Global foreign exchange averages approximately $9.6 trillion per day in over-the-counter turnover¹. Despite this scale, access remains gated by bilateral credit relationships, prime brokerage arrangements, and venue permissions. The fastest-growing participant segment (institutional buy-side firms) expanded activity by roughly 60% between the 2022 and 2025 BIS surveys, yet these participants require privacy, compliance controls, and deterministic execution that most current venues do not jointly provide¹. Section 2 examines this market structure and derives the two buy-side constraints that shape venue design.

Global OTC FX turnover, 2004-2025¹

In parallel, stablecoins have exceeded $300 billion in total supply and process trillions in annual adjusted transaction volume². However, stablecoins are not interchangeable across issuers. Each carries distinct redemption terms, reserve composition, and regulatory posture, creating FX-like basis and depeg risk for which institutional-grade hedging instruments are largely absent. Section 6 characterizes this risk surface.

Three developments have improved the feasibility of onchain FX venues. Aggregate blockchain throughput has grown by roughly two orders of magnitude since 2020, from approximately 25 TPS to approximately 3,400 TPS across major networks³. Zero-knowledge proofs (defined in Section 5.3) and trusted execution environments (defined in Section 5.3) can reconcile counterparty verification with trade confidentiality, enabling compliant participation without blanket surveillance⁴. Regulatory frameworks have advanced from proposals to enforcement: the EU's Markets in Crypto Assets Regulation (MiCA) is fully applied, and U.S. policy proposals for stablecoin legislation and onchain market structure are increasingly concrete²⁶.

No existing venue combines these capabilities into a single FX derivatives platform. Legacy infrastructure gates access through relationships and prefunded capital. Most decentralized venues lack the compliance infrastructure, privacy protections, and instrument sophistication that institutional participants require. This paper surveys FX market structure, characterizes the unhedged risk surface created by stablecoin fragmentation, and specifies the design requirements for an institutional-grade onchain FX derivatives venue. It then describes Ollo Finance, a protocol architecture targeting these requirements:

• FX market decomposition: A functional-layer analysis identifying which layers (settlement, execution, risk transfer) are structurally amenable to onchain displacement, and which (credit relationships, regulatory licenses) are not (Sections 3-4).
• Stablecoin risk characterization: A description of issuer-specific basis and depeg risk as an unhedged exposure class resembling traditional FX credit spread risk. This risk surface expands alongside stablecoin adoption while hedging instruments remain scarce (Section 6).
• Venue requirements specification: Requirements (enforceable counterparty eligibility, trade-intent protection, deterministic settlement, MEV mitigation, and regulatory auditability) derived from institutional buy-side constraints (Section 8).
• Ollo architecture: A protocol comprising non-fungible trading accounts, multi-collateral margin synthesis, multi-lane execution, oracle integration for 24/7 risk management, and a privacy-first compliance model targeting the structural gap between legacy FX infrastructure and the emerging onchain settlement layer (Section 10).

Sections 2 through 9 and 11 present analysis grounded in public industry data. Section 10 describes a proposed platform architecture; forward-looking claims are labeled accordingly.

2.1 Market Scale and Instrument Mix

The April 2025 BIS Triennial Central Bank Survey reports a market of record scale. Average daily over-the-counter FX turnover reached approximately $9.6 trillion, up 28% from $7.5 trillion in 2022¹. The U.S. dollar appeared on one side of 89.2% of all trades, up from 88.4%¹.

The product mix shifted. Spot trading's share rose from 28% to 31% of total turnover (roughly $3.0 trillion per day). Outright forwards climbed from 15% to 19% (a roughly 60% increase in absolute terms). Options turnover more than doubled. FX swaps, while still the single largest category, saw their share decline from 51% to approximately 42% as growth in other instruments outpaced swaps¹.

FX instrument mix by share of total turnover¹

2.2 Institutional Growth

The composition of growth is more revealing than the headline. Inter-dealer activity increased, while institutional investors (including asset managers, pension funds, and hedge funds) expanded activity by nearly 60%, rising from roughly $820 billion to $1.3 trillion per day¹.

This buy-side expansion has structural implications. These participants trade with specific requirements around privacy, regulatory compliance, and execution determinism. Growth in buy-side activity does not make existing venues inadequate by itself, but it increases the cost of the constraints those venues impose, because the participants entering the market are precisely those whose compliance and privacy requirements are most binding.

2.3 Buy-Side Constraints

The buy side's expansion intersects with two constraints that practitioners consistently cite.^† In interviews conducted during 2024-2025, low volume was never cited as the reason for institutional reluctance to engage with onchain FX. Two constraints achieved broad agreement:

Unknown counterparties. Regulated entities cannot trade against anonymous actors. KYC-compliant markets are a prerequisite, not a preference. Trading against unknown participants creates unacceptable AML and sanctions exposure.

Transparency of positions. Visibility of large orders on public networks enables front-running, MEV extraction, and adverse selection. For institutional-sized trades, this transparency is a measurable execution cost.

These constraints define the design requirements for any venue aspiring to institutional relevance. They are referenced throughout the remainder of this paper: Section 5 examines why prior infrastructure could not resolve them, Section 8 translates them into a venue requirements specification, and Section 10 describes the architectural responses.

3.1 Layer Decomposition

Foreign exchange comprises six interdependent functional layers, each with its own cost structure, barriers to entry, and points of value extraction.

The first layer is credit and access: bilateral credit lines, prime brokerage arrangements, and internal risk limits that determine which entities can participate and at what scale. Above it sits liquidity provision, dealer streams, non-bank market-maker pricing, and internalization pools that determine available prices. Distribution encompasses the infrastructure through which participants reach counterparties, including physical remittance networks, electronic venues, and app-based fintech channels. Settlement involves fragmented rails, operational cutoffs, and timing conventions (T+0 to T+2) governing when and how obligations are discharged. Compliance and identity (AML and KYC onboarding, sanctions screening, and cross-jurisdictional reporting) gate participation. Finally, the risk-transfer layer consists of derivatives instruments (forwards, swaps, and options) allowing participants to manage exposures over time.

Figure 2 illustrates these relationships. Each layer imposes costs that compound through intermediation; this compounding is one source of the margin structure analyzed in Section 4.

FX functional stack (simplified)

3.2 Participant Structure

FX's participant structure is as layered as its functional stack. Drawing on the BIS survey and practitioner estimates¹:

Note: The breakdown beyond BIS top-line categories (inter-dealer approximately 46%, "other financial institutions" approximately 50%) reflects practitioner estimates and should be treated as approximate.

3.3 Feasibility of Displacement

Not every layer is equally amenable to onchain displacement. Credit relationships and regulatory licenses represent decades of institutional capital and are unlikely to be disintermediated by protocol design alone. Distribution moats, while durable, are eroding as stablecoin-native fintechs bypass traditional remittance networks.

Settlement and execution, by contrast, are architecturally replaceable. Atomic settlement on programmable ledgers can reduce Herstatt risk (the risk that one party delivers currency but the counterparty fails to deliver the other leg) when both legs settle under the same atomic transaction boundary⁶. Risk-transfer instruments can be implemented as smart contracts with deterministic clearing rules, reducing the need for bilateral scaffolding.

However, atomic settlement requires both legs to share a settlement domain. Cross-chain transactions or fiat-to-crypto legs reintroduce settlement risk because the two legs cannot be made contingent within a single atomic operation. Additionally, replacing bilateral credit with collateral-first access shifts the barrier from relationships to capital, potentially disadvantaging smaller participants differently rather than eliminating access constraints. These tradeoffs bound the layers where onchain displacement has the highest probability of traction (settlement and risk transfer) while leaving credit and distribution largely intact. Section 4 catalogs the specific frictions within these layers and derives the design targets that follow.

4.1 Distribution Moats

FX intermediaries extract margin through proprietary distribution. Western Union's moat is a physical footprint in over 200 countries. Revolut's is tens of millions of app installations. Banks hold regulatory licenses and credit relationships that take decades to build.

The persistence of proprietary distribution is partly a legacy of slow settlement rails: each intermediary beyond a direct execution path introduces friction (reconciliation delays, correspondent-bank fees, cutoff-time mismatches) and that friction supports margin. As stablecoin-native fintechs bypass traditional remittance networks, the distribution layer is eroding, but the credit and licensing layers beneath it remain durable (Section 3.3).

4.2 Incumbent Frictions

Several friction points sustain the current margin structure:

4.3 Prefunded Capital Costs

The clearest structural inefficiency is capital trapped in prefunded accounts. FX exchanges and intermediaries maintain large pools of idle capital across currencies and jurisdictions to facilitate settlement. This capital generates little to no return and reinforces incumbent advantages by raising barriers to entry. Economies of scale allow large institutions to spread fixed costs across higher volumes, but the underlying cost persists as a drag on capital efficiency.

The opportunity cost of prefunded settlement capital is:

where \(C_{\text{idle}}\) is the trapped capital, \(r_f\) is the relevant risk-free rate, and \(r_{\text{idle}}\) is the effective yield on idle balances. A mid-sized FX intermediary maintaining $500 million in prefunded settlement accounts at a 4.5% risk-free rate earning 0.5% on idle balances incurs an annual opportunity cost of \(500\text{M} \times (0.045 - 0.005) = \$20\text{M}\). For the largest dealers, the aggregate cost scales with position size. This cost is not visible as a line item but is embedded in spreads and access fees throughout the intermediation chain.

Margin-based alternatives do not eliminate locked capital; they substitute one form of committed capital for another. The efficiency gain depends on whether margin requirements are lower than prefunded settlement balances for equivalent exposure, a condition that holds in many but not all scenarios.

4.4 Design Targets

A system addressing these frictions would satisfy four design targets:

• Collateral-first access: Replace credit gating with programmatic margin and enforceable eligibility rules. Participation depends on posted collateral and verified identity rather than bilateral credit lines.
• Atomic settlement: Release idle capital by replacing prefunded settlement with atomic execution where both legs share a settlement domain (Section 3.3).
• Deterministic matching: Replace opaque internalization with rules-based matching where execution logic is auditable.
• Expanded hedging access: Extend risk-transfer instruments (currently reserved for prime-brokerage clients) to verified participants meeting collateral requirements²⁶.

These targets define what an alternative system must achieve. However, achieving them requires infrastructure that was not previously available. Section 5 examines the constraints that historically prevented onchain FX and the advances that have since changed feasibility.

5.1 Throughput Limitations

For most of blockchain's history, the technology could not support markets of FX-like scale. In 2020, aggregate throughput across major networks was approximately 25 TPS³. Bitcoin achieves roughly 7 TPS with long confirmation and finality windows; Ethereum's Layer 1 processes roughly 15 to 30 TPS with multi-minute finality³. These figures are orders of magnitude below the processing demands of even a modest share of global FX flow.

By 2025, aggregate throughput has grown to roughly 3,400 TPS, with some networks offering sub-second block times³. Layer 2 rollups and parallelized execution architectures have contributed most of this growth, though throughput alone does not resolve the institutional constraints described below.

Blockchain throughput comparison³

5.2 Institutional Constraints

The institutional constraints defined in Section 2.3 (unknown counterparties and position transparency) remained binding throughout blockchain's throughput-limited era. Higher throughput alone did not resolve them.

The counterparty-identity constraint persisted because early blockchain architectures offered no mechanism for verifying real-world identity without exposing it to all network participants. Pseudonymous addresses provided no assurance of KYC or AML compliance, making regulated entities unable to satisfy their obligations while trading onchain. The position-transparency constraint persisted because public ledgers record every transaction and balance state in plaintext. Once a wallet address is linked to an identity, a participant's full onchain activity (order size, direction, and portfolio composition) becomes visible and exploitable⁴. For institutional-sized trades on networks with multi-second confirmation times, the window of vulnerability is operationally meaningful: adversaries can observe pending transactions and extract value through front-running or adverse selection.

These constraints are structural rather than performance-related: faster blockchains reproduce them at higher throughput unless the execution environment itself provides confidentiality and identity verification.

5.3 Privacy and Execution Advances

Two classes of solutions have moved from research to production. Zero-knowledge proofs allow one party to prove a statement (such as "this counterparty has passed KYC screening" or "these funds do not originate from sanctioned addresses") without revealing the underlying data⁴. The proof is generated using private inputs and verified against a public verification key. Practical applications include deposit screening, withdrawal screening, and selective deanonymization through key-sharing arrangements where a regulator can decrypt specific records under lawful request⁴.

Execution-design innovations address position transparency through complementary mechanisms. Batch auctions aggregate orders over a discrete time window and execute them at a uniform clearing price, eliminating ordering advantages within each batch. Request-for-quote workflows allow counterparties to negotiate bilaterally without broadcasting intent to the public mempool. Trusted execution environments can process order data in hardware-isolated enclaves, concealing details until after execution³; however, TEEs carry a hardware trust assumption and a documented history of side-channel vulnerabilities (attacks that extract information from physical implementation characteristics such as timing or power consumption), so they function as one layer in a defense-in-depth model rather than a standalone guarantee. These advances address the two binding constraints and are examined in the context of venue design in Section 8.

6.1 Scale

Stablecoins have shifted from crypto-market plumbing to a payments instrument operating at global scale². Total supply exceeds $300 billion, with more than 99% denominated in U.S. dollars². Annual adjusted transaction volume (filtered for bots, MEV, and artificial activity using the Visa, Artemis, Allium, and Castle Island methodology) runs at roughly $9 to $11 trillion, more than five times PayPal's throughput and more than half of Visa's². Monthly adjusted volume approached $1.25 trillion in September 2025 and appears weakly correlated with broader crypto trading cycles, suggesting meaningful non-speculative usage².

Stablecoin scale vs. traditional payment networks²

6.2 Non-Interchangeability

A critical distinction separates stablecoins from domestic payment instruments: stablecoins are not universally accepted at face value across counterparties. Even when pegged to the same fiat currency, stablecoins may trade at a discount depending on issuer creditworthiness, reserve composition, regulatory status, and redemption mechanics². Tether's terms of service specify that reserve composition is at "the sole control and sole absolute discretion of Tether."^‡ This differs from domestic deposits, where users do not routinely price issuer-by-issuer credit risk per transaction.

6.3 Fragmentation and Basis Risk

The stablecoin landscape has fractured into dozens of issuer-specific instruments representing the same underlying fiat: USDC, USDT, USDe, DAI, GHO, PYUSD, RLUSD, and others for USD alone; EURC, EURT, and EURCV for euros; and emerging-market stablecoins for MXN, BRL, and more. This fragmentation disperses liquidity and introduces peg risk between assets that should be identical but are not. Two issuers, Tether and Circle, control approximately 87% of total supply, compounding concentration risk².

Stablecoin issuer risk map (major USD instruments)

6.4 Historical Depegs

Stablecoin depegs are not theoretical. The Terra/UST algorithmic collapse in 2022 destroyed over $40 billion in value. USDC temporarily depegged to approximately $0.87 in March 2023 following the failure of Silicon Valley Bank, where Circle held a portion of reserves. USDT has experienced stress episodes in prior market events. More recently, Ethena's USDe and Synthetix's sUSD experienced depeg episodes in 2025. In general, stablecoins with more complex stabilization mechanisms tend to exhibit higher tail risk².

Selected stablecoin depeg events

6.5 Unhedged FX-Like Risk

Stablecoin issuer and peg risk resembles the credit spread and currency basis risk that traditional FX participants hedge with forwards, futures, options, and swaps. Yet for stablecoin holders, institutional-grade hedging tools are scarce: "Retail: very few ways exist to hedge de-pegging or loss-of-peg risk. Institutional: no products available where hedging need would be greatest"².

The basis between two issuer tokens is:

where \(P_i\) and \(P_j\) are the observed prices of stablecoin \(i\) and stablecoin \(j\) respectively. For example, if USDC trades at $0.998 and USDT trades at $1.001, the USDC/USDT basis is \((0.998 - 1.001) / 1.001 \approx -0.30\%\). Under normal conditions this basis is small, but during stress it can widen sharply.

During the March 2023 SVB event, USDC traded at approximately $0.87, a 13% deviation from par. For a holder with $10 million in USDC, this represented a mark-to-market loss of $1.3 million with no available hedging instrument to offset the exposure.

The result is a growing, under-hedged risk surface. Stablecoin supply is commonly projected to reach roughly $3 trillion by 2030²; if that trajectory holds, the absence of hedging infrastructure becomes increasingly consequential. This unhedged exposure motivates the instrument design described in Section 9 and grounds the architectural specification in Section 10.

7.1 Exchange, Not Transfer

DeFi has disproportionately optimized transfer (moving stablecoins from point A to point B through AMMs, bridge protocols, and payment applications). The exchange dimension (converting and pricing between currencies and issuers) remains less developed. A consumer in Mexico receiving USDC still needs to convert it to pesos, and the exchange facilitating that conversion often routes through dollars, reintroducing fees, spreads, and intermediaries.

In traditional FX, economic value concentrates in conversion, hedging, and funding rather than simple transfer. Swaps alone account for approximately 42% of OTC FX turnover; forwards represent 19%; options volume more than doubled between the 2022 and 2025 BIS surveys¹. The instruments that manage risk over time are where structural revenue resides.

7.2 Stablecoin-Native FX

We define stablecoin-native FX as the emerging market for pricing, trading, and hedging the basis between issuer-specific stablecoin instruments (e.g., USDC vs. USDe, USDT vs. DAI) and between stablecoin-denominated cross-currency pairs (e.g., USDC and EURC). This market exists in nascent form (including AMM pools and basis arbitrage) but lacks the instrument sophistication, compliance infrastructure, and execution quality that institutional participants require.

7.3 Why FX Derivatives Have Not Been Onchain

FX derivatives are structurally more complex than spot exchange. They require coordinated settlement across multiple legs and time periods, deep liquidity across currency pairs, and sophisticated margining and collateral management. Earlier blockchain systems lacked the performance and stablecoin liquidity to support these workflows at scale. Perpetual futures (the dominant onchain derivative) operate on a single-leg model with periodic funding-rate payments and do not replicate the time-structured cash flows of traditional FX instruments.

7.4 Feasibility

Three concurrent developments have improved the feasibility of onchain FX derivatives:

• Stablecoin liquidity at payment-network scale provides the collateral and settlement substrate. With more than $300 billion in supply and adjusted annual volumes exceeding $9 trillion, stablecoins can support margin deposits and settlement flows for derivatives markets².
• Programmable settlement on higher-throughput chains enables multi-leg coordination. Smart contracts can enforce margin calls, funding payments, and expiry logic without manual intervention.
• Atomic settlement primitives ensure both legs execute or fail together when they share a settlement domain, reducing settlement risk⁶. As noted in Section 3.3, this property holds only when both legs reside on the same chain or settlement layer.

7.5 Structural Implications

These conditions merge to define a stablecoin-native FX market.

Structural changes enabled by onchain FX derivatives

These changes do not eliminate all costs. Atomic settlement requires both legs to share a settlement domain; cross-chain or fiat-to-crypto legs reintroduce settlement risk (Section 3.3). Collateral-first access shifts the barrier from relationships to capital. Smart contract transparency, while reducing discretion, can increase position visibility unless mitigated by the privacy measures described in Section 8 and specified in Section 11.

The feasibility conditions and structural implications established above define what an onchain FX derivatives venue can achieve. The next section specifies what such a venue must achieve to satisfy institutional requirements.

8.1 Privacy as Infrastructure

Privacy is a precondition for institutional participation onchain, not an optional feature. As one investor summarized: "Privacy is critical for the world's finance to move onchain, yet most blockchains still lack it"⁴. Privacy also creates venue retention through a practical switching cost: "Bridging tokens is easy, bridging secrets is hard"⁴. Once institutions operationalize private workflows within a specific execution environment, the cost of migrating those workflows rises.

The early internet provides a precedent: weak privacy properties constrained adoption of commercial activity until transport-layer encryption (HTTPS) became standard⁴. Onchain finance faces an analogous threshold, specifically, until execution environments can protect trade intent and counterparty identity, institutional adoption remains constrained regardless of throughput or instrument availability.

8.2 Compliance Without Surveillance

Modern cryptographic techniques can reconcile participant privacy with regulator informational requirements. Zero-knowledge proofs allow a party to prove a statement (such as "I am a KYC-verified entity" or "these funds do not originate from sanctioned addresses") without revealing underlying data⁴. The proof is constructed from private inputs and verified against a public verification key; the verifier learns only the truth of the statement, not the inputs.

Practical methods include deposit screening, withdrawal screening, and selective deanonymization through key-sharing where a designated authority can decrypt specific records under lawful request⁴. Buterin and others have advanced "privacy pools," where users demonstrate clean fund provenance without exposing their full transaction graph⁵. These mechanisms allow a venue to enforce compliance at lifecycle boundaries (onboarding, deposit, withdrawal, and audit) without blanket surveillance of trading activity.

8.3 Execution Design

For institutional-sized orders, information leakage is a measurable execution cost. Three venue-design approaches address this:

Dark-pool mechanics conceal order details (price, size, and direction) from other participants until a match is found. The matching engine operates on encrypted or access-restricted order data, so unfilled orders are never exposed. This reduces adverse selection for large orders but requires trust in the matching operator or a cryptographic substitute.

Private request-for-quote (RFQ) workflows allow a participant to solicit prices from selected counterparties without broadcasting intent to the public mempool. Counterparties compete on quotes within a closed channel; the requesting party selects the best price. This protects trade intent while preserving price competition, though liquidity is limited to invited counterparties.

Batch auctions aggregate orders over a discrete time window and execute at a uniform clearing price, eliminating ordering advantages within each batch. The tradeoff is execution latency: participants must wait for the batch window to close before receiving fills. For high-frequency liquidity providers, this latency introduces pricing risk during the batch window that must be incorporated into quote width.

8.4 Deterministic Execution

Deterministic execution reduces MEV by limiting discretionary transaction ordering. One concrete example is Unichain's Flashblocks: a verifiable block builder running inside a trusted execution environment produces sub-block confirmations on the order of 200 ms³. The venue-level requirement is consistent regardless of implementation: predictable ordering and predictable settlement semantics.

8.5 Requirements Summary

An onchain venue aspiring to institutional relevance must satisfy the following requirements, derived from the buy-side constraints defined in Section 2.3:

• Enforceable counterparty eligibility: KYC and AML verification without blanket surveillance.
• Intent and size protection: Privacy-preserving execution that shields orders from pre-trade information leakage.
• Deterministic settlement semantics: Predictable, auditable post-trade outcomes.
• MEV mitigation: Fair ordering or structural minimization of extractable value.
• Regulatory auditability: Selective disclosure mechanisms for supervisory access.
• Instrument design suited to hedging: Derivatives that serve risk-transfer functions, not only speculative trading.

These requirements translate the buy-side constraints from Section 2.3 and the feasibility advances from Section 5.3 into a specification. The next two sections describe how Ollo targets this specification: Section 9 states the design objectives, and Section 10 specifies the architecture.

Ollo targets a structural gap: historically, as settlement costs have declined, exchange activity has tended to expand, and as exchange activity expands, risk-transfer tools become the constraint. Stablecoins have lowered settlement friction; the missing layer is institutional-grade FX risk transfer that is accessible, compliant, and resilient under stress.

9.1 Traditional FX

In traditional FX, access and pricing quality are downstream of relationships: credit lines, prime brokerage, internal limits, and venue permissions. That architecture serves the top of the market but systematically rations access, keeping corporates, SMEs, and emerging-market participants on inferior terms. The frictions cataloged in Section 4 (proprietary distribution, prefunded capital, opaque internalization) are symptoms of this relationship-dependent structure.

Ollo's objective in traditional FX is to address what is structurally addressable. Collateral-first access replaces bilateral credit dependency with programmatic margin and enforceable eligibility rules (Section 10.1). Deterministic clearing semantics allow users to reason about outcomes, fills, margin changes, liquidation rules, from protocol rules rather than discretionary practice (Section 10.4). Execution-quality protections shield trade intent and reduce information leakage (Section 8.3). Capital efficiency improves by replacing idle prefunded balances with onchain margining and atomic settlement where applicable (Section 10.2). These objectives do not eliminate all access barriers; collateral-first access substitutes a capital requirement for a relationship requirement, which may concentrate participation among capital-rich entities rather than broadening it uniformly.

9.2 Stablecoin FX

Stablecoins have created a new domain of FX activity: issuer-to-issuer basis (USDC vs. USDT vs. USDe), cross-currency stablecoin pairs (USD vs. EUR stablecoins), and stablecoin-to-fiat conversion at the edge. As described in Section 6, each issuer introduces distinct redemption terms, reserve policy, regulatory posture, and operational risk. The result is FX-like basis and depeg exposure without FX-grade hedging tools.

Ollo's stablecoin objectives target this gap. Issuer risk becomes hedgeable by converting basis and depeg exposure into standardized instruments (perpetual futures, prediction markets, and eventually swaps) priced, hedged, and cleared through the margin system described in Section 10.2. The protocol treats stablecoin pairs as first-class FX pairs while supporting fiat-referenced pairs where regulation and liquidity require it. Continuous operation reflects stablecoin settlement's 24/7 nature; the oracle integration in Section 10.6 addresses the timing mismatch between 24/7 stablecoin markets and 24/5 fiat reference data.

9.3 Venue Integration

FX venues become central when they are where risk is transferred. Liquidity tends to concentrate at venues offering the deepest markets in the instruments most relevant to professional risk transfer, those that determine hedging cost and funding cost.

Ollo's integration objective is to become a venue where stablecoin basis is quoted as routinely as major fiat pairs, hedgers can express risk in standardized terms, and third parties can integrate through the protocol's deterministic execution and settlement interfaces (Sections 10.4, 10.5). The mechanisms supporting this objective (verified-access network effects, execution-quality retention, and instrument breadth) are specified in the protocol architecture that follows.

Ollo is designed as a protocol stack for FX derivatives. The intent is to encode core institutional venue functions (accounts and permissions, margining, execution, oracle hygiene, and risk controls) so that they are auditable, deterministic, and composable.

Design note (forward-looking): The subsections below describe a target architecture. Specific implementation details (chain selection, cryptographic design, oracle vendors, and matching approach) are expected to evolve with regulatory requirements and empirical performance.

10.1 Non-Fungible Trading Accounts

Ollo's account model separates identity and permissions from execution keys. An institutional "account" must carry permissions, compliance state, margin configuration, and operational controls, not simply a balance.

Accounts are represented as tokenized, non-fungible objects bound to a verified entity after onboarding. Each account supports sub-accounts for strategies, desks, or risk silos, allowing a single entity to segregate exposures without maintaining separate onboarding credentials. Delegation is explicit and scoped: an account owner can authorize trader keys for execution, risk-officer keys for position modification, and compliance-officer keys for audit access, each with defined permission boundaries.

Compliance permissions are encoded directly in the account object. Eligible markets, leverage ceilings, and jurisdictional rules are enforced at the protocol level. Privacy controls (including view keys and selective disclosure) allow the account holder to control what information is visible to counterparties, the venue operator, and regulators, within the compliance framework described in Section 11.

This structure is operationally closer to how institutional trading firms function: compliance state determines what an account may do; execution keys determine who may act on its behalf.

10.2 Margin Synthesis

FX derivatives require margin systems that handle multiple collateral types and correlated exposures. Ollo's margin design targets the behavior of a conservative clearing layer rather than a retail leverage product.

Multi-collateral margining assigns risk weights and haircuts to each accepted collateral asset. For issuer-specific stablecoins, the margin system applies issuer-specific haircuts that increase under volatility, reflecting the depeg risk characterized in Section 6. The effective margin value of a collateral deposit is \(V_{\text{eff}} = \sum_{k} Q_k \cdot P_k \cdot (1 - h_k)\), where \(Q_k\) is the quantity of collateral asset \(k\), \(P_k\) is its mark price, and \(h_k\) is the applicable haircut.

Cross-margining across correlated FX exposures reduces aggregate requirements where the risk reduction is genuine. If a participant holds a long EUR/USD position and a short GBP/USD position, the positive correlation between EUR and GBP against USD means the combined tail risk is lower than the sum of the individual position risks. The margin system reflects this by computing portfolio-level value-at-risk rather than summing isolated position margins. However, correlations tend to spike during crises, so the system applies a correlation discount (a reduction in aggregate margin reflecting offsetting risk between correlated positions) bounded by a conservative floor.

Portfolio-aware maintenance margin responds to volatility and liquidity conditions. Initial margin is set at account opening; maintenance margin adjusts dynamically. When a position's margin ratio falls below the maintenance threshold, the system triggers a margin call or initiates liquidation. The conversion rules are encoded in the protocol and legible to participants before they enter positions.

10.3 Collateral Rehypothecation

Capital efficiency matters in FX, but it must not come from hidden leverage. Ollo's approach to rehypothecation, if enabled, is explicit and opt-in at the account level. Collateral reuse is bounded by hard limits and conservative haircuts: an account that opts in specifies a maximum reuse ratio enforced at the contract level. Users can verify collateral allocation through onchain accounting.

Rehypothecated collateral is segregated from core margin so that failure modes are contained. If a rehypothecation counterparty defaults, the loss is absorbed by the rehypothecation pool and backstop fund, not by core margin. The backstop fund's capitalization and replenishment mechanisms determine the credibility of this guarantee: a backstop that is underfunded or that relies on protocol-bootstrapped capital introduces a centralized point of failure. The fund's balance, contribution rules, and trigger conditions are therefore deterministic and verifiable onchain. The governing constraint is that margin secures solvency first; any incremental yield or collateral reuse is secondary.

10.4 Exchange Mechanism

FX liquidity is heterogeneous. A single mechanism is rarely optimal across retail-sized flow, institutional block flow, and market-maker quoting. Ollo's execution design is organized as parallel lanes sharing a common settlement layer.

The RFQ lane serves block-sized trades where counterparties compete on quotes without broadcasting intent to the broader market. A participant submits a request specifying instrument and size; selected market makers respond with firm quotes within a time window; the requesting party accepts the best price. The trade settles against the shared margin system.

The order-book or batch-auction lane serves continuous markets where transparency of rules and minimized ordering advantages are essential. In batch mode, orders accumulate over a discrete time window and execute at a uniform clearing price, structurally neutralizing front-running within each batch. In continuous mode, a central limit order book matches orders by price-time priority with deterministic sequencing. Batch auctions shift MEV to boundaries between batches (for example, capturing arbitrage at batch close) rather than eliminating it entirely. The choice between batch and continuous modes may vary by instrument and liquidity conditions.

The router lane handles spot conversion by sourcing liquidity externally (from DEX aggregators, AMM pools, or compliant external venues) when native liquidity is insufficient or when conversion is a precondition for a derivatives trade.

The common requirement across lanes is consistent: protect intent, minimize information leakage, and ensure deterministic post-trade outcomes. Settlement is shared, so margin, accounting, and risk controls operate uniformly regardless of execution pathway.

10.5 Liquidity Provisioning

Liquidity provision is a coordination problem. Ollo's design targets conditions under which liquidity appears when it is economically rational.

Market-maker programs define quoting obligations tied to measurable depth and uptime. Participants committing to two-sided quotes within specified spread and size thresholds receive proportional rebates. Obligations and rebates are encoded in the protocol for onchain verification. Just-in-time quoting supports RFQ workflows where liquidity is committed only upon a specific request, reducing capital at risk for providers while ensuring availability for block-sized trades.

External composability allows the router lane to source spot liquidity from outside the protocol. Incentive parameters (rebate proportionality, uptime thresholds, and spread requirements) mechanically favor sustained quoting over transient volume, aligning provider incentives with hedging utility.

The liquidity framework described above operates across all three execution pathways defined in Section 10.4.

10.6 Oracle Integration

FX introduces a core timing mismatch: many reference markets operate 24/5, while stablecoin markets and onchain settlement operate 24/7. Oracle design must address two questions: what is the mark price when the reference market is closed, and how can the system avoid forced liquidations from stale prints or thin liquidity?

A robust approach uses a hierarchical oracle structure. Primary institutional FX reference feeds provide mark prices during market hours. Secondary sources (including onchain stablecoin market prices and alternative data providers) serve as sanity checks and fallbacks. When primary feeds become stale (e.g., during weekend hours for fiat pairs), the system applies volatility-aware bands, time-weighting, and last-known-good policies bounding allowable price deviation from the last reliable observation.

Explicit circuit breakers activate when oracle inputs breach defined thresholds. If primary and secondary feeds diverge beyond a configurable tolerance, or if the time since the last update exceeds a staleness limit, the system can halt new position opening, widen margin requirements, or suspend liquidations for affected instruments until feed quality is restored.

The operational aim is to convert 24/5 reference data into 24/7 risk management without oracle-driven fragility. The tradeoff: conservative oracle policies reduce false liquidations but may delay response to genuine price moves during feed degradation.

10.7 Risk Controls

Ollo's risk controls assume stress, not normality.

Conservative margin requirements include issuer-specific adjustments for stablecoin collateral, reflecting the depeg risk quantified in Section 6.5. Haircuts increase under elevated volatility. Position limits and leverage ceilings vary by pair liquidity and participant category.

Liquidation design minimizes toxic flow through partial liquidation. Rather than closing an entire position at once (which can cascade through thin markets) the system reduces position size incrementally until the margin ratio is restored above the maintenance threshold. When partial liquidation is insufficient, backstop mechanisms including auction-based liquidation and insurance funds absorb residual losses. Insurance and backstop fund accounting is transparent: fund balances, contribution rules, and trigger conditions are deterministic and verifiable onchain.

Circuit breakers respond to extreme price moves, oracle discontinuities, and depeg events. When a stablecoin collateral asset experiences a depeg exceeding a predefined threshold, the system can automatically increase haircuts, restrict new positions in the affected pair, or suspend trading until conditions stabilize. These risk controls provide the protective layer within which the privacy and compliance design described in Section 11 operates.

11.1 Privacy Properties

Ollo treats privacy as execution infrastructure. The design targets three properties, each addressed through a distinct mechanism.

Order-intent protection prevents the market from reacting to a participant's size or direction before execution. On public blockchains, pending transactions in the mempool are visible to all observers, enabling front-running and adverse selection. Ollo mitigates this through the execution-lane design described in Section 10.4: RFQ workflows confine order details to invited counterparties, batch auctions conceal individual order parameters until the batch clears at a uniform price, and encrypted order handling within trusted execution environments prevents mempool observers from extracting trade intent. As noted in Section 5.3, TEEs provide hardware-level isolation but carry a hardware trust assumption and a documented history of side-channel vulnerabilities; they function as one component in a layered privacy model rather than a standalone guarantee.

Position confidentiality prevents other participants from inferring a trader's inventory, risk posture, or strategy from onchain data. Batched execution aggregates multiple fills into consolidated settlement updates, reducing (but not eliminating) the ability to attribute specific trades to specific accounts from public ledger data. Onchain forensic techniques and clustering heuristics can deanonymize batched transactions over time, particularly when combined with external metadata; stronger guarantees would require fully shielded execution, which is outside the current design scope. The account model described in Section 10.1 supports view keys and selective disclosure, allowing the account holder to control which parties observe position state.

Counterparty privacy allows trading with verified entities without unnecessary exposure of identity or transaction graph. Zero-knowledge attestations allow a participant to prove compliance properties (KYC verification, sanctions-clean fund provenance, jurisdictional eligibility) without revealing underlying documents or personal data. The verifier learns only that the attestation is valid; the prover's identity and transaction history remain private within compliant bounds.

11.2 Compliance Architecture

Ollo's compliance objective is legibility: regulators and counterparties should understand what rules apply, how they are enforced, and what data can be produced under lawful request, without blanket surveillance.

Verified access enforces KYC/KYB as a gating condition. Participants complete onboarding through an off-chain identity verification process; the result is encoded as a compliance credential on their non-fungible trading account (Section 10.1). The credential specifies eligible markets, leverage ceilings, and jurisdictional constraints enforced at the execution layer.

Sanctions and AML controls are implemented at key lifecycle points: onboarding, deposit, withdrawal, and periodic re-verification. Deposit screening uses the zero-knowledge methods described in Section 8.2 to verify clean fund provenance without exposing the full transaction graph.

Audit-ready records are produced by deterministic execution. Every trade, margin adjustment, liquidation, and settlement event generates a log entry with sufficient detail for post-trade reconstruction. These records are available to the account holder and, through selective disclosure, to designated regulators under lawful request. Selective disclosure requires institutional participants to manage cryptographic keys for compliance access, an operational overhead that must be weighed against the privacy benefits.

Jurisdiction-aware constraints are encoded as permissions on the account object. A participant registered in a jurisdiction prohibiting certain instruments or leverage levels is programmatically prevented from accessing them, making the compliance posture auditable from protocol logic rather than operator attestations.

12.1 Instrument Suite

Ollo's product scope follows a sequenced approach: start with instruments that have demonstrated product-market fit onchain (perpetual futures), expand into forecasting markets where FX-specific coverage is sparse (prediction markets), and progress toward the instruments that dominate institutional FX risk transfer (swaps).

Ollo instrument suite (proposed; subject to roadmap)

12.2 Phase 1: Perpetual Futures

Ollo's initial market entry targets perpetual futures with institutional-grade tooling across major, minor, exotic, and stablecoin pairs. This combination (fiat-referenced FX and stablecoin-native FX on a single venue) is unusual across both traditional finance and DeFi. Decentralized perpetual futures volumes have grown substantially, with the broader category processing trillions in cumulative volume². The instrument's demonstrated product-market fit makes it a practical entry point operating on the margin and oracle infrastructure described in Section 10.

12.3 Phase 2: Prediction Markets

Prediction markets represent a growing product category. FX-specific prediction markets (covering rate decisions, peg stability, and macro outcomes) remain a largely untapped vertical. Kalshi currently offers a restricted set of FX markets; the opportunity exists to expand this category onchain with broader pair coverage. Prediction markets are typically fully collateralized binary outcomes with bounded losses, which is why they impose lighter margining requirements than leveraged derivatives. They require the oracle and dispute-resolution infrastructure from Section 10.6.

12.4 Phase 3: Swaps and Structured Derivatives

The long-term product arc adds FX swaps and structured derivatives alongside policy-compliant access for institutions, corporates, and broader participant segments. This phase requires trust established through regulatory relationships, audit trails, and operational track record from Phases 1 and 2. FX swaps represent the single largest BIS survey category (approximately 42% of turnover, Section 2.1); serving this instrument class requires the full margin, oracle, and compliance infrastructure described in Sections 10 and 11.

12.5 Structural Differentiation

Ollo's design produces differentiation on three axes. Compliance network effects arise from verified onboarding: regulated entities can only trade where counterparties are also verified, so each verified participant can increase the venue's utility to other regulated participants. As identity-verification infrastructures and reusable KYC tokens become more widely available, the durability of this advantage depends on execution quality and instrument breadth rather than compliance infrastructure alone.

Capital efficiency follows from collateral-first perpetuals and programmable settlement (the mechanism is described in Section 10.2), which can reduce hedging costs relative to relationship-dependent legacy access, particularly for stablecoin and fiat-referenced pairs where prefunded-capital drag is most pronounced (Section 4.3).

Execution-environment retention results from privacy-preserving execution. Faster confirmation reduces exposure windows relative to slower public mempools. Once institutions operationalize workflows within a protected environment, the cost of migrating those workflows (re-establishing privacy configurations, compliance credentials, and counterparty relationships) creates a practical switching cost⁴.

The structural differentiation described above operates within the regulatory environment. Section 13 examines the pathways forming in both the EU and the United States, and the material uncertainties that remain.

13.1 EU MiCA

The EU's Markets in Crypto Assets Regulation represents a comprehensive framework for onchain financial services. Now fully applied, it provides authorized crypto-asset service providers (CASPs) the ability to operate across all 27 EU member states with a single authorization². Enforcement has been substantive: more than 540 million euros in penalties issued, including a single 62 million euro fine in France, and more than 50 firm licenses revoked². MiCA is active regulation, with enforcement actions that have begun to affect the competitive positioning of crypto-asset service providers.

Selected regulatory milestones²⁶

13.2 U.S. Policy

In the United States, the GENIUS Act (Public Law 119-27, signed July 18, 2025) provides a comprehensive federal framework for payment stablecoins². By September 2025, Treasury had opened implementation via an advance notice of proposed rulemaking; FDIC published an implementation NPRM in December 2025; NCUA announced a proposed rule in February 2026; and the OCC issued Bulletin 2026-3 on February 25, 2026 announcing its NPRM to implement the Act. At the securities and derivatives layer, proposals remain pre-enactment. Policy principles are emerging for an atomic settlement pathway within existing frameworks, such as Section 15(c)(6) of the Exchange Act⁶. Current proposals advocate safe harbors providing a rebuttable presumption that non-custodial, non-discretionary apps interfacing with decentralized protocols are not engaged in broker-dealer activity⁶. On the CFTC side, proposals call for clarity on when autonomous, non-custodial protocols fall outside Commodity Exchange Act registration requirements⁶.

13.3 Regulatory Uncertainty

The trajectory in both jurisdictions is toward defined pathways for compliance-forward onchain venues, but material uncertainty remains. The GENIUS Act is enacted but not yet fully operative: Section 20 sets its effective date as the earlier of 18 months after enactment or 120 days after final implementing regulations (currently projected for January 18, 2027). Securities and derivatives safe harbor proposals remain policy positions, not settled law. MiCA's application to derivatives and FX-specific instruments is still being interpreted through regulatory technical standards that may impose requirements not yet fully visible.

Cross-jurisdictional conflict is a further risk. MiCA and U.S. frameworks may impose contradictory obligations (on data localization, reserve requirements, or permissible instrument types) forcing a venue to choose compliance with one jurisdiction at the cost of eligibility in another. A protocol qualifying for a U.S. safe harbor may not satisfy MiCA's CASP authorization requirements, or vice versa.

These uncertainties constrain the confidence with which any protocol can plan its compliance posture. Ollo's architecture is designed to accommodate jurisdictional variation through account-level permission encoding (Section 10.1), but the regulatory environment itself remains a dependency the protocol cannot unilaterally resolve.

This paper traced a causal chain connecting FX market structure, stablecoin fragmentation, and the design requirements for onchain FX derivatives.

Global FX turnover reached approximately $9.6 trillion per day in the 2025 BIS survey, with institutional buy-side activity expanding by roughly 60% since 2022¹. Despite this scale, access remains gated by bilateral credit relationships, prefunded capital requirements, and proprietary distribution networks. These frictions persist because settlement infrastructure has historically lacked the throughput, privacy, and compliance properties needed for institutional participation (Sections 2-5).

Stablecoins have introduced a parallel settlement substrate exceeding $300 billion in supply². However, fragmentation across issuers creates FX-like basis and depeg risk for which institutional-grade hedging instruments are largely absent. Supply projections commonly cite roughly $3 trillion by 2030², making this an expanding, under-hedged exposure class (Section 6).

Advances in blockchain throughput, zero-knowledge cryptography, and regulatory frameworks (including MiCA and the GENIUS Act) have made compliant onchain FX venues feasible. The requirements are specific: enforceable counterparty eligibility, privacy-preserving execution, deterministic settlement, and MEV mitigation (Section 8). Material regulatory uncertainty remains, particularly regarding cross-jurisdictional consistency and safe harbor scope for non-custodial protocols (Section 13).

Ollo Finance is designed to address these requirements as an onchain FX derivatives venue with verified access, atomic settlement semantics where applicable, and instruments spanning fiat-referenced and stablecoin-native pairs. The protocol architecture (non-fungible trading accounts, multi-collateral margin synthesis, multi-lane execution, oracle integration for 24/7 risk management, and privacy-first compliance) targets the structural gap between legacy FX infrastructure and the emerging onchain settlement layer (Sections 9-12).