如何用Corda设计银行间支付系统？央行与清算所角色问询

Great question—let’s break this down step by step, starting with how to build the system on Corda, then dive into the critical roles of the central bank and clearinghouse.

Core Steps to Design the System #

1. Define States and Contracts #

First, model the core data and business rules that underpin the system:

• Create a PaymentState to represent each interbank transfer, including fields like payerBank, payeeBank, amount, status (e.g., PENDING_CLEARING, CLEARED, SETTLED), and transactionId.
• Write a PaymentContract that enforces non-negotiable rules:
  • Only the payer bank can initiate a pending payment.
  • Only the clearinghouse can mark payments as CLEARED after netting calculations.
  • Only the central bank can finalize payments to SETTLED after adjusting reserve accounts.

2. Build Transaction Flows #

Map the traditional payment lifecycle to Corda’s flow framework:

• Payment Initiation Flow: The payer bank creates a PaymentState, signs it, and sends it to the payee for confirmation. Once both parties sign, the transaction is notarized (to prevent double-spending) and recorded on both banks’ ledgers.
• Netting Clearing Flow: The clearinghouse runs a scheduled flow to pull all PENDING_CLEARING states, computes multilateral net positions for each bank, generates a NettingState summarizing net receivables/payables, and updates the original PaymentStates to CLEARED.
• Final Settlement Flow: The central bank validates the NettingState, adjusts each bank’s central bank reserve account (via a ReserveAccountState), marks the NettingState as SETTLED, and updates the PaymentStates to COMPLETED.

3. Network Identity & Permissions #

Use Corda’s identity service to restrict network access to authorized banks, the central bank, and clearinghouse. Set up role-based permissions:

• Only the clearinghouse can trigger netting transactions.
• Only the central bank can modify ReserveAccountStates.
• Banks can only initiate payments from their own accounts and confirm incoming payments.

4. Integrate with Existing Systems #

Each bank node connects to its internal core banking system via Corda’s RPC API to submit payment requests and sync transaction statuses. The central bank integrates with its reserve management system to keep reserve balances in real-time sync.

Do We Need Central Bank & Clearinghouse as Separate Nodes? #

Absolutely. Corda’s peer-to-peer model requires each distinct entity with unique responsibilities, data ownership, and authority to operate its own node. Merging these roles into other nodes would break the trust model and violate the principle of separation of duties.

Clearinghouse Node: Responsibilities & Role #

The clearinghouse is a business logic node (not a Notary) with these key duties:

• Collect all pending interbank payments at scheduled intervals (e.g., hourly/daily).
• Run netting algorithms to calculate each bank’s net position, reducing overall liquidity demand.
• Validate that each bank has sufficient credit lines or collateral to cover its net obligations.
• Generate and sign netting transactions to update payment states from pending to cleared.

Relationship with other nodes:

• It receives pending payment states from all banks via Corda’s peer-to-peer data sharing.
• It sends final netting results to each bank for review (optional, depending on your system rules).
• It submits netting transactions to the Notary for uniqueness validation before recording them on the ledger.

Central Bank Node: Responsibilities & Role #

The central bank is a regulatory and settlement node (also not a Notary) with non-negotiable duties:

• Execute final settlement by adjusting each bank’s central bank reserve account—the only legally valid way to settle interbank obligations.
• Monitor bank liquidity in real time to mitigate bankruptcy risk: if a bank’s reserves fall below required thresholds, it can pause the bank’s payment flows or trigger emergency liquidity support.
• Audit all transactions on the network to ensure compliance with regulatory rules (e.g., anti-money laundering, capital requirements).

Relationship with other nodes:

• It receives netting transactions from the clearinghouse, validates net positions, and executes reserve adjustments.
• It maintains a ledger of all ReserveAccountStates, shared only with the respective bank and the clearinghouse.
• It acts as the ultimate authority: it can freeze a bank’s node access or reverse transactions in case of fraud or insolvency.

What About the Notary Node? #

The Notary is a separate, neutral node (often operated by a trusted third party—though the central bank could oversee it, it’s not mandatory) whose sole job is to prevent double-spending by verifying no state is used in multiple transactions. Neither the clearinghouse nor the central bank needs to act as the Notary; keeping this role separate ensures technical neutrality and avoids conflicts of interest.

内容的提问来源于stack exchange，提问作者Bo Ye