How the money is held, moved and taken back.
This note sets out the security package instrument by instrument, the reasoning behind the operating layer, the mechanics of a funding and collection cycle, and what happens on enforcement. It is written for the people who will be asked to sign off, rather than for the people who will be asked to allocate.
Instrument by instrument.
Nothing here is exotic. The only design decision that departs from a conventional receivables warehouse is where the operating layer sits, and that decision is documented rather than assumed.
Account pledge: Fixed security over the SPV account. Debenture: Fixed and floating over the obligor. Share pledge: The entity, not only its assets.
Deed of charge: English law, over every wallet. Acknowledgment letter: How the institution acts on notice. Servicer power of attorney: Step-in without further consent.
Receivables purchase: True sale into the borrower SPV. Debtor confirmation: Binding and non-disputable. Credit insurance: Mandatory on every receivable.
| Instrument | Secures | Effect |
|---|---|---|
| Account pledge | Tier 1 | Fixed security over the pledged SPV bank account holding undeployed commitment, at a bank the lender selects. |
| Debenture | Obligor | Fixed and floating security over the obligor's assets and undertaking, including receivables, contractual rights and the platform records that evidence them. |
| Share pledge | Obligor | Security over the shares in the borrower SPV, so the entity itself can be taken rather than only its assets. |
| Deed of charge | Tier 2 | English law security over every wallet in the operating layer: the SPV funding and collection wallets, the seller wallets and the servicer wallet. |
| Acknowledgment letter | Tier 2 | Written acknowledgment of the charge from the electronic money institution itself, with instructions on how it will act on an enforcement notice. |
| Receivables purchase agreement | Assets | True sale of eligible receivables to the borrower SPV, with notice to the debtor where applicable, so the asset is isolated before it is funded. |
| Servicing agreement | Operations | Defines servicer duties, standard of care, reporting obligations, termination triggers and the replacement servicer mechanic. |
| Servicer power of attorney | Standing | Grants the security agent and any replacement servicer the authority to operate the accounts and the collection flow directly, without further consent. |
| Debtor pre-signed confirmation | Assets | The commercial anchor: reported traffic is a binding, non-disputable payment obligation payable to a designated account. Obtained before onboarding, not chased after default. |
| Credit insurance | Assets | Mandatory cover against non-payment on every eligible receivable, sitting behind the structural protections rather than in place of them. |
Why an electronic money institution, and why a deed of charge.
This is the question every counsel asks first, so it is answered first.
Why the operating layer is not a bank account
A pledged bank account is an excellent way to secure capital at rest and a poor way to control capital in motion. Daily funding against verified delivery requires per-party segregated accounts, a distinct payment reference per debtor, programmatic distribution against platform events, and an audit trail written at the moment of transfer rather than reconstructed at month end. Correspondent banking does not provide those things at the speed or granularity the asset requires.
A regulated electronic money institution does. Client funds are held in segregated accounts, each party holds a wallet in its own name, each debtor is issued a unique virtual account number, and every movement is executed by authorised API call and tagged by type. That is what makes zero commingling a structural property rather than a policy.
The infrastructure is also deliberately provider-agnostic. A second regulated institution can be substituted into the operating layer on defined triggers without redocumenting the security package, so the programme is not hostage to one provider's risk appetite.
Why a deed of charge rather than an account control agreement
An electronic money institution is not a deposit-taking bank. Account control agreement drafting assumes a bank that can be instructed to block, freeze and remit under a tripartite arrangement, and it does not attach cleanly to an institution operating on a different regulatory footing. Insisting on the familiar instrument produces a document that reads well in a conditions precedent checklist and fails at the moment it is needed.
The enforceable equivalent is a deed of charge over the wallets, an acknowledgment letter from the institution confirming the charge and how it will act on notice, and a standing servicer power of attorney. Together these give the security agent and any replacement servicer control of the accounts on enforcement. This is the position our current senior lender's counsel reached after examining the alternative, and the documentation reflects it.
We will say this rather than have you discover it: a pledge over a bank account can be the stronger instrument in some enforcement scenarios, and if a lender prefers a bank at the operating layer, the architecture accommodates it with equivalent controls. What does not work is bank drafting applied to a non-bank counterparty.
One turn of the money, start to finish.
Grey steps are executed automatically by the platform against contracted logic. The highlighted steps are the control points.
- 01
Commitment held
Capital sits in the pledged SPV bank account under charge, pledge and assignment. It is not deployed and it does not accrue interest.
- 02
Borrowing base calculated
The platform calculates the base continuously from eligible receivables; the team prepares a weekly funding projection and release schedule.
- 03
Lender approves the release
The control point. Capital crosses from the secured account to the operating layer only on lender approval, sized to the base. Interest begins to accrue on deployed capital only.
- 04
Delivery verified
Traffic reports arrive from the debtor's systems to an independent mailbox. Volumes and rates are confirmed at source, before eligibility is tested.
- 05
Receivable purchased and advance released
Eligible receivables are purchased automatically within criteria. The advance moves to the seller's own wallet and the servicing fee to the servicer wallet in the same movement, each tagged and auditable.
- 06
Idle capital returns
Anything left unallocated in the operating layer returns automatically to the secured account within a defined window. Capital is never parked outside the conventional perimeter.
- 07
Invoice reconciles to traffic
At period end the seller's invoice is matched against traffic already reported and funded. The invoice records the obligation; it does not create it.
- 08
Debtor settles to its own virtual account
Each debtor pays a unique virtual account number resolving to the SPV collection wallet. Payment routing is contractual, fixed at confirmation, and not within the seller's gift to change.
- 09
Asset closed, waterfall applied
The platform applies the contracted priority of payments on receipt: principal and fees to the lender position, the retained balance released to the seller. The logic is hard-coded to facility terms under change control.
- 10
Partial payments allocated, not closed
Where a debtor pays part of an obligation, the amount is allocated against the asset without closing it. The residual remains outstanding and visible, and seller reimbursement is deferred until the asset closes.
- 11
Interest independently reconciled
The control point. The cash manager reconciles and confirms the monthly interest figure before it is distributed, and signs off the reporting overlay.
- 12
Collections recycle
Principal recycles within the operating layer into new eligible receivables, subject to the same eligibility gate, until the facility amortises or the lender declines a release.
What happens if we are the problem.
A servicer that cannot be replaced is a single point of failure dressed as a relationship. Three questions decide whether this programme survives its servicer, and each has an answer in the documents.
Yes, and without our cooperation
The deed of charge, the acknowledgment letter and the servicer power of attorney together give the security agent and any replacement servicer control of the accounts on enforcement. The acknowledgment letter fixes in advance how the institution will act on notice, so the answer does not depend on a negotiation conducted during a default.
Yes, on defined triggers
The servicing agreement sets out termination triggers and the replacement servicer mechanic. The obligations that matter operationally are the reporting feed, the debtor confirmations and the collection routing; all three are documented artefacts held outside the servicer, not institutional memory.
This is the honest constraint
Esoteric collateral is harder to hand over than mainstream receivables; a replacement servicer must be able to read traffic reports and operate the payment layer. We treat this as a real diligence item rather than a formality, and the continuity documentation, data escrow position and candidate arrangements are open for review in the data room.
Graduated response, not a cliff edge
The facility contemplates funding pauses that stop new deployment while the existing book continues to process and pay down: covenant breaches uncured beyond a defined period, insurance lapse, financial condition breaches and material performance breaches. During a pause the collection and distribution flows continue as documented, the security agent holds read-only access as usual, and distributions continue on their contracted priority. Escalation to default is a separate decision with its own cure window.
Tested, and provider-agnostic
A business continuity plan covers the platform, the payment rails and the data layer, with a simulation test report available for review. Core infrastructure vendors hold SOC 2 Type II attestation; vulnerability scanning and penetration testing run continuously through a CREST-accredited provider. The operating layer can be moved to a substitute regulated institution on defined triggers without redocumenting the security package.
Narrow by design, not diminished.
In a traditional structure the account bank supplies independence by standing between the servicer and the money. In an operating layer with no account bank in the middle, that independence has to be reconstructed deliberately. It is, from three retained controls plus the controls the lender holds directly.
- C1
Independent interest reconciliation
Reconciles and confirms the monthly interest figure before it is distributed to the lender. The platform computes it from facility terms; the cash manager verifies it.
- C2
Independent reporting overlay
Signs off the monthly reporting pack, so what the lender receives is not solely self-reported by the servicer.
- C3
Enforcement step-in
Available at all times through the deed of charge, the acknowledgment letter and the servicer power of attorney. The cash manager does not need wallet signing authority to be effective, because control sits in the security package.
- L1
Approval of every weekly capital release
The single point at which pledged capital is permitted to leave the secured account.
- L2
Live API and dashboard visibility
Across every wallet and transaction, in real time, with each transfer tagged by type at the moment it occurs.
- L3
Read-only account access
Reconciliation without asking the servicer for a file.
- L4
Right to revoke servicer API access
At any time, without notice. Servicer access is scoped to transactions the facility authorises, and every action is logged.
- L5
Quarterly Big Four borrowing base audit
Independent verification of the base being lent against, on a quarterly cycle.
The ones that come up every time.
01If the servicer operates the platform that runs the waterfall, who stops it changing the waterfall?
The priority of payments is hard-coded to facility terms and sits under change control, so it cannot be altered unilaterally. Every allocation is tagged by type at the moment of transfer and is visible to the lender in real time through the API and dashboard, the monthly interest figure is independently reconciled before distribution, and the borrowing base is audited quarterly by a Big Four firm. The servicer's honesty is not one of the assumptions.
02Why should we be comfortable with capital leaving the secured account at all?
Because the crossing is controlled at every dimension: the lender approves each release, capital moves weekly on a needs basis against the borrowing base rather than in bulk, interest accrues only on deployed capital, unallocated funds return automatically to the secured account within a defined window, the operating layer sits inside the deed of charge, and servicer API access can be revoked at any time. The alternative, holding everything in a bank account, would mean funding on a cycle the asset does not have.
03What stops the seller redirecting a debtor payment?
Payment routing is fixed in the debtor's pre-signed confirmation, which names the designated account before any funding occurs, and each debtor settles to a unique virtual account number rather than to a shared account. Changing the routing requires the debtor to act against a confirmation it has already signed, and the resulting break would be visible in the collection wallet the same day.
04How is dilution handled?
Structurally rather than by reserve. The debtor's confirmation makes reported traffic a binding, non-disputable payment obligation, and eligibility excludes any receivable carrying a dispute, offset claim or fraud indicator at the purchase date. A minimum seller deposit sits beneath the advance on every transaction. Residual dilution experience is in the performance data in the data room, and we would expect you to test it there rather than take the design on trust.
05The book is concentrated in wholesale telecommunications. How is that managed?
Openly. Concentration is tested monthly against outstanding balance with limits by debtor, seller and country, and diversification into adjacent metered services is phased and capped rather than opportunistic, with each expansion gated on performance in the preceding period. Telecommunications is where the verification model is strongest, so it is deliberately the deepest part of the book rather than an accident of origination.
06Artificially inflated traffic is a known problem in this market. What is your exposure?
Real, and treated as the primary loss vector rather than an edge case. Fraud tolerance is a zero covenant, not a target. Traffic that fails screening fails eligibility rather than being priced for, verification runs to the debtor's own reporting rather than the seller's, and the debtor confirmation means a carrier that disputes traffic is disputing its own systems' output. Detection methodology and incident history are open for review under non-disclosure agreement.
07Does credit insurance carry the structure?
No, and that is deliberate. Cover against non-payment is a mandatory eligibility condition on every receivable, but it sits behind the debtor confirmation, the security package, the concentration limits and the seller deposit rather than in place of them. A structure whose only real protection is an insurer's continued appetite has a single point of failure, and that failure mode is well documented in this asset class.
08What does a replacement lender actually inherit?
A bankruptcy-remote borrower with a documented security package, a receivable pool with a live tape and full stratifications, debtor confirmations already signed and in force, contractual payment routing that does not need to be renegotiated, and an operating layer that a replacement servicer can be given control of through the standing power of attorney. The programme is designed to be handed over, not just to be operated.
Ask it directly. We would rather answer a hard structural question in week one than have it surface in week five of a credit process. Request data room access below and put the question in the note field; it goes to the person who negotiated the clause, not to a mailbox.