Glossary

Defined terms.

Twenty-seven terms as the specification uses them. Where a term has a general meaning in securities practice and a narrower one here, the narrower one is stated.

Book-entry: A security exists in book-entry form when ownership is evidenced by an entry in a register maintained by or for the issuer, rather than by a physical certificate delivered to the holder. Transfer is effected by changing the entry. Book-entry has been the dominant form of securities ownership in the United States for decades.
Constitutive record: A record that is the authoritative book, as opposed to a notificational record that mirrors an authoritative book kept elsewhere. OCP makes the onchain event log constitutive: there is no offchain master book behind it, and therefore no pair of records that can drift apart.
OCF — Open Cap Table Format: The JSON industry data standard for capitalization data, maintained by the Open Cap Table Coalition. Covers issuers, stakeholders, stock classes, stock plans, vesting terms, valuations, documents and the full taxonomy of equity transactions.
OCF manifest: The complete state of a cap table extracted from the ledger as OCF. Sufficient to reconstitute the register on any conformant runtime. Because the manifest is the register rather than a report about it, nothing is summarized and nothing is left behind.
OCP — Open Cap Table Protocol: The onchain extension of OCF: a specification for how the OCF event log is recorded, validated, authorized and read on a distributed network, so that the issuer’s official book is a live, queryable system of record.
OCP-conformant: An implementation that answers yes to every applicable question in the Appendix A coverage map, measured against that specification version. Conformance today is self-attested; no executable suite is published yet.
System operator: The role held by a registered transfer agent — or by an issuer acting as its own — that authorizes issuer parties, withdraws authorizations, and retires cap tables. Signatory on the cap table and on every object within it.
Issuer party: The party that exercises every update to its own cap table and whose authorization is required to create it. Signatory alongside the system operator on every object recorded.
Stakeholder party: A party holding per-position visibility into the records that concern them. On Canton, enforced by sub-transaction privacy and the disclosed-contract mechanism.
Dual signatory: The arrangement in which every object in an OCP register carries both the issuer and its transfer agent as signatories. The record is a joint act, verifiable as one by anyone entitled to read it — which is what makes the question on whose authority was this recorded answerable from the record itself.
Atomic batch: One UpdateCapTable transaction describing every create, edit and delete in a sequence — a closing, a grant package, a secondary transfer. Either the whole batch applies or none of it does.
Balance integrity: The guarantee that no accepted write may leave any security overdrawn. Evaluated against the whole post-batch state of the register, not just the batch, and under the least favourable ordering of same-dated events.
Adversarial ordering: Because OCF carries no intra-day sequencing, where several events share a date the runtime evaluates them in the order that produces the lowest possible balance — reverse splits, retirements, reductions, then forward splits — and accepts the batch only if every possible ordering is valid.
Determinism: The property that two parties applying the same log through the same data model reach the same positions. Not what makes the record authoritative — legal designation and an accountable keeper are — but what makes it usable as one by parties who did not write it.
Position of record: A position published onto the ledger by the transfer agent that writes the register, in the same transaction that appends the underlying OCF objects. Names the holder, issuer, stock class, restriction bucket, total quantity, reserved quantity and the securities it was computed from. Official for readers, subordinate to the log, not transferable, not a token.
Restriction bucket: The set of legends and transfer restrictions that make two shares of the same class non-interchangeable for a given movement. What makes a position answerable rather than merely countable.
Reservation: A first-class field on a position of record. Free quantity and reserved quantity are published together, so a pending issuance, transfer or settlement can hold part of a position without a separate hold book being invented alongside the register.
Verification vs evaluation: The line OCP draws through compliance. Verification produces a fact and requires judgment or external data — that a person is who they claim, that an investor meets the accredited standard, that a board consent was validly given. Evaluation applies a rule to recorded facts and is mechanical — whether a holding period has expired, whether a legend permits this transfer. Verification stays with the transfer agent; evaluation moves onchain.
Compliance by automation: The conversion of compliance-by-intermediation into machine evaluation: fewer intermediaries, each equipped to operate at the speed the substrate permits, with judgment where judgment is required and machine evaluation everywhere else.
Two-layer authorization: The stakeholder signs an authorization payload with their own key — the legal instruction and non-repudiation proof. The transfer agent verifies it, runs the compliance checks, and constructs and submits the transaction. The audit log binds the hash of the signature to the hash of the resulting transaction.
Observer party: A Canton platform primitive: a party with read-only visibility into a contract, including all subsequent updates, but no ability to exercise any choice against it. How regulators, examiners, auditors and counsel obtain standing, scoped, real-time inspection.
Sub-transaction privacy: Canton’s mechanism for confining each transaction to the parties involved in it, so confidentiality is enforced with the transaction rather than by redaction afterwards. An unrelated party on the same network sees nothing at all.
Compensating event: How OCP corrects. The erroneous transaction remains permanently on the register and a subsequent typed OCF transaction records the correction, carrying a reference to what it corrects and a reason code. Nothing is silently changed; the audit trail is enriched rather than edited.
Succession: A transfer of administration between operators, in four specified steps: extraction of the OCF manifest, verification by recomputation, re-establishment of grants and credentials, and continuity of the log across the seam. What changes is who administers the register, not what it contains.
Protocol vs network: A network is something you join — it has a centre, a membership and an operator who runs shared infrastructure. A protocol is something you implement: no centre, nothing to join, and two parties who both implement it interoperate without having asked anyone. HTTP is a protocol; no one operates the web.
Master securityholder file: The transfer agent’s official record of securityholders under the Exchange Act 17Ad-series rules. SEC staff confirmed in May 2025 that this file may be maintained using distributed ledger technology, with no offchain duplicate required.
Transfer agent: Under Exchange Act § 3(a)(25), a person who — on behalf of an issuer or of itself as an issuer — countersigns securities on issuance, monitors issuance against unauthorized issuance, registers transfers, exchanges or converts securities, or transfers record ownership by bookkeeping entry without physical issuance of certificates. That last function is what OCP performs.

Read the specification →