finality
A transfer completes between two secure elements. There is no window in which a third party reverses it, because there is no third party holding the balance.
CoinCard is a way to put a bank-issued, asset-backed instrument into a secure element the holder carries, so that it can be transferred without a shared ledger deciding who owns what. Issuance and redemption stay with you. The instrument does the moving.
What this page is. A working sandbox, described honestly, for a bank evaluating the mechanism. It is not an offer, not a regulated product, and the values in it are test values. The live records page shows what the system actually holds right now, including its imperfections.
A transfer completes between two secure elements. There is no window in which a third party reverses it, because there is no third party holding the balance.
Your database records what you issued. It does not hold the spendable value, so compromising it does not compromise the instruments.
Value can move between two cards with no network at all, under a protocol that cannot duplicate it.
Every instrument is signed by a key you hold, and your own ledger of what you signed is compared against the service record.
| Role | Holds | Cannot |
|---|---|---|
| Bank vault | The issuance key and a record of every instrument it signed. | Spend an instrument. Issuing authority and spending authority are separate keys. |
| Secure card (holder) | One or more instruments in protected persistent memory, each in its own slot. | Alter the denomination, the backing terms, or the transfer conditions — all are in the signed preimage. |
| Service | Records of issuance and redemption, and the anchor records published by the bank. | Mint value, or move value, without a bank signature. |
Verification answers two questions, and a value threshold decides how many you must ask:
Tier 1 — signature. The service recomputes the canonical string from the instrument's terms and checks your signature over its digest. That establishes you vouched for an instrument of this denomination and these conditions.
Tier 2 — anchor. The service compares its record with your record of what you signed. Denomination, conditions and signature must all agree; if they do not, the disagreeing field is named and the instrument is refused. Above a value you set, tier 2 is mandatory.
In the sandbox, both tiers run against a real key, and the live page reports how many anchor records exist. You can see the mechanism working rather than read a claim about it.
Two embodiments are implemented and in use here:
At scale we address many secure elements electrically from one enclosure — selecting one element at a time, energising and clocking only that one, and holding the input-output lines of the rest isolated, so a single network link reaches thousands of independent instruments each resident in its own processor.
| Operation | What it does |
|---|---|
issue | creates an instrument; returns the digest your key must sign |
attest | records your signature; the instrument becomes spendable |
redeem | retires an instrument and returns value to the holder |
resell | returns a redeemed instrument to your shelf and issues it to another holder |
register / attest card | gives a physical vault card an identifier your key signs |
reconcile | compares your card's actual contents with the record; the card wins |
validate | runs both verification tiers against one instrument |
Sandbox deployment. Instruments shown are test values, are not money, and are not redeemable for money. Nothing here is an offer of securities or a solicitation. A production deployment would be subject to the licensing, capital and disclosure rules of the issuing institution's jurisdiction, and those rules — not this page — would determine what may be issued.