Quipu is a complete, working market venue for tokenised assets: three tiers of trading, instant settlement, and a compliance and surveillance apparatus built into the architecture rather than bolted onto it. It was designed for one reader in particular — the person who must put their name on the regulatory application.

You may not write software, but you are answerable for it. When the regulator, the auditor or the board asks how do you know the books balance? How do you know no tokens were minted off the record? How do you know that reversed trade was reversed correctly? — the answer cannot be "the vendor assures us." Quipu was built so the answer is: we checked, independently, and here is the evidence.

Quipu is a full trading and settlement venue in a single system. It offers three cumulative tiers of market: a bulletin board for negotiated bilateral deals with multi-round counter-offers; call auctions that clear every participant at one uniform price; and a continuous limit order book with the order types and safeguards of an institutional exchange — price bands, circuit breakers, self-trade prevention. It handles four asset classes, from straightforward digital tokens to financial instruments, walks issuers through onboarding with an approval queue at the end, and runs primary offerings as well as secondary trading. It operates in sterling and euro, under UK and EU jurisdiction, in six languages, with its own administration consoles and content management built in.

The engineering underneath is deliberately conservative: Go and PostgreSQL, six self-contained binaries and a background worker. Nothing exotic to hire for, nothing fashionable to explain away.

Most markets match a trade and then spend hours or days settling it — and settlement can fail. Quipu removes the gap entirely. Funds are reserved before an order ever enters the book, and the moment a trade matches, the buyer's cash, the seller's tokens, the fees and the trade record all move together in one indivisible transaction, within milliseconds. A fill cannot fail to settle because there is nothing left to do. There is no clearing cycle, no counterparty limbo, no unwind risk. Finality is not a process here; it is a property.

Beneath the market sits a classical double-entry ledger: separate journals for money and for tokens, every entry zero-sum by rule, negative balances impossible by construction. Both journals — and the audit log — are cryptographically chained, so that altering any historical record visibly breaks the chain. Once a day, the books are sealed with a Merkle anchor: a compact fingerprint that can be lodged outside the system altogether, meaning not even the operator can quietly rewrite history. Token supply is conserved per asset — units cannot appear or vanish off-ledger, and tokens exported to self-custody remain counted.

This is the part your auditors will enjoy. Quipu ships with an independent, read-only verifier that re-derives every ledger invariant from first principles. It does not ask the platform whether the books balance; it recomputes them and tells you. The matching engine is deterministic, so the order journal can be replayed at any time and must reproduce — byte for byte — every fill the system ever reported. Reconciliation against the chain runs on its own, and if supply ever drifts, the affected asset halts itself and opens a case before a human has noticed. Trust is a fine thing. Quipu prefers arithmetic.

Every action a user can take is gated by a compliance matrix tied to their identity-verification level and the asset class involved — the rulebook is enforced by the system, not by memoranda. Incoming money is matched automatically by unique, check-digited payment references and registered bank accounts, with third-party funding held to suspense for review. Withdrawals above threshold require two separate administrators; so does breaking a trade, which is reversed with exact compensating entries, never by editing the past. An export to an unscreened wallet is not discouraged — it is impossible — and every export carries the data package required under the FATF Travel Rule, with holders re-screened against sanctions lists on schedule.

The most sensitive category, financial assets, sits behind a dual-controlled gate that provably refuses while closed. You can demonstrate to a regulator not merely that you do not yet offer them, but that the system cannot — and open the gate, under two pairs of hands, when your permissions do.

Surveillance runs live: wash-trade and rapid-churn detection with thresholds you can tune in production, a case workflow with assignment and a full transition trail, and export in the STOR style — the suspicious transaction and order reports supervisors expect to see. Any instrument can be halted and resumed individually, and every trading entry point honours the halt.

Resilience here is not a policy document. It is a scripted failover drill that proves zero fills lost or duplicated; backup and point-in-time recovery runbooks with a scripted restore; a black-box load harness; and monitoring with a full alert pack covering ledger integrity, settlement lag, funds and availability — all exercised in continuous integration, not dusted off before an audit. Every external dependency — identity checks, sanctions, banking, screening — sits in an endpoint registry with a manual fallback, and every parameter change is versioned. When someone asks who changed what, and when, and under whose second signature, the system already knows.

Quipu is not a whitepaper and not a roadmap. It is a working venue whose every material claim was designed to be checked by someone other than its makers — which is precisely the posture a regulatory process rewards. If your responsibility is to take a market from it works to it is authorised, ask for the demonstration that matters: we will halt an instrument, break a trade, replay the book and run the independent verifier while you watch.

Most platforms ask for your confidence. This one hands you the means to withhold it.