FinToken XArchitectureEnd-to-end view
End-to-end view
How a single invoice flows from submission to settlement across all eight personas. Time, channel, state, who-touches-what — and what happens when the happy path breaks.
Happy path · invoice FX-INV-23A4F
£10,000 from Coppergate Joinery to Northwind Retail. Submitted 22 May 2026; due 21 July 2026. Funded by Pennine; slice 2 sold on the secondary to Brunel; settled clean.
| Time | Who | What | Channel | State |
|---|---|---|---|---|
| 22 May 10:42 | Aisha (Coppergate) | Submits FX-INV-23A4F at /invoices/new | Browser | INVOICE_SUBMITTED |
| 22 May 10:43 | FinToken X (auto) | Vision pass, Optical Character Recognition (OCR), duplicate check | Server | INVOICE_VERIFIED |
| 22 May 10:44 | Aisha | Sees "awaiting buyer"; status banner on dashboard | Browser | — |
| 22 May 10:44 | Tom (Northwind) | Receives C1 email with magic-link confirm | BUYER_NOTIFIED | |
| 22 May 14:21 | Tom | Clicks confirm at /buyer/confirm/FX-INV-23A4F | Browser | BUYER_CONFIRMED |
| 22 May 14:21 | FinToken X (auto) | Mints Ethereum Request for Comments 3643 (ERC-3643) token FXR-INV-23A4F on FinToken X Network · transfers to listing wallet | Chain | INVOICE_TOKENISED → LISTED |
| 22 May 14:22 | Aisha | Receives S4 email "Northwind confirmed — finding lender" | — | |
| 22 May 14:22 | Caroline (Pennine) | Sees FX-INV-23A4F on /marketplace (within filters) | Browser | — |
| 22 May 14:23 | Caroline | Clicks into receivable, accepts pricing 2.4% | Browser | — |
| 22 May 14:24 | Caroline | Funds at /payments/new · £9,760 disbursement initiated · token transferred to Pennine wallet | Browser + chain | INVOICE_FUNDED |
| 22 May 14:24 | FinToken X (auto) | Receives £9,760 in collections; routes £9,660 to Aisha (Faster Payments Service (FPS)); retains £100 platform fee | Banking | ADVANCE_DISBURSED |
| 22 May 14:31 | Aisha | £9,660 lands in Coppergate's bank · S6 email | Bank + email | — |
| 22 May 14:38 | Faisal (Brunel) | Pennine fractionalises into 5 slices; lists slice 2 on secondary at 2.42% YTM | Browser | — |
| 22 May 14:39 | Faisal | Inspects, completes pre-trade check, accepts trade · slice token transfers Pennine → Brunel · £1,991.50 fiat leg settles | Browser + chain + banking | TRADE_EXECUTED → TRADE_SETTLED |
| 22 May 12:18 | Priya (compliance) | Mandatory Money Laundering Reporting Officer (MLRO) review on Coppergate file (separate flow, completed pre-funding) · approved | Browser | MLRO_APPROVED |
| 14 Jul 09:00 | Tom | Receives C4 reminder email · 7 days to maturity | — | |
| 21 Jul 08:00 | Tom | Receives C4 due-day email | — | |
| 21 Jul 11:14 | Northwind Accounts Payable (AP) | Pays £10,000 via Faster Payments · narration FX-INV-23A4F | Banking | OBLIGOR_PAID |
| 21 Jul 11:14 | FinToken X (auto) | Reconciles inbound credit · routes £8,000.00 to Pennine (whole-token equivalent of 4/5 slices) + £2,000.00 to Brunel (slice 2) | Banking | — |
| 21 Jul 11:15 | FinToken X (auto) | Burns FXR-INV-23A4F on chain · audit anchored | Chain | INVOICE_SETTLED |
| 21 Jul 11:16 | Caroline + Faisal + Aisha + Tom | Closeout emails to all parties | — |
Total elapsed: 60 days, exactly the agreed tenor — no waste. Total time on critical path from invoice submission to seller cash: 3h 49min. The bottleneck is buyer confirmation latency (Tom took 3h 39min); once Tom clicks, fund-to-cash is sub-10 minutes.
State machine · invoice + parties
The invoice is the spine. Buyer state, seller state, lender state, investor state attach to it.
Invoice lifecycle
SUBMITTEDSeller
VERIFYINGFinToken X
VERIFIEDFinToken X
AWAITING_BUYERFinToken X
AWAITING_BUYER
CONFIRMEDBuyer
TOKENISEDFinToken X · chain
LISTEDFinToken X
LISTED
FUNDEDLender
DISBURSEDFinToken X
SETTLEDObligor
DISPUTEDBuyer rejected
VOID
FUNDED
PAST_DUE+5 Business Days (BD) past maturity
DEFAULT+30 BD past maturity
VERIFYING
REJECTEDVision / duplicate / cap
CONFIRMED
POST_CONFIRMATION_DISPUTEBuyer flags after click
Subject lifecycle (any role)
CREATED
ONBOARDING_SUBMITTED
KYC_PASSED
SCREENING_PASSED
SCREENING_PASSED
MLRO_REVIEW
RISK_PASSED
ACTIVE
ACTIVE
FROZENGate 4 alert
ACTIVEon resolution
FROZEN
DECLINEDMLRO terminal decision
Service-Level Agreement (SLA) budgets
Targets at every step. Breach paths route to the relevant operational queue.
| Step | Owner | Target | Hard cap | Breach path |
|---|---|---|---|---|
| Sumsub Gate 1 decision | Sumsub + FinToken X | < 90 sec | 2 BD | MLRO queue with provenance |
| ComplyAdvantage Gate 2 decision | ComplyAdvantage | < 60 sec | 2 BD | MLRO queue |
| MLRO Gate 3 decision | Compliance | 4 BH | 5 BD | Red banner + deputy escalation at 7 BD |
| Vision-pass authenticity check | FinToken X | < 30 sec | 5 min | Manual review queue |
| Buyer confirmation (per invoice) | Buyer | 1 BD | 5 BD | Invoice auto-expires |
| Token mint after buyer confirm | FinToken X · chain | < 30 sec | 5 min | Site Reliability Engineering (SRE) alert, manual mint |
| Lender funding click → cash to seller | Lender → FinToken X → bank | < 10 min | 4 hours | SRE alert, manual reconcile |
| Open Banking Account Information Service (AIS) reconciliation | FinToken X | < 60 sec | 4 hours | Statement parser fallback + alert |
| Pre-trade check submission | Investor | — | — | (no SLA — gates a trade) |
| Webhook delivery to lender | FinToken X | < 5 sec | 24h with backoff | Ops alert at 12h, manual replay |
| Suspicious Activity Report (SAR) filing to National Crime Agency (NCA) | MLRO | 1 BD | 3 BD | Compliance internal escalation |
| Audit log Merkle anchor | FinToken X | < 10 min | 1 hour | SRE alert + audit-log freeze |
Error & recovery flows
The unhappy paths. Each is a divergence from the table at §happy path; the recovery route is shown.
E1 · Buyer rejects at C2
AWAITING_BUYER
DISPUTED
COMPLIANCE_REVIEW
COMPLIANCE_REVIEW
VOIDFraud confirmed
SUBJECT_FROZENOriginator
Pattern: in this market, buyer rejection is a strong fraud signal. We treat every dispute as a compliance event. If the dispute is benign (mistaken email, clerical error), the invoice is voided cleanly and the seller resubmits; if it's not, we open a SAR and freeze the seller subject.
E2 · Obligor late · 5 BD past due
FUNDED
PAST_DUE
PAST_DUEFinToken X chases
SETTLEDRecovered
PAST_DUE
DEFAULT+30 BD
RECOVERY_POOLSandbox-phase recourse
Sandbox-phase recourse pool: in the Sandbox phase, FinToken X holds a recourse pool sized at 1% of cumulative disbursed volume; it covers lender principal in default cases up to that pool's depth. Beyond the pool, the lender's standard contractual recourse runs to the originator and to recovery on the obligor. Post-Sandbox, the recourse model becomes per-receivable insurance — that change is described in backend.
E3 · Sanctions delta on a live subject (Gate 4)
ACTIVE
FROZENList delta hit
MLRO_REVIEW
MLRO_REVIEW
ACTIVEFalse positive
DECLINEDSAR filed
Proceeds of Crime Act 2002 (POCA) tipping-off note: the user-facing copy on a frozen subject reads "we've paused new submissions on your account while we conclude a routine review" — never "you matched a sanctions list". The subject can keep using settled positions; new actions are paused.
E4 · Pre-trade check fails Q2 (sanctions on investor director)
PRE_TRADE_PENDING
PRE_TRADE_FAIL_SANCTIONS
SUBJECT_FROZENInvestor
MLRO_REVIEW
E5 · On-chain transfer fails compliance module
TRADE_EXECUTING
TRADE_FAILED_CHAIN
FIAT_REFUNDInvestor's funds returned
Why this happens: the on-chain Compliance Modules are the last line of defence. If the buyer's wallet binding has lapsed, or if a sanctions delta hit between pre-trade and execute, the transfer aborts on-chain. Fiat leg unwinds; the lender's slice returns to listed.
Time budgets · happy path vs unhappy
| Phase | Happy path | Unhappy path |
|---|---|---|
| Onboarding (seller) | 24h | 5 BD with MLRO escalation |
| Onboarding (lender, investor) | 3–7 BD | 14 BD with MLRO escalation |
| Onboarding (buyer) | 5 min | 2 BD if Sumsub YELLOW |
| Per-invoice submission → buyer confirm | 1 BD median | 5 BD then expire |
| Confirm → cash to seller | 10 min | 4 hours with manual reconcile |
| Tenor → settlement | matches invoice tenor | + up to 25 BD before DEFAULT |
Who touches what at each step
| Step | Seller | Buyer | Lender | Investor | Broker | Compliance | Partner | Admin |
|---|---|---|---|---|---|---|---|---|
| Seller onboarding | active | — | — | — | watching pipeline | MLRO review | (if Supply Chain Finance (SCF) tenant) | support only |
| Invoice submit | active | — | — | — | — | — | (monitors aggregates) | support only |
| Buyer confirm | watching | active | — | — | — | — | — | support only |
| Token mint | — | — | — | — | — | — | — | watches anchor lag |
| Lender funds | watching | — | active | — | — | — | (if SCF tenant) | support only |
| Cash to seller | active | — | watching | — | watches commission | — | — | watches reconcile |
| Secondary trade | — | — | active (sell side) | active (buy side) | — | pre-trade audit | — | — |
| Settlement | (closeout email) | active (pays) | active (receives) | active (receives) | — | — | — | watches reconcile |
| Token burn | — | — | — | — | — | — | — | watches anchor |