Three locks.
All of them mandatory.
A valuation engine pointed at collateral that does not exist returns a very precise number about nothing. Compliance is not the cost of doing this business — it is the licence to do it at all.
Registry number
A receipt is issued with a nationally unique registry number that records issuance, endorsement, pledge and cancellation. Its job is to make a second pledge on the same goods discoverable by a stranger.
Without it, duplicate pledge is not prevented — it is merely discouraged.
Independent audit
Three layers, not one: inbound quality inspection, unannounced stock counts, and an annual reconciliation of receipt balances to physical inventory. The inspection body must not be affiliated with the borrower.
The retained sample is the point. It is the only evidence that survives a dispute.
Pledge state machine
A receipt holds exactly one state at any moment, and discharge is only executable on a lender instruction. Borrower cannot self-release; warehouse cannot release on its own initiative.
Two locks share one rule: no single party can move the goods.
The most common structural gap
Registering a receipt and registering a pledge are different acts with different legal effects. Operators routinely do the first and forget the second.
| Layer | What it proves | Effect | Failure mode if skipped |
|---|---|---|---|
| Warehouse receipt registry e.g. 中仓登 |
This receipt is real, who holds it, what state it is in | Industry registration and public notice | One lot, multiple receipts |
| Movable-property pledge registry e.g. 中登网 |
This specific claim has been registered against this collateral | Statutory notice — enforceable against third parties | Priority lost in insolvency or a competing claim |
| Exclusive state lock system level |
No second request can be accepted in the same window | Operational control | Human override re-creates the exposure |
Three frequencies, three questions
| Layer | Frequency | Question answered | Performed by |
|---|---|---|---|
| Inbound inspection | Per lot, at intake | Is the quantity, moisture, defect count and cup score what was declared? Sample retained. | Accredited third-party lab |
| Stock count | Monthly, unannounced | Does the physical lot exist, at the position the record says? | Resident supervisor or appointed agent |
| Annual reconciliation | Annual | Do receipt balances tie to inventory and to the ledger? | Audit firm |
Two cases where the model was fine and the collateral was not
Both are worth remembering because the lesson is not about pricing. It is about whether the thing being priced exists, and whether it has already been promised to somebody else.
| Case | Control that failed | Consequence |
|---|---|---|
| Shanghai steel trade, 2012 | Duplicate pledges, forged receipts, mutual guarantees between borrowers | Large-scale bank losses; steel-trade credit withdrawn across the board |
| Qingdao port, 2014 | The same metal pledged to multiple Chinese and foreign banks behind forged warehouse receipts | Foreign banks exited commodity finance; the trust discount lasted a decade |
In both cases the haircut models worked exactly as designed — on collateral that did not exist or was already encumbered. This is why the three locks sit above the valuation engine in our architecture, not beside it.
Five rules that do not get negotiated
- 1Register before you disburse. The registry confirmation number is a disbursement condition, not a follow-up task.
- 2No disposal channel, no pledge ratio. If we cannot actually sell the collateral in a default, the LTV is fiction. Contract terms plus a named buyer.
- 3The borrower supplies no parameters. Prices come from a third-party index, quality from an independent lab, the model stays closed.
- 4Every valuation is written down, immutably. An auditable daily snapshot is the only defence when a counterparty disputes a margin call.
- 5Concentration caps are hard. One borrower, one origin, one vault — each capped. A single-tenant warehouse is not diversification.