A live Canton demonstrator
Allocated Swiss gold, made operable.
Aurum turns Swiss-custodied LBMA bars into fractional, transferable, pledge-ready co-ownership interests.
The core idea
Not another gold token.
Aurum is not a token wrapped around a promise. It is a control layer for allocated physical gold. Specific LBMA bars remain in Swiss custody. Holders receive ledger-based interests against that reserve. Transfer, pledge, redemption, eligibility, valuation freshness, and proof-of-reserves are controlled by the model itself.
Why it exists
Institutions should not have to choose between safety and usability.
Physical gold gives direct exposure, but it is operationally heavy. Whole bars are hard to split, move, pledge, or use quickly. Paper gold is easier to trade, but the holder carries issuer and counterparty risk. Unallocated balances are convenient, but they are claims on metal, not allocated title to specific metal.
The missing middle
Aurum is built for allocated gold with instrument-grade operability.
The gold becomes divisible
A holder can use a precise fraction of an allocated position instead of moving or selling a whole bar.
The position becomes visible
A lender, issuer, custodian, or auditor can see the state they are entitled to see, without exposing the full position to everyone else.
The wrong action is refused
Over-issuance, stale valuation, ineligible transfer, redemption of controlled gold, and reuse of pledged gold are blocked before they become transactions.
Why it is different
Three properties. Every other instrument forces you to drop one.
Allocated title, near-zero counterparty risk, and instrument-grade operability. Each existing way of holding gold concedes one of the three. Aurum is built to concede none.
Allocated title, near-zero counterparty risk, and operability in one place. No existing product offers all three.
How it works
A specific bar at the gate. A usable interest in the pool.
The model keeps the bulk specific and audited, while making each holder's interest divisible, transferable, and controllable. That is the move that turns inert metal into usable collateral without losing the allocated character of the gold.
Admit the bars
Allocated LBMA bars enter the reserve with issuer and custody control. Each bar is tied to refiner, serial number, weight, fineness, and custody status.
Issue the interest
A holder receives a fractional co-ownership interest against the reserve. The interest is divisible, transferable, and visible only to entitled parties.
Move or lock the position
The holder can transfer, pledge, margin, redeem, or borrow against the position, subject to the rules. If pledged, it locks until release or enforcement.
Keep evidence attached
Reserve state, custody state, control state, and provenance remain attached to the position. The gold can be used without losing its allocated character.
Collateral
The claim moves. The metal does not.
Aurum lets allocated gold become working collateral without sending the metal out of custody. A holder pledges a position to a named secured party. The position becomes controlled. The lender sees the lock, the haircut, the valuation status, and the enforcement path. The holder sees available capacity and restrictions. Unrelated parties see nothing.
This is not title transfer
It is not a title-transfer repo, not leased gold, and not rehypothecation. The holder keeps title and the specific gold stays segregated.
What a lender can see
Collateral amount, control status, valuation freshness, eligibility status, reserve backing, and enforcement route.
What the model blocks
Transfer of pledged gold, redemption of controlled gold, reuse of the same gold, stale valuation, and action by an ineligible party.
Gates are shown before the action commits
A pledge is not a database flag set by the interface. It is a ledger action with signatories, rights, obligations, and refusal paths.
- The holder owns the interest being pledged.
- The valuation is fresh and approved.
- The draw stays within eligible value.
- Both required parties sign the relevant action.
Proof of reserves
Over-issuance is impossible, not discouraged
The Reserve view reconciles allocated metal against issued claims directly from the pool contract. The pool carries the rule issued ≤ allocated and enforces it on every issuance in the same transaction. You can attempt an over-issue in the Issue tab; the ledger refuses it and the demonstrator shows the refusal verbatim. That refusal is the proof of reserves: you cannot mint a claim the metal does not back.
Who sees what
One position. Different authorised views.
Aurum is role-aware. The same gold position is not shown the same way to everyone. Privacy is not added afterwards. It is part of the operating design.
Holder
- Sees own position, free gold, controlled gold, available capacity, pending actions, and restrictions.
Issuer
- Sees reserve state, issuance capacity, eligibility controls, redemption requests, and operating exceptions.
Custodian
- Sees bar identity, custody status, reconciliation state, and confirmation duties.
Secured party
- Sees the collateral locked to them, valuation state, control rights, cure status, and enforcement route.
Auditor or observer
- Sees the proof surface, snapshots, exceptions, and disclosed evidence without receiving operational control.
Refused by construction
The refusals are the product.
Aurum is valuable not only because of what it enables, but because of what it will not allow. For institutional gold, safety is not a marketing claim. It is the set of things the system will not let happen.
What the ledger refuses
TransferTests:testPledgedRefused: ok
ValuationTests:testStalePriceRefused: ok
MultiIssuerTests:testIssuerCannotSeePeerEntitlements: ok
Internal model: 49 templates | 190 gated choices
Control room
A working instrument, not a diagram.
Aurum is a live Canton/Daml demonstrator for allocated Swiss gold. It already models the core institutional lifecycle: reserve, issuance, transfer, redemption, pledge, control, borrowing base, margin, guarantee, substitution, settlement, liquidation, and proof.
Acting as
Holder view
Canton
Per-party privacy with multi-party settlement. Each party sees only its own authorised view of a shared position.
Daml
Financial rights and obligations are encoded in the contract. Prohibited actions refuse by construction.
Typed frontend
The interface acts as a control room for allowed actions. The ledger remains the source of truth.
Built for the parties who move the market
Custody, control, proof, privacy, and usable collateral.
Aurum is designed for the institutional reality of gold. Each party must see enough to act, but not more than it is entitled to see.
Institutional allocators
Hold gold exposure with more precision, more transparency, and less operational friction.
Bullion partners
Make allocated metal more useful without moving away from custody, bar identity, and trusted market practice.
Lenders
Assess, monitor, and control gold collateral with clearer visibility and stronger restrictions.
Issuers
Originate instruments backed by real metal, with reserve logic and control rules built into the operating model.
Auditors and observers
Review the reserve, the position, and the control surface without becoming operational parties.
The Swiss legal foundation
Swiss law was rewritten for exactly this.
The 2021 DLT Act gave ledger-based rights a place in Swiss securities and bankruptcy law. Aurum's structure is built to sit on those provisions. This is a reasoned reading of public regulatory material, not a determination; classification is to be confirmed with Swiss counsel in Phase 1.
Art. 973d CO · the securities rail
- A right such as co-ownership of gold can be registered on a ledger and transferred without a written assignment, with the same good-faith protection as a traditional security.
- The register must give the creditor, not the debtor, power to dispose. Aurum's per-party Canton model is built to that exact test.
Revised DEBA · bankruptcy segregation
- Ledger-based assets can be segregated from a custodian's insolvency estate, the basis for holding the metal off the custodian's balance sheet.
- Aurum's pool, with per-holder fractional shares against a serialized barlist, maps directly onto this segregation test.
The prudential tailwind
Under the Basel framework, claims secured by allocated gold carry a 0% risk weight, while unallocated paper gold attracts an 85% stable-funding charge. The rules reward exactly what Aurum is: allocated, segregated, and held outright.
Legal and validation note
Built for the conservative path.
Aurum is designed around allocated co-ownership of Swiss-custodied gold, expressed through ledger-based rights and validated against Swiss custody, securities, insolvency, and distribution requirements.
The legal structure is a Phase 1 validation item. The model is built to be tested with Swiss counsel, bullion partners, custodians, and institutional distributors before incorporation or launch.
Aurum is not trying to avoid regulation. It is built for the market where regulation, custody, and trust matter most.
The hard part is already built.
Allocated Swiss gold can stay in the vault and still become usable. Aurum shows the operating model: proof, privacy, transfer, pledge, control, and refusal by construction.