The non-credit model: default and recovery
The first question a serious allocator asks is simple: what happens when a counterparty does not perform? This page is the canonical answer. Other pages reference it rather than repeating it.
The model
Trade Dollar finances goods, not borrowers. The vault is the beneficial owner of the assets. Because a smart contract cannot hold legal title, a dedicated special purpose vehicle, the financing vehicle, holds legal title to the goods on the vault's behalf. The vehicle owns the goods; it is not merely a secured creditor. For every funded metals trade the vehicle holds legal title to the physical inventory, plus cargo insurance in excess of cargo value (currently 110%) with the vehicle named to receive any payout.
This is why we call the model non-credit. A credit model lends money and depends on the borrower paying it back; if the borrower defaults, recovery runs through a claims process against whatever assets the borrower has left. In Trade Dollar's model, the financing vehicle does not wait in line behind other creditors. It owns the goods outright, so it can sell them, redirect the shipment, or claim on the insurance. Recovery does not depend on a borrower staying solvent. This structural difference is why trade finance has kept historically low loss rates even in markets with higher counterparty risk.
The vehicle is designed to be bankruptcy-remote from Salus, the Curator, and Trade Dollar, so a failure of any of them is not designed to pull the vault's assets into its estate. The full structure is set out on Legal: what you hold.
The layered security package
Each metals trade is backed by several layers at once: legal title to the goods held by the financing vehicle, a Digital Warehouse Receipt that records them, storage and custody agreements, inspection and grading checks, the pre-contracted onward sale to the end buyer with proceeds paid into a controlled settlement account, a supplier repurchase obligation where the structure uses one, and step-in rights if something goes wrong.
Monitoring in-life is active: if the effective loan-to-value breaches its thresholds, a margin-call mechanism can require more collateral or partial repayment, and an uncured call becomes an event of default handled through the recovery path on this page.
How a loss is handled
If a deal is impaired, the loss is recognized in the NAV rather than hidden. Recovery is then pursued through the goods and the insurance claim. Because the vault values conservatively and recognizes gains only when they are realized, the NAV reflects problems when they happen, not later.
What this does and does not mean
The non-credit model changes the recovery path: it runs through physical assets and insurance, not a borrower's solvency. It does not remove risk. Recovery still depends on the value of the goods, how quickly they can be sold, and the insurance process. Counterparties, custodians, and insurers can still fail, and that can affect both the timing and the amount recovered.
For the full risk map, see Risks. For what the insurance covers, see Insurance architecture.