P2P
P2P holds live on the exchange ledger itself — and fraud signals work before the trade, not after your money is gone.
The legacy P2P flow resolved a dispute as a coin-flip and pinned a single price. The new flow escalates disputes through arbitration with an SLA and floats the price off an oracle, so neither side is trapped by a stale number.
Legacy · before
Now · in build
A P2P escrow is not a flag — it is a two-phase operation on the same double-entry ledger as the rest of the exchange. The hold is created once; it can be released or refunded, but never both.
Escrow state machine
Hold
The crypto is moved into a pending escrow transfer on the ledger — out of the seller’s spendable balance, not yet the buyer’s.
On a confirmed trade the hold posts to the buyer — the pending transfer is committed once and is then final.
On a cancellation or an upheld dispute the hold is voided back to the seller — the pending transfer is reversed, not duplicated.
Single resolution: a hold commits or reverses exactly once, so a double release is impossible by construction.
Fraud protection is not a refund queue — it is a set of checks that run around the trade, before and during, not just after a loss. Each one is a concrete signal, not a promise to be careful.
01 · Payer-name match
The fiat payer is reconciled against the counterparty on the trade. A payment arriving from an unrelated name is a flag, not a pass — a common third-party-payment fraud pattern.
Mechanism: payer-name reconciliation on the fiat leg.
02 · Velocity & device
Per-account velocity limits cap how fast trades can stack up, and a device fingerprint ties activity to a device so one actor cannot quietly fan out across many fresh accounts.
Mechanism: velocity limits + device fingerprint.
03 · Cooling-off & holds
New participants pass through a cooling-off period, and risk profiles carry T+N holds before funds free up — so a freshly-created account cannot drain straight through on day one.
Mechanism: cooling-off + T+N holds on risk profiles.
04 · Mule-network detection
Shared signals across accounts surface clusters that move funds for one another — the structure of a mule network — rather than treating every account as an island.
Mechanism: cross-account signal correlation.
A contested trade does not stall forever. It starts in mediation; if that fails it escalates to arbitration under an SLA, and the resolution is escrow-aware — it can split the held amount rather than only picking a winner.
Dispute flow
Both sides get a structured channel to resolve the trade between themselves first, with the escrow still held.
If mediation fails, a decision is made under a published service-level agreement — a bounded clock, not an open-ended wait.
The outcome resolves the held escrow directly, and can split it between the parties rather than only awarding all-or-nothing.
Mediation, then arbitration — the escrow stays held until a decision resolves it.
A merchant’s standing is built from facts you can see — completion rate, average release time — and the higher tiers post a deposit, so reputation has skin in the game and gaming it has a cost.
01 · Readable reputation
A merchant’s history shows their completion rate and average time-to-release — concrete numbers from their own trades, not a star a stranger handed out.
Mechanism: completion-rate + average-release-time metrics.
02 · Deposit-backed tiers
Moving up the merchant tiers requires posting a deposit. The standing is collateralised, so a trusted badge is something earned and at stake, not just claimed.
Mechanism: deposit-backed merchant tiers.
03 · Anti-gaming
The same anti-fraud signals that protect trades also detect self-dealing and circular volume, so a tier cannot be farmed with fake activity between colluding accounts.
Mechanism: self-dealing detection on reputation inputs.
The architecture leaves explicit seams for compliance — Travel-Rule data exchange and sanctions screening — so they can be wired in as the surface matures, rather than bolted on after the fact.
01 · Travel Rule
The flow is designed with a place to attach originator/beneficiary data exchange where a jurisdiction requires it — committed in the plan, not yet switched on.
02 · Sanctions screening
Screening counterparties against sanctions lists has a defined integration point in the trade flow, ready to enable as the compliance surface comes online.
Where your crypto sits during a trade, what happens when a payment is disputed, and why the fiat side works the way it does.
In a pending escrow transfer on the same double-entry ledger as the rest of the exchange. It has left the seller’s spendable balance but has not yet posted to the buyer. From there the hold resolves exactly once — released to the buyer or refunded to the seller — so it can never be in both places.
The escrow stays held. The trade goes into mediation and, if that fails, to arbitration under an SLA. The payer-name match and the fiat-leg reconciliation are evidence in that decision, and the outcome can refund the seller or split the held amount — the money does not move on a claim alone.
A merchant’s standing comes from readable facts — completion rate and average release time — and the higher tiers require posting a deposit. Because the standing is deposit-backed and the reputation inputs are checked for self-dealing, a tier is earned and collateralised rather than simply claimed.
P2P is asymmetric by nature: the crypto leg can sit in ledger escrow, but the fiat payment happens directly between the two people over their own banking rails. This is stated plainly — instead of pretending to custody fiat, the trade is protected with payer-name matching, velocity and device signals, holds, and an escrow-aware dispute process.
P2P settles on the exchange ledger: custody holds the funds, the account is the ledger it all sits on, and transparency lets you verify it.