ILLUSTRATION
The car in the warehouse
The receipt that can't see the car
Picture a warehouse that stores cars, and for each car a receipt: a slip that says "the bearer of this owns the car in bay 12." The receipt can be sold, pledged, endorsed. Whoever holds it holds the car. In theory.
That is a token for a real-world asset: a digital slip that says "this represents this promissory note, this receivables pool, this bond." It carries the same problem as the receipt. The slip can keep circulating, spotless, while the car in bay 12 is gone, or had its engine swapped, or already has a new owner. The receipt never finds out. The value of the receipt depends on something the receipt itself cannot see.
Tokenization today does two things well: it moves the receipt, and it checks whether whoever moves it is authorized. What no one had standardized is the third question, the one that matters: is the car still in the bay, still yours, still backed? That gap is what this registry fills.
The cast
| The valet, ERC-8226 | A scoped power: "you may move this car, up to this value, until Friday." It answers one question, is the actor authorized. |
|---|---|
| The status board, ERC-8320 | A board that says, car by car, "bay 12: present, inspected by Inspector A, backing current." It answers another, what is the published state and who signed it. |
| FACTOS | Operates the board. Keeps the register and decides which notes are live. It does not inspect the car. |
| The inspector | By design, an independent third party, a receivables verifier or a loanbook reviewer, who signs "the car is here and backed." That seat is not FACTOS, on purpose: it keeps us out of the business of vouching, which is a legal line. In the live demo the seat is held by a test key; the design only requires it to be a different key from the one that validates. |
What nobody had wired
The two standards are from the same authors and did not reference each other. The valet had his permission, the board had the state, but the valet's permission never looked at the board. He could move a car whose backing had already been pulled, and nothing stopped him.
We wired it. Now, the moment the valet goes to move the car, the system checks the board. If the board says "backing withdrawn," the valet does not move it, even though his permission runs until Friday. We proved it with real transactions anyone can inspect: the valet acts, we pull the backing, the valet retries, and the action reverts on its own. See FACTOS-PRS-8320-2026-09-18.
The refinement a reviewer caught
Our first version checked something crude: is there any backing signature on the board? A reviewer flagged two holes, and he was right. With several signatures, pulling the one that matters leaves the others; and a signature that says "only 60 percent backed" passes the same as one that says "100 percent."
We fixed it and ran it again live. The valet no longer accepts any signature; he requires the one from his trusted inspector. We put two inspectors (test keys, in the demo) signing the same car, pulled the trusted one's signature, left the other's on the board, and the valet still stopped. A naive check would have passed. Ours did not. See FACTOS-PRS-8320-SEL-2026-09-21.
The padlock with an unknown key
Here is the sharp part, and it is where you see what FACTOS actually is. What if the inspector reaches the bay and finds a padlock on the car, and no one knows who holds the key?
The inspector can only sign what is true. With a padlock of unknown ownership he cannot sign "free and backed," so he does not sign clean. Without that signature, the valet stops. The correct behavior of the system, when the truth is "there is a lock and we don't know whose," is to stop, not to guess.
FACTOS records the fact of the padlock. It does not invent who holds the key. That is the line we do not cross: we never vouch for who the rightful owner is. If we don't know, the honest published state is "there is a lock, owner unknown," and that is what we publish, not a comforting fiction.
What FACTOS does not do, said plainly: it does not, by itself, discover who holds the key or remove the lock. Resolving that, who registered the pledge, notifying the debtor, the collateral registry, is legal work off the board. FACTOS's job ends at publishing the true state and stopping the machine when it is not clean.
Why it matters
The market already has proof of reserves: it tells you the money is there. What it lacks is proof that the right is still clean and still yours. A padlock with an unknown key is exactly what proof of reserves cannot see, and what a token can hide.
The value of FACTOS is not "we always know who holds the key." It is this: when there is a lock we don't understand, we say so and we stop the machine, rather than let the receipt keep circulating as if the car were clean. Honesty that fails closed. That is the product, and it is what a token, on its own, can never do.