We Built a Privacy-Preserving Financial Workflow on Canton

If you worked in fintech between 2015 and 2020, you probably remember enterprise blockchains and the pilot graveyard that followed. Blockchain was going to fix everything. Trade finance, supply chain, settlement, insurance…you name it. Big names joined and hundreds of millions poured into pilots. Most of it quietly died. The ideas weren’t wrong. The infrastructure wasn’t there yet, and the regulatory moment hadn’t arrived. That’s changed on both fronts. We built a live demo on Canton to show what that actually looks like.

To appreciate why this cycle feels different, it helps to understand why past cycles failed.

The consortium problem. we.trade needed every major European bank to commit before a single invoice could be financed on it. IBM Food Trust needed every link in the supply chain. Every use case required competitors to agree on shared governance before a single transaction could happen. Networks died waiting.

Privacy was bolted on, not built in. Enterprise Ethereum forks like Quorum added private transaction managers on top of an architecture that was public by default. Privacy was an addendum, not a first-class property of the contract model itself.

Regulatory ambiguity paralyzed institutions. Without legal clarity on what a digital asset actually was, compliance teams couldn’t sign off. Pilots stayed pilots without production scale.

Canton is a privacy-first DLT network built by Digital Asset. The network’s Global Synchronizer is the decentralized backbone designed specifically for regulated financial institutions to transact on shared infrastructure without exposing their data to other participants.

Private by default, deterministic finality, no public shared state. It’s the first network where institutional workflows actually make sense to build on.

Architectural Breakthrough

Every previous approach forced a choice: share a ledger and expose your data, or keep your data private and lose the network effect. Canton breaks that tradeoff. Each institution runs its own participant node with its own private contract store. The synchronization domain (Canton’s coordination layer) never sees the transaction content, only ciphertext. Validation happens privately on each participant’s own node. That’s the architectural breakthrough past cycles never delivered. The ledger is shared. The data isn’t.

Privacy v. Anonymity

Most blockchain privacy defaults to anonymity. Canton doesn’t. That’s the wrong model for institutions because anonymous counterparties are a compliance problem. Canton does something different: selective disclosure. Confidential by default, visible only to the parties who need to see it. The ledger hides the deal. It never hides who you’re dealing with.

Daml: Authorization as the Data Model

Daml makes authorization the data model. Unlike Solidity, where anyone can call any function, every contract explicitly declares who signs, who sees, and who acts. That’s what institutional use cases have always needed and for the first time, it’s built into the language itself.

Regulations Finally Caught Up

The conditions that paralyzed past cycles are gone or have a much clearer picture. MiCA is live in Europe, the US passed the GENIUS Act in 2025 (the first federal stablecoin law), and T+1 mandates have put a hard deadline on settlement modernization. Institutions now have a framework to build within and a reason to make moves.

The proof is in the numbers. Canton now processes over $9 trillion in monthly transaction volume (Canton Strategic Holdings, 2026). Broadridge alone settles $362 billion in daily repo volume on the network, DTCC selected Canton as its tokenization partner, and Goldman Sachs built its Digital Asset Platform on Canton for issuing and managing digital bonds (Messari). These aren’t pilots. This is enterprise-grade infrastructure for the global financial system.

The best way to understand what Canton actually does is to watch it in action. We built a live, interactive demo at daml.lazer.tools, a real working application running on a real, self-hosted Canton node.

The use case is invoice factoring. It’s not glamorous. It’s also a multi-trillion dollar workflow that’s been promised blockchain solutions for a decade.

We chose invoice factoring because it’s a use case that’s uniquely enabled by Canton’s architecture. Invoice factoring is inherently B2B, and business finances are sensitive by nature. This kind of payment flow would never work on a public shared ledger. Canton fits because it lets you scope state visibility to the exact parties involved in each transaction.

Same Ledger, Different Views

The demo loads five parties simultaneously on one shared ledger.

The Invoice Factor and Market Regulator both show a lock icon: “No contracts visible to this party.” They’re on the network. They just can’t see anything yet because nothing has been shared with them. Parties join the network independently and transact when the contract says they can. No governance committee friction.

Progressive Disclosure in Action

As the workflow unfolds: stablecoins minted, invoices created, receivables sold, each party’s view updates based only on what they’re contractually entitled to see. The Regulator never sees the commercial terms between Issuer and Factor. The Factor never sees the Obligor’s full picture.

This isn’t access control layered on top of a shared database. It’s enforced at two levels simultaneously:

1. At the protocol level: participant nodes only store contracts where their parties are signatories or observers. Each institution keeps its own data in its own database, coordinating on shared workflows without holding the full state.

2. At the contract level, every Daml template explicitly declares who signs, who sees, and who acts. Authorization is the data model, not bolted-on.

That’s how you give auditors and regulators visibility into only what’s been disclosed to them and not the full ledger without building a permissions layer on top. The regulator sees exactly what it needs to. Nothing more.

The MintProposal Pattern

In Canton, you can’t affect someone else’s account for multi-signatory contracts without their explicit permission. The one caveat: observers can be added unilaterally. For example, you can disclose a contract to a regulator without their consent. But observers can only see, not act. The key invariant is signatory authority.

In EVM you can send a token to any address and they’re stuck holding it. In Canton, any party touched by a transaction has to explicitly consent, enforced by the language. Daml’s authorization rule: you can’t create a multi-signatory contract without every signatory’s authority. Propose/accept falls out of that naturally: one party creates a proposal, the counterparty accepts, only then does the contract exist. The demo’s stablecoin follows the same pattern. Not a UX choice. It’s the protocol.

Progressive disclosure controls what each party sees. The MintProposal pattern controls what each party can do.

Deterministic Finality in Seconds

T+2 exists because of intermediary coordination overhead. Canton collapses most of that into protocol-level coordination. Only the participants whose parties are actually involved validate and confirm the transaction, so there’s no global reconciliation loop to wait on.

As Jackson Ernst, our Lazer engineer who built the demo, puts it:

“People spend a lot of energy arguing whether Canton is really a blockchain. The useful question is: what am I trusting, and can I verify it?”

The main tradeoff of using Canton is decentralization. Using Canton means trusting that the super validator network (the consortium running the sync layer) stays online, processes transactions without censorship, and orders them honestly. You can verify correctness independently on your own node. What you can’t independently enforce is liveness and fair ordering. If the consortium goes down, you can’t settle. That’s a genuinely different failure mode from a public chain.

The second tradeoff is permissioning. Canton Network participation is gated. For institutions that’s a feature (you know who’s on the network). Canton made an explicit architectural choice to trade open participation for regulatory viability, and the $9 trillion in monthly volume suggests institutions agree with that tradeoff.

Third, tooling and Daml programming language. Daml has a real learning curve. It’s implemented in Haskell and the authorization model is unfamiliar to most developers. The tooling is maturing fast but isn’t fully mature yet. The Canton Quickstart repo was a useful starting point: infrastructure scaffolding that lets you skip setup and focus on contracts, which is what we forked to build this POC.

That said, you’re not navigating this alone. Digital Asset, the company behind Canton, offers institutional support and services while Canton Network Foundation stewards the network and supports public-good infrastructure through milestone-based grants, a meaningful offset for teams investing in learning the ecosystem.

Invoice factoring is the use case, not the limit. The architecture applies anywhere you have multiple parties who need to transact on a shared state with data that can’t be fully visible to all participants. The infrastructure that was promised in the last cycle is now real, production-grade, and buildable today, and the regulatory moment has arrived. The architecture problem has been solved. Goldman, DTCC, and Broadridge have already placed their bets.

What’s left is builders who understand how to work with it. Who can take something genuinely technical and ship it as a working product. That’s where Lazer comes in. We understand the financial infrastructure we’re building on, not just shipping its code.

Explore the demo at daml.lazer.tools, comment and get in touch.

We want to see what you build. Tag us on X and Farcaster!

Contributors: @yachtyyachty, @AtownBrown

🌐lazertechnologies.com 𝕏@lazer_hq 🔗LinkedIn 📬 founders@lazertechnologies.com