Inside Project Acacia: our read on the RBA × DFCRC final reportacacia.rem.money
Case Study · 01

A tokenised T-Bill fund on a private Zone.

Investors deposit USDC and receive TBILL shares that accrue value as the underlying T-bills earn yield. They redeem back to USDC any business day. Balances are private to other participants. Qualified-purchaser compliance lives at the protocol layer, not in your contract. This is the reference architecture REM ships, and it is built to survive a regulator's walkthrough.

TIP-403
Compliance enforcement
Real-time
NAV pipeline
Atomic
Settlement to L1
View-keyed
Auditor access
The Product

In one sentence.

USDC in, NAV-accruing TBILL shares out. Investors redeem back to USDC any business day. Holdings stay private to other participants. The compliance allow-list lives at the protocol layer. Not in your contract, not skippable, and updateable within one block of a sanctions list change.

Cast of Characters

The six parties that make it work.

A tokenised fund is more than a smart contract. Six counterparties co-operate, and knowing where each one sits (on-chain or off) is the first design decision.

Issuer / Fund Sponsor

Owns the fund, sets the rules, holds the master operator key for the Zone.

Fund Administrator

Posts the daily NAV. Typically a regulated third-party admin firm.

Custodian

Holds the underlying T-bills in the real world. BNY, State Street, or a prime broker.

Investors

KYC'd qualified purchasers seeking yield without public-chain exposure.

Auditor / Regulator

View-key access for compliance audits. Read-only, scoped, revocable.

REM

Designs the Zone, ships the contracts, operates infra. Cannot touch investor funds.

Technological Roadmap

How the rail comes online.

Seven phases across two parallel tracks. The legal and operational scaffolding gates production launch; the on-chain build gates the technical milestones. Every phase is a discrete deliverable with sign-off criteria.

  1. Phase 00
    Legal & operational scaffolding
    Off-chain
    • ›Stand up the fund vehicle (Cayman SPC, Delaware LP, or Lux SCSp) and sign the offering documents.
    • ›Negotiate the custodian agreement (BNY, State Street, prime broker) and the fund administrator SLA.
    • ›Select the KYC/KYB vendor (Persona, Jumio, Sumsub) and codify the qualified-purchaser policy.
    • ›Build the investor onboarding portal: identity verification, subscription documents, allow-listed wallets, accredited-investor attestations.
  2. Phase 01
    Stand up the Zone
    On-chain
    • ›Generate the sequencer key set, deploy the Zone portal on Tempo, initialise genesis.
    • ›Provision per-environment chain IDs (testnet, staging, production) with isolated keys.
    • ›Mirror the TIP-403 compliance policy from Tempo L1, replicated continuously to the Zone.
    • ›Wire observability: block explorer, sequencer health, compliance event stream, on-call paging.
    $rem zone deploy --network tempo --policy tbill-fund
  3. Phase 02
    Configure the qualified-purchaser policy
    On-chain
    • ›Author TIP-403 policy TBILL_QUALIFIED_PURCHASERS on Tempo L1 with jurisdictional carve-outs.
    • ›Wire the KYC vendor's webhook to push approved wallet addresses into the policy.
    • ›Plug in screening providers (Chainalysis, TRM) for ongoing wallet risk scoring and de-listing.
    • ›Validate at the protocol layer: non-allow-listed wallets cannot hold, send, or receive TBILL.
    $rem compliance policy.create('TBILL_QUALIFIED_PURCHASERS')
  4. Phase 03
    Issue the share token
    On-chain
    • ›Mint the share token through the Zone's TIP-20 factory: name, symbol, decimals, supply controls.
    • ›Bind the qualified-purchaser TIP-403 policy as the immutable transfer hook.
    • ›Set the mint authority to the RWAVault address; lock the upgrade path behind a multi-sig.
    • ›Pre-flight with an external audit firm before production cutover.
    $rem zone tokens.issue({ symbol: 'TBILL', policy: 'TBILL_QP' })
  5. Phase 04
    Build the fund contract suite
    On-chain
    • ›NavOracle: administrator-only NAV poster, gated reads for downstream consumers, circuit breakers.
    • ›RWAVault: subscribe/redeem against live NAV, fee accrual, redemption queueing, partial-fill semantics.
    • ›SubscribeFromTempo: one-shot L1 on-ramp, encrypted subscriptions, refund path on policy failure.
    • ›DistributionAgent: optional cash-distribution leg with tax-lot tracking for non-NAV-accruing variants.
    • ›Full test coverage, invariant fuzzing, and an external auditor's report against the production tag.
    $forge build && forge test --gas-report
  6. Phase 05
    Wire the daily operating model
    Hybrid
    • ›Custodian feeds NAV inputs to the administrator over a signed channel; administrator posts to NavOracle.
    • ›Subscriptions and redemptions during the trading window settle at intraday NAV, with no manual batches.
    • ›Treasury operations dashboard streams Zone events into back-office and the auditor's view-keyed feed.
    • ›Incident playbooks for NAV mispost, screening hit, and emergency redemption gating.
  7. Phase 06
    End-to-end programme rehearsal
    On-chain
    • ›Full subscribe → NAV accrual → redeem cycle run by test wallets across every onboarded channel.
    • ›Simulated yield period at 5% APY confirms accrual math against the administrator's shadow book.
    • ›Auditor view-keys issued, scoped, exercised, and revoked. Compliance event log signed and archived.
    • ›Sponsor and regulator walkthroughs of the live testnet environment, pre-launch.
The Contract Suite

Four contracts. That is the whole fund.

The Zone supplies the heavy machinery: the TIP-20 token factory, sequencing, compliance enforcement, and cryptographic settlement to Tempo L1. The contracts only encode the fund-specific policy: NAV, subscription, redemption, and distribution. Every contract ships with full test coverage, invariant fuzzing, and an external auditor's report.

NavOracle.solOracle

Administrator-gated NAV pipeline. Circuit breakers, staleness checks, signed-input verification. Downstream contracts subscribe to NAV transitions atomically.

setNav(uint256 newPrice, bytes signature)nav() → (uint256 price, uint64 asOf)
RWAVault.solVault

Subscription and redemption engine. Live NAV-priced mint and burn, fee accrual, redemption queueing for stressed markets, partial-fill semantics, emergency-gate hooks.

subscribe(uint256 usdcAmount)redeem(uint256 shareAmount)queueRedemption(uint256 shareAmount)
SubscribeFromTempo.solL1 Bridge

One-transaction on-ramp from Tempo L1 into the Zone. Encrypted subscription payloads, policy pre-check, automatic refund on compliance failure.

subscribeFromMainnet(addr, usdc, bytes proof)refund(bytes32 id)
DistributionAgent.solDistributions

Optional cash-distribution leg for funds that pay yield as periodic dividends instead of accruing into NAV. Tax-lot tracking and pro-rata allocation.

distribute(uint256 amount, uint32 period)claim(uint32 period)
End-to-End Flow

One test wallet, twelve lines.

The 7-day milestone reproduces every time. This is exactly what a sponsor or regulator sees in the demo.

zone://tbill-fund/testnet
01Alice → SubscribeFromTempo.subscribe(10,000 USDC)02↳ 10,000 USDC bridged into Zone as cash-ZTIP-2003↳ TIP-403 policy check: Alice ∈ TBILL_QUALIFIED_PURCHASERS ✓04↳ NavOracle.nav() = 1.000005↳ RWAVault mints 10,000 TBILL → Alice06↳ Alice's balance: 10,000 TBILL (private)07// 7 days pass — fund earns ~0.10%08Administrator → NavOracle.setNav(1.0010)09↳ Alice's holdings now worth 10,010 USDC at NAV10Alice → RWAVault.redeem(10,000)11↳ Burn 10,000 TBILL, queue 10,010 USDC payout12↳ Settlement finalised in the next Zone→Tempo batch (<60s)
The Build Split

The Zone replaces ~30% of the lift.

A tokenised fund always has a legal and operational half that lives outside the chain. The Zone collapses the bespoke infra build (privacy, compliance enforcement, settlement) into a managed primitive. The other half is the fund-vehicle work you would do for any real-world product.

On-chain · REM ships
  • Zone deployment and sequencing
  • TIP-403 compliance enforcement at the token layer
  • Vault accounting, NAV reads, atomic mint/burn
  • Settlement back to Tempo L1 in cryptographic batches
  • Auditor view keys and event log integrity
Off-chain · You ship
  • Fund vehicle and legal wrapper
  • Custody of the actual Treasuries
  • Administrator-signed NAV input
  • KYC and qualified-purchaser onboarding
  • Investor-facing portal and subscription docs
Economics

Where the savings come from.

The technology stack is the easy half of the savings story. The hard half is the operating model. A Zone-native fund collapses the four operating-cost lines that dominate a traditional Treasury fund's P&L.

Fund admin

Compressed admin stack

No legacy registrar, no separate transfer agent, no manual cap-table reconciliation. The Zone is the registrar. The contract is the cap table. Subscriptions and redemptions clear automatically against live NAV. Ongoing fund-admin cost drops by an order of magnitude.

NAV operations

Automated NAV propagation

The administrator posts NAV once per business day. The Vault prices every subscription and redemption against that NAV for the next twenty-four hours. The daily NAV email chain, the portal upload, the manual share-class recompute all disappear.

Compliance ops

Allow-list enforced at the protocol

Qualified-purchaser checks happen once at onboarding, and the policy travels with the token. Per-transaction compliance review goes away. So does the quarterly reconciliation between the transfer agent and the KYC vendor, and the risk of an unauthorised secondary transfer.

Investor servicing

Self-service redemption

Investors redeem directly against the Vault on any business day. The phone-based redemption desk, the batch redemption file, the NAV-strike manual workflow are all gone. The operations team grows the book without growing headcount.

The Credibility Milestone

A sponsor-ready demo before the lawyers finish drafting.

The on-chain rail can come up before the legal scaffolding does. You can show a fund sponsor, an allocator, or a regulator a working testnet environment without the offering documents in place. Wallet subscribes, private balance accrues, NAV ticks up, redeem settles back to USDC, compliance fires at every hop. The slide deck becomes a walkthrough, and the credibility loop closes in days instead of quarters.

Ship this with REM.

This is the architecture REM builds for asset managers issuing Treasury-backed yield products. Bring us your fund thesis and your compliance constraints. We'll stand up the rail.

Book a call Next case study