Who keeps Canton's numbers honest?

Ask how big the Canton Network is and you’ll have four answers inside five minutes.

The network’s own boilerplate says it supports over $6 trillion in on-chain real-world assets. A research note says Canton had processed $6 trillion by the end of 2025. An aggregator calls it $6 trillion a month. And rwa.xyz, the tokenized-asset data site, puts the value it can actually count at about $321 billion, as of 30 October.

That’s a spread of nearly twenty to one. Nobody on that list invented a number. They’re measuring different things, and only one of them tells you which thing it’s measuring.

Keep that list in mind, because it’s the whole subject in miniature. Institutions are being asked to trust Canton’s biggest numbers, and nobody has published a way to check them.

I come at this from both sides. My working days are spent in data governance for large enterprises, the discipline that decides what an organisation’s numbers mean and who answers for them. My evenings run The Golden Record, where every claim I publish carries a label and every correction gets printed, mine included. So this piece is written from practice, with a practitioner’s checklist in hand.

Two terms first, in plain words, because everything else hangs on them. A definition says what a number measures: its unit, its period, its scope, and who owns it. Lineage is the record of where a number came from and what happened to it on the way. Keep those two and the rest reads easily.

The scale nobody has stamped

Canton’s recap of its October summit makes the case I want to make here. One of its headline takeaways says data quality and centrality are critical for institutions moving on-chain, and it pictures Canton as a source of truth that hands every network the same reference information. I agree with all of it.

AnnouncedEarlier in that same post, the network says Broadridge settles more than $300 billion of US Treasury repo on Canton each day.

ConfirmedBroadridge's own release of 8 October puts its Distributed Ledger Repo platform at $359 billion a day in September. It doesn't name Canton, or any other network.

Both can be true at once. Broadridge is a Super Validator, one of the firms that keep Canton’s shared sequencing backbone running and vote on its rules, so the network’s line is plausible. But it’s announced by the network about another company’s book, and I can’t find a published method that would let an outsider check how much of that $359 billion settles through the public network, and how much runs on Canton technology inside Broadridge’s own platform.

Nobody in that chain is being careless. The gap sits in the infrastructure.

Trade between strangers has always run on weights and measures. A buyer at a border market doesn’t need to trust the seller, only the scale, and the scale earns that trust because someone outside the deal calibrated it and stamped it with a date. Canton has the traders and the goods, and its participant list carries some of the most trusted names in finance. What it doesn’t have yet is the stamped scale: a public definition of what each headline number measures, when it was measured, and a method anyone can rerun.

A figure nobody can recompute can open a conversation with an allocator. It can't go into the risk committee pack that closes one.

How one platform’s book becomes a network’s volume

One project I’ve managed was a business glossary, the place where an organisation writes down what its own words mean. It sounds like housekeeping. It decides whether an organisation can answer its own strategic questions.

The classic failure is simple. Two departments each report margin by customer, and the totals disagree. Nobody made an arithmetic error. One counts a customer once a contract is signed, the other only once an invoice goes out. Same word, different definitions underneath, so every report built on top inherits the gap.

The fix isn’t a better report. It’s an agreed definition at the conceptual layer, where the business describes what it does, mapped down to how the data is modelled and stored, with a named owner accountable for the definition and its use. Then quality rules have something to test against, departments spend less time reconciling, and the data becomes findable and reusable by people who weren’t in the room.

“On Canton” is that word for this network. The network, its partners, analysts and aggregators all use it. I can’t find a published definition, or a name next to it as owner.

Every figure like this is the last stop on a journey. The $359 billion is many repo trades totalled. Repo is short-term borrowing against securities, and each trade is a transaction: an event with a time, a value, and the parties and assets involved.

In my work with enterprise data, the first thing I check under any total is the nouns. A transaction is master data in motion. The customer, the product, the counterparty and the place stay fixed, and only the time and the value change. If those nouns aren’t held in one authoritative place and referenced the same way at every step, the total drifts.

Then I check lineage, in two directions. Vertical lineage runs from what the business means by a word, down to how the data is modelled and stored. Horizontal lineage follows the number across systems over time, through every hop and transformation. A number earns trust when both are written down. Here’s Broadridge’s figure, walked through those checks.

No single hop was dishonest. Each one dropped a field the next reader needed.

And because nothing written down says what “on Canton” covers, nothing stopped the scope from changing at hop 3.

One check gets skipped more than any other. Data is fit or unfit for a purpose, and the purpose sets the guardrails. A figure built for a summit recap carries a recap’s guardrails, while a figure going into a risk report has to meet internal policy and outside regulation. Only lineage tells you which one you’re holding.

Which $6 trillion?

In a well-run organisation a metric doesn’t just appear. Someone drafts the term, a working group of the people who’ll use it agrees the definition, and where they can’t agree, the named owner decides. The agreed version goes into a data catalogue that every report draws from, and changing or retiring it runs the same process.

What comes out the other end is a definition card. This is the card I’d hold any headline number against, filled in for Canton’s most repeated one.

Here’s where the four readings come from.

Then there’s the validity field, which does more work than it looks. Later network material uses a monthly figure, $8 trillion and then $9 trillion. Nothing published retired the $6 trillion line, so it still circulates beside its successors. That’s exactly the job an archive step exists for.

None of this makes the figure wrong. A partnership release is fit for its purpose, and its purpose isn’t a board pack. The trouble starts when readers treat it as certified.

Compare rwa.xyz. In November 2025 it split tokenized assets in two and published the test it uses. An asset counts as distributed if it can leave the issuer’s platform and move wallet to wallet, and as represented if it can’t. Canton dominates the represented side, at about $321 billion on 30 October. That figure fills most of the card, with a definition, a scope rule, a unit, a dated snapshot and an owner. It also shows how much the definition question matters: on rwa.xyz’s own platform table, nearly all of Canton’s represented value is a single entry, Broadridge’s repo platform, listed with Canton as its network.

So $6 trillion and about $0.3 trillion aren’t necessarily in contradiction. They measure different things, and only one says which thing it measures.

Not confirmedThe earliest network use of the $6 trillion line I can date is September 2025, the month after Broadridge's repo platform reported $5.9 trillion for August. If a network's asset figure began as one platform's monthly flow, all five hops above happened in a single sentence. The network could settle this in one line, and I'd welcome that.

Who counts as “on Canton”

When a number goes wrong, I don’t start by guessing which layer failed. A mature data team logs the defect, traces it back along the lineage, finds the root cause and fixes it at the source. Guessing first is how organisations end up patching reports instead of data. Three layers are in play here, and they’re easy to blur.

Take the nouns first. The network’s October recap says more than 650 firms have connected over two years, and OpenZeppelin’s Canton material counts nearly 600 ecosystem participants. Neither defines “connected” or “participant”, and neither publishes the list. The difference may simply be growth, but nobody outside can tell.

Then take the categories. According to Canton’s developer documentation, a validator can connect to the Global Synchronizer, the network’s shared public backbone, and to private synchronizers at the same time. So “on Canton” can mean activity sequenced through the public network, or activity running on Canton software elsewhere, on a private synchronizer or inside an institution’s own platform. All of these are legitimate. They aren’t the same claim, and nothing published says which one a figure counts.

The network’s own pages count them alike. Its ecosystem entry for the European Investment Bank says the EIB’s digital bonds, issued through Goldman Sachs’ and HSBC’s own platforms, brought fully on-chain assets to the Canton Network. The first of those bonds was issued in late 2022, and the Global Synchronizer went live in July 2024. In Digital Asset’s vocabulary that’s consistent, because Canton names the technology as well as the network. It’s also exactly why the word needs a definition.

Some issuers supply the category themselves. When SG-FORGE issued its first US digital bond with Broadridge in November 2025, its release said the nodes ran on the Global Synchronizer. That clause is reference data.

The nouns also need identifiers, or at least a shared standard for the attributes everyone uses, and finance already has most of them. For a network bringing in institutions that already live by these standards, adopting them is an open door. August’s ticker clash shows the cost of not walking through it: another asset trades under the same CC ticker, so market data for one could be read as the other.

The data firms already inside the network make this easier. Chainlink and Kaiko sit in the Super Validator set, and shared standards are what let their data plug in anywhere. None of this competes with Canton’s privacy. The transactions stay private, and the identifiers travel with the nouns.

Naming the authoritative source is a conscious decision every platform has to make, and ownership has a natural home. The Canton Foundation could act as arbiter and ratify a standard, while builders across Canton projects agree how to implement it. The machinery exists, since Canton’s improvement proposals include a Standards Track, which is how the network adopted its token standard, CIP-0056. I’d take a seat at that table.

Six days in August

Between 15 and 20 August I logged every story I killed at verification. None of the failures were exotic.

Quality dimensions need agreed definitions too, or two teams mean different things by “validity”, which is the glossary problem one level up. Here’s how I use three of them. Timeliness is data reaching its consumer when it’s needed, with a freshness marker showing it reflects the latest reality. Accuracy is the record matching reality. Uniqueness is one identifier per thing.

The dimension that does an institutional reader the most damage isn’t on that chart. It’s trustworthiness, the combined result of all of them, part numbers and part judgment, and once it’s lost it’s very hard to win back. The best protection I know is a transparent marker. When data is wrong or not yet resolved, say so on the data itself, so whoever uses it knows the caveats. That’s the job the three labels on every claim here do.

The marker has to work in both directions. On 15 July I rejected the claim that x402, an open standard for machine payments, ran on Canton. It was real, Canton’s developer forum documented it, and I published the correction on 5 August.

A quality process that only catches other people's errors is marketing.

Institutions have a formal version of this test. The largest banks answer to BCBS 239, the Basel Committee’s 2013 principles for risk data aggregation and reporting. Four of them ask for accuracy and integrity, completeness, timeliness and adaptability. The first two ask for governance, and the data architecture underneath.

That matches what I learned working on AnaCredit, the European Central Bank’s loan-by-loan credit reporting for euro-area banks. Every field had to be complete, accurate and on time, and a blank or a wrong value could draw a fine. But the report was never judged alone. It had to come with evidence of the machinery behind it: named data owners and users, a documented golden source for each record, rules for reference and master data, a working issue process and defined quality dimensions. A regulator judges a number by the mechanism that produced it.

So could a bank carry Canton’s numbers into that kind of reporting? For its own positions, it starts strong. Under Canton’s developer documentation, every validator keeps a complete, append-only history of its own parties’ transactions, and an auditor can be added as an observer, so a bank running its own validator holds its own golden source. For the coin economy, round-by-round records of minting, burning and fees are public, and anyone can rebuild the totals. The gap is the headline activity figures. Rules like BCBS 239 govern a bank’s own risk data, not a network’s headline volume, but those figures land in due diligence packs and board papers, and on what’s published today they arrive with no owner, golden source or issue process behind them.

So the network has a design choice. It can enforce guardrails on every application at the source, or apply them where data leaves the network. I’d start at the point of consumption. Name an owner, or a small group of them, accountable for collecting and aggregating network figures, with ways to check the data and rules for compliance. Then a risk desk receives the number with the evidence that it’s fit for purpose. The firms best placed for that role already sit in the Super Validator set.

Privacy is the reason, not the excuse

Why can’t Canton just publish an explorer? Because the design won’t let it, on purpose. Canton’s documentation describes sub-transaction privacy: each transaction is split into views, and each party receives only the parts it has a stake in. For the rest, a participant sees neither the content nor who else was involved. The synchronizer that orders transactions sees only encrypted messages and confirmation results, and each validator stores only its own parties’ data. There’s no complete picture anywhere for an explorer to show. Even timing counts as sensitive, since the docs warn that when transactions happen, how large they are and the patterns they form can leak information.

A delivery-versus-payment trade shows how it works. The buyer and seller are both parties to the trade, so each sees both legs, and that’s what lets it settle as one atomic step. The cash issuer sees the cash moving and the registrar sees the asset moving. Neither sees the other leg, and nobody outside the trade sees any of it. The privacy is built into the design, not added on top.

In traditional data governance, named owners manage the metadata and enforce the rules through process. On a ledger like this, the rules can be written into code, so governance runs inside every transaction. That’s computational governance, and Canton already does it for visibility, since who may see a contract is declared in the contract and enforced by the protocol. It hasn’t done the same for meaning.

Canton encodes who may see a number. It doesn't yet encode what its headline numbers mean.

FAIR’s A2 principle says metadata should stay accessible even when the data itself isn’t. Applied to Canton, that gives three tiers.

Broadridge’s feed through Kaiko already works this way for one platform. Chainlink’s Super Validator proposal points the same way for the network, committing Chainlink to obtain rights to view relevant private data at the request of the protocols that need it, then standardize and publish it. That needs guardrails.

I’d want the view scoped to totals, not to the parties in each trade or the timing of each one. Privacy law such as GDPR applies wherever personal data is involved, and access should be monitored programmatically against written compliance rules. Statistics offices add one more rule: never publish a total built from so few contributors that any one of them can be worked out. In a market with three large repo desks, a daily total is three positions in a thin disguise.

Consequences belong in governance, not in goodwill. CIP-0111, approved in April 2026, sets out how the network reduces a Super Validator’s weight, and its review must consider the requirements in that validator’s own proposal. Chainlink’s describes the firm’s privacy tooling, but I can’t find terms in it for how private Canton data seen under those rights must be handled, or what follows if it’s mishandled. Written in, those terms would give CIP-0111 something to enforce.

Two of the six gates in my own vetting framework cover this ground: Structure & Provenance, and Interoperability & Trust Audit. Canton’s protocol was built to meet the second. Its headline figures are where the first still has work to do.

Who gains, who pays

The biggest stake sits with institutions. Large capital moves on risk models and investment decisions, and both need numbers as inputs. Standards create trust. They give a risk department a benchmark to check against, which is what lets an institution move assets onto a network and defend the decision afterwards. The benefit runs down the stack from there.

Someone does pay. Definitions take work, a named owner takes on accountability, and a defined number can’t be rounded up for a press release. That cost lands on whoever publishes, which is why it hasn’t happened by accident.

The case against

The strongest objections deserve a hearing, along with where each one wins.

“Institutions do their own diligence privately.” They do. But Canton’s privacy applies to every user, institutions included, so a bank’s own diligence sees its own positions and nothing else. It can’t rebuild network-wide figures without access to data someone else provides. That’s what FAIR is really about: findable, interoperable, reusable data from a trustworthy source everyone can draw on. Institutions also need the same data as each other, because the products they build on Canton depend on exchanging it. So the standards have to be public and apply to every participant, from Super Validators and node operators to projects and institutions running their own validators. It really is that simple.

“Marketing figures are always loose.” That’s partly fair, as the $6 trillion section conceded. But that line didn’t stay in marketing. It traveled into a Super Validator’s release, a security firm’s technical article and aggregator feeds, and serious diligence then spends its time unwinding it. The objection wins on one point: no investment committee approves anything on a boilerplate number. The cost is time and trust, not a mispriced deal.

“rwa.xyz already provides the neutral measure.” For tokenized asset value, it’s the best public measure there is, and this piece leans on it. But it’s one data product measuring one thing under its own classification. It doesn’t measure activity, participants or the public-versus-private line, and it depends on what data owners choose to share. It’s part of the answer, not a substitute for definitions the network owns.

“Whoever defines the numbers becomes a gatekeeper.” The network’s own recap sharpens this one, since it says no single entity should control critical infrastructure. That’s why I’d put the Foundation in the arbiter’s seat and leave implementation to builders, through the same open Standards Track and public votes that produced the token standard. Anyone can read a definition and challenge it. The objection still wins if one company ends up owning the definitions, so the process counts for more than who sits in the chair.

“Public totals on a private ledger leak what the design protects.” This is the one I take most seriously, as the three repo desks show. The answer is the discipline statistics offices already use: minimum contributor counts, and aggregation windows wide enough to blur timing. The objection wins outright for some figures, and a good standard says which numbers shouldn’t be published at all.

None of the five closes the gap. Two of them, gatekeeping and leakage, should shape how it’s closed.

The test you can run

You don’t need access to anyone’s ledger to apply any of this. Before a Canton figure goes into a memo, ask it five questions.

The $6 trillion line fails all five. The rwa.xyz figure passes most of them. A figure that fails can still open a conversation. It shouldn’t close one.

Who is doing this today?

Go back to the border market. The scale is trusted because someone outside the deal calibrated it and stamped a date on it. On Canton, most of the parts needed to build that scale already exist: a token standard adopted through an open Standards Track, data owners publishing governed figures, a neutral classifier, a public process for ratifying standards, CIP-0111 for reducing a Super Validator’s weight when it falls short of its commitments, and three data and oracle firms in the Super Validator set with written commitments to standardize and document Canton data.

Draft, not adoptedThere's even a working template. In October, Fairmint filed a draft standard for unique assets on Canton's token standard, and its transfer agent intends to issue equity certificates under it first. Read with a data manager's eyes, it does for a single asset almost everything this piece asks of the network.

The network’s headline numbers deserve the same treatment. So the question this piece set out to ask lands on three firms. Kaiko’s Super Validator proposal commits it to process, standardize and document Canton activity data. Coin Metrics’ commits it to bring Canton MainNet data into its analytics. Chainlink’s commits it to gain rights to private data, then standardize and publish it. Who is doing this for the network’s headline figures today? Not who could. Who is. If the answer is nobody, the next institution should know that before it builds a position on a number nobody can recompute.

Here’s my part. Every claim I publish carries one of three labels, confirmed, announced or speculated, with the original event date and the source. I publish my corrections, including my own mistakes, and the Quadrant scores a claim at zero until it verifies. Next, I’m building a structured record of the Canton ecosystem: the firms, assets and projects, and the claims made about them, each with an identifier, a definition, a source and a date. Call that announced, by me, since it’s a plan, not a product. I’d rather it plugged into a shared standard than became one more private one. That’s the part I want to play in this network, as one participant among many. If you’d use a record like that, tell me what it needs to hold.

And if any figure in this piece is wrong, mine included, send it with a source. I’ll correct it in public, the way I corrected x402.

Kaiko, Coin Metrics, Chainlink: is a published definition of Canton's headline volume inside your commitments, and if it isn't, whose job is it?

References and further reading

1. Canton Network, Top Takeaways from Canton Summit 2026, 22 October 2026 (canton.network)
2. Broadridge, Distributed Ledger Repo processes $7.5 trillion in September, 8 October 2026 (broadridge.com)
3. Broadridge, DLR market data on Kaiko's data application on Canton Network, 10 September 2025 (broadridge.com)
4. Canton Foundation improvement proposals: CIP-0009 (Broadridge), CIP-0046 (Coin Metrics), CIP-0056 (token standard), CIP-0061 (Chainlink), CIP-0063 (Kaiko), CIP-0111 (reducing Super Validator weight) (github.com/canton-foundation/cips)
5. Canton Network and Chainlink strategic partnership, 24 September 2025 (canton.network)
6. Hex Trust becomes a Super Validator on the Canton Network, January 2026 (hextrust.com)
7. Blockworks, Canton's $6T RWA rails (blockworks.co)
8. Cointelegraph, banks, RWAs and two blockchain rails (cointelegraph.com)
9. OpenZeppelin, accelerating secure development on Canton, 10 June 2026, and smart contract security for institutional finance on Canton (openzeppelin.com, openzeppelin.com)
10. rwa.xyz, networks and tokenization platforms tables, snapshots of 29 and 30 October 2026, and an explainer of the distributed and represented classification (networks, platforms, defiprime.com)
11. Canton documentation: privacy model; compliance module; private and hybrid synchronizers (privacy model, compliance, hybrid synchronizers)
12. Canton Network ecosystem entry for the European Investment Bank, and the network's bond issuance table (canton.network, bond table)
13. Societe Generale, first digital bond in the United States on blockchain, 18 November 2025 (societegenerale.com)
14. The Canton Network's Global Synchronizer and Canton Coin go live, 1 July 2024 (canton.network)
15. Identifier standards: ISIN (ISO 6166) and DTI (ISO 24165), ANNA; LEI (ISO 17442), CFI (ISO 10962) and ISO 4217, SIX; ISO 8000 data quality (anna-web.org, six-group.com, iso.org)
16. Basel Committee, Principles for effective risk data aggregation and risk reporting (BCBS 239), January 2013 (bis.org)
17. European Central Bank, AnaCredit (ecb.europa.eu)
18. Canton Strategic Holdings, Form 10-Q for the quarter ended 30 June 2026 (sec.gov)
19. Fairmint, draft CIP: Canton NFT profile on Token Standard V2, October 2026 (github.com)
20. The Golden Record, the Quadrant (thegoldenrecord.xyz/quadrant)