Institutional payments infrastructure
Yamale settles payments between banks, funds and businesses in the time it takes to read this sentence — carrying the reference and purpose codes reconciliation actually needs, on a network where every participant has been approved rather than merely allowed.
A cross-border payment today takes days, passes through correspondents that each take a cut, and arrives stripped of the reference that would let anyone match it to an invoice. Public blockchains fix the speed and lose everything else.
| Correspondent banking | A public blockchain | Yamale | |
|---|---|---|---|
| Settlement | 2–5 days | Seconds to minutes | Seconds, final |
| Who may take part | Whoever your correspondent already banks | Anyone with a key | Institutions approved by name, by a national authority |
| Reference and purpose | Truncated, or lost between hops | A memo field, if any | First-class fields, ISO 20022 shaped |
| Who issues the currency | The central bank, off-ledger | Anyone, unbacked | One approved issuer per currency |
| Who can freeze an account | Any correspondent, unilaterally | Nobody | A national authority, on a public case with an ombudsman veto |
| Who can seize funds | A court order, executed by a bank | Nobody | Two thirds of validators, into an account no one person holds |
| What a supervisor can see | What each bank chooses to report | Everything, including what it should not | Its own country's payments, by a key it was granted |
Yamale keeps the speed of the second column and puts the accountability of the first one back — enforced by the chain rather than promised in a contract.
Seven things the chain does, and the rule each of them enforces rather than recommends.
Credit transfers shaped like ISO 20022, the standard banks already use. The end-to-end reference and purpose code are first-class fields, not a memo — so a payment arrives already matched to what it was for.
RefusesAn institution not approved by a national authority, or a customer that institution never registered.
Fiat-referenced tokens with exactly one approved issuer each. Only that issuer can mint or redeem, and the permission is a governance decision recorded on the chain rather than a setting in a config file.
RefusesA second issuer for a currency that already has one.
Shared funds with roles, spending limits and time locks. Money committed to somebody — a vesting grant, a scheduled disbursement — leaves the spendable balance entirely and cannot be redirected by anyone.
RefusesSpending funds already committed to somebody — no administrator, no vote and no quorum of signers can reach them.
Liquidity pools anyone may open or add to, so a holder of one currency can move into another without leaving the network. Prices come from the pool's own reserves.
RefusesA swap that would round in the pool’s favour against the person making it.
Exchange rates agreed by the validators, weighted by stake, so moving one costs as much as attacking the network. Real-world assets are valued instead by an appointed independent party, and every figure stays attributed to whoever signed it.
RefusesA rate too old to trust. An expired price is not a price, and the transaction depending on it stops.
A validator can freeze a stolen balance in the block they see it move — because a theft takes minutes and a vote takes hours. Taking it needs two thirds of the validator set, goes to one address set by governance, and leaves a public record of who accused whom, on what evidence, and how every validator voted. Cases that failed stay on that record too.
RefusesAny one person moving what was seized. Three of five custodians, and the destination is fixed in the constitution.
Who may validate, who may issue, who may route payments — every one of those is a vote of everyone who has staked, with the decision and its reasoning kept on the chain next to what it authorised.
RefusesA proposal that would edit one of the thirteen fixed rules, or admit a validator nobody voted for.
Every account belongs to a country, and every step below is refused until the one before it has happened. Nobody can place themselves — the institution that performed the identity check is the only party that can, and it had to be approved by that country's authority first.
Each of these closed off an easier option. They are the reason the rest of the system looks the way it does.
Block production is a decision the network makes by vote, because an institution has to be able to say who processes its transactions. Reading the chain, holding currency and being paid need nobody's permission.
When a treasury commits funds to somebody, they leave its spendable balance. No administrator, no governance proposal and no group of signers clearing their threshold can spend them. That is enforced by where the money sits rather than by a rule that checks — which is the difference between a commitment and an intention.
Every price carries when it was observed and how old that makes it. Nothing is silently frozen at its last known number: a feed that stops becomes explicitly unusable, and the operations that act on a price immediately refuse a stale one rather than guess.
New issuance decays geometrically, so the total ever created converges on a fixed number instead of growing indefinitely. What validators earn is predictable years ahead.
Fixed when the chain was created. An ordinary governance vote to alter any of them is refused by the chain itself; changing one is an amendment needing four fifths and a delay measured in weeks. These are the values in force right now, read from the network.
Reading the constitution from the chain…
The account every seized asset is sent to is one of these rules, so it cannot be redirected by the people who would benefit from redirecting it. It is a three-of-five held by five separate custodians, and no single one of them can move it.
The chain is running in public and the figures at the top of this page are read from it. What has not happened is the part that gates a real deployment: nobody outside the project has audited any of this, and the validator set is too small to survive losing a member. Both are stated here because a reader who discovers them later is right to discount everything else.
| Where | State | What that means |
|---|---|---|
| The chain | Running | Public, producing blocks, two validators. The figures at the top of this page are read from it. |
| Payments, currencies, treasuries, trading, staking, governance, prices | Built and tested | Each covered by tests, and each documented — including what it refuses to do. |
| Launch and key ceremony | Performed | Genesis built from a real ceremony; the account that receives every seizure is a three-of-five nobody holds alone. |
| Upgrades | Performed | Proposed, voted, halted at a height and applied on the running chain — not only in a test. |
| Independent audit | Not started | Nobody outside the project has reviewed this. It is the gate on any real deployment and we do not pretend otherwise. |
| Fault tolerance | Two validators | Losing either stops the chain. Four is the minimum that survives losing one, and that is a deployment decision rather than a code one. |
| Account service, USSD, agent networks | Not started | The commercial critical path for reaching people who do not hold their own keys. |
| Lending against real-world assets | Later phase | The valuation layer it needs is in place; nothing consumes it yet. |
Everything above is documented in the open, including the parts that are missing: the documentation keeps its own honest list.
A single-node network takes about two minutes to start, and the explorer points at it without any further setup.