What Institutional On-Chain Lending Has Been Missing: Privacy with Isolation

Selective disclosure is enforced at the protocol layer. Data is disclosed only to the parties authorized to see or act on it. It isn't filtered by a front end, and it isn't promised by a policy after the fact. Meridiant is built around that primitive, not around it.

§ 01What institutions actually need

Institutional capital won't move onto infrastructure that broadcasts position size to every competitor watching the chain. It won't move onto infrastructure that exposes client collateral to any counterparty with a block explorer open.

That's not caution. It's the same confidentiality standard these desks already operate under off-chain.

It's also not a minor item on the list. Asset managers executing large trades need confidentiality to limit information leakage, market impact and front-running. Custody firms may need to demonstrate solvency without revealing individual client holdings, while credit desks need counterparties and regulators to see the information relevant to them without exposing the entire book to the market. None of those requirements is easily met by a ledger that publishes everything by default.

Almost no on-chain lending market can meet that bar. Open Aave and you can see exactly what an address has supplied, borrowed and how close it sits to liquidation. Morpho Blue creates isolated markets, but because it operates on public chains such as Ethereum and Base, every position still sits on a publicly observable ledger.

That's not a flaw in either protocol. It's a property of the chain underneath them.

Canton's architecture is why Meridiant doesn't share that ceiling. It is also why the network has attracted participation from financial institutions and market-infrastructure providers across tokenization, repo, collateral management and securities lending. The relevant point is not simply who is connected to Canton. It is that these institutions can transact across shared infrastructure without exposing commercially sensitive data to everyone else using the network.

§ 02Privacy needs isolation underneath it

Privacy on top of an interconnected lending pool doesn't remove risk. It changes who can observe it. Isolation is what determines who ultimately bears it, which is why institutional lending needs both.

Aave maintains separate asset reserves inside a broader, multi-asset lending pool, where borrowers can generally use one supported asset as collateral to borrow another. It has also introduced more precise protections through Umbrella, its bad-debt coverage system. Umbrella coverage is isolated by asset and network: staked aUSDC, for example, covers USDC deficits on that deployment rather than losses across every Aave market.

The distinction is therefore not that Aave operates one universal insurance fund while Meridiant does not. It is that Aave remains a cross-collateralized lending environment, whereas Meridiant isolates the entire market structure: collateral, loan asset, oracle, liquidity and resulting credit exposure.

The lesson is not that Aave lacks risk controls. It is that separating asset reserves is not the same as isolating lending markets. A problem originating with one collateral asset can still create bad debt in another reserve, while a loss of confidence can spread across the wider venue.

Meridiant doesn't have a shared liquidity structure for that risk to travel through. Each market's collateral secures that market's loans and nothing else: one collateral asset, one loan asset, one oracle and one risk profile. The protocol doesn't combine unrelated collateral and borrowing activity inside a single cross-collateralized pool, and one market's liquidity never covers another market's losses. A bad-debt event stays with the suppliers who chose exposure to that market.

Because the market is also private, containing the risk doesn't require exposing the position that caused it to anyone outside the market. As Meridiant's documentation puts it, liquidation can be open to anyone authorized to act without becoming visible to everyone watching.

§ 03What privacy has to survive: composition

The other place privacy usually breaks is composability.

Borrow, swap and deploy across separate applications, and a private position has to stay coherent across every leg of that sequence, not just resolve cleanly inside Meridiant's own contracts.

On Canton, selective disclosure and atomic composability work together. Each participant receives only the information it is authorized to see, while the dependent legs of a multi-party transaction commit together or not at all. If one required leg fails, the transaction does not leave the others partially completed.

Atomicity does not create privacy by itself; Canton's disclosure model determines who can see the underlying data. But atomic execution is what allows private transactions to compose across applications without sacrificing settlement integrity or requiring the complete position to become public.

§ 04What Meridiant is, in practice

Strip away the argument and Meridiant is a small number of design choices, applied consistently:

• Isolated markets: One collateral asset, one loan asset, one oracle and one risk profile per market. There is no shared liquidity pool for a bad-debt event to spread into.
• Position privacy: A position is disclosed only to the parties authorized to observe or act on it, rather than to the network or participants in unrelated markets.
• Atomic settlement: Opening, repaying or liquidating a position occurs through a single Canton transaction. If any required leg fails, none of it commits.
• Borrower-controlled collateral: Collateral is encumbered as security rather than transferred into a protocol-owned pooled vault. The borrower retains the economic interest in it, subject to the market's repayment and liquidation rules.

Nothing here is under-collateralized, and nothing spans more than one market.

§ 05Why this compounds

Isolation without privacy still leaves a position legible to anyone watching. Privacy without isolation can leave participants exposed to losses generated by risks they did not choose. Atomicity without selective disclosure protects the execution of a transaction, but not its confidentiality.

No single guarantee does another's job. Selective disclosure determines who can see the position. Isolation determines who bears its risk. Atomic settlement ensures that the transaction does not execute only in part. Institutional capital needs all three from the same infrastructure, rather than as separate compromises.

Canton is the base layer built for that combination. Selective disclosure at the protocol layer makes privacy enforceable rather than promised, and it is the reason Meridiant can build isolation and privacy into the same market design instead of trading one against the other.

That architecture alone does not guarantee adoption. Meridiant will still need trusted assets, reliable oracles, deep liquidity, institutional integrations and credible distribution. But it removes two constraints that public lending protocols cannot fully solve at the application layer alone: position confidentiality and market-level containment.

Meridiant is therefore not simply a more private version of the same lending market. It is a market designed around what institutional participants need to know, what they should not be required to reveal and which risks they have actually agreed to take.