The raise, what it funds, where Meridian operates, and the route to revenue. £87,270,000.

Executive Summary

Development stage. Meridian Global Finance is not currently authorised to provide banking, deposit-taking, or investment services in any jurisdiction. Nothing in this document is an offer of securities, an invitation to invest, or investment advice. All figures are projections based on stated assumptions.

Executive Summary

Raise: £87,270,000 · September 2026

The ask in one paragraph

Meridian Global Finance is raising £87.27 million to build and licence a gold-anchored settlement network, the banking infrastructure around it, and the licence-gated platform on which other authorised institutions will operate.

The figure is derived from its uses rather than chosen: £36.98 million of named capital and build lines, £37.04 million of operating expenditure to milestone, 12% contingency, and a 5% placement fee grossed up. The floor is £82 million; below that the licensing path does not close.

This round funds 3.25 years — to DFSA authorisation, launch, and first tenant revenue. It does not fund five years of the plan. A Series B is assumed at first tenant revenue. That is stated here rather than left to be discovered, because a round presented as funding five years is one an investor disproves with a calculator.

Funds are held under a Third-Party Managed Account with an FCA-authorised Electronic Money Institution and drawn down against written milestones.

What is being built

Three things, in the order they generate revenue.

1. The platform. A licence-gated core banking system that authorised institutions operate on, with capability unlocked by each tenant's own permission. An EMI tenant gets payment accounts, cards, transfers, cross-border and FX. A credit institution additionally unlocks the Personal Asset Marker, seeding, the Pool and the credit facility — an in-place upgrade if the tenant obtains a banking licence later. Pricing runs £150,000–£600,000 implementation and £300,000–£1,200,000 annually by tier, plus per-account and transaction lines.

This is the revenue that arrives first and the reason the raise is not dependent on Meridian's own authorisation.

2. Cross-border settlement. A network that does the job correspondent banking does today, in a different order. Compliance clears before funds move rather than after, which is why international transfers currently take one to five days. Value moves as gold-anchored settlement tokens, minted at the live price and burned on arrival, with no correspondent chain and no intermediary balance sheet holding funds in transit. Fee: 0.05% of value, charged to the sender on top, so the recipient receives the full amount.

3. Banking. Multi-currency accounts, cards with instant holder-set controls, savings held as allocated gold, physical cash delivery, and business accounts for merchants.

4. Asset-backed lending. Property finance on a fixed markup rather than compounding interest — risk-banded 1.2× to 2.0×, fixed at origination and never re-priced. No loan-to-value covenant to breach, so a fall in property value triggers nothing. The borrower's deposit is not converted into untouchable equity; it is held as prepaid months of cover they can draw on during hardship.

Underneath all three sits a ledger that stores every amount in base-33 notation, which makes fractional currency units structurally unrepresentable rather than merely disallowed, and a hash-chained record that cannot be quietly amended.

Where Meridian operates

Three locations, each for a stated reason.

DIFC, Dubai — the licensed entity, its regulatory capital, and the premises the DFSA requires within the free zone. Run by a UAE-resident Senior Executive Officer.

Italy — the European operating base. The route in is the acquisition of an existing Italian business, which comes with its commercial site; this is an acquisition of a trading company, not a property purchase. It satisfies Italy's investor-visa route through business investment, gives the founder Italian residency, provides the commercial power supply and space the development and test lab requires, and houses his family during the build. Every one of those purposes is disclosed here deliberately, on the same footing as the other items in Meridian's fit-and-proper record.

Italy also puts the team within practical reach of the build partners by road — through Switzerland to Poland in a single day with an early start, a route that is not realistic from the UK.

United Kingdom — no operating presence.

The relocation is investor-led. Several investors have made participation conditional on the founder and the operating base sitting outside the UK. That condition is the primary driver; the operational advantages follow from it rather than justifying it after the fact.

The separation is deliberate and carries a requirement: effective management of the licensed entity must genuinely sit in DIFC, with board meetings held and minuted there, because Italian law can treat a foreign company as Italian-resident where management is exercised from Italy. The structure is built to that standard from the outset rather than corrected later.

Why now

The migration from SWIFT MT to ISO 20022 closed its coexistence window on 22 November 2025. Every incumbent is mid-programme, migrating a decade of legacy messaging infrastructure, with further mandatory deadlines running to 2028. Meridian has no legacy estate. It can be built ISO 20022-native from the first line of code — an advantage that exists only for an entrant starting now.

Separately, currency debasement has become legible to ordinary holders. Measured in gold, sterling lost 53% of its value in three years, against official CPI of 14.5%. That gap is the case for anchoring a unit of account to weight rather than to policy.

Use of funds

	£m
Raise	87.27
Less: placement fee (5%)	(4.36)
Less: contingency held back, unallocated	(8.88)
Less: regulatory capital, locked at authorisation	(10.40)
Less: seed gold reserve, locked	(10.00)
Less: gold carry — vaulting, insurance, attestation	(0.29)
Less: doré refining and logistics	(0.35)
Less: TPMA and fund establishment	(1.28)
Less: platform development — specialist build partner	(6.50)
Less: infrastructure and certification	(2.00)
Less: platform go-to-market and tenant acquisition	(1.50)
Less: founder establishment and European operating base	(4.09)
Less: development and test workstation	(0.17)
Less: DIFC premises — lease, fit-out, deposits	(0.40)
Deployable operating budget, 3.25 years	37.04

The operating bases are shown openly rather than buried. The Italian line funds the acquisition of an existing trading company together with its commercial site — a genuine acquisition, not a property purchase. It becomes Meridian's European operating base and secure facility, and the same transaction satisfies the qualifying investment under Article 26-bis of the Consolidated Immigration Act. Nothing about this is intended to be quiet: investors should see the whole structure, including the parts that serve more than one purpose. The DIFC line funds premises inside the free zone, which the DFSA requires of a licensed firm — a mainland or virtual address does not satisfy the rule.

Three further lines are new since the previous version, and each is traceable. Platform development at £6.5 million engages a specialist build partner to take the working system to production standard; the scope is certification-led, with acceptance on passing independent security audit and a named tenant's due diligence rather than on capacity, milestone payments against tested deliverables, and source code and IP vesting in Meridian. Infrastructure and certification at £2 million is predominantly ISO 27001, SOC 2 Type II, penetration testing and 24/7 operations — certification is what unlocks tenants, not hardware. Platform go-to-market at £1.5 million funds tenant acquisition for a business model that did not exist when this was first modelled.

Two of these are assets, not expenditure — but neither can fund operations. Regulatory capital is not budget. The DFSA requires USD 10 million base capital (rising with the expenditure-based test as opex grows) for a Category 1 (deposit-taking) licence, held in the licensed entity and unavailable for operations. Every model that treats it as spendable is wrong by that amount.

The seed gold reserve is the same in kind. ASC cannot be credited against metal that does not exist, so £10 million — roughly 96kg, about eight Good Delivery bars — is held allocated with an LBMA vault and independently attested before any token is issued. It sits on the balance sheet and carries about £90,000 a year in vaulting, insurance and attestation. It can be sized at £5 million instead, which still buys a credible attestation and releases £5 million of raise; £10 million reads as more serious to a counterparty bank.

Two further gold requirements are not funded by this raise, and it is worth being precise about why. Transit float — metal backing settlements in flight — is roughly £1.6 million at Year 3 volumes on a four-hour settlement target, and is funded from operations. Savings backing is bought with the customer's own money at the moment they deposit, so the obligation and the metal arrive together; the exposure is the settlement lag, not the principal.

Operating budget to milestone (3.25 years), by category:

	£m	Share
People	49.4	59%
Technology & infrastructure	11.1	13%
Regulatory, legal & professional	6.1	7%
Establishment (Italy, DIFC)	4.6	6%
Go to market	7.6	9%
Travel, insurance, G&A	5.1	6%
Total, including a 10% unforeseen uplift	83.9

Founder establishment and European operating base — itemised

This line is broken out in full. Nothing in it is summarised, bundled or described in general terms, and the residential element is shown on the same footing as everything else.

	£
Acquisition of Italian trading company and estate (EUR 2,988,000)	2,568,784
Acquisition legal, notary and due diligence	128,439
Planning, geometra, destinazione d'uso verification	18,000
Commercial power connection and upgrade	165,000
Development and test lab build — server room, cooling, power conditioning	395,000
Physical and network security, segregation from residential	210,000
Site works and commercial fit-out	340,000
Relocation, transport and establishment	72,000
Italian entity running costs, 3.25 years	195,000
Total	4,092,223

The acquisition is of an existing trading company — a 2,120 sqm organic agritourism estate in Umbria with 19.8 hectares of olive groves, vineyard, pasture and woodland, holding the Umbria Region's 5 Sunflowers rating, the Chamber of Commerce Italian Hospitality brand, and a TripAdvisor Certificate of Excellence. It is an operating business with its own revenue, not a property purchase, and the same transaction satisfies the qualifying investment under Article 26-bis of the Consolidated Immigration Act.

There is no separate residential line: accommodation forms part of the estate acquired, not an additional purchase. The site carries a 40 kW commercial supply with photovoltaic generation, which is what makes the development and test facility possible; Italian residential supply would not carry it.

Conditions of drawdown. Release of this line is conditional on three years of audited accounts for the target, occupancy and forward booking data, written confirmation of the stable's zoning position, the certificato di agibilità on the restored farmhouse, and a supply capacity assessment. These are stated as conditions rather than intentions.

Development and test facility

A single deep-learning workstation is specified for the Italian site: AMD EPYC 9755 with four NVIDIA L40S accelerators, 2 TB ECC memory, NVMe storage and 400 GbE networking, under Ubuntu with the standard container toolchain. £168,537.

Approximately 3.3 kW peak including cooling, which the site's existing supply carries. Generator, fuel store and battery backup provide the resilience layer, and are within the site works line.

NVIDIA AI Enterprise licensing is deliberately excluded. It is not required for bare-metal CUDA workloads, is licensed per GPU across every accelerator in the machine, and can be acquired later if shared-GPU tenancy or a vendor support SLA becomes necessary. Excluding it now is a £79,114 five-year commitment not entered into.

Treasury and drawdown

Capital is held in escrow outside the United Kingdom and drawn against a pre-agreed schedule. This is a condition of the round, not a preference.

Subscription monies are held by an independent escrow agent outside the UK.
Drawdown is against the itemised schedule in this document and the financial model. Expenditure outside that schedule requires consent.
Funds enter the UK only for defined purposes — principally salaries and statutory obligations for UK-resident personnel — and each such flow is identified in advance.
Every application of capital is disclosed before it is made, not reported after.

Nothing in this raise is spent on a purpose not named in this document. That is the standard being applied, and it is the reason the establishment line above is itemised to the pound rather than presented as a single figure.

The route to revenue

Meridian will operate under a partner's permissions before it holds its own licence. Funds and flows sit with an FCA-authorised Electronic Money Institution under a Third-Party Managed Account while Meridian's own DFSA application proceeds.

This is the single most important decision in the plan, and the numbers explain why:

Year 5 cash, net of all deductions	Build alone	Partner first
Base case, £81.78m	(£9.3m)	£27.6m
30% volume shortfall	(£20.7m)	£5.1m

Building alone does not work at this raise, and with the gold reserve in place it needs approximately £108 million. That is not an argument for raising more — it is confirmation that the partner route is load-bearing rather than an optimisation. Operating under a partner's permissions brings revenue forward approximately two years and defers the regulatory capital until the licence is real. It costs a revenue share of roughly 30%, falling by half once Meridian holds its own authorisation — materially cheaper than raising an additional £20 million of equity, and it dilutes nobody.

Phasing

Phase	Period	What it delivers	Gate
1 — Build	Months 1–18	Core ledger, protocol, security; Italy engineering base; the four DFSA-mandated hires; application dossier	DFSA accepts the application
2 — Licence	Months 12–24	Regulatory capital placed; compliance framework; external audit; readiness review	Authorisation granted
3 — Live	Year 2 onward	Client money, settlement volume, first institutional counterparties	Revenue covering operating cost
4 — Scale	Year 4 onward	Lending book, additional corridors, owned infrastructure	Funded from revenue, not from this raise

Financial summary

£m	Yr1	Yr2	Yr3	Yr4	Yr5
Headcount	19	38	60	87	114
Operating cost	7.7	10.2	14.6	21.5	29.9
Revenue	—	—	1.4	8.1	28.8
EBITDA	(7.7)	(10.2)	(13.3)	(13.4)	(1.2)

Figures shown on the build-alone basis, which is the conservative case. On the partner route, revenue begins approximately two years earlier and Year 5 EBITDA is materially positive.

What we are not claiming

This is pre-revenue. No customer has ever paid a fee. Meridian holds no financial services authorisation in any jurisdiction.

The binding risk is volume, not the licence. A six-month delay to authorisation — well inside the DFSA's own stated 12 to 18 month range — is survivable. A 30% shortfall against Year 3 settlement volume is not, building alone, on any raise this round can support.

That risk is materially reduced by the platform line. Tenant implementation and licence fees are contracted revenue from institutions that have already obtained their own authorisation — they do not depend on Meridian's licence, on settlement volume, or on counterparties who have not yet signed. A single Institution-tier tenant is £750,000 in year one and £500,000 recurring. Year 3 volume is a forecast about counterparties who have not yet signed anything.

The lending book is not funded by this raise. Lending requires deposits or wholesale funding, available only after authorisation. Equity absorbs losses; it is not lent out.

Gold is not stable against fiat. It moved 48% within the last twelve months. The argument for anchoring is preservation of purchasing power over time, not short-term stability, and anyone told otherwise should discount the rest of what they are told.

Operating under a partner's permissions is a dependency. If the partner's authorisation is restricted or withdrawn, Meridian's revenue stops before it holds a licence of its own. The contract must carry long notice, defined termination triggers, and an agreed migration path.

The raise

£87.27 million target. £82 million floor.

Every pound is traceable to a named line. The increase over the previously modelled £70 million reflects scope that genuinely grew — a specialist build partner, the certification programme that unlocks tenants, a reserve that now carries funded holding costs, and a platform business that did not exist at first modelling. It is not a number reverse-engineered from a comparator.

Below £82 million the licensing path does not close: regulatory capital, the certification programme and 3.25 years of runway cannot all be funded, and dropping any one of them removes the condition on which the others depend.

Below £60 million, we would rather not proceed than proceed underfunded. A regulated build that runs out of capital at month forty does not fail gracefully.

Meridian Global Finance is in active development and is not currently authorised to provide banking, deposit-taking, payment, investment management or other regulated financial services in any jurisdiction. This document is a summary of a business plan provided to prospective investors in direct discussion. It is not an offer of securities, a prospectus, a financial promotion, or investment advice. All figures are planning assumptions derived from a financial model available on request, not forecasts. Past performance of any asset referenced is not a guide to future performance.

How the consumer model differs from conventional lending, and what that costs to deliver.

Zero Interest: The Holder's Case

How the Beit's consumer model differs from conventional lending, and what that difference costs to deliver.

Version 1.0 · September 2026

1. The claim, stated narrowly

The Beit is not a cheaper bank. It is an institution whose revenue does not come from the people it serves.

That distinction matters more than any rate comparison, because it determines what the institution wants its customers to do. A conventional lender earns more when a borrower borrows longer and repays slower. The Beit earns nothing from either.

Everything below follows from that single structural difference.

2. What consumer credit costs in the United Kingdom


Average credit card APR, May 2026	36.81%
Average credit card interest rate (purchase rate)	27.07%
Bank of England average household card rate, January 2026	24.66% — highest in over 30 years
Arranged and unarranged overdrafts	commonly 20–40%
Average UK adult card balance	~£1,400
Credit card interest paid, UK, 2026	£19.3 billion
Per adult, per year	£342
All UK interest payments, 2026	£60 billion

None of that reduces a balance. Where borrowers meet only minimum payments, most of each payment services interest rather than paying down what was borrowed. On a £1,400 balance at 24.65% it can take over a decade to clear, with the borrower repaying close to as much again in interest as was originally borrowed.

Over a working life, at current rates:

	40 years	63 years
Credit card interest alone	£13,680	£21,546
All consumer interest	£44,444	£70,000

3. The same borrowing under the Beit


Lifetime facility drawn, at £2,000/month from 19 to 82	£1,512,000
Interest charged	nil
Fees charged to the holder	nil
Cash withdrawal charges	nil
Settled at death from the PAM	£1,512,000

The principal is repaid in full. What is never charged is the interest, and the interest is the entire difference.

This is not forbearance or a promotional rate. There is no interest mechanism in the instrument, and no code path by which one could be introduced without amending the deed.

4. The field, side by side

Institution	Primary revenue	Paid by	Earns more when
High-street bank	Net interest margin on lending	the borrower	rates rise, balances persist
Credit card issuer	Interest at 24–37% APR, plus fees	the borrower	repayment is slower
Neobank	Interchange, subscriptions, lending	the customer	usage and lending grow
Short-term / payday lender	Interest, frequently several hundred per cent	the borrower	the borrower cannot repay
Gold-backed token issuer	Custody and minting spreads	the holder	assets under custody grow
The Beit	Merchant transaction fee; stewardship fee on Pool assets	the merchant, and the fund itself	the Pool grows and holders draw less

The last column is the argument. In every conventional model, the institution's interest and the customer's interest diverge at the point where the customer struggles. Under the Beit they do not meet at all — the holder is not the revenue source.

5. What it costs to mean it

Zero interest is not a discount applied to a conventional balance sheet. It is a different balance sheet.

Approximately 44% of the Pool sits out as a non-earning facility at any time. The remaining assets must therefore return roughly 8.85% for holder scores to compound at the stated 5%.

That is the trade, and it should be read plainly rather than implied: the conservative growth assumption and the zero-interest promise cannot both be conservative. One funds the other.

Three consequences follow, and all three are in the design:

The Pool must be the lender, not a treasury and not the Beit's own balance sheet. Carried by a treasury at gilt rates, the outstanding book at national scale would cost more annually than the welfare bill. Carried by the Pool it is forgone return rather than cash outflow — the only configuration in which zero interest is solvent.
Revenue must be aligned, not merely non-extractive. A transaction fee alone is earned on spending, which points the wrong way against a design that rewards restraint. A stewardship fee on Pool assets is what makes the institution earn more when holders do better.
The facility must be non-recourse. Where a PAM settles short, the pooled reserve absorbs it and nothing passes to the family — written into the deed, not the policy manual. A design that abolishes inheritable debt cannot create it at the last step.

6. What this document does not claim

It does not claim the Beit is authorised. Meridian Global Finance holds no banking, deposit-taking or investment permission in any jurisdiction, and the instrument described here requires a credit institution licence to operate.

It does not claim the comparison is like-for-like on risk. Conventional lenders extend unsecured credit to people with no collateral. The Beit's facility is secured against a compounding asset that cannot be withdrawn — a materially safer book, and the safety is what makes the rate possible.

It does not claim the model is proven. The growth assumption is drawn from published sovereign fund performance — Alaska's board return objective is CPI plus 5%, and its realised return since 1977 is around 8.7% — but a return objective is not a guarantee, and Alaska has posted six negative years in roughly forty-eight.

It does not claim conventional banks are behaving improperly. They are doing what their capital structure requires. The argument here is about structure, not conduct.

7. The sentence the comparison reduces to

Every institution in section 4 is solvent because its customers pay interest.

The Beit is solvent because its customers' capital earns a return, and it lends that capital back to them at nothing.

Whether that works depends entirely on the return, which is why the growth mandate is the most consequential open decision in the design — and why it is stated as an open decision rather than a settled one.

Issuance, the credit facility, federation, settlement, transition.

PAM Banking Structure

Personal Asset Marker — institutional architecture, custody, growth mandate, credit facility and settlement

Meridian Global Finance · Design specification · Version 1.3

1. Purpose and scope

This document specifies how the Personal Asset Marker operates inside a banking structure: which entity holds what, who is permitted to touch it, how growth is managed, how the credit facility is secured, and how a PAM closes on death.

It is an internal design specification. It describes a structure under design, not a structure in operation. Meridian Global Finance is in active development and is not currently authorised to provide banking, deposit-taking, investment management, or other regulated financial services in any jurisdiction.

Where this document states a figure, that figure is an assumption under test, not a commitment. Section 14 lists the decisions still open.

2. The founding constraint

The PAM pool is not an asset of any Meridian entity.

Everything else in this document follows from that sentence. If the pool sits on the balance sheet of the institution managing it, then the pool is available to that institution's creditors on insolvency. A PAM described as the survival instrument for a citizen's whole life would be extinguished by the failure of the firm administering it.

The pool is therefore constituted as a separate legal entity — a statutory fund or trust with its own legal personality, bankruptcy-remote from every Meridian entity. Meridian acts as manager, not owner. It earns a management fee. It never owns a penny of the pool.

The practical test: if Meridian Global Finance is wound up tomorrow, a replacement manager is appointed and not one PAM is affected. If that is not true of the structure as built, the structure is wrong.

This is also what makes the pool genuinely inaccessible. Access controls in software can be changed by whoever controls the software. Separate legal ownership cannot.

3. Entity architecture

Entity	Function	Holds
The Pool	Statutory fund or trust holding all PAM assets	Everything
Custodian	Independent third party, holds assets under custody agreement	Legal custody
Stewardship	Regulated manager — investment mandate over the Pool	Nothing
The Beit	Issues the credit facility, holds the loan book	The facility
Valuation Agent	Independent; sets Noble value and PAM valuations	Nothing
Office of the Protector	Represents holders; power to remove the Manager	Nothing

Six roles, and the separations between them are the control environment.

3.1 Custody sits outside the manager

Assets are held by an independent custodian, not by the entity managing them. This is the single control that distinguishes a legitimate managed pool from the structures that have failed catastrophically — in every major misappropriation case of the last thirty years, the manager also held custody. Any serious allocator, and any supervisor, will ask about this before they ask about returns.

3.2 Management is a separate regulated activity

Managing the Pool is not a desk inside the Beit. Under DFSA rules, Managing Assets and Managing a Collective Investment Fund are distinct regulated activities from Accepting Deposits and Providing Credit, each requiring its own permissions, its own capital, and its own Approved Persons.

Stewardship therefore exists as a separately licensed entity operating under a written management agreement with a defined mandate — and can be removed for breaching it.

3.3 Valuation is independent of lending

The entity that values a PAM must not be the entity lending against it.

If Stewardship both marks the pool and sizes the credit line, it holds a standing incentive to mark up: higher valuations justify larger facilities, larger facilities generate more income, and the management fee rises with assets under management. Nobody has to act dishonestly for this to distort outcomes over twenty years.

This mirrors the role segregation already specified at account level — Holder, Contributor, Registry, Valuation, Credit and Audit, with nobody holding two roles against the same PAM. Section 3 applies the same principle at institutional scale.

3.4 Holders need representation

The Office of the Protector exists so that "inaccessible to everyone" does not quietly mean "inaccessible to the holder, fully accessible to the manager."

It holds the power to remove Stewardship, to compel disclosure, and to veto changes to the mandate. Without a counterweight of this kind, a supervisor will assume the manager is unconstrained, and will be right to.

4. Issuance

One PAM per registered birth. No discretionary issuance.

The only event that mints a PAM is a validated birth registration. The only event that burns one is a validated death registration. Total supply is therefore a demographic fact, not a management decision — bounded by the birth rate, which nobody controls and everybody can count.

This is the answer to the question every reviewer will ask about a pegged instrument: what stops unlimited issuance. The answer is the same mechanism used for sovereign issuance under MSaaS — the ledger refuses anything that is not a registration event, and the refusal is recorded permanently.

The birth registration number is validated against the government registry and stored hashed. The PAM is opened in the child's name. A guardian receives visibility and contribution rights only, and control transfers on presentation of the same registration number at eligible age.

4.1 Issuance size

Modelling in Section 7.3 indicates 20,000 Nobles at issuance, against the 10,000 Nobles used in earlier working. At 10,000 Nobles and a 5% growth assumption the system runs above its own ceiling. This is an open decision (Section 14).

At the current gold reference, 20,000 Nobles is approximately 948g, or £98,386.

4.2 Contributions

Anyone may contribute to any PAM. Nobody may ever withdraw.

Withdrawal is prevented by the absence of a code path, not by a permission check. There is no withdrawal function to be authorised, mis-configured, or escalated into.

Contributions are not decorative. At a 5% growth assumption, contributions of approximately £507 per month between birth and age 19 close the entire gap between a 10,000-Noble seed and the fund required to support a flat £2,000 monthly facility. The contribution right is a funding mechanism, and should be presented as one.

4A. Self-seeding

A PAM may be funded privately as well as by the state. The instrument is the same; the funding source is not.

The state seed exists for children whose families cannot fund one. Where a family can, it should — and the design should let it. This removes the objection that the PAM is a state-only instrument, and it means public money is not spent where it is not needed.

4A.1 The ceiling

No PAM may exceed £5,000,000 in value, however funded.

The ceiling is universal. It applies to state-seeded and self-seeded PAMs alike, requires no means testing, and needs no separate contribution limit — a single ceiling applied to everyone is a better rule than two ceilings applied differently.

The ceiling makes large contributions self-limiting without forbidding them:

Seed at birth	Reaches ceiling at age	Years held flat
£98,386 (state)	81	1
£250,000	61	21
£500,000	47	35
£1,000,000	33	49
£5,000,000	0	82

Paying in more does not buy more. It buys the same ceiling sooner and forfeits the compounding in between.

4A.2 Growth above the ceiling

Growth earned on a PAM standing at the ceiling sweeps to the Pool and funds seeds for children whose families cannot pay.

The alternative — compounding simply stops — forfeits real return the Pool has already earned. The sweep is the only treatment that produces redistribution during life rather than only at death, and it gives a treasury a reason to favour the ceiling rather than merely tolerate it.

4A.3 What self-seeding does not buy

The facility is £2,000 per month regardless of PAM value. A £5,000,000 PAM and a state-seeded PAM deliver an identical standard of living.

What additional capital buys is the residual at settlement — what passes to the next generation. This should be stated plainly rather than implied, because a reader who assumes self-seeding buys a larger monthly entitlement has misunderstood the instrument, and because it bears directly on Section 4A.5.

4A.4 Why a family would use a PAM rather than a trust

A UK discretionary trust settled with £500,000 carries a 20% entry charge above the nil-rate band, decennial charges of up to 6%, exit charges on distribution, trustee fees typically 0.5–1.0% annually, and setup costs. Over eighty years this compounds to roughly £1.86m of charges against a fund of approximately £9.4m.

The same £500,000 in a PAM reaches the £5,000,000 ceiling, subject to a single 1.8% charge at settlement.

The structural advantage is approximately 2.6× before any tax treatment is considered. No entry charge, no decennial charge, no exit charge, no trustee, no administration.

This is the incentive. It requires no public subsidy, it is calculable by any adviser, and it holds regardless of the holder's tax position or residence.

4A.5 First-seeding relief

The proposed treatment is relief against income tax on the first seeding of a PAM, to a maximum of £500,000, once per PAM, with no relief on subsequent contributions.

The rationale is that the contributor receives nothing: the transfer is irrevocable, the capital cannot be recovered, and the benefit accrues to the holder. This is the basis on which uncapped charitable relief operates.

The constraint that makes it workable is that PAMs are bounded by births. A donor cannot manufacture eligible recipients. An extended family of two hundred generates roughly two new PAMs a year, representing approximately 2% of a £48m earner's liability.

Two conditions are required for this to hold, and both should be drafted in:

Relief applies only to PAMs opened at birth. Without this, seeding an adult relative's newly opened PAM produces a deduction for the donor, a tax-free entitlement for the recipient, and a fund outside the estate — three benefits from one gift, with no child involved.
Relief is rationed during transition. At launch every PAM in the country is a new PAM. Restricting relief to birth-opened PAMs closes this as well.

Exposure to be resolved by counsel. Charitable relief requires two conditions: irrevocability and the absence of private benefit. Irrevocability alone has not been sufficient in any jurisdiction — this is why irrevocable trusts are nonetheless subject to the relevant property regime. A contribution benefiting the contributor's own family engages private benefit on its face. Further, on the flat-facility rule at 4A.3 the child's position is unaltered by additional capital; what the contribution buys is the residual at settlement, which is an estate benefit rather than a benefit to the child. Counsel should advise on whether relief is obtainable on this basis, on what conditions, and at what cap.

Comparable reliefs are capped and none exceeds 50%: EIS at 30% on up to £1m invested annually, SEIS at 50% on £200,000, VCT at 30% on £200,000. Each exists because the capital enters trading companies that employ people and may fail. A PAM contribution enters a pool and cannot be lost. The precedent is weaker than it appears and should not be leant on in submissions.

4A.6 Insolvency lookback

Self-seeded contributions are subject to a stated lookback period, aligned with the insolvency law of the contributor's jurisdiction — in the United Kingdom, five years for transactions at undervalue and two years for preferences.

The quality that makes a PAM attractive as a protective structure — that nobody can withdraw, ever — is the same quality that makes it available as a fraudulent conveyance. Without a stated lookback, the first insolvency proceeding involving a PAM ends with a court determining that PAMs can be reached. Such a finding would apply to every holder, not merely the one before the court, and would destroy the absence-of-withdrawal guarantee on which the entire structure rests.

Writing the lookback in preserves the guarantee and keeps the boundary under Meridian's control rather than a court's.

The protections this structure is designed to provide are against business failure and against fraud committed upon the holder. It is not available to shield assets from the consequences of the holder's own wrongdoing, and the exclusion should be explicit. The explicit exclusion is what makes the protection credible.

5. The nature of the instrument

The PAM is a score, not a claim.

It is denominated by reference to gold weight, which gives it a stable unit of account across currencies and across decades. It is not a holding of allocated gold, and it does not confer a right to redeem for metal.

It is not currency. It does not circulate. It cannot be spent, transferred between living persons, or pledged to any party other than the Beit.

What it confers is an entitlement: to a secured line of credit sized against its value, and to settlement on death. That distinction is not presentational. A claim on a pool requires a coverage ratio that no national-scale pool could support. An entitlement sized against a value requires only that the structure can carry the resulting credit book — which is a financing question, and an answerable one.

5.1 On the peg

A peg is a promise to defend a price. It is not a source of value, and it does not hold by assertion. Pegs fail when issuance exceeds the capacity to defend them — this is the common thread through Bretton Woods, the ERM, Argentina's currency board, and the algorithmic stablecoin failures of 2022.

The PAM peg holds because issuance is bounded by demography (Section 4) and because the entitlement it confers is settled from real assets in the Pool, not from the peg itself. The peg is a measuring convention. The Pool is the substance.

Any document, page or presentation that implies tokens may be created at will because they are pegged should be treated as a defect and corrected.

6. Growth mandate

The Pool is managed to a total-return mandate. Gold sets the unit of account; the portfolio produces the return.

This is the Alaska and Norway model, and the benchmarks are worth stating plainly because they are the comparators a reviewer will reach for.


Alaska Permanent Fund — board return objective	CPI + 5%
Alaska Permanent Fund — actual, since 1977	approx. 8.7% annualised
Alaska Permanent Fund — trailing ten years	approx. 8.1%
Norway GPFG — fiscal spending rule	3.0% of fund value
Meridian PAM — modelling assumption	5.0%

The 5% assumption is Alaska's stated long-term real return objective. It is materially below what Alaska has delivered across five decades. It is used here deliberately as a conservative case, and the sensitivity is shown rather than hidden.

Growth derives from a diversified portfolio — the same asset classes Alaska holds — with gold as the anchor and denominator rather than the sole asset. This removes the physical supply constraint that a fully allocated model would impose: a fully allocated 20,000-Noble birthright at United Kingdom birth rates would require approximately 580 tonnes of gold annually, around a sixth of global production.

6.1 The Stewardship function

A dedicated department under the Stewardship entity, with:

a written mandate stating target return, risk limits, and permitted asset classes
reporting to the Protector, not to the Beit
performance measured against the stated benchmark and published
no authority to lend to, invest in, or transact with any Meridian entity without Protector approval and full related-party disclosure

6.2 What the assumption rests on

The return is portfolio return, not metal appreciation. This distinction matters because it is the first question a technical reviewer asks.

Gold appreciates; it does not yield. A fund described as "earning 5%" while holding only metal invites the question of what it earns from, and has no answer. A diversified fund denominated in gold weight has a straightforward one: it earns what a diversified portfolio earns, and it is measured in a unit that does not erode.

Where the return in any period falls below the assumption, the consequence is not a shortfall in payments. It is a reduction in available facility under the ceiling described in Section 8. The system absorbs underperformance by lending less, not by paying out less than it holds.

7. The credit facility

The PAM is never drawn. It compounds untouched for the holder's life. The facility runs alongside it, secured against it.

The Pool is the lender. The Beit issues and administers the card; it is not the principal. This is not a presentational distinction — see Section 7.5.

7.1 Terms


Eligible from	age 19
Standard facility	£2,000 per month, flat, indexed to local cost of living
Interest	nil
Holder fees	nil
Security	the holder's PAM
Recourse	non-recourse — limited to the PAM
Ceiling	75% of PAM value
Settlement	on death, from the PAM
Lender of record	the Pool

Funds may be spent, transferred or withdrawn as cash without restriction or charge to the holder. The facility is the holder's to use as they choose; the constraint sits on the PAM, never on the spending.

7.1.1 Local calibration

The £2,000 figure is calibrated to Irish and United Kingdom living costs and is not a global standard. A fixed sterling figure applied worldwide is not viable: five billion holders at £24,000 per year is approximately 138% of world output, which cannot be distributed.

Calibration is structural rather than formulaic. Each national pool grows with its own economy (Section 9), so the facility it supports is scaled to that economy without any central body setting a figure for a country it does not belong to.

The facility is flat and is not stepped. Analysis of a stepped or ramped structure showed it does not solve the early-years problem: the stress point is ages 30 to 38, and a ramp that reaches a livable figure by age 45 has already breached the ceiling by 26 under conservative growth. A flat facility with correct issuance sizing is both simpler and safer.

Terminating the facility at 65 rather than at death was also modelled. It makes no material difference to the capital requirement, for the same reason — by 65 the compounding has already resolved the outcome either way. The facility therefore runs for life.

7.2 Cost of the facility to the holder

Zero interest. Zero fees. No charge of any kind to the holder.

This is a design commitment, not a launch promotion. The facility is the holder's lifeline, and a charge levied against a lifeline is a charge levied against the people least able to carry it.

It also preserves the tax position. Credit is not income and falls outside income taxation under existing law; an interest charge or account fee would introduce a cost that functions as a deduction from the entitlement without appearing as one.

Over a sixty-year term the arithmetic is decisive. Against a PAM of approximately £3.1m at age 85 under conservative assumptions, an unremunerated facility settles at around £2.0m, leaving a substantial inheritance. At 4% compounding the same facility settles at approximately £9.6m — the estate is insolvent, the entire PAM is consumed, and the instrument has become a mechanism for transferring a citizen's lifetime asset to the lender. Anything above roughly 1.5–2% produces that outcome.

Zero is therefore not merely generous. It is the only rate at which the instrument does what it exists to do.

7.3 Sizing

Modelled at a 5% growth assumption, flat facility from 19 to death, peak exposure constrained to the 75% ceiling:

Growth assumption	£2,000/month	£2,500/month
5.0%	20,374 Nobles	25,468 Nobles
6.0%	14,388 Nobles	17,985 Nobles
7.0%	10,463 Nobles	13,079 Nobles
8.7% (Alaska actual)	6,391 Nobles	7,988 Nobles

At a 10,000-Noble issuance and 5% growth, the maximum flat facility that never breaches the ceiling is approximately £982 per month.

Cohort modelling across a full stationary population confirms the same result from the aggregate side. Pool value against outstanding facility book:

Issuance	Growth	Coverage
10,000 Nobles	5%	115%
10,000 Nobles	7%	414%
20,000 Nobles	5%	230%
20,000 Nobles	7%	829%

Coverage below approximately 133% means the system as a whole is operating above its own 75% ceiling. The individual and aggregate models agreeing is evidence the modelling is internally consistent.

7.4 What this is, in balance-sheet terms

This is not a spending programme. Norway's fund distributes approximately 3% annually and never recovers it; on that basis the largest sovereign fund in existence sustains roughly £800 per person per month, across all public services.

The PAM facility is lent, not granted, and is recovered on settlement. In steady state the repayment flow and the lending flow are close to equal. The requirement is therefore to carry the outstanding facility book until it settles — a financing requirement against a matched asset, not a depletion of principal.

That distinction is the central point of the entire structure and should lead any presentation of it.

7.5 Why the Pool must be the lender

A zero-interest facility has no cash income. Whoever funds it carries the outstanding book at their own cost of funds.

At United Kingdom scale the outstanding book approaches £38 trillion in steady state. Carried by a treasury at gilt rates, that is £1.1–1.5 trillion a year — substantially worse than the welfare expenditure it replaces. Carried by a bank, it is a capital charge no institution could bear.

Carried by the Pool, it is not a cash cost at all. The Pool forgoes return on the lent portion; nothing leaves the system; the principal returns on settlement. The carry becomes internal, which is the only configuration in which zero interest is sustainable.

This also makes the non-recourse provision coherent. The Pool absorbing a shortfall on its own book is internally consistent. A bank absorbing it would require external capital against a risk it does not own.

7.6 What zero interest costs in growth

The cost is real and it is paid in compounding, not in cash. It must appear in the model rather than be discovered by a reviewer.

In steady state approximately 44% of the Pool is out as facility, earning nothing. For PAM scores to compound at the stated 5%, the remaining assets must therefore return 8.85%.


Alaska Permanent Fund — stated objective	CPI + 5%
Alaska Permanent Fund — actual since 1977	approx. 8.7%
Required here to sustain 5% scores at zero interest	8.85%

This is achievable — it is approximately Alaska's realised record across five decades — but it is not conservative. At a true 5% portfolio return, scores can compound at only 2.82% once the zero-interest book is carried.

The conservative growth assumption and the zero-interest commitment cannot both be conservative simultaneously. One is funded by the other. Stating this plainly is preferable to presenting two prudent-looking numbers that are not jointly prudent.

7.7 Accrual, transfer and lapse

Entitlement accrues monthly and rolls forward. A holder who does not draw in a given month retains that entitlement. Unspent entitlement is not lost while the holder lives.

This is what makes the facility usable for costs that do not arrive monthly. Eleven years of undrawn entitlement from age 19 is £264,000 — sufficient as a deposit of approximately 53% on a £500,000 property, reducing the mortgage required from £450,000 to £236,000. Accumulate-and-spend is a designed use of the facility, not a loophole in it, and it is among the strongest cases for the instrument.

Accrual requires a ceiling. Unbounded accrual reassembles the lump sum the flat facility exists to prevent: a holder who does not draw between 19 and 30 has £264,000 available in a single transaction. The risk concentrates in exactly the case the structure is meant to address — a holder who is stable for a period, accrues, and then becomes vulnerable with a large balance available.

A ceiling on the accrued balance, or a rolling expiry window, preserves the cushion without ever assembling a sum that could be lost at once. This is an open decision; the design intention above is incompatible with unbounded accrual and one or the other must give.

Transfer between holders is necessary and must be bounded. Partners share costs and families assist each other; a facility that cannot be shared is not usable for household expenditure. But open person-to-person transfer makes the entitlement liquid through a third party, and a secondary market — entitlement sold below face value for cash — appears wherever benefits are issued on transferable instruments. The holders who sell at a discount are those the no-withdrawal rule exists to protect.

Merchant payment and direct debit should be unrestricted. Open transfer should be limited to linked holders within a household or named dependants. All transfers are recorded on the ledger.

This is also the point on which a regulator will press hardest. A transferable credit line settling on proprietary rails at scale invites the question of whether the system constitutes a value transfer scheme. The answer must be structural — bounded transfer, full ledger visibility, identity bound to birth registration — and not merely definitional.

Undrawn entitlement lapses at death. It confers no claim and forms no part of the estate.

Nothing has been lent, so there is nothing held to inherit. The holder who draws less already passes on more, pound for pound, because the PAM settles with less debt against it: on a PAM at the ceiling, a holder who never draws passes on £4,910,000 against £3,398,000 for one who draws fully — a difference of £1,512,000, exactly the amount not drawn.

Treating undrawn entitlement as an inheritable asset would require the Pool to pay out £6,422,000 against a £5,000,000 PAM, creating £1,512,000 per holder with no offsetting asset, and would leave the Pool least solvent against its most prudent members. It would also credit the holder twice for the same restraint.

8. Card economics

Revenue comes from a single source: a transaction fee of 0.05% on merchant settlement.

8.1 The fee falls on the merchant

The holder pays nothing — not to spend, not to transfer, not to withdraw cash. The fee is interchange, borne on the acquiring side, in the ordinary manner of card networks.

This distinction must be explicit in every document and every page. A fee charged to the holder would contradict the zero-fee commitment and would mean a holder paying for access to their own entitlement.

8.2 The fee depends on owning the rails


UK/EU regulated interchange cap — debit	0.20%
UK/EU regulated interchange cap — credit	0.30%
PAM card	0.05%

At 0.05% the fee sits below the regulated floor. On Visa or Mastercard rails the scheme would take 0.20–0.30% while the programme collected 0.05%, losing money on every transaction.

The fee is viable only on Echelon Chain, where marginal transaction cost approaches zero. The card is therefore not a product that can launch on third-party infrastructure — it is a direct commercial justification for the settlement network.

8.3 Yield

A percentage fee is levied on value, not on transaction count. Spending £2,000 across forty purchases yields precisely what spending it in one purchase yields. Transaction frequency does not affect revenue.

Coverage	Annual spend	Fee revenue	Per day
Ireland	£0.1tn	£47m	£0.2m
United Kingdom	£1.2tn	£612m	£1.7m
European Union	£8.2tn	£4.1bn	£11.2m
Global, income-indexed	£30.8tn	£15.4bn	£42m

8.4 Rate adequacy

The fee does not fund the carry — that is forgone Pool return, not cash. It funds programme operations: issuance, fraud, settlement, dispute handling, support.

Cost per account per year	Break-even fee
£15 (lean)	0.062%
£20	0.083%
£25 (realistic)	0.104%

At 0.05% the programme is short at both Ireland and United Kingdom scale — £47m of revenue against £58–98m of cost in Ireland, £612m against £765m–1.3bn in the United Kingdom.

Recommendation: launch at 0.10%. This funds operations comfortably, remains a third of the regulated cap, and leaves the card materially cheaper than any commercial alternative. Raising a published rate after launch is considerably harder than reducing one once scale is achieved.

9. Federated structure

The PAM is not a single global pool. Each participating country has its own pool, its own department, and its own local governing bodies, constituted within that jurisdiction. Meridian provides the ledger, the standard, and the operating framework; the pool itself is local.

Each national pool is invested in and grows with the economy it belongs to. This is the Alaska relationship reproduced per country, and it is what makes the facility self-calibrating: a pool tied to local economic growth supports a facility scaled to local living costs, without any central body setting a figure for a country it does not belong to.

9.1 Growth follows the economy

National pools will diverge, permanently and heritably. A pool compounding at 7% and one compounding at 3% produce, from an identical seed, a difference of approximately 23× over a single lifetime.

This is a stated position, not an oversight. The PAM equalises within a country. It is not a global levelling instrument and does not present itself as one. A pool's growth rate reflects the performance of its economy, which is the responsibility of that economy's government — the same relationship Alaska has to Alaska, and the same reason Alaska does not fund Mississippi.

There is no cross-subsidy between national pools. Meridian manages pools; it does not underwrite economic performance.

9.2 Portability

A PAM travels with its holder.

Event	Treatment
Holder relocates	PAM transfers to the destination pool at full value; nothing is lost
Growth rate	Switches to the rate of the country of residence
Seed and contributions	Unchanged — only the rate varies by location
Facility level	Determined by PAM value, not by local living costs
Seed recovery at death	To the originating country, at nominal, wherever death occurs

The facility rule is the significant one. A holder who relocates draws what their PAM supports, not what their new country costs. Where that falls short of local living requirements, the difference is the holder's to earn. The instrument does not top up to the standards of a destination it did not fund.

Relocation is a free choice and is not restricted. The consequences of it sit with the holder.

9.3 What this resolves

Local constitution places each pool under the supervision of the state whose citizens it serves, which answers the governance question directly: no single body holds a mandate over the citizen wealth of multiple sovereigns. Each department is accountable within its own jurisdiction, under its own governing bodies.

10. The ceiling and the automatic brake

Facility drawn may not exceed 75% of PAM value.

On approach to the ceiling, the available monthly figure reduces automatically. This is enforced by the ledger, in the same manner as safe-draw refusal and sovereign over-issuance refusal: the instruction is declined and the refusal recorded permanently.

This is not a failure state. It is the mechanism by which the structure remains solvent without discretionary intervention. It does mean the monthly figure is not guaranteed under all conditions, and holder-facing material must say so plainly rather than implying a fixed entitlement.

The ceiling is also what makes the governing principle operational: the facility must not overshadow the growth of the PAM. Expressed arithmetically, growth at 5% on a 20,000-Noble PAM covers a £2,000 monthly facility from approximately age 51 onward; before that, the accumulated headroom carries it, and the ceiling enforces the limit if it does not.

11. Closure and settlement

11.1 Trigger and hold

A death certificate is submitted to the Beit by a family member or the person administering the estate.

Submission triggers an immediate hold. The facility is frozen, the PAM is frozen, and the balance is fixed at date of death — not date of settlement. Probate can run for years, and an estate must not be charged for administrative delay it cannot control.

The certificate is a claim, not proof. Settlement proceeds only on verification against the government death registry, mirroring the birth-registry validation at opening. The person submitting the certificate frequently has a financial interest in the outcome; the registry check, not the document, is the control.

11.2 Waterfall

Outstanding facility is cleared from the PAM.
Recovery of the founding contribution to the originating government.
Residual to beneficiaries, transferred into their own PAMs.

Value does not exit the system. It moves from one PAM to another. Where a beneficiary is a minor, the transfer lands in a PAM already locked until eligible age, which requires no special handling.

11.3 Recovery of the founding contribution

The basis of this recovery is an open decision with a range of approximately fifty to one. On a PAM of £5.38m at age 82 under 20,000-Noble issuance and 5% growth:

Basis	Recovered	Residual to beneficiaries
Nominal contribution	£98,386	£3,741,572
Contribution plus CPI	£745,230	£3,094,728
Contribution revalued at peg	£5,375,958	nil

Recommendation: nominal, or nominal plus CPI. The originating government recovers its outlay; it does not participate in the growth. If the recovery indexes to the peg it consumes the entire PAM on every settlement, and the structure is a deferred tax rather than an intergenerational instrument. This must be fixed in the deed, because ambiguity left here will be resolved by a future treasury in its own favour.

11.4 Shortfall

Where the outstanding facility exceeds the PAM at settlement — principally where a holder dies young, with the facility accumulated but the compounding incomplete — the shortfall is absorbed by the pooled reserve and nothing passes to the family.

This must appear in the deed, not in a policy manual. If any part of an unsettled balance can follow a beneficiary, the structure has created inheritable debt, which is the precise condition it exists to abolish.

Pooling makes this financeable: early deaths are offset by long lives, unused facility, and voluntary contributions. It is nonetheless a reserve that must be capitalised and disclosed, not an assumption.

11.5 Cases requiring resolution

Beneficiary without a PAM — a non-resident spouse or relative outside the system. Either the transfer opens a PAM in their name or it cannot complete.
No beneficiaries — residual returns to the Pool. State this explicitly, or intestacy law will supply an answer that is not this one.
Disputed estate — the hold persists; the balance remains frozen at date of death throughout.

12. Correction procedure

A system with no correction path does not avoid corrections. It acquires an undocumented one later, or lives with permanent errors. Both are worse than a governed procedure.

Genuine error cases — misrecorded birth registration, duplicate issuance, identity fraud at opening — are corrected by quorum action under the existing 9-of-13 validator mechanism, recorded permanently and disclosed to the holder.

This is not a withdrawal path and cannot be used as one. It corrects registry errors. It does not move value out of the system, and it cannot reduce a PAM below its issued value.

13. Failure scenarios

Scenario	Outcome
Meridian insolvency	Pool unaffected; replacement manager appointed
Custodian failure	Assets segregated; transferred to replacement custodian
Sustained portfolio underperformance	Facility ceiling reduces available draw; no principal loss
Gold price decline	PAM value falls in fiat terms; facility reduces proportionally
Holder dies young, facility exceeds PAM	Pooled reserve absorbs; nothing passes to family
Forged death certificate	Registry verification fails; hold persists; settlement refused
Attempted unauthorised issuance	Ledger refuses; refusal recorded permanently

13A. Transition

Every figure elsewhere in this document describes a system in steady state. No such system exists, and the path to one is the weakest-evidenced part of the design.

In steady state, PAMs exist at every age, settlements fund new issuance, and repayment flow approximates lending flow. On day one none of that is true. Nobody holds a PAM, nothing has compounded, nothing settles, and the entire cost falls on the founding period.

13A.1 What cannot be done

Existing adults cannot be seeded at issuance. A PAM seeded at 20,000 Nobles to an adult has had no time to compound, so a flat £2,000 facility breaches the 75% ceiling within approximately three years irrespective of the holder's age. The instrument depends on decades of compounding before drawing begins; an adult seed provides none.

The universal one-off is not fundable. Seeding the existing United Kingdom population at £98,386 each is approximately £6.7 trillion, against gilt issuance of a different order entirely. At Ireland scale it is approximately £531 billion. No treasury can raise this, and no structure within Meridian's reach can lend it.

13A.2 The only viable path

Cohort phase-in. PAMs are issued at birth only. Existing adults remain on conventional provision for life.

The annual commitment is then bounded by the birth rate rather than by population:

	Births per year	Annual seeding cost
United Kingdom	~594,000	~£58.4bn
Ireland	~54,000	~£5.3bn

For the United Kingdom this is approximately 19% of current welfare expenditure — substantial, but of an order a fiscal case can be made about, unlike the one-off.

13A.3 What a government receives, and when

The honest position is that a government legislating this receives nothing during its term, and nothing during the following three or four.

Year from launch	Position
1–18	Full annual seeding cost. No draws. No settlements. No welfare saving.
19–40	First cohorts draw. Conventional provision still carried in full for everyone else. Cost is at its peak — both systems running simultaneously.
40–65	Conventional caseload declines as PAM cohorts replace it. First settlements begin.
65+	Settlement receipts and the 1.8% charge arrive at scale. Repayment flow approaches lending flow.

The peak burden falls between years 19 and 40, when both systems are carried at once. This is the fiscal fact that determines whether the proposal is adoptable, and it has not yet been modelled. It should be, before any approach to a treasury.

13A.4 What follows from this

The sixty-to-seventy year horizon is not a rhetorical framing; it is a consequence of the arithmetic. Norway's fund was established in 1990 and became fiscally material only in the 2010s. Alaska's was established in 1976.

Three implications follow:

The proposition to a treasury cannot rest on welfare savings, which arrive after year 40 at the earliest. It rests on the 1.8% charge — a large, predictable, cheaply collected receipt against a base that compounds without assessment or litigation.
A statutory lock is required. No structure dependent on sustained contribution across ten or more parliaments survives on policy alone.
Private and self-seeded PAMs matter disproportionately during transition, because they carry no public cost at a point when public cost is at its highest.

13A.5 Open

The transition case is the least developed part of this specification and the part most likely to determine whether it is adopted. Required before external presentation: a year-by-year fiscal model of the dual-running period, a position on statutory entrenchment, and a defined treatment of the cohort born immediately before launch.

14. Open decisions

Issuance size — 10,000 or 20,000 Nobles. Modelling supports 20,000 at a 5% growth assumption. This doubles the founding commitment per citizen.
Recovery basis for the founding contribution — nominal, CPI-indexed, or peg-indexed (Section 11.3).
Card fee rate — 0.05% as specified, or 0.10% as recommended for operational self-funding (Section 8.4).
Standard facility amount — £2,000 or £2,500 monthly, which interacts directly with decision 1.
Compensating issuance — whether seed size varies by national growth rate, or is uniform. Uniform issuance is consistent with Section 9.1; varying it would soften divergence at the point of origin.
Jurisdiction of the Pool and the statutory form it takes.
Accrual ceiling — whether accrued unspent entitlement is capped (6 or 12 months) or expires on a rolling window. Unbounded accrual is incompatible with the flat-facility principle (Section 7.7).
Transfer boundary — the limit on open person-to-person transfer, and the identity binding applied to it (Section 7.7).
First-seeding relief — whether obtainable at all, on what conditions, and at what cap. Counsel opinion required; the private-benefit exposure is set out at Section 4A.5.
Transition — the dual-running period between years 19 and 40 is uncosted and determines adoptability (Section 13A).
Investment mandate — whether national pools invest domestically, globally, or on a split mandate with a capped domestic allocation. Alaska is mandated to seek maximum prudent return and explicitly not to act as an in-state development bank; Norway invests exclusively abroad. A domestic mandate builds the national economy but tracks its growth rate; a global mandate makes the return assumption at Section 7.6 realistic and largely removes the divergence accepted at Section 9.1. This decision governs the return assumption on which every other figure depends and should be taken first.
Tax treatment. Facility draws are credit, not income, and fall outside income taxation under existing law in the relevant jurisdictions — this requires no exemption and should not be presented as one. Settlement and residual transfer are where taxation arises, and statutory recognition on the model of existing long-term savings vehicles is the appropriate route. Confirmation required from counsel in each jurisdiction.

Settled in this revision

Zero interest and zero holder fees, as a design commitment rather than a promotional rate (Section 7.2).
The Pool, not the Beit and not a treasury, is lender of record (Section 7.5).
The transaction fee falls on the merchant, not the holder (Section 8.1).
The card cannot launch on third-party card rails at the specified fee level (Section 8.2).
Pools are federated by country, each locally constituted and locally governed (Section 9).
Divergence between national pools is accepted as a stated position; no cross-subsidy (Section 9.1).
A PAM travels with its holder; the growth rate follows residence; the facility is sized by PAM value, not local living costs (Section 9.2).
A universal ceiling of £5,000,000 per PAM, however funded, with growth above it sweeping to the Pool (Section 4A.1–4A.2).
Self-seeding permitted; the facility remains £2,000 monthly regardless of PAM value (Section 4A.3).
The incentive for private seeding is structural — approximately 2.6x a discretionary trust on charges alone — and does not depend on tax relief (Section 4A.4).
An insolvency lookback applies to self-seeded contributions, aligned to the contributor's jurisdiction (Section 4A.6).
Undrawn entitlement lapses at death and forms no part of the estate (Section 7.7).
Existing adults are not seeded; transition is by birth cohort only (Section 13A.2).
Earlier demonstration material modelled an active-phase percentage draw. That was a projection tool for illustrating compounding to investors, not a design proposal, and is superseded by the credit structure specified here.

15. Status

Meridian Global Finance is in active development. It is not currently authorised to provide banking, deposit-taking, investment management, or other regulated financial services in any jurisdiction, and nothing in this document is an offer or solicitation of any kind.

Figures are modelling assumptions under test. The gold reference used throughout is £3,226 per troy ounce, with 1 Noble denominated at 0.047424g.

Meridian Global Finance · PAM Banking Structure · Version 1.3

Identity binding, permissions, and the absence of a withdrawal path.

PAM Access Control

For the production application. Supersedes the demonstrator.

0. What changes from the demo, and why

Demo behaviour	Production	Reason
"Advance a year" control	REMOVED ENTIRELY	Time cannot be a user input against a compounding fund. It is an abuse vector, and there is no legitimate reason a holder needs it.
PAM balance and projections visible to holder	Balance visible. Projections internal-only.	A projection is not a fact. Showing one invites reliance on a number nobody has promised.
Single-operator control of PAM records	Segregated across functions	No individual should be able to open, credit, value and authorise draws against the same fund.

The year-advance control must not exist in any build shipped outside a controlled demonstration environment. It is not to be hidden behind a flag, a role, or an admin screen. It is deleted from the production codebase. A function that can move a compounding fund forward in time is a function that can be made to pay out early.

1. Access model

Access is by function, never by seniority. Nobody holds more than one of these against the same PAM.

Function	Can	Cannot
Holder	View current balance. View contribution history. Make contributions. Nominate beneficiaries.	Withdraw. Transfer. Pledge. View projections. Alter any date.
Contributor (third party)	Contribute to a nominated PAM. See only their own contributions.	View the balance. View holder details beyond the name they were given.
Registry	Open a PAM against a verified birth record. Link a child PAM to a guardian account.	Credit, value, or authorise any draw.
Valuation	Apply the gold price. Run the yield calculation.	Open, close, credit, or authorise a draw.
Credit	Assess and authorise a facility secured on the PAM.	Alter the balance. Alter the valuation. Open or close a PAM.
Audit	Read everything.	Write anything.

Rule: any operation touching a PAM requires the acting function to be recorded on the ledger entry. An entry with no function attributed is invalid and must be rejected at write time, not flagged at review.

2. The irreversibility rule

Value can enter a PAM. Value cannot leave it.

This is the defining property. It is not a policy, a default, or a setting.

There is no withdrawal endpoint. Not restricted — absent.
There is no transfer-out endpoint.
There is no close-with-balance path. A PAM ends only on death, under the succession rules.
A contribution, once committed, cannot be reversed by the contributor, the holder, or an operator.

Implementation note: implement this as the absence of a code path, not as a permission check. A permission can be misconfigured. A function that does not exist cannot be called. If a withdrawal path exists anywhere in the codebase "for testing", it will eventually run in production.

The holder must be told this in plain words before their first contribution, and it must be repeated at every contribution over a threshold you set:

Money paid into a Personal Asset Marker cannot be taken out. It is not a savings account. It exists to provide for your future, not your present.

3. Child PAM — opening

Trigger: a guardian with a verified account requests a child PAM.

Required: the child's birth registration number, validated against the government birth registry.

The registry check confirms the child exists and the birth is registered. It is not an identity check on the guardian — that has already happened at account opening. Two separate verifications, recorded separately.

On success:

PAM opened in the child's name, not the guardian's.
Seeded per the issuance rules.
Linked to the guardian's account as a visible dependent, not as an asset of the guardian.
Birth registration number stored hashed, never in clear. It is a lookup key at transfer, not a stored identifier.

What the guardian gets: visibility of the balance, the ability to contribute, and nothing else. The guardian cannot withdraw, pledge, close, or transfer the child's PAM at any age. The PAM was never theirs.

Rejections, all of which must be recorded rather than silently failing: - Birth registration not found or not matched - A PAM already exists against that registration number - Guardian account not verified

4. Child PAM — contributions

Anyone may contribute. Guardians, grandparents, family, anyone given the reference. This is deliberate: a child receiving birthday money should be able to put some of it into their own PAM.

Contribution rules: - Minimum: set low enough that a child can contribute meaningfully. - No maximum on aggregate, but single contributions above your threshold trigger source-of-funds checks like any other credit. - The contributor sees only their own contributions, never the balance. - Every contribution is irreversible on commit, and the contributor is shown that before confirming.

What contributions do not do. A contribution does not create an entitlement to earlier access, a larger draw before the eligible age, or any claim by the contributor on the fund. A grandparent who contributes £10,000 has given a gift, not bought an interest. State this in the contribution flow, because someone will eventually assume otherwise and be aggrieved.

5. Child PAM — transfer to the holder

Trigger: the holder, at the eligible age, presents the same birth registration number.

Process: 1. Holder opens or already holds an account in their own name, fully verified. 2. Presents the birth registration number. 3. System matches the hash against child PAMs awaiting transfer. 4. Identity match confirmed against the birth record. 5. PAM re-links from guardian visibility to holder control.

What changes on transfer: the holder now sees their own balance and contribution history directly. The guardian's visibility ends.

What does not change: the holder still cannot withdraw. Transfer of control is not transfer of access to capital. That distinction has to be explained clearly in the interface or it will be misunderstood at exactly the moment it matters.

6. Draw eligibility

No benefit accrues before the eligible age. Not a reduced benefit — none.

From the eligible age, a facility becomes available secured on the PAM. The holder is not given the fund. They are given access to a monthly sum, with the PAM standing as security.

6.1 The safe-draw rule — non-negotiable

Draw plus state share may never exceed the fund's actual yield.

Consequence: the capital is never reachable. Not by the holder, not by an operator, not by an administrator with a reason. A request exceeding the rule is refused — not queued, not escalated, not flagged for approval. Refused, and the attempt recorded.

6.2 Sizing the draw — read this before setting the number

The draw must be derived from the fund, not fixed in configuration. A fixed monthly figure will eventually exceed what the fund yields, and at that point either the rule breaks or the product does.

Worked example at the current seed:


Seed at birth	10,000 Nobles = 474.2g gold ≈ £49,193
Compounded to 19 at 5%	£124,307
Yield at 5%	£6,215/year = £518/month
Sustainable draw	£518/month, indefinitely, capital intact

A £2,500/month draw against this fund exhausts it at age 24. It is 4.8× the yield. The safe-draw rule would refuse it on the first request, correctly.

To sustain £2,500/month the fund must be £600,000 at age 19, which requires a seed of approximately 48,267 Nobles — about 2.29kg of gold per citizen at birth, roughly 4.8× the current figure.

This is the number that matters for any sovereign conversation. "A livable wage replacing welfare" costs roughly £236,000 of gold per citizen at birth, not £49,000. Better to know it now than to discover it in front of a finance ministry.

Implementation: express the draw as a percentage of fund yield, not a currency amount. It then rises as the fund rises, and the safe-draw rule is satisfied by construction rather than by monitoring.

monthly_draw = (fund_value * yield_rate * holder_share) / 12

7. Credit facility secured on the PAM

At eligible age, the holder may be issued a credit facility with the PAM as security.

Rules: - Facility limit is a percentage of fund value, capped by the safe-draw rule. - Drawings accrue against the facility, not against the fund's capital. - The fund is never liquidated to settle the facility. It is security, not a source of repayment. If it can be sold to clear a debt, it is not a lifelong asset. - On default, the facility is suspended and the draw reduced. The capital stays intact.

The distinction to make explicit in the interface: a holder with £126,000 in their PAM does not have £126,000. They have a monthly entitlement derived from it. Every screen showing the fund value must show the available draw alongside it, or the number will be misread.

8. What must be recorded

Every one of these is a ledger entry, and the refusals matter as much as the approvals:

PAM opened, with the acting function and the registry verification result
Every contribution, with contributor reference
Every valuation run
Every draw request — approved and refused
Every refusal reason
Transfer of control from guardian to holder
Any facility issued, varied, or suspended

A refusal that leaves no record is only half a control. A holder who was refused must be able to prove they were refused, and why.

9. Removed functions — do not reintroduce

Function	Status	If someone asks for it
Advance/extend years	Deleted	The answer is no. There is no legitimate operational need, and it is the single highest-value target for abuse.
Withdraw from PAM	Never existed	The absence is the product.
Guardian access to child capital	Never existed	The PAM was never the guardian's.
Operator balance adjustment	Deleted	Corrections are made by a new compensating entry, never by amending history.
Single-operator full access	Deleted	Segregated by function.

10. Training — what staff must be able to explain

Staff will be asked all of these, and a wrong answer given confidently is worse than no answer:

Why can't I take my money out? Because it is not a savings account. It is an asset that provides for your future. Everything paid in stays in.
I have £126,000 — why can I only draw £518? Because the draw comes from what the fund earns, not from the fund itself. Spending the capital would end the benefit within a few years.
I contributed to my grandchild's PAM — can I see the balance? No. You can see your own contributions. The fund belongs to the child.
Can I use my PAM as a deposit on a house? It can stand as security. It cannot be sold or spent.
What happens to my child's PAM if I close my account? Nothing. It was never yours.

This specification describes intended system behaviour for a product that is not authorised in any jurisdiction. Seed values, yield rates, draw percentages and eligible ages are parameters to be set against a funding model and confirmed with counsel, not constants. The arithmetic in section 6.2 should be re-run whenever any of them changes.

Capability gated by each tenant's own authorisation.

Licence-Gated Platform

Meridian as infrastructure that licensed institutions operate on, with capability gated by each tenant's authorisation.

Version 1.0 · Not legal advice — the mapping in §3 requires confirmation per jurisdiction.

1. What this changes

Meridian stops being an applicant for a banking licence and becomes the ledger, the standard and the rails that licensed institutions run on. A tenant brings their own authorisation; the platform unlocks only what that authorisation permits.

This resolves the sequencing problem directly. Meridian does not wait years for a Category 1 licence before the PAM can exist — a tenant that already holds one can run it on day one, in their jurisdiction, under their permissions. It also maps cleanly onto the federated structure already designed: a department per country, each locally licensed, each running the same standard.

What it does not do is remove regulation. Supplying ICT services to financial entities engages DORA in the EU and the critical third parties regime under Chapter 3C of the Financial Services and Markets Act in the UK. Every regulated tenant will impose contractual resilience, incident-reporting, subcontracting and audit obligations on Meridian, and those apply whether or not Meridian is ever formally designated. Budget for the compliance function accordingly — it is smaller than a licence, not absent.

2. Enforcement principles

Server-side, capability-based, fail-closed.

The gate is in the service layer, never the UI. A hidden button is not a control. Every API call resolves the caller's licence profile and checks the capability before doing any work.
Default deny. An unrecognised licence class, an expired verification, or an unmapped jurisdiction grants nothing. New capabilities ship disabled for every tenant until explicitly mapped.
Licence status is verified, not declared. Check against the regulator's public register — the FCA Financial Services Register, the DFSA public register, the relevant national competent authority — on onboarding and on a recurring schedule. A tenant's assertion of their own permissions is not evidence.
Re-verification is mandatory. Authorisations get varied, suspended and revoked. A cached "yes" from eighteen months ago is a liability. Re-check on a schedule and on every material action.
Every gate decision is logged — tenant, capability, licence class, jurisdiction, decision, timestamp — and written to the chain. This log is the evidence that the platform enforced the boundary, and it is the first thing a regulator will ask for.
Jurisdiction is part of the key, not an attribute. An EMI authorisation in one jurisdiction does not carry to another. The permission lookup is (licence_class, jurisdiction, capability).

3. Capability matrix

Indicative. Requires confirmation per jurisdiction before implementation.

Capability	AISP/PISP	Payment Institution	EMI	Investment firm	Credit institution
Account information	✓	✓	✓	—	✓
Payment initiation	✓	✓	✓	—	✓
Payment accounts / virtual IBAN	—	✓	✓	—	✓
Card issuance	—	✓	✓	—	✓
Transfers, direct debits, standing orders	—	✓	✓	—	✓
Cross-border remittance	—	✓	✓	—	✓
FX incidental to payments	—	✓	✓	—	✓
Merchant acquiring / transaction fee	—	✓	✓	—	✓
E-money issuance	—	—	✓	—	✓
PAM registry record	—	—	✓	✓	✓
PAM seeding (holding funds)	—	—	—	✓*	✓
Pool investment management	—	—	—	✓	✓
PAM facility (credit provision)	—	—	—	—	✓
Settlement and estate handling	—	—	—	—	✓
Deposit accounts	—	—	—	—	✓

* Subject to the vehicle's own structure and permissions; an asset manager holds client assets under different conditions than a bank holds deposits.

The three bolded rows that only a credit institution unlocks are the PAM itself. Everything above them is a payments business. This is the honest shape of the product: the transactional layer is broadly available, the instrument that defines the project needs a bank.

4. Data model

Tenant
  ├── legal_entity, jurisdiction
  ├── licence[]  
  │     ├── class, regulator, reference_number
  │     ├── verified_at, verification_source, next_check_due
  │     ├── status: active | varied | suspended | revoked
  │     └── permissions_snapshot        (as published by the regulator)
  └── capability_grants[]               (derived, never hand-edited)

Capability grants are derived from verified licence state, never set directly. There must be no administrative function that grants a capability without a corresponding verified licence — that function would become the vector by which the whole control is bypassed, and it would be the first thing an attacker or a careless operator reaches for.

5. Licence change handling

A licence being varied or revoked is an operational event with customer impact, not a database update.

Event	Platform response
New capability added	Grant on next verification
Capability removed	Revoke immediately; block new activity in that capability
Suspended	Freeze all gated activity; existing balances remain readable
Revoked	Full block; initiate the wind-down procedure below

Wind-down must be designed before launch, not after the first revocation. For each capability: what happens to in-flight transactions, to held balances, to PAM records, and to the customers of that tenant. A tenant losing its licence must not mean its customers lose their records or their money. Write this into the tenant agreement and build the runbook.

6. Liability boundary

Meridian provides infrastructure. The tenant holds the customer relationship, the regulatory permission and the conduct obligation.

That division must be explicit in the tenant agreement, but note that regulators look through contractual arrangements to substance. If the platform designs the product, sets the terms, determines the pricing and controls the customer experience, a regulator may conclude that the platform is performing the regulated activity regardless of who holds the licence.

The safer position is that tenants configure meaningfully — their own terms, their own pricing within bounds, their own conduct standards — rather than reselling a fully-determined product with their licence number on it. Worth raising with counsel early, because it affects product design and not merely paperwork.

7. Build sequence

Tenant model, licence records, register verification integration
Capability resolution service with default-deny and full audit logging
Gate every existing endpoint; tests asserting that ungranted capabilities return 403 and perform no work
Payment capabilities live for PI and EMI tenants
PAM registry for EMI and above
Seeding, Pool and facility for credit institution tenants
Wind-down runbook and tenant agreement before the first external tenant

8. Open for counsel

Whether the capability mapping in §3 holds in DIFC, UK and EU respectively
Whether operating this platform is itself a regulated activity in any target jurisdiction
Where the conduct liability sits when the platform determines product design — §6
DORA obligations that will be pushed down contractually by EU tenants, and what they cost to meet
Whether Meridian should self-designate under DORA, which carries oversight cost but signals maturity to institutional tenants
Whether a tenant's customers have any claim against the platform on tenant failure

Operating under an EMI and upgrading on licensing.

Phased EMI to Beit

How Meridian operates under an Electronic Money Institution authorisation, and upgrades to full Beit function on licensing, without rebuilding.

Version 1.0 · Not legal advice — every scope question below requires confirmation from DIFC counsel.

1. The principle

Build the endpoint data model now. Gate the regulated functions behind permission flags.

The mistake to avoid is building a payments product and later bolting a bank onto it. The ledger, the identity binding, the PAM registry and the block structure should all be built to their final shape in Phase 1. Only the activities are gated.

The mistake in the other direction is equally costly: building Phase 2 capability into a Phase 1 deployment where a misconfiguration could activate it. Phase 2 code must not be present in the Phase 1 build at all.

2. The absolute boundary

Safeguarded e-money funds must never touch the Pool. Not temporarily, not in transit, not in a reconciliation window.

An EMI must safeguard customer funds in a segregated account at a credit institution, or under insurance, and is prohibited from using them to extend credit or investing them beyond permitted safeguarding assets. Commingling is not a compliance defect to be remediated — it is the event that ends the authorisation.

Architectural controls required:

Separate ledger namespaces with no transfer primitive between them. Not a blocked transfer — no function that could express one.
Separate database credentials. The Phase 1 service must have no write access to Pool tables.
Daily automated reconciliation of safeguarded balances against the e-money float, with a hard alert on any variance.
A test in CI that fails the build if any code path can move value between namespaces.

This is the single control that matters most in Phase 1. Everything else is recoverable.

3. Phase 1 — live under EMI

3.1 Operating

Function	Status
Payment accounts, virtual IBANs	Live
Card issuance and merchant payment	Live
Credit transfers, direct debits, standing orders	Live
Cross-border remittance and corporate payments	Live
FX incidental to payment transactions	Live
Transaction fee revenue (0.1%)	Live
Echelon Chain recording payment events	Live
Identity binding to registration documents	Live

This is a real business. It generates the transaction fee revenue, builds the customer base, and proves the ledger at production volume — which is the strongest possible evidence to put in front of a regulator at the Phase 2 application.

3.2 PAM in Phase 1 — registry only

A PAM may exist as a record: issued against validated birth registration, bound to identity, recorded on chain, visible to the guardian.

It may not hold funds, accrue growth, or carry a facility.

Why. Accepting money that is not for payment purposes is deposit-taking. Investing it is asset management. Lending against it is credit provision. An EMI holds none of those permissions, and the PAM engages all three.

What this buys: the registry, the identity layer, the birth-registration integration and the issuance discipline are all proven and populated before Phase 2 opens. On licensing, existing PAM records activate rather than being created from nothing.

3.3 Built but dormant

Present in the data model, absent from the Phase 1 deployment:

Pool accounting and unit tracking
Growth accrual engine
Facility accrual, drawing and settlement
Settlement waterfall and the levy
Self-seeding and contribution handling

Schema exists. Migrations are written and tested. Code is in a separate crate or service that is not deployed.

4. Language constraints in Phase 1

An EMI cannot describe itself as a bank or imply deposit protection.

This is not presentational. It is a conduct requirement and it applies to the site, the app, the documents and any investor material that a consumer could reach.

Do not use	Use
bank, banking, the bank	the institution, Meridian, the platform
deposit, deposits, depositor	funds held, balance, e-money balance
savings, savings account	payment account, balance
interest	(nothing — no interest is paid or charged)
your money is protected	funds are safeguarded under EMI rules

Also required: a clear statement that e-money balances are not covered by a deposit guarantee scheme.

Action. The current site, the Beit framing and several documents use banking language throughout. This needs a full pass before any EMI application, and it will read oddly at first — the Beit as steward rather than as a house that holds deposits. That framing is closer to the actual design anyway.

5. The alternative worth costing

Phase 1 as described cannot fund a PAM at all, which delays the product for years.

Option: a separately licensed fund vehicle from the outset. The Pool sits in its own entity with its own asset-management permission, distinct from the EMI. Seeding and growth then operate in Phase 1; only the facility waits for Phase 2.

Trade-off: two authorisations to obtain and maintain rather than one, two capital requirements, and a more complex group structure. But it puts the PAM in front of real holders years earlier, and the five-entity structure already contemplated in the financial model may accommodate it without much change.

This is a question for counsel and it should be asked early, because the answer determines whether Phase 1 is a payments business with a dormant registry or a payments business with a live, growing PAM.

6. Phase 2 — on licensing

6.1 Trigger

Authorisation granted for deposit-taking or credit provision, and for managing the Pool, in the relevant jurisdiction. DFSA Category 1 carries a base capital requirement of USD 10m or 18/52 of annual operating expenditure, whichever is higher.

6.2 Activation sequence

Capital in place and verified before any activation
Pool entity funded and the investment mandate operating
Safeguarding arrangements restructured — the e-money boundary from §2 changes shape and must be re-specified, not simply removed
Existing PAM records activated: seeding enabled, growth accrual begins
Facility opened to holders at eligible age
Settlement and levy paths enabled last, as they are the least urgent and the most consequential to get wrong

6.3 What migrates cleanly

Because the endpoint model was built in Phase 1: identity bindings, PAM records, registration hashes, the chain history, the customer base and the payment rails all carry over without migration. Only new capability is switched on.

7. Open for counsel

Whether a separately licensed Pool vehicle can operate alongside an EMI in the same group, and under what separation requirements (§5)
Whether a PAM registry record with no funds and no facility constitutes a regulated activity in itself
Whether the DFSA categories map as assumed — payments, credit and asset management as three distinct permissions
Whether Phase 1 language changes are sufficient, and what disclosure is required on every consumer surface
Which entity in the existing five-entity structure holds the EMI authorisation

Pricing, security package, wind-down, successor mechanism.

Platform Tenant Heads of Terms

Commercial structure for licensed institutions operating on the Meridian platform.

Version 1.0 · This is a commercial structure for counsel to draft from. It is not a contract and not legal advice.

1. The relationship

Meridian supplies technology. The Tenant holds the regulatory permission, owns the customer relationship, and carries the conduct obligation.

	Meridian	Tenant
Ledger, rails, PAM standard	Provides	Uses
Regulatory authorisation	—	Holds
Customer relationship and contract	—	Owns
Conduct and consumer duty	—	Carries
Product terms and pricing to end customers	Bounds	Sets
Availability, security, resilience	Carries	Monitors

Meaningful Tenant configuration is required, not optional. Regulators look through contracts to substance. If Meridian determined the product, the terms, the pricing and the customer experience, a regulator could conclude Meridian performs the regulated activity whoever holds the licence. The agreement should therefore require the Tenant to set its own customer terms, its own pricing within defined bounds, and its own conduct standards — and Meridian should be able to evidence that it did.

2. Pricing

2.1 Tiers

Tier	Active accounts	Implementation	Annual platform	Per account / month	Transaction
Foundation	up to 50,000	£150,000	£300,000	£0.45	4 bps
Institution	50,000 – 500,000	£250,000	£500,000	£0.30	3 bps
Sovereign	500,000+	£600,000	£1,200,000	£0.18	2 bps

Transaction fees apply to payment volume processed, with a flat fee substituting above a defined ticket threshold so large-value corporate flow is not priced out (see the rate analysis: an ad valorem fee is uncompetitive against large-corporate treasury pricing).

An Institution-tier tenant at 250,000 accounts and £2bn annual flow yields approximately £2.0m a year across the three lines.

2.2 Tier movement

Reviewed quarterly against active account count. Movement up takes effect at the next billing period; movement down at the next anniversary, to prevent gaming around a review date.

2.3 Additional charges

Implementation beyond the standard scope, bespoke integration, additional environments, out-of-hours support, and audit or regulator support beyond an agreed annual allowance, all at published day rates.

3. Licence maintenance — Tenant obligations

The Tenant must at all times:

Hold and maintain every authorisation required for the capabilities it uses
Notify Meridian within 2 business days of any variation, restriction, suspension, revocation, regulatory investigation, enforcement action, or voluntary undertaking affecting those permissions
Permit and assist verification against the relevant public register, on onboarding and on Meridian's recurring schedule
Notify of any change of control, material adverse change in financial condition, or breach of its own capital requirements

Notification is an obligation, not the control. Meridian verifies independently against the regulator's register regardless, because a tenant in difficulty is precisely the tenant least likely to notify promptly.

4. Security package

4.1 Structure

A Wind-Down Security Deposit, held in escrow with a third-party agent on trust terms, with defined drawdown triggers.

Not held on Meridian's balance sheet. If Meridian held it, the Tenant would be an unsecured creditor on Meridian's insolvency — the mirror of the risk being managed — and holding institutional funds against future obligations raises its own permission question.

4.2 Sizing

Deposit = £250,000 + (£0.75 × active accounts)

Reviewed annually and on tier movement. Top-up due within 30 days of a review notice. Capped at an agreed maximum, with a parent or group guarantee covering exposure above the cap.

Indicative wind-down cost, which the formula tracks:

Accounts	Estimated total wind-down cost
25,000	~£568,000
250,000	~£933,000
1,000,000	~£1,480,000

4.3 The deposit is security, not a forfeit

Critical drafting point. A clause providing that the deposit "becomes applicable to Meridian" on Tenant failure is a forfeiture, and penalty clauses are unenforceable where the sum is out of proportion to the legitimate interest protected. An administrator will challenge it, and a clause that fails takes the protection with it.

Draft it as security instead:

drawn against actual, itemised wind-down costs
reconciled on completion of the wind-down
surplus returned to the Tenant or its estate
shortfall claimed as an ordinary debt, and covered by the guarantee where applicable

Commercially near-identical. Legally the difference between enforceable and void.

4.4 Return on orderly exit

On termination without licence failure, and once migration is complete and all sums are settled, the deposit is returned in full within an agreed period.

5. Successor institution

5.1 What is required

A named successor cannot simply assume a book. Transferring customers between licensed institutions is a regulated transaction — in the UK a banking business transfer runs under Part VII of the Financial Services and Markets Act, requiring court sanction and regulator consent, over months rather than days.

The arrangement therefore requires, in advance of any failure:

A standing agreement with the successor institution, signed and in force
The successor's own permissions covering those customers in that jurisdiction
Due diligence on each Tenant's book completed before failure, refreshed periodically
A continuous retainer paid to the successor — no institution holds capacity open for free
A transfer mechanism the relevant regulator has been sighted on

The successor retainer is charged to the Tenant as a pass-through, annually.

5.2 Tenant obligations

The Tenant agrees in advance to the appointment of the successor, grants the powers of attorney and consents needed to effect a transfer, and is obliged to cooperate with migration. These consents must be given at signing, because a Tenant in administration may be unable or unwilling to give them later.

6. Failure and wind-down

Trigger	Platform response
Capability removed from licence	Immediate revocation of that capability; existing positions readable
Authorisation suspended	Freeze all gated activity; balances readable; no new business
Authorisation revoked	Full block; wind-down initiated; successor engaged
Insolvency event	As revocation, plus notification to affected regulators
Failure to top up the deposit	Escalation, then treated as a termination event

The wind-down runbook is an annex to the agreement, not a later document. For each capability it must state what happens to in-flight transactions, held balances, PAM records and the Tenant's customers.

Customers must not lose records or money because their institution failed. That is the point of the entire arrangement, and it should be stated as a principle in the agreement rather than left to be inferred.

7. Data, IP and exit

Tenant data belongs to the Tenant. Meridian holds it as processor.
Meridian owns the platform, the ledger design, the base-33 standard and the PAM specification. The Tenant receives a licence to use, not to own.
Tenant environments are logically separated with their own credentials and storage. No cross-tenant access path exists.
Exit assistance is a contractual right, priced at published day rates, with a defined data format and a maximum period. A tenant that cannot leave cannot safely join, and procurement will test this clause hard.
Source code escrow, released on defined Meridian-failure triggers, is standard for critical infrastructure and should be offered before it is asked for.

8. Regulatory and resilience obligations

The Tenant's own regulator will require Meridian to meet outsourcing and operational resilience standards, which flow down contractually. Under DORA these apply to EU financial entities from 17 January 2025, and the UK critical third parties regime sits in Chapter 3C of the Financial Services and Markets Act.

Meridian commits to:

Incident notification within defined windows
Subcontractor disclosure and change notification
Audit and inspection rights for the Tenant and its regulator
Business continuity and exit testing at agreed intervals
Register-of-information support to allow Tenant DORA reporting

These obligations apply whether or not Meridian is ever formally designated. An annual allowance for audit and regulator support should be defined, with additional work chargeable.

9. Liability

Meridian's liability capped at an agreed multiple of annual fees, with standard exclusions for indirect and consequential loss.
Uncapped for the matters that are usually carved out: death or personal injury, fraud, and breach of confidentiality or data protection obligations.
Meridian does not indemnify the Tenant for the Tenant's own regulatory breaches, including operating outside its permissions. The capability gate is a control, not a warranty that the Tenant is compliant.
The Tenant indemnifies Meridian against claims arising from the Tenant's conduct toward its own customers.

10. Term

Initial term of 3 years, then annual renewal. Termination for convenience on 12 months' notice, reflecting migration lead times. Immediate termination for licence revocation, insolvency, or material unremedied breach.

11. For counsel

Enforceability of the security deposit structure in each target jurisdiction
Whether the successor mechanism satisfies the Tenant's own regulator as a credible continuity arrangement
Whether operating the platform is itself a regulated activity anywhere in scope
Whether §1 gives sufficient Tenant configuration to avoid Meridian being treated as performing the regulated activity
Escrow agent selection and trust terms
DORA obligations likely to be imposed by EU tenants, and their cost

How the institution runs day to day.

Operating Process

Operating Process & Structure

September 2026 · Companion to the Executive Summary and financial model

1. Corporate structure

Five entities, each with one job.

Entity	Jurisdiction	Purpose
Meridian Holdings Ltd	ADGM or DIFC	Investors hold equity here. Owns everything below. One cap table.
Capital SPV	DIFC Prescribed Company	Holds the raise. Ring-fenced from operating liabilities.
MGF Operating Ltd	DIFC	The regulated entity. Holds the DFSA licence, employs the Approved Persons, holds regulatory capital.
Meridian Technology Srl	Italy	Engineering team, product development.
Meridian IP Ltd	ADGM or DIFC	Holds base-33, the Echelon protocol and trademarks. Licenses to OpCo.

Setup cost: approximately USD 242,000 in year one, roughly 0.3% of the raise, already inside the model's legal and establishment lines. A DIFC Prescribed Company is USD 1,100 in year one (USD 100 application plus USD 1,000 licence); the regime opened to all applicants on 24 July 2026.

Two rules that cannot be bent:

Regulatory capital sits in the licensed entity. The USD 10 million cannot be held in the SPV or the TPMA and pointed at. The DFSA tests capital in the entity holding the permission. It moves to MGF Operating at authorisation — not before, not elsewhere.
IP sits outside the operating entity. If the operating company ever fails, the protocol, the numeral system and the trademarks survive and remain licensable. This costs almost nothing to arrange now and is impossible to arrange later.

2. How investor money reaches the business

Funds are held by the FCA-authorised Electronic Money Institution under a Third-Party Managed Account, and released to MGF against written conditions.

Step	What happens	Who holds the permission
1	Investors subscribe for equity in Meridian Holdings and pay into the TPMA	The EMI
2	Funds held in segregated safeguarding accounts, separate from the EMI's own assets	The EMI, under EMRs 2011 and PSRs 2017
3	MGF submits a drawdown request against pre-agreed conditions	The EMI administers and releases
4	Funds released to MGF Operating for the stated purpose	MGF receives; each release evidenced
5	At authorisation, regulatory capital placed into the licensed entity	MGF Operating

Why this structure rather than holding the money ourselves. Pooling money from multiple investors and deploying it at a manager's discretion can meet the definition of a Collective Investment Fund, which requires a fund manager licence Meridian will not hold. Under a TPMA the account is operated by an authorised institution whose permissions cover precisely this activity. Meridian is a beneficiary drawing against agreed conditions, not the operator of a fund.

It also gives investors something stronger than a promise: money with a regulated firm, in segregated accounts, released against conditions agreed at close.

Disclosed to every investor, in these words: the FSCS does not apply. Client funds are safeguarded under the Electronic Money Regulations, which separates them from the firm's own assets. That is not a deposit guarantee.

3. Drawdown governance

A drawdown mechanism is a governance mechanism. Whoever approves releases effectively controls the company, so the conditions are agreed in writing at close and are objective, testable and dated — never matters of judgement.

Standing monthly release covers payroll, rent, and contracted services against the approved budget. Administrative, not discretionary.

Milestone releases are tied to events that either happened or did not:

Milestone	Evidence	Releases
DFSA application submitted and accepted	Regulator acknowledgement	Phase 2 tranche
External audit completed	Signed audit opinion	Audit-contingent tranche
Authorisation granted	Licence document	Regulatory capital placement
First institutional counterparty settled	Executed transaction record	Phase 3 tranche

Variance reporting. Any category running more than 10% above budget is reported to the board in the month it occurs, with the cause and the remedy, not at the quarter end when it is already history.

What the contract must contain before a penny moves: long notice periods, defined termination triggers, an agreed migration path for client funds, and confirmation in writing that the TPMA covers holding subscription monies for a corporate fundraise — a specific use, not to be assumed because the product exists.

4. Why Italy

The operational base is Italy, with the regulated entity in DIFC. Four reasons, in order of weight.

1. Access to the development partner. The engineering relationship requires regular, in-person work. Italy places the founder within practical reach of it. This is the primary driver; everything else is corroborating.

2. Cost of engineering. The same seniority costs roughly 40% less in northern Italy than in London or DIFC. Across a five-year build with engineering at the centre of the cost base, that difference is worth several million pounds — and it buys the same people, not cheaper ones.

3. Route to Dubai. Italy to Dubai is approximately six hours, with an FBO close to the operational base. A DIFC licence requires visible, regular presence; the ability to be in Dubai reliably and at short notice is a structural requirement of the licence, not a convenience. From Italy that is a routine trip. From several alternatives it is not.

4. Practical accessibility. Establishing and maintaining a base in Italy is materially more straightforward at present than the alternatives considered, including Poland. Entry and establishment friction is a real operational cost when the schedule is licence-driven and slipping months are expensive.

What Italy is not. It is not the regulated jurisdiction. The DFSA licence attaches to MGF Operating in DIFC, and the four mandated Approved Persons — Senior Executive Officer, Compliance Officer, MLRO and Finance Officer — must be UAE-resident. Italy is where the product is built. Dubai is where the bank is licensed and supervised. Conflating the two would be a serious error in front of a regulator.

5. The gold reserve

ASC is anchored to a fixed weight of gold. Tokens cannot be credited against metal that does not exist, so a seed reserve of £10 million — approximately 96kg, about eight Good Delivery bars — is placed before go-live, held allocated with an LBMA vault and independently attested.

Requirement	Size	Funded by
Seed reserve	£10m	The raise. Locked, like regulatory capital.
Transit float	c.£1.6m at Yr3 volumes, four-hour settlement	Operations
Savings backing	1:1 with customer ASC holdings	The customer, at deposit

Carrying cost is approximately £90,000 a year: vaulting and insurance at 30bps plus independent attestation at £60,000.

Attestation is not optional. An unaudited gold claim is worth nothing, and a counterparty bank will ask for the vault report before it asks anything else. The attestation schedule is annual at minimum, and the reserve is never commingled with customer holdings.

6. Dubai presence and travel

Maintaining a DIFC licence is not a remote activity. The budget reflects that.

£ per year	Yr1	Yr2	Yr3	Yr4	Yr5
CEO — multi-jurisdiction	230,000	290,000	360,000	430,000	500,000
Executive team & client	90,000	150,000	220,000	300,000	380,000

CEO travel assumes approximately 20 Dubai trips a year plus roughly 12 long-haul trips across Asia-Pacific for market and partner development: flights, accommodation and ground transport. The CEO is not the UAE-resident officer — that is the Senior Executive Officer, hired locally and budgeted within headcount. This is a cost of the corporate structure, not a discretionary line, and it is deliberately not trimmed. A regulator that cannot reach the people responsible will draw its own conclusions, and a licence application is a poor place to discover that.

General and client travel covers counterparty visits, conferences and partner onboarding — institutional business development, which is a relationship business conducted in person.

6b. Jurisdictional roadmap

DIFC is the first licence, not the only one. The intended path runs through Singapore, Japan, South Korea and China — markets where the thirteen-hub Spire architecture is designed to operate.

Each is a separate licence, not an extension of the DFSA one. Singapore (MAS), Japan (FSA), South Korea (FSC) and China each require their own application, their own regulatory capital, their own locally-resident officers and their own multi-year timeline. None of that is funded by this raise, and none of it should be implied to an investor as included.

It is a Phase 4 programme funded from revenue. It is named here because it is the growth path and it explains the CEO travel profile — but it is deliberately outside the five-year model. A plan that quietly assumed four additional banking licences inside this raise would be wrong by an order of magnitude.

What this raise does fund toward it: the protocol, the ledger and the settlement architecture are built jurisdiction-agnostic from the start, so expansion is a licensing and staffing exercise rather than a rebuild. That is a material part of why the technology is being built rather than bought.

7. Operating cadence

Weekly. Engineering standup in Italy. Compliance and risk review. Cash position against plan.

Monthly. Board pack: management accounts, variance against budget, licence application status, pipeline. Standing drawdown request. Any category more than 10% over budget flagged with cause and remedy.

Quarterly. Independent security review during the build phase. Milestone assessment against the drawdown schedule. Investor update, whether or not the news is good — particularly when it is not, because a single round means investors have no opportunity to reprice and must not be surprised.

Annually. External audit from Year 2. Full penetration test. Regulatory return. Reassessment of the volume assumptions that the whole model rests on.

8. The three assumptions that decide the outcome

Stated plainly, because they are where the plan will be right or wrong.

1. Settlement volume from Year 3. The largest single swing factor. It is a forecast about counterparties who have not signed anything. A 30% shortfall is fatal on any raise below £70 million building alone. This is why the partner route matters: it buys roughly two years of revenue before that forecast has to be correct.

2. Time to authorisation. Modelled at 18 months, the outer end of the DFSA's stated range for a well-prepared de novo application. Every additional month costs approximately £0.9 million of burn against no revenue. Survivable, but not free.

3. Headcount ramp. People are 59% of operating cost. The four DFSA-mandated roles are hired in Year 1 regardless of licence status, because the regulator expects them in place at application. Everything else can flex; those four cannot.

9. What happens if it goes wrong

Volume disappoints. Headcount ramp slows first — it is the largest and most flexible line. Retail acquisition stops entirely; it is the smallest revenue contributor and the largest discretionary spend. The partner route continues rather than accelerating toward own-licence, preserving cash at the cost of margin.

Authorisation is delayed. Operations continue under the partner's permissions. This is the scenario the partner route exists to absorb, and it is why the route is load-bearing rather than an optimisation.

The partner relationship ends. The most serious single-point risk, which is why the contract carries long notice and a defined migration path. Mitigation is to treat the own-licence timetable as urgent throughout, never comfortable.

Capital runs short. There is no second round. This is addressed by raising £70 million rather than the £47 million the model says survives, and by holding 12% unallocated. The contingency is not a slush fund and is not counted as budget in any figure presented to investors.

Meridian Global Finance is in active development and is not currently authorised to provide banking, deposit-taking, payment, investment management or other regulated financial services in any jurisdiction. This document describes an intended operating structure and is not an offer, a prospectus, or a representation that any regulatory authorisation, partnership or engagement is in place. Entity costs, fees and timelines are indicative and should be confirmed with counsel and the relevant registries before commitment.

Build specification for the banking app PAM module.

PAM App Implementation

For implementation in Cursor. Target: beit-accounts.html (banking app), with removals in beit-demo.html.

Version 1.0 · Meridian Global Finance

1. Remove from the DIFC-facing surface

Delete the year-advance simulation entirely.

In beit-demo.html: - #advanceBtn and #advAllBtn — both controls - advanceYear() and its listeners (lines ~1095–1135, ~2640–2641) - PAM_MINORITY_GROWTH and PAM_ACTIVE_YEAR block types - Any UI that projects a PAM balance forward in time

Why this matters beyond presentation. A projection control on a regulator-facing screen reads as a performance illustration. Under DFSA conduct rules, projected returns shown to prospective clients attract disclosure requirements that a demo cannot satisfy. Removing it is the correct call and should be recorded as deliberate, not incidental.

Growth still occurs server-side. It is simply not simulated, not projected, and not user-advanceable.

2. Access control

PAM administrative functions — issuance, seeding approval, correction, settlement — are available to operations staff only, authenticated separately from the citizen app.

Citizen app: read own PAM balance, read facility state, contribute, transact on facility
Ops console: everything else
No shared code path between the two. The citizen build must not contain issuance or correction functions at all, not merely hide them.

Correction remains a quorum action under the existing 9-of-13 Ophir Spires mechanism. It is not an ops override.

3. Activation

A PAM is activated through an existing verified banking account. It is not a standalone signup.

Account (verified, KYC complete)
  └── Activate PAM
        └── Add child account
              └── Seeding route  ──┬── Apply for state seed
                                   └── Self-seed

Requirements at activation: - Birth registration number, validated against the government registry, stored hashed - PAM opened in the child's name - Guardian receives visibility and contribution rights only - Control transfers at eligible age on presentation of the same registration number

4. Seeding routes

Two options presented at setup, equally weighted in the UI.

4.1 State seed

Application submitted through the app. Status states: submitted → under review → approved / declined.

Do not imply automatic approval. The state is the decision-maker; the app is the channel.

4.2 Self-seed

Funded from the activating account.

Recommended minimum: 10,000 Nobles (~£49,200) — pending resolution, see §9
Subject to the £5,000,000 lifetime PAM ceiling
First seeding only is relief-eligible, per the design specification
Irrevocable. The confirmation screen must state this in plain words before commitment, not in small print after.

5. No withdrawal

There is no withdrawal function. This is implemented as absence of a code path, not a permission check or a disabled control.

Do not write a withdrawal handler that returns an error. Do not add a canWithdraw flag. There must be nothing to authorise, misconfigure, or escalate into.

Contributions in, growth accrues, facility draws against it, settlement on death. No other movement exists.

6. Facility activation at 19

At eligible age the holder may apply for the facility. On approval:

PAM view shows three things, clearly distinguished:

Display	Meaning
PAM balance	The score. Not spendable. Not a claim.
Available credit	Accrued entitlement not yet drawn
Facility account details	Sort code / account number for routing

The distinction between the PAM balance and available credit must be visually unmistakable. A user who believes the PAM balance is spendable has misunderstood the instrument, and that misunderstanding is the single most likely source of complaint.

Facility capabilities: - Card payment at merchants - Transfer to own main account - Transfer to another account - Direct debits and standing orders - Bill payment

Facility terms: - Zero interest - Zero fees to the holder - Accrues monthly, rolls forward - Secured against the PAM, settled at death

7. Open items requiring a decision before build

7.1 Seed size versus facility amount

These are in conflict and cannot both ship as stated.

Seed	Value	Max flat draw within 75% cap
10,000 Nobles	£49,187	£1,031/month
20,000 Nobles	£98,375	£2,061/month

A £50,000 seed does not support a £2,000 monthly facility. Either raise the seed to 20,000 Nobles or size the facility to roughly £1,000.

Whichever is chosen, the figure appears in the UI and becomes the number users hold you to.

7.2 Accrual ceiling

Unbounded accrual reassembles a lump sum — eleven undrawn years is £264,000 available in one transaction, which is the outcome the flat facility exists to prevent.

Implement a cap (6 or 12 months) or a rolling expiry. The value is a decision; the mechanism should be built either way.

7.3 Transfer boundary

Open person-to-person transfer makes the entitlement liquid through third parties and invites a secondary market.

Recommended: merchant payment and direct debit unrestricted; open transfer limited to linked holders within a household or named dependants. All transfers recorded on the ledger.

8. Ledger and arithmetic

All amounts as integer hay-pennies (£0.005). No fractional representation anywhere.
Base-33 at the boundaries: wire format, storage keys, displayed identifiers.
Native integers in the core for arithmetic, comparison, accumulation.
Every PAM event commits a block. Issuance, seeding, contribution, facility draw, repayment, settlement.

9. Regulatory display requirements

Every PAM screen must carry the development-stage disclaimer already used elsewhere on the site. Meridian Global Finance is not currently authorised to provide banking, deposit-taking, or investment services in any jurisdiction.

No screen may display a projected future value, a rate of return, or a growth illustration.

Native base-33 arithmetic engine, algorithms and testing.

Base-33 Limb Core

Implementation specification for a native base-33 arithmetic engine in Rust.

Meridian Global Finance · Echelon · Version 1.0

1. What this is

A bignum arithmetic core that operates genuinely in base 33 throughout — not a binary engine with a base-33 display layer. Values are stored, added, multiplied and compared in base-33 limbs, and serialise to runes without any radix conversion.

Design claim, stated honestly. This produces identical results to binary integer arithmetic. It is not faster, not more accurate, and not more secure. What it provides is a machine that operates natively in the system's own base, so that the wire format, the storage format and the arithmetic all share one radix and no conversion step exists between them. That is a coherence and integrity property, not a performance one, and it should never be presented as the latter.

2. Constants — verified

B     = 33
K     = 12                              digits per limb
R     = 33^12 = 1_667_889_514_952_984_961

Quantity	Value	Check
33¹²	1,667,889,514,952,984,961	60.53 bits — fits `u64`
33¹³	55,040,353,993,448,503,713	65.58 bits — exceeds `u64`
2 × 33¹²	3,335,779,029,905,969,922	addition carry safe in `u64`
33²⁴	2.78 × 10³⁶	multiplication intermediates safe in `u128`

K = 12 is maximal for u64, and it is also the elegant choice. Each limb maps to exactly twelve runes, so no base-33 digit is ever split across a limb boundary. Encoding becomes a per-limb operation with no cross-limb carry logic. A binary bignum cannot do this — base-2⁶⁴ limbs do not align to base-33 digits at any boundary.

3. Type layout

/// Little-endian limbs. Each limb < R. Always at least one limb.
/// Canonical form: no trailing zero limbs except a single [0] for zero.
pub struct B33 {
    limbs: Vec<u64>,
    neg: bool,
}

Invariants to assert in debug builds: - every limb < R - limbs.len() >= 1 - no trailing zero limb unless limbs == [0] - neg == false when the value is zero (no negative zero)

4. Operations

All algorithms below are verified — a reference implementation was cross-checked against arbitrary-precision integers over 3,000 random values up to 33⁴⁰ with zero mismatches. Port them directly rather than re-deriving.

4.1 Addition (magnitudes)

carry = 0
for i in 0..max(len_a, len_b):
    s = a[i] + b[i] + carry          // u64, max 2R-1 < u64::MAX
    if s >= R { s -= R; carry = 1 } else { carry = 0 }
    out.push(s)
if carry != 0 { out.push(carry) }

No overflow: maximum intermediate is 2R - 1 ≈ 3.3 × 10¹⁸, against u64::MAX ≈ 1.8 × 10¹⁹.

4.2 Subtraction (magnitudes, requires a ≥ b)

borrow = 0
for i in 0..len_a:
    d = a[i] as i128 - b[i] as i128 - borrow
    if d < 0 { d += R; borrow = 1 } else { borrow = 0 }
    out.push(d as u64)
assert!(borrow == 0)
trim(out)

4.3 Signed add/sub

Sign-magnitude. Compare magnitudes first, subtract smaller from larger, take the sign of the larger. Zero result must clear neg.

4.4 Multiplication (schoolbook)

out = vec![0u64; len_a + len_b]
for i, x in a:
    carry: u128 = 0
    for j, y in b:
        cur = out[i+j] as u128 + x as u128 * y as u128 + carry
        out[i+j] = (cur % R) as u64
        carry    = cur / R
    k = i + len_b
    while carry != 0 {
        cur = out[k] as u128 + carry
        out[k] = (cur % R) as u64
        carry  = cur / R
        k += 1
    }
trim(out)

Maximum intermediate is R² + 2R ≈ 2.8 × 10³⁶, well inside u128::MAX ≈ 3.4 × 10³⁸.

Schoolbook is correct at any size. Karatsuba is worth adding only above roughly 32 limbs (≈ 384 base-33 digits), which no monetary value will reach — defer it until a profile shows it matters.

4.5 Division by a small divisor (d < R)

rem: u128 = 0
for i in (0..len_a).rev():
    cur = rem * R + a[i]             // u128
    out[i] = (cur / d) as u64
    rem    = cur % d
trim(out), rem

4.6 Full division

Knuth Algorithm D adapted to radix R. Needed for general quotients; not needed for the ledger, which divides only by small denominators. Implement §4.5 first and add Algorithm D only when a caller requires it.

4.7 Comparison

Trim both, compare lengths, then limbs from most significant down.

5. Codec

Each limb is exactly twelve runes. The most significant limb strips leading zeros; all others are zero-padded to twelve.

const RUNES: [char; 33] = [
    'ᚠ','ᚢ','ᚦ','ᚩ','ᚱ','ᚳ','ᚷ','ᚹ','ᚻ','ᚾ','ᛁ','ᛄ','ᛇ','ᛈ','ᛉ','ᛊ','ᛏ',
    'ᛒ','ᛖ','ᛗ','ᛚ','ᛝ','ᛟ','ᛞ','ᚪ','ᚫ','ᚣ','ᛠ','ᛡ','ᛢ','ᛣ','ᛥ','ᚸ',
];

These codepoints are load-bearing. Five of them (Tir, Beorc, Ac, Æsc, Ing) were wrong in earlier versions of this project's tables — visually similar but genuinely different Unicode characters, one of them the ETH character. Copy this array verbatim; do not retype it, and add a test that round-trips every rune through char as u32.

Decoding must reject any character not in the table rather than substituting zero.

6. Testing

Differential testing is the requirement, not unit tests. Compare every operation against a trusted arbitrary-precision implementation (num-bigint) over randomised inputs.

proptest! {
    #[test]
    fn add_matches_bigint(a in any_b33(), b in any_b33()) {
        prop_assert_eq!(to_big(&(a.clone() + b.clone())),
                        to_big(&a) + to_big(&b));
    }
}

Cover: add, sub, signed add/sub, mul, divmod_small, cmp, encode, decode, round-trip. Include the boundary cases explicitly — zero, one, R-1, R, R+1, single-limb maximum, values straddling limb boundaries, and negative results that reach exactly zero.

Also assert the invariants from §3 after every operation in debug builds. Most bignum bugs are canonical-form violations that only surface later as wrong comparisons.

7. Expected performance

Target is within 2–3× of native u64 arithmetic for values of a few limbs. For reference, a digit-at-a-time Python implementation runs at roughly 60× native.

If the measured figure lands far outside 2–3×, the likely causes are heap allocation per operation (use SmallVec with inline capacity for 2–4 limbs) or % and / by the non-power-of-two constant R (precompute a reciprocal and use multiply-shift).

Do not pursue SIMD. Carry propagation is inherently serial and the gain does not survive the complexity.

8. Integration boundary

   Rust core (this crate)          base-33 limbs throughout
        │
        ├── FFI / WASM             encode to runes at the boundary
        │
        └── application layer      runes on the wire, in storage, on screen

Money remains integer hay-pennies (£0.005). The limb core is an integer engine; it has no fractional type and should not acquire one. Rates, fees and proportional splits are computed as integer numerator/denominator operations with an explicitly stated rounding rule, exactly as the existing ledger does.

Note that the fee, levy, growth and cap denominators all carry factors of 2 or 5, so none of them terminate in base 33 either. The rounding rule is required regardless of base and is not something this core removes.

8A. Rates, ratios and decimal interoperability

8A.1 No floating point in the core

The limb engine is an integer engine. It has no fractional type and must not acquire one.

Every rate in the system is a ratio of small integers:

Quantity	Ratio
Transaction fee (0.1%)	1 / 1000
Settlement levy (1.8%)	18 / 1000
Annual growth (5%)	1 / 20
Facility cap (75%)	3 / 4

All are computed as:

/// Exact integer ratio with a single stated rounding step.
/// Panics on den == 0. Never used for money without an explicit rule.
pub fn apply_ratio(amount: &B33, num: u64, den: u64, rule: Rounding) -> B33

product   = amount * num          // exact, limb multiplication
quotient  = product / den         // exact quotient
remainder = product % den
apply `rule` once, to the remainder only

Exact until the single rounding step, bit-identical on every machine, no floating-point unit involved, no rounding mode to configure globally, and reproducible in an audit years after the fact.

The rounding rule is a stated policy, not an implementation detail. Declare it once (banker's rounding / round-half-even is the conventional choice for financial systems, as it avoids the upward bias of round-half-up over large volumes), apply it in exactly one place in the codebase, and document it in the ledger specification. Two different rounding rules in two code paths is the classic source of reconciliation breaks.

Note that none of these denominators terminate in base 33 — 1000, 20 and 4 all carry factors of 2 or 5. The rounding rule is required regardless of base. Base 33 does not remove it.

8A.2 Decimal floating point at the interface only

IEEE 754-2008 standardised decimal floating point (decimal64, decimal128), and it is implemented in hardware on IBM z-series. Several systems Meridian must interoperate with use it: mainframe clearing systems, some card processors, and ISO 20022 amount fields.

Requirement. Values arriving in or leaving as decimal must be parsed and emitted natively, never routed through a binary float. A binary float cannot represent most decimal fractions exactly, so passing a decimal amount through f64 corrupts it silently.

inbound   decimal128  ->  exact integer hay-pennies  ->  limb core
outbound  limb core   ->  exact integer hay-pennies  ->  decimal128

Reject rather than round on inbound values carrying more precision than one hay-penny. A silent truncation at the boundary is a reconciliation break waiting to happen.

Do not use decimal floating point in the ledger. decimal128 holds 34 significant digits and then rounds — 10⁴⁰ + 1 loses the +1. Integer minor units never do. For a ledger, integers are strictly more precise than decimal floating point, and substituting one for the other would be a downgrade.

The architecture is the same shape throughout: a rich representation at each boundary, exact integers in the middle.

base 33      at the wire and display boundary
decimal128   at the interoperability boundary
integers     everywhere in between

9. Reference prototype

A verified Python reference implementation of every algorithm in §4 and §5 exists at limbproto.py. It passed 3,000 randomised cross-checks against Python's arbitrary-precision integers and against the project's existing base33.format_notation(). Port from it; use it as the oracle in differential tests during development.