Margin Is the Product

The perpetual futures market is crowded in a particular way. Hyperliquid, Binance, OKX, Bybit, dYdX, Lighter and Paradex compete on the same two numbers, the leverage on the front page and the fee on the tier table, and the two are linked: the venues that offer 100x and 150x are the ones with the deepest backstops, and the venues with thin backstops offer 50x anyway and lean on random deleveraging or socialised loss when it goes wrong. A venue arriving now with a small balance sheet cannot beat either group at that game. What it can do is change the game, because there is one thing every venue in the register leaves on the table.

None of them, and not Deribit either, nets risk across underlyings. Hyperliquid, dYdX, Lighter and Paradex say so in their margin formulas; Binance’s unified account pools collateral but sums each position’s bracket maintenance with no offset; OKX’s and Bybit’s portfolio-margin modes net risk only inside a single underlying; Deribit’s cross-currency matrix documents no correlation credit. A market maker quoting twenty markets, a relative-value fund running ETH against SOL, a desk hedging a basket, all carry books whose risk is a fraction of the sum of their legs, and today they post the sum everywhere. The traditional clearing houses have credited that fraction for decades, under a rule that says when it is allowed. Give it to the hedged book and the venue gets the open interest that comes with it, which is the liquidity that makes every other part of the risk framework cheaper.

This piece sets out the framework that makes such a venue safe, from the margin schedule up, and it is built to be argued with: every table is generated from daily price histories for the twenty illustrative markets (nineteen with measured history, one carried by proxy) and from the parameters the incumbents publish, and the interactive companion, the Risk Cockpit, exposes every dial. The sections run in the order the losses run. What the field competes on and how venues have failed; the three-layer standard the framework is built to; margin sized to the tail; portfolio margin as the product; the insurance fund that sets the venue’s size; a liquidation ladder a trader can predict, and what it does in a cascade; how losses are shared when margin is not enough, and what is refused; and how the whole thing is run. Screenshots of the Cockpit sit beside the sections they belong to.

The register below was read from each venue’s published documentation or public interface on September 23, 2026. Two structural facts sit under it. Margin is summed across positions everywhere, and the size of the backstop, not the risk of the book, is what sets the leverage on the front page.

The second fact is the one a founder should sit with. Binance’s roughly $1.29B fund, OKX’s roughly $3B vault and Bybit’s roughly $385M pool are what let those venues offer 100x to 150x; dYdX at roughly $17M and Paradex at roughly $0.5M still offer 50x and rely on random deleveraging or socialised loss when the book breaks. A venue with a small balance sheet should do neither. It should offer less contract leverage than either group, make the liquidation experience more predictable than either group, and give hedged books the offset none of them give. That is a coherent position in a crowded field, and it is coherent because every piece of it comes from the same arithmetic.

The arithmetic is grounded in things that have already gone wrong. Every mechanism in the framework has an incident behind it, and the register below is the working list.

A venue with no pre-funded backstop has exactly three ways to absorb a loss: the trader’s own margin, an insurance fund built from fees, and auto-deleveraging. The framework is organised around one statement of what each layer is for, with a number attached.

Each layer has a named owner, a disclosure (the schedule, the coverage ratio, the event log) and a review cadence. Two mechanisms that appear in several venues’ documentation are removed from the loss waterfall on purpose. Socialised loss punishes every profitable trader for the failure of a few, and it is the mechanism most likely to make an institutional participant leave. A halt on a price move strands every position in the market while the underlying keeps trading, and so converts a liquidity problem into a solvency one. A halt remains a tool for engine, settlement or collateral failure, never for a price. Section 07 returns to both, because the question of who shares a loss, and with what consent, is the question the whole waterfall answers.

The standard is also what makes the portfolio-margin product safe to offer, because the same tails that set the margin schedule set the correlation gate, the coverage ratio and the stress list. Nothing in the product is a marketing number with a risk model bolted on afterwards.

The rule fits in a paragraph and is applied identically to every market. Take every day since January 2021, or since listing, and measure the worst mark seen inside the day against the previous close on both sides, the loss a liquidation engine actually faces, jump included. Take its 99th percentile. Scale that daily figure to the tier’s close-out horizon by the square root of time. That is the raw maintenance margin. Round it up to the leverage grid (20, 15, 10, 7, 5, 3), cap it at 20x, and set initial margin at twice maintenance.

The close-out horizon is the time it takes, in a stressed market, to close a position through the venue’s own book and then through the backstop’s external hedge. It is thirty minutes for the majors, sixty for the large alts, a hundred and twenty for the long tail and four hours for a new listing, and it is a parameter the risk committee owns. A market lands in the most liberal tier whose horizon-scaled tail fits inside the tier’s leverage and whose external liquidity gates it clears: aggregate perpetual open interest across all venues of at least $3B and spot daily volume of at least $2B for tier A, $100M and $100M for tier B. The gates catch liquidity as well as price. POL, in our illustrative listing, lands in the long tail not because of its volatility, which would allow 7x, but because its aggregate open interest is below the tier B gate.

Three things are worth saying about what the data give. First, the schedule is not “slightly more conservative” by fiat; it is what the standard produces, and the 20x cap only binds on BTC, where the arithmetic would allow 25x. BTC and ETH calibrate to 20x, SOL to 15x, the large alts to 10x, DOGE, NEAR and PEPE to 7x and the long tail to 5x, against Hyperliquid’s 40x on BTC and the 50x that dYdX, Lighter and Paradex run on the majors. Second, what the maintenance margin does not cover is shown beside it. The 99.9% move over the same horizon is 3.4% for BTC against a 2.5% requirement, 4.2% for ETH, 7.0% for SOL. That gap is the job of the ladder, the backstop and the fund, and it is why they are sized from the same tails rather than from a round number. Third, the schedule is set on a through-the-cycle sample so that it does not tighten in the middle of a crash, which is the anti-procyclicality principle the clearing-house standards require. A daily monitor recomputes the one-horizon tail from a 90-day weighted volatility and flags any market where the current figure exceeds the scheduled margin; a flag is a review, not an automatic change.

The settlement policy under the schedule is short and every line of it comes from an incident. Funding is paid hourly on the spot index, never on the mark, so a stale or distorted mark cannot generate transfers, with a cap of 1% an hour in tier A and 2% in tiers B and C, a quarter of Hyperliquid’s figure, because a young venue with a thin book should not let its own premium set an extreme rate against its traders. Profit and loss settle hourly at the mark, the clearing-house variation-margin idea at perpetual speed, which caps the venue’s exposure to any one account’s paper profit at one hour’s move and makes auto-deleveraging, if it is ever needed, a haircut on an hour of profit rather than a week of it. Withdrawals come only from settled cash and only if the margin left behind is at least the greater of initial margin and 10% of open notional, Hyperliquid’s post-March-2025 rule adopted as written. Collateral is a single stablecoin with no haircut at launch, and its depeg is a venue-level scenario in the stress list: below $0.985 on the oracle, every market goes reduce-only and margin is re-expressed at the collateral’s oracle price.

A market maker quoting all twenty markets, a fund running ETH against SOL, a desk hedging a basket: each carries a book whose risk is a fraction of the sum of its legs, and each posts the sum on every perpetuals venue in the register. Portfolio margin gives them the fraction. It is the reason the venue can offer 20x rather than 50x and still be the cheapest place to carry a hedged book, and it is the reason the framework has to be as strict as it is, because the credit is only as good as the tails it is built from.

The traditional clearing houses credit hedges as a matter of course, through CME’s inter-commodity spread credits and the OCC’s portfolio simulation, and the regulation that permits it says when. Under 17 CFR 39.13(g)(4)(i) a derivatives clearing organisation may reduce margin only where the price risks of the positions are “significantly and reliably correlated” and there is “a theoretical basis for the correlation in addition to an exhibited statistical correlation.” Those two conditions are the design of the product. The number is necessary but not sufficient; a pair with a number and no story stays at gross.

How it is computed. The maintenance margin of a portfolio is the square root of a quadratic form over its legs, with each leg weighted by its signed notional times its own maintenance rate, and with the pairwise coefficient set by a rule rather than a fitted matrix. Same-direction pairs take a coefficient of 1: no diversification credit at all, because in a crash everything falls together (on BTC’s worst 5% of days since 2023 the alts’ correlation with BTC is 0.4 to 0.6, but the losses arrive at the same time). Opposite-direction pairs whose correlation is at least 0.5 on both the normal sample and the stressed sample take the stressed correlation, which is the lower and therefore the conservative one for a hedge. Every other opposite-direction pair, and any pair involving a market without a measured correlation, takes −1, which makes the two legs add at gross: there is no root-sum-square benefit for “uncorrelated” legs, because we do not believe it under stress.

The largest-leg floor is the design’s most important sentence: a hedge can at best free the margin of its smaller leg. For an equal-notional pair that caps the reduction at 50%, which is what the BTC/ETH case shows. The correlations are re-measured monthly, and a pair that drops below 0.5 on either sample loses its credit at the next monthly reset, not intraday, so a change in the rule never hits an account without notice.

The worked books below are the Cockpit’s presets, and the pattern in them is the argument. An equal-notional BTC/ETH hedge gets 50%, the floor. ETH against SOL gets 43%. BTC against SOL gets nothing at today’s correlations, because the stressed sample reads 0.49, a hair under the gate, and the framework says so rather than rounding it up. A long-only basket gets nothing. A hedge with a long-tail leg gets nothing. A ten-market market-maker inventory gets 45%, because its long and short legs partly cancel across several qualifying pairs.

The inventory in the screenshot posts $315,369 at gross and $173,271 as a portfolio, a 45% reduction, with the brackets applied; the same book in Figure 7 at base rates gives the same percentage. Read the coefficient matrix and the rule is visible. BTC against LINK, SUI and AAVE shows −1.00, so those short legs add at gross against the BTC long; ETH against XRP, LINK and SUI is 1.00, same direction, no credit; BTC against ETH is 0.60, the stressed correlation, and that pair is where the credit comes from.

Eligibility, and a stricter ladder. Portfolio margin is a mode, not a default. An account opts in, holds at least $100,000 of equity, passes the same onboarding screen as a market-maker programme participant, and accepts a liquidation ladder that restores health to 130% rather than 125% after a tranche, because a portfolio that is being liquidated loses its hedge as its legs are closed. The engine liquidates the legs in the order that reduces the portfolio margin fastest, which in practice means the unhedged remainder first. At launch the mode is a whitelist, the first market makers and two or three relative-value accounts, and it opens to any qualifying account at ninety days if no portfolio-margin account has reached the backstop.

A perpetuals venue’s exposure is not its volume, it is its open interest, and the framework ties open interest to two things: what the outside world can absorb, and what the venue’s own backstop can pay for. The second is the dial.

The liquidity ceiling. Each market has an open-interest ceiling set from external liquidity, at launch 1% of the asset’s aggregate perpetual open interest across all venues or 2% of its spot daily volume, whichever is smaller, for tier A, with 1.5% and 3% for tier B, 1% and 2% for tier C and 0.2% and 1% for a new listing. The shares rise on a published schedule as the venue’s share of external liquidity proves itself: 1% at launch, 2.5% at ninety days if the coverage ratio has never fallen below 1.0, 5% at one year. Every market also has a floor, $2M for tier A, $500k for B, $250k for C and $100k for a new listing, so that every listed market is tradable from the first day.

The ramp and the concentration charge. Once a market’s open interest passes 70% of its cap, the initial margin on new risk rises linearly to twice the base by the cap, and at the cap the market is reduce-only; this is dYdX’s open-interest-driven ramp, and it slows a crowded market before it hits the wall rather than at it, without touching the maintenance margin of positions already open. An account holding more than 10% of a market’s open interest pays a maintenance multiplier of one plus five times the excess share, 1.5x at 20%, 2x at 30%, applied across linked accounts. That is the clearing-house concentration add-on, and it is the direct answer to JELLY and POPCAT: a position that is a large share of a thin market is more expensive to hold, on purpose, before it becomes a problem.

Where the fund’s money comes from. Three sources, in order of reliability: every liquidation fee; a 30% sweep of the venue’s net trading fees until the fund reaches its target and 10% thereafter; and the owners’ seed, which is a decision for the owners and is shown below at four sizes. The profits a backstop vault makes taking over positions belong to the vault’s depositors, not to the fund, so that the fund’s growth never depends on a crash.

What the fund has to cover. The design-stress loss of the book is the sum over markets of a loss rate times open interest, where the loss rate is the 99th-percentile bad debt per dollar of open interest that the cascade simulation of section 06 produces for the market’s tier. The fund’s target is 125% of that figure on the live book. Turn the sentence around and it becomes the dial: given a fund balance, the open-interest cap of every market is the largest book the fund covers at 125%. Every market gets its floor, and the remaining coverage is spread across the liquidity ceilings by a single scaling factor. When that factor is below one the fund binds, and the caps rise with every dollar the fund earns; when it reaches one, liquidity binds and the caps sit at the ceilings. A fund that starts small is therefore not a gap in the framework. It is the parameter that sets how large the venue may be, and it grows with the venue.

How fast it grows. At $100M a day of volume, with the venue retaining a blended 2 basis points of net trading fees and liquidations running at 0.8% of volume in ordinary months, the fund earns roughly $0.3M a month from the sweep and the liquidation fees together. On that path, with 4% monthly volume growth and two stress months in which the fund pays out its full design-stress loss, a $1M seed covers the book from the first day, $80M of capacity against a $60M book, and the fund outgrows the book within a quarter; by month twelve the fund is about $5M and the caps allow roughly $400M of open interest against a book near $100M. At $250M a day the fund binds for the first two months and the caps are the constraint, which is the correct behaviour for a venue growing faster than its backstop. At $25M a day the fund reaches about $3.7M in two years and the caps are never the constraint. At a $0.5M seed the venue opens with about $40M of capacity across all markets, which is a launch, not a business, and the owners should read that row as the price of a small seed.

Disclosure and triggers. The fund balance and the coverage ratio, balance divided by the design-stress loss of the live book, are published daily. Coverage below 1.25 raises the fee sweep to 50%; coverage below 1.0 freezes cap increases and puts any market whose own contribution has grown more than 20% in a week into the ramp; coverage below 0.75 makes tiers B and C reduce-only until the ratio recovers. Any drawdown of more than 25% of the fund in a day is an incident with a post-mortem.

The design goal is that a trader can compute, before the fact, what happens to their position at every price, and that what happens is the same every time. The policy is a ladder with fixed steps, fixed fills and a fixed fee, and health is always measured on the composite mark of section 07, never on the venue’s own last trade.

The liquidation fee is 0.5% of the liquidated notional in tier A, 1% in tier B, 1.5% in tier C and 2% for a new listing, charged on each tranche, paid only out of equity that exists, and paid entirely to the insurance fund. Any equity left after a full close-out is returned to the trader. Liquidation orders are limit orders inside the band, never market orders, so a cascade on the venue’s own thin book cannot fill a liquidation at a price the trader could not have predicted; if the book cannot fill inside the band the position waits for the next step, and if it reaches 67% health the backstop takes it. Against Hyperliquid the ladder is slower and gentler, with 25% tranches against 20% and a clearance fee where Hyperliquid charges none; the difference is that Hyperliquid’s vault held roughly $269M in June 2026 and the fee is what builds ours. Against Binance it charges less than half the clearance fee and never uses a market order.

The worked example is a $100,000 BTC long at 20x, $5,000 of margin, in a 7% decline over forty-five minutes that opens with a 1.5% gap. Under a stylised flat-leverage baseline, one 20x number for every market, a ladder that closes 10%, then 30%, then 60% of the original position, market-order fills and no backstop, the engine paid $541 of slippage, charged no fee and returned $752 of the $5,000. Under the framework it paid $480 of slippage, charged $482 of fee to the fund and returned $526. Both policies leave the trader solvent in an orderly decline; the framework’s ladder finishes in three predictable steps and its fee, the price of a funded backstop, is the difference in the residual. Where the two part company is the cascade.

The cascade simulation. For each market, two thousand accounts are built to a target open interest, 55% long, sizes log-normal around $5,000, 35% of accounts at maximum leverage and 25% at half, with entries spread over the previous three days so that some positions already sit near their maintenance level. The path runs four hours at 20-second steps, with depth drawn from the market’s worst 2% of daily excursions, speed between 0.15% and 0.6% a minute, 10–30% of the move arriving as an opening gap capped by tier, and 35% of the move retraced. Fills go against the venue’s own book at a square-root impact, bounded by the band under the framework and unbounded for the baseline’s market orders; the backstop takes over at 67% health and hedges externally at the same impact function. Two hundred runs per market and policy; the 99th percentile of bad debt as a share of open interest is the tier loss rate that the dial of section 05 uses.

The schedule and the ladder cut the 99th-percentile bad debt by roughly two-thirds on the majors and by 80–90% on the alts, relative to a flat 20x with the baseline ladder. And the loss rate per dollar of open interest comes out between roughly 0.5% and 1% at the 99th percentile in every tier: BTC at 20x and POL at 5x land in the same place, because leverage, not volatility, is what turns a gap into bad debt. At 20x a 5% gap is bankruptcy; at 5x it is a bad afternoon; the tiers are set so that the two balance. That is the arithmetic behind the tier structure, and it is why the fund’s coverage is allocated by loss rate rather than by market size. The simulation runs one market at a time, has no order-book microstructure beyond the impact function, assumes the backstop’s external hedge is always available at the impact cost, and treats the fund as a single pool. Each of those is a known simplification and each is the first thing to refine with live marks.

Every mechanism past the trader’s own margin is a way of making someone else pay, and the question that organises a loss waterfall is not only in what order but with whose consent. A clearing house answers it with a default waterfall: the defaulter’s collateral, the clearing house’s own contribution, a guaranty fund the members pre-fund together, assessments on the survivors, and, at the very end, a haircut on the variation-margin gains of the winners. A perpetuals venue has the same shape with different names, and the framework keeps three of the four ways of sharing and refuses the fourth.

The backstop, a paid and opt-in mutual. At launch the venue’s own book is thin relative to its open interest, and in a fast market most liquidations reach the backstop; the simulation says so plainly, with the backstop taking over 12% of the BTC and ETH books and 21% of the SOL book in the design stress and earning the remaining margin for doing it. That makes the backstop the most important piece of infrastructure the venue has that is not the matching engine, and it is built in two stages. From launch, a committed programme: two to four professional liquidity providers each commit a stated amount of collateral to a backstop account and agree to take over positions at 67% health at the mark, keeping the remaining margin, with a per-market take-over limit and an aggregate daily loss limit each, and the programme’s total capacity published as part of the coverage ratio. Each commitment is a credit exposure the venue underwrites under a short policy: no unsecured credit, a limit set from a scorecard and expressed as the participant’s largest potential loss in the design stress, collateral in the venue’s vault, and mechanical recall triggers. After ninety days, a depositor vault, segregated by tier so that a long-tail strategy’s losses stay inside that strategy’s collateral, with its own loss limit beyond which the market goes reduce-only, and with its role in the waterfall, its limits, its drawdown history and its lock-up on one page before anyone deposits. The vault never becomes the only backstop; the committed programme stays behind it. Hyperliquid’s vault made roughly $40M in the October 2025 cascade and lost roughly $4M, $12M on paper and $4.9M across the three single-market incidents of 2025; both halves of that record belong on the disclosure page.

The fund, a mutual everyone pays into ex ante. Every trader pays a little through the fee sweep and every liquidated trader pays more through the liquidation fee, and in exchange the fund stands between the book and the winners. The consent is in the fee schedule, and the fund’s coverage ratio is published every day so that the consent is informed.

Auto-deleveraging, involuntary but bounded. Auto-deleveraging is the mathematical guarantee that the venue is solvent at every mark: if a bankrupt position cannot be closed and the fund cannot pay, the shortfall is closed against the most profitable, most leveraged positions on the other side, at the bankruptcy price of the failing position. It is a bad outcome for the counterparties chosen and it is built to be rare, fair and explained. It triggers only when the fund’s balance is below the shortfall, per market, and never pre-emptively to protect the fund’s balance, so that a fund that has been spent after other traders were deleveraged is not mistaken for a backstop. It ranks by profit percentage times effective leverage, the BitMEX-lineage rule that Binance and Aster use as written and that Bybit and OKX use in an equivalent form, with a five-band indicator on every position so that a trader knows their place in the queue before the event; random selection is not adopted because randomness is the opposite of predictability. It executes at the bankruptcy price with no fee to the deleveraged side, which is free to re-open at once. Every event is published within the hour: market, notional, accounts affected, price, and which layer of the waterfall was exhausted. And when the fund is above target, deleveraged traders are made whole for the difference between the bankruptcy price and the mark at the time, from the fund, in the order of the event log. A small venue cannot promise the “no ADL” guarantee that Binance offers on its majors below $10B of open interest, but it can promise to pay when it can.

Socialised loss, and the price halt, refused. Socialised loss spreads one account’s failure over every profitable account in the market. It is what Paradex applies to withdrawers and what Deribit keeps as a never-used last resort behind a fund of roughly $180M, and it is the mechanism most likely to make an institutional participant leave, because it is a loss the participant did nothing to earn and could not have sized. It leaves the waterfall. So does a halt on a price move, for the reason section 02 gave. What remains is a waterfall in which every layer is either the defaulter’s own money, a paid and opt-in commitment, a pre-funded mutual with a published coverage ratio, or a bounded, ranked and reimbursed last resort.

The mark. The mark is the number every margin calculation, liquidation and funding payment runs on, and on a thin book it must not be the main input. The construction is the median of three: the external spot index plus a two-and-a-half-minute exponential moving average of the difference between the venue’s own mid and that index, the fair-basis leg; the median of the venue’s best bid, best ask and last trade, included only when the book inside the band is at least a published minimum depth; and the median of the perpetual mid prices on Binance, OKX, Bybit and Hyperliquid, weighted 3, 2, 2, 1. Each input is capped at 1% from the median of the others for tier A and 3% for tiers B and C, an input more than five minutes stale drops out, and when fewer than two inputs are live the mark freezes at its last value, liquidations pause and the market enters the oracle-pause state. The oracle’s published confidence interval is a margin add-on: when it exceeds 0.5% of price on a tier A market, initial margin on new risk rises by the excess.

States, and the halt rule. A price move alone never halts a market. The tools for a fast market are bands, margin and reduce-only, in that order, and every market moves through four states without skipping one on the way up: normal; wide band, when the mark has moved more than three times the tier’s 99% one-horizon tail inside the horizon, which doubles the aggressive-order band and raises initial margin on new risk by 50%; reduce-only, on open interest at the cap, a concentration charge above 2x, coverage below 0.75 in tiers B and C or an oracle confidence interval above 2% of price; and oracle pause. The venue itself has three states, normal, reduce-only and halt, and the halt is reserved for matching-engine degradation, a settlement-layer failure or the collateral’s oracle price below $0.985. A halt resumes in stages, reduce-only for thirty minutes and then normal, with the first mark on resumption taken from the external index and never from the last trade before the halt.

A framework is a set of numbers and a set of rules about who may change them. The second set is what an institutional counterparty’s due diligence reads, and it is short.

A Risk and Margin Committee, chaired by the head of risk with the chief executive, the head of engineering and one independent member as voting members and the head of sales attending without a vote, owns every parameter in this piece and the record of every change. The head of risk sets and may tighten any parameter at any time and reports it within twenty-four hours; loosening any parameter, a higher leverage, a higher cap, a wider band, a lower fee, a new portfolio-margin pair, requires a one-page memo and a vote; listing a market requires the twelve-scenario pre-launch list; delisting on risk grounds is the head of risk’s call. Revenue owners may propose and may not veto. The owners may overrule the head of risk in writing, in the decision log, with the reason stated. The memo has the same seven headings every time: what changes and from what to what; why now; what the model says, the tail at the horizon and the coverage ratio before and after; what an owner, a market maker and an engineer each need to know; what could go wrong and what we would see first; when it takes effect and how it is announced; who owns it.

The standing cadence is daily for the coverage ratio, the monitor flags and the parametric stress on the live book; weekly for the four historical replays and the correlation gate; monthly for the schedule review, the tier gates and the ceiling shares; and event-driven, with any layer-2 or layer-3 event re-running the full list before the affected market resumes. The monitoring page carries, per market and for the venue, open interest against cap and ramp, the largest account’s share, the health distribution of open positions, the mark against each of its three inputs, funding against its cap, the coverage ratio and fund balance, backstop capacity drawn and remaining, and the state of every market. Alerts are tiered from a warning at 70% of cap or a 10% account share, through a page when notional below 120% health exceeds 10% of a market’s open interest or the coverage ratio falls below 1.25, to an incident for any layer-2 event, a 25% one-day fund drawdown or an oracle pause, with a named owner within fifteen minutes, a public note within the hour and a written post-mortem within five working days.

The first ninety days follow the layers. Day zero: the schedule at the fund-bound caps, isolated and cross margin, the ladder, the composite mark, the symbol and venue states, the committed backstop programme and a daily coverage ratio, gated by the twelve scenarios passed on every listed market. Day thirty: portfolio margin for the whitelist, the first monthly schedule review and correlation re-measurement, gated by no backstop event on a portfolio-margin account and a coverage ratio that has never fallen below 1.0. Day sixty: fund-bound caps recomputed on the live fund, gated by thirty consecutive days at or above 125% coverage. Day ninety: the ceiling shares raised, the depositor vault opened by tier with its disclosure page, portfolio margin opened to every qualifying account, and the first quarterly report to the owners: every event, every change, every memo.

Read together, the framework is one argument. Contract leverage set by the tail rather than by the competition; a hedge credit set by the stressed correlation and floored at the largest leg; a fund that sets the venue’s size and grows with it; a ladder that finishes in three steps a trader can price in advance; a waterfall in which every layer is either the defaulter’s own money or a consented mutual, with auto-deleveraging as the bounded guarantee at the end. Institutions get capital efficiency on the book. Retail gets predictability on the contract. In a market that competes on the number on the front page, that is a different product, and margin is what it is made of.