The Credit Model

What is CRX underneath the hedging?

A trust network of counterparties, built so that no one party's failure can reach another.

The members sit in different countries, under different regulators, holding different collateral. A licensed liquidity provider in one jurisdiction faces an end-user in another that it has never met. For that to be safe, one thing has to hold: each relationship has to stand on its own. A loss in one cannot be allowed to leak into the rest of the network.

So the product is not the hedge. The product is isolation. Every other choice in this page follows from it.

CRX matches two kinds of member. On one side, end-users: corporates and funds that need to hedge a currency, eligible contract participants (ECPs), onboarded under a standard ISDA. On the other, sophisticated, licensed liquidity providers with a credit and operational history. The network lets the first face the second without either having to underwrite the other.

Where does the isolation idea come from?

From on-chain credit, where the same problem was solved once already.

Compound, launched in 2018, was one of the largest credit markets of its kind. It worked by pooling: lenders supplied assets into one shared pool, and borrowers drew against it. The flaw was structural. Because the pool was shared, the soundness of every lender depended on the riskiest asset listed. One badly-priced collateral could, in principle, leave bad debt that every lender bore, including lenders who had never touched it.

Morpho Blue, released in 2023 by Paul Frambot and the team at Morpho Labs, isolated it. Each market is one collateral against one loan asset, with its own oracle and its own parameters. Risk is contained to the market. A lender chooses exactly which collateral it is exposed to, and a bad market cannot reach a lender in another one. Paired with over-collateralised margin, this let sophisticated lenders, for the first time, take exposure to counterparties they did not know and did not have to trust.

CRX takes that philosophy and applies it to FX hedging. The collateral is dollars and dollar-equivalents; the exposure is a currency forward rather than a loan; the legal frame is an ISDA rather than a smart-contract market. But the load-bearing idea is the same: isolate the risk, and a stranger becomes a safe counterparty.

What does CRX isolate?

Four things, each its own wall. Together they are why one member's failure stays one member's failure.

Isolation	What it means	Detailed in
Collateral	A failed or de-pegged asset marks down only the parties who posted it. A party that never held it is untouched.	CSA & Multi-Asset Collateral (~4 min)
Margin	Initial margin sits in a segregated account (SCA), one per relationship, holding only that relationship's margin, never lent on.	Variation Margin (~4 min)
Counterparty	Every position is a bilateral risk between two parties. Your collateral is reserved to your own trades; no one else can reach it.	this page, below
Default	A default is paid from the defaulter's own estate, in a fixed order. No shared pool, no mutualised loss.	this page, below

The first two are mechanics other pages own. The last two are this page. Read them as one claim: what you post backs only your own trades, and what another party loses is paid only from their own collateral.

Do I need a credit check to trade?

No. Complete the standardised ECP onboarding once, post the standard margin, and trade, usually within minutes. That one signature covers every pair with CRX, so even a brand-new firm with no banking history trades the day it signs.

This is the trustless path, and it is the default. You rely on no one's creditworthiness, because you post enough margin that you do not have to.

Every member is an ECP and ISDA-onboarded, and the ISDA close-out is enforced by CRX in both modes below. Trust never replaces the legal claim; it only changes how much margin and how much time sit in front of it. How the one adherence works: Onboard once, trade with CRX (~3 min).

What are my two ways to trust a counterparty?

Two, chosen per relationship. Both are fully secured. Neither is unsecured credit, and CRX is never a lender.

	Trustless (permissionless)	Credit-reliant (credit-checked)
Credit check	none	you submit credit info; CRX decides
Initial margin	the standard ISDA amount	smaller, priced to the trust CRX sees
On a breach	no cure window	a cure window first, then liquidation
You rely on	only your own posted margin	the counterparty's credit, behind the margin
Time to first trade	minutes after the ISDA	the same

The trustless path asks nothing of the other side's balance sheet, so you never have to monitor whether your counterparty is still sound. The credit-reliant path posts less and grants time to cure, in exchange for leaning on a counterparty whose credit you have chosen to trust.

NoteNeither mode is unsecured credit. Both are fully secured to the initial margin CRX sets; you never run a deficit. The only things trust changes are how much margin you post and how much time you have to cure.

To move from trustless to credit-reliant, submit your credit information from Settings → Compliance. CRX reads it its own way and may grant a smaller margin and a cure window on that relationship. It is never obliged to grant trust, and granting it never reopens your ISDA.

How does the cure window run?

A breach is one thing: your account on that relationship drops below its required initial margin. A keeper, an automated agent, records the breach on-chain, and that record starts the clock.

1. Inside the window: you cannot be liquidated. Variation margin keeps settling, but no collateral is seized. Top the account back up and the flag clears.
2. After the window: if you are still short, the owed side may close out that one agreement.

Three rules govern it:

• The cure must hold. A last-second top-up does not count; the fix has to hold for a short, set dwell before the flag clears.
• It waits for the market. A closed FX session neither starts nor runs the clock, so a default can never be proven against a frozen weekend price. See Calendar & Sessions (~3 min).
• Each side has its own window, fixed at signing. The window is a signed term of the agreement, immutable for its life. A different window means a new agreement. Set it to zero and you have the trustless path: no grace delay, so the close-out is callable as soon as the SCA falls below the maintenance floor.

After the window, the owed party chooses who fires the close-out: auto (any keeper, the moment the window passes, the default) or manual (only the owed party, on its own timing).

The cure window is grace for the party in breach. It is also exposure for the party that is owed: while the clock runs, the owed side is bound and cannot seize. Time for the debtor, exposure for the creditor: that trade is the second lever below.

What can I tune, and what does each cost?

Four levers. Each one trades risk against capital efficiency, because locked capital has a cost, and the right setting depends on which side of that trade you sit.

Lever	Turn it up	The trade	Set per
Initial margin	more margin posted	safer, but more of your capital is locked and idle	relationship, by credit mode and pair
Cure window	more time to cure	grace for the debtor; exposure for the creditor, who is bound while it runs	relationship, signed at opening
Collateral	yield-bearing or local-currency assets	lower cost of capital, against a haircut and an eligibility rule	the CSA, per relationship
Isolation	always on	your collateral can never be spent on another party's loss; you give up the cheapness of pooling	the network, structurally

Three of the four are detailed elsewhere, and here is where each lands:

• Initial margin is sized to the ISDA SIMM standard, a volatility-scaled, ten-business-day figure with a hard floor per pair. The full method, and how a credit check lowers it: Margin requirements (~4 min).
• Cure window is the mechanism in the section above.
• Collateral is where regulation and cost of capital meet. Stablecoins are issued by different banking partners under different regimes, and a member's own regulator may restrict which it can hold. USDC, issued by Circle, counts at par and is the settlement currency. A firm that wants its locked margin to earn posts a yield-bearing asset instead (a tokenised Treasury note like Ondo's USDY, or sUSDS, the yield-bearing dollar CRX marks eligible today) and accrues yield on margin it has posted but not lost. The cost is a haircut, sized to the asset's risk. The live eligible set is whatever your CSA marks: today USDC, sUSDS, EURC, and USDT. What each counts for after its haircut: CSA & Multi-Asset Collateral (~4 min).
• Isolation is the one lever that does not move. It is always on, and the next section is the price it charges and how CRX gives most of it back.

How do I move capital between isolated accounts?

Through one general balance that feeds every segregated account.

Isolation has a cost. If each relationship holds its own walled-off margin, your capital is split across many accounts, and a traditional set-up would have you pre-fund each counterparty separately and rebalance between them by hand. That is the fractioning isolation creates.

CRX answers it with a single free pool. You deposit once into your general balance; when you bind a position, margin is allocated from that pool into the relationship's SCA; when a position closes or over-margins, the exact excess is deallocated back. The pool is shared across all your relationships; the SCAs are not. So capital flows between isolated accounts in one move, instantly, while the isolation between them never breaks.

You keep one balance to manage and many walls that cannot be crossed. Where the general balance and the SCAs sit, and how each is valued: CSA & Multi-Asset Collateral (~4 min).

What stops one default from reaching me?

A default is contained to one relationship before it can ever spread to the network. This is default isolation, the fourth wall, and it is a ladder, not a single act.

A breach in one relationship leads, at worst, to a local close-out of that one agreement against the collateral posted there. Only a proven shortfall across the defaulter's whole estate triggers the whole-book cascade. And even then, the loss is paid from the defaulter's own money first. It never reaches another counterparty, and there is no shared pool to reach.

Rung	State	Trigger	Cost
0	Healthy	The general balance covers every variation-margin call.	Nothing.
1	Breach	One segregated account (SCA) falls below its initial-margin requirement. A keeper stamps it on-chain.	The stamp. No collateral moves.
2	Cure window	The breach stands; the clock runs.	Time. Top up the SCA to clear the flag.
3	Tier 1: local close-out	The window elapses and the SCA is still below the maintenance floor (60% of IM by default).	That one agreement's SCA. General balance untouched.
4	Insolvency assertion	The estate looks unable to cover its remaining obligations.	A bond from whoever asserts it. The party is frozen.
5	Solvency test	The assertion opens the test.	Nothing, just a measurement. A false assertion forfeits the bond.
6	Tier 2: whole-book close-out	The test fails.	The waterfall runs; the party is stamped DEFAULT.

Rungs 1 to 3 are Tier 1: one relationship, the collateral posted there, no bond. Rungs 4 to 6 are Tier 2: the whole book, a bond to open it, one price for everything, a terminal default. Most positions never leave rung 0.

When does one agreement close out?

When its cure window elapses and its SCA stays below the maintenance floor — a fixed fraction of IM, 60% by default, signed into the agreement. The margin call rings earlier, at IM; the band between IM and the floor is the cushion, and the collateral that still backs what is owed. See What triggers liquidation? (~4 min). The test is per-relationship: it reads one SCA, never the whole estate. The window is zero on the trustless path and a hard grace period on the credit-reliant one.

The owed side seizes that agreement's SCA to cover the loss. The general balance is never touched, no bond is posted, and the party keeps trading every other agreement it holds. A Tier-1 close-out settles that one agreement alone. It is the clearest expression of isolation: one wall breached, the rest standing.

When does the whole book close?

Only on a proven shortfall across the whole estate: the defaulter cannot cover what it owes even after each agreement's own collateral is applied. A relationship can breach while the party stays globally solvent. That is Tier 1. Tier 2 fires only when the breaches, summed, exceed everything the party holds.

The procedure runs in three stages:

1. Assert. The operator or either counterparty posts a bond from its own general balance and opens a short proof window. The accused is frozen.
2. Prove. Force variation margin on every one of the party's agreements at one fresh price, then test solvency: does the general balance cover the shortfalls left after each SCA is applied? A large book is swept in chunks inside its own cascade window.
3. Resolve. If the estate covers it, the party is solvent: the assertion fails and the bond is forfeited to the accused. If it does not, the waterfall runs and the party is stamped with the permanent DEFAULT flag.

NoteA party cannot be defaulted without a proven shortfall. A false assertion costs the asserter its bond. The default flag is a marker of a proven event, never an operator's choice.

What order is collateral taken in?

The cascade values every agreement at one shared price first, so no survivor is paid out of collateral another survivor is owed. Then it moves collateral in a fixed order:

1. The agreement's own SCA. Each counterparty takes from what the defaulter posted to that relationship.
2. The defaulter's general balance, pro-rata. Remaining shortfalls split by size against a one-time snapshot, so the order claims are paid in cannot change the result.
3. The unpaid residual. Anything beyond the defaulter's whole estate is borne by CRX, the dealer on the other side, with ISDA recovery as the legal claim.

The defaulter's positions pass to a pre-agreed backstop counterparty holding standing consent to step in, and the party is terminated.

Haircuts apply to the test, never the payout. Solvency is judged at haircut value, which decides whether the cascade fires. Every leg that moves collateral pays at full oracle value, which decides how much a survivor receives. A haircut can trigger the cascade; it never shrinks what you are paid.

Who pays a shortfall?

The defaulter, then CRX, never a pool.

• The first two tranches come from the defaulter's own SCA and general balance.
• A residual beyond its estate is borne by CRX, the dealer on the other side, with ISDA recovery against the legal estate.
• No guarantee fund, no operator backstop, no mutualised pool. No firm's collateral is ever spent on a loss it was not party to.

The contract enforces the order: the defaulter's own collateral first, a shared pool never. Your own collateral is reserved to your own trades, so neither CRX nor another member can reach it to cover a loss it was not party to. This is the difference between CRX and a clearing house, which mutualises a default across its members. CRX does not.

Collateral that no one else can touch is collateral that no one else's mistake can take.

Why does the waterfall rarely run deep?

Because initial margin is sized for a far harsher week than a real close-out uses. It covers the worst move over a ten-business-day margin period of risk, plus a per-pair hard floor for managed currencies that devalue in one step rather than drift. A live, on-chain close-out on the Pyth price completes in hours. Run on time, the first tranche (the agreement's own SCA) covers everything.

The deeper legs bind in two cases only: the liquidation runs late, or the market gaps beyond the margin in one step. What remains is residual gap risk, bounded by the per-pair floor and priced into the margin CRX sets. See the floors per pair in Margin requirements (~4 min).

Is CRX my counterparty?

Yes, on both legs. Your leg faces CRX; CRX faces the other party with the mirror leg. That is the matched-principal model: CRX stands in the middle, not off to the side.

But it stands there matched. The two legs cancel, so CRX holds no position and takes no directional risk. It does not trade against you and does not profit from your loss.

So every position is an isolated risk between two parties. When margin breaks, the close-out is matched off the two sides of that one trade, never the wider book. Every leg settles on-chain, always backed by more collateral than it owes, never on a promise.