The month-end close, collapsed.
Twenty subsidiaries, one private ledger.
A diversified holding company runs cash, shared services, royalties, and capex across dozens of operating entities. Month-end consolidation is a spreadsheet exercise. Breaks are caught late. A public chain is out of the question. REM's reference architecture installs a private Tempo Zone as the group's settlement ledger: one tamper-evident source of truth, with entity-level privacy, parent-wide visibility, and scoped, expiring auditor access.
What "month-end" actually costs a holding company.
Group treasurers don't lose sleep over chain choice. They lose sleep over a 30-day close, breaks caught too late, and an audit trail that lives in inboxes.
20+ sub-ledgers, one truth
Each subsidiary runs its own ERP. Intercompany invoices move as spreadsheets, payments move as bank wires, and someone at the parent rebuilds the consolidating ledger by hand at month-end.
Reconciliation latency
T+30 close cycles. Recon breaks are caught weeks after the cash has moved. Audit prep is a quarterly fire-drill.
Privacy with auditability
Subsidiary positions, vendor terms, and inter-entity flows cannot sit on a public chain. The parent and the auditors still need a single, tamper-evident ledger.
Treasury sweep operations
Idle cash at SubCo A funds payroll at SubCo B. Today that's a wire, a foreign-bank fee, and two days of float. The parent wants T+0 sweeps with cryptographic proof.
Hub-and-spoke, in a private Zone.
The parent treasury is the hub. Each subsidiary is a wallet in the Zone. The shared services centre and recurring-charges agents run as scheduled contracts. The auditor reads through a scoped, expiring view-key. The outside world only sees USDC moving into and out of the TreasuryVault.
Six parties. One ledger.
Internal entities only see what they need to. The parent sees everything. The auditor sees what the parent grants, for as long as the parent grants it.
Parent / Treasury
Owns the consolidation, runs sweeps, signs off on net positions. Master operator of the Zone.
Subsidiaries (Operating Cos)
Each one has its own wallet inside the Zone. Sees its own ledger. Cannot see siblings.
Shared Services Centre
Books recurring intercompany charges for IT, HR, and group services. Settles against the Zone instead of via wires.
External Vendors
Paid out via Zone → Tempo L1 → bank rail. Vendor identity and amount stay private to the issuing entity.
Group Auditor
Holds a parent-issued read view-key. Reads the consolidated ledger and entity-level detail on demand.
REM
Designs the Zone topology, ships the contracts, integrates ERPs, operates the rail. Cannot touch group funds.
Who sees what.
The hardest design choice in intercompany infra is the visibility model. The Zone makes it explicit and enforces it cryptographically.
From kickoff to steady-state operations.
Eight phases. Two run before a line of code is written: treasury policy and entity mapping. Two run after technical launch: parallel-run cutover and steady-state operations. Every phase below is a discrete deliverable with finance, compliance, and audit sign-off.
- Phase 00Treasury policy and entity mappingOff-chain
- ›Map every subsidiary to a legal-entity ID, a designated Zone wallet, and a back-office cost centre.
- ›Catalogue every intercompany charge category: shared services, royalties, sweeps, capex, dividends.
- ›Codify the treasury sweep policy. Thresholds, directions, dual-control sign-offs, jurisdictional limits.
- ›Lock the audit access model: which auditor receives which view-key, at what scope, for how long.
- ›Engage external counsel on the tokenised-cash-equivalent posture in each jurisdiction the group operates in.
- Phase 01Provision the group ZoneOn-chain
- ›Stand up a dedicated Tempo Zone (group-treasury-1) with REM as operator and a redundant sequencer set.
- ›Mirror the TIP-403 group compliance policy from Tempo L1, bound to the parent's master operator wallet.
- ›Provision per-entity wallets with HSM-backed key storage and per-entity transaction-signing policies.
- ›Hook up observability: block explorer, sequencer health, compliance event stream, treasury alerting.
$rem zone deploy --network tempo --policy group-treasury - Phase 02Allow-list the entitiesOn-chain
- ›Author policy GROUP_ENTITIES on Tempo L1, scoped to the holding company's legal hierarchy.
- ›Onboard entity wallets in batches, each one tagged with legal-entity metadata and cost-centre identifiers.
- ›Build the divestiture path. Selling an entity revokes its wallet in one block of policy propagation.
- ›Plug in OFAC and screening providers for continuous wallet risk scoring across the group.
$rem compliance policy.create('GROUP_ENTITIES') - Phase 03Issue the group settlement tokenOn-chain
- ›Mint a USDC-backed Zone TIP-20 (gUSD), collateralised 1:1 by USDC held in the parent's TreasuryVault.
- ›Bind the GROUP_ENTITIES transfer policy as the immutable transfer hook. gUSD never leaves the group perimeter.
- ›Set redeem authority to the parent's TreasuryVault contract with a dual-control timelock for production cutover.
- ›Publish proof-of-backing attestations on a verifiable cadence for the auditor and the regulator.
$rem zone tokens.issue({ symbol: 'gUSD', backing: 'USDC' }) - Phase 04Build the policy contract suiteOn-chain
- ›TreasuryVault: the gUSD mint/redeem gateway, parent-controlled, with multi-sig and emergency-gate hooks.
- ›IntercompanyLedger: a pair-tagged, category-tagged, period-tagged settlement primitive with idempotency guarantees.
- ›SweepAgent: parent-signed treasury sweeps, threshold-driven, with full audit-trail emission.
- ›RecurringCharges: an on-chain cron for monthly service fees, royalties, IT chargebacks, HR allocations.
- ›AuditViewRegistry: issues, scopes, and revokes auditor view-keys with cryptographic expiry and access logs.
- ›Full Foundry test coverage, invariant fuzzing, a formal-verification spec for the ledger and the sweep policy, and an external auditor's report on the production tag.
$forge build && forge test --gas-report - Phase 05ERP integrationOff-chain
- ›Adapters for NetSuite, SAP S/4HANA, Oracle Fusion, and Workday. REM-built, REM-maintained.
- ›Bi-directional sync: intercompany invoices in, settlement events out, with at-least-once delivery and replay protection.
- ›Cost-centre to entity-wallet mapping with reversible rollouts. Sandbox, staging, and shadow-write environments.
- ›Continuous reconciliation in the background. Break detection fires as transactions land, not at period close.
- Phase 06Cutover and parallel runHybrid
- ›Run legacy wire-based settlement and Zone settlement in parallel through at least one full close cycle.
- ›Reconcile both ledgers continuously; investigate breaks while they are still small and isolated.
- ›Migrate one charge category at a time. Shared services first, royalties and capex last. Rollback at every step.
- ›The group auditor signs off on the Zone as the system of record at the end of cutover; finance team certifies.
- Phase 07Steady-state operationsOn-chain
- ›Continuous reconciliation. Month-end close compresses from a project into a report.
- ›Treasury sweeps execute automatically against the SweepAgent policy with parent oversight.
- ›Auditor view-keys re-issued each audit cycle with fresh scoping and access expiry.
- ›Net new entities onboarded through the policy update flow as soon as the legal paperwork lands.
Five contracts. Audit-ready primitives.
The Zone handles privacy, compliance enforcement, sequencing, and cryptographic settlement to Tempo L1. The contracts encode the holding company's treasury policy and nothing else: gateway, ledger, sweeps, recurring charges, auditor access. Full Foundry coverage, invariant fuzzing, a formal-verification spec on the ledger and sweep policy, and an external auditor's report on every production tag.
TreasuryVault.solVaultParent-controlled gateway between USDC on Tempo L1 and gUSD inside the Zone. Multi-sig governed, timelock-protected, with emergency-gate hooks for compliance events.
deposit(uint256 usdc)redeem(uint256 gUSD, addr to)attestBacking()IntercompanyLedger.solSettlementThe core settlement primitive. Each booking is pair-, category-, and period-tagged. Idempotent under retries. Emits structured events the back-office consumes.
book(addr from, addr to, uint256 amt, bytes32 category, uint32 period)settle(bytes32 batchId)ledgerOf(addr, uint32 period)SweepAgent.solTreasuryAutomated treasury sweeps. The parent signs the policy envelope; the agent executes against thresholds, with full audit-trail emission and dual-control overrides.
sweep(addr fromCo, addr toCo, uint256 amount)setPolicy(bytes policy)RecurringCharges.solAutomationOn-chain scheduler for monthly service fees, royalties, IT chargebacks, and HR allocations. Kills the rebilling spreadsheet and the chase-the-invoice operating model.
schedule(bytes32 chargeId, Cadence cadence)execute(uint32 period)pause(bytes32 chargeId)AuditViewRegistry.solAuditIssues, scopes, and revokes auditor and regulator view-keys with cryptographic expiry. Every key carries a scope filter and an access log that the parent can stream.
grant(addr auditor, bytes32 scope, uint256 expiresAt)revoke(addr auditor)accessLog(addr auditor)The close fits in a paragraph.
What used to take 30 days of spreadsheets, wires, and reconciliation calls runs as a sequence of contract calls. Auditable, idempotent, and finished before the auditor finishes their coffee.
Where the savings come from.
No vanity ROI claims. Just the cost lines that compress. Plug in your group's baseline FTE-days, wire and FX fees, intercompany float, and audit fees. The architecture targets every one of them.
Close cycle compression
Finance teams spend weeks every month chasing intercompany breaks across spreadsheets. A continuously reconciled ledger pushes that effort out of data assembly and into analysis. For a group of twenty-plus entities, that's double-digit FTE-days a month going back to the team.
Wires and FX, gone for in-group flows
Sub-to-sub wires cross correspondent banks. Each one carries a flat fee and an FX spread. Intercompany settlement inside the Zone runs at gas cost, batched, and paid once per cycle, regardless of how many intercompany legs flow through it.
Float released back into operations
Wire-based intercompany sweeps sit in transit for one to two business days. A T+0 sweep removes that float. For groups running nine-figure intercompany balances, the working-capital recovery shows up on the cash-flow statement.
Audit work that scales down, not up
Auditors usually request quarterly evidence packages and reconcile them by hand. Scoped, expiring view-keys let them work directly against the live ledger. Less manual evidence chasing means lower audit fees and faster sign-off cycles.
The noisiest subsidiary migrates first.
Pick the entity with the heaviest intercompany activity. Usually the shared services centre, or the operating company that touches the most counterparties. Move its book onto the Zone. Run the close in parallel against the legacy wire-and-spreadsheet flow. Whatever the treasury team learns on that one entity becomes the template for the rest. By the time the second close runs, month-end is a report, not a project.
Collapse your close with REM.
If your group finance team is buried under intercompany reconciliation, this is the reference architecture REM ships. Bring us the entity map and the audit constraints. We'll design the rail.