | per application | no | bank pipeline | no | DeCCP, on commitments |
| robustness / accountability | legal | consensus | parties + BFT ordering | varies | the bank | Rivinius: both, 11–20× | rung 1 deployed; rung 5 built at n=9 |
| in production | yes | pilots | mainnet, commercial repo | some | yes | no | research, one host |
The prior-art page has the paper-by-paper version, including the three claims retracted from earlier drafts. Comparison with other systems covers eighteen products and platforms, Canton in depth, from public materials of 2026-09-05.
Where the trust actually sits
Publicly verifiable, rung 1
The quote proof lets anyone check the winner was the minimum of the committed keys. The deployed MPC is malicious-secure with abort: a deviation is detected, not attributed, not survived. Robust reconstruction at n ≥ 4t+1 is built and measured at nine nodes, and costs less than the deployed engine; the deployed engine runs seven.
Validators check everything submitted
Every Avalanche validator independently verifies the 3-of-7 approval, the typed instruction, the complete quote proof, both joint range proofs, the taker's price limit, the asset link, the DvP relation, deadline, sequence, previous root and nullifier before applying a transition atomically.
What they do not re-run
Validators do not replay the private MP-SPDZ transcript. The share-to-proof handoff is closed by matching the field and a per-party input check, and that remaining committee trust boundary is stated in the wire specification rather than left implicit.
Post-quantum, half done on purpose
Signatures and key exchange are moving to hybrids: Ed25519 + ML-DSA-65 and X25519 + ML-KEM-768, both halves required, downgrade refused. Accepted on one host and on main in all eight repositories since 2026-09-07. The zero-knowledge relations stay on the discrete logarithm until a commitment that reopens many times exists without a group. Status.
Anonymity is other people's traffic
A ring of 16 with no other settlements around it names its note with certainty. With sixteen settlements of traffic and recency-matched decoys the observer is at the nominal 1/16. A construction that hides you in a crowd does nothing in an empty room, and the measurements say so.
Three ways in
Build against it
- The zkPI wire layout and its vectors
- What DeFMI checks, then the note ledger
- Binding computed to committed
- Clone, test, run the L1 gate
Decide what to deploy
- Choosing a deployment: placement, profiles, switches
- Netting models and the intraday limit
- DeCCP and DeKYX
- Applications beyond venues
Check the claims
What this is not
A research implementation. Not audited. It custodies nothing and there is no token. Every multi-node acceptance ran as processes or containers on one host under one administrator: five AvalancheGo validators, seven MP-SPDZ parties, seven order-book nodes. No deployment has run across independent organisations, a real WAN, HSM-held keys or a legal finality regime. Under Japan's book-entry regime DeFMI cannot be the register; it mirrors one and reconciles. None of this is compliance, and "auditable" is material for control, not control. The status page lists what stands between the current gate and production, item by item.