Introduction

MACH is a middleware settlement engine for the Stellar network.

It sits between two systems that cannot see each other: the banking rails where trade payments actually move, and Soroban, where the obligations those payments discharge are represented as contracts. MACH's only job is to carry a verified fact across that boundary, namely that a specific invoice has been paid, and to do it with cryptographic provenance rather than a human attestation.

What MACH is

MACH is infrastructure, not an application. Concretely, it is three things:

Everything else (origination, underwriting, pricing, KYC, custody of fiat, custody of collateral) belongs to somebody else. MACH is deliberately small.

What MACH is not

Warning

MACH does not hold funds. This is the single most important property of the design, and every other decision in this specification follows from it.

MACH never takes custody of fiat or of digital assets. It has no omnibus account, no treasury, no pooled balance, and no ability to move a user's money.

• The fiat sits with the anchor, a regulated entity already licensed to hold it.
• The collateral sits in the Soroban contract, governed by contract logic.
• MACH holds only the authority to relay a proof it has independently verified.

The distinction matters legally and technically. A protocol that custodies funds inherits the regulatory perimeter of a money transmitter and the blast radius of a hot wallet. MACH governs the logic of settlement between bank accounts and Soroban; it does not stand in the payment path.

Why middleware is the right shape

A tokenised invoice is a contract that must react to an event occurring outside the ledger. There are only three ways to make that happen:

1. A human confirms it. This is the status quo, and it costs roughly 72 hours per settlement. It also reintroduces exactly the discretionary trust that moving on-chain was supposed to remove.
2. The contract queries the bank. Contracts cannot make outbound calls, and banks do not expose ledgers to anonymous callers. This option is not available.
3. A verifiable relay carries a signed attestation from a party the bank already trusts. This is MACH.

Option three works because the regulated anchor is already the entity that sees the fiat credit, and is already required to be identifiable on-chain via SEP-1. MACH does not ask anyone to trust it. It asks them to trust the anchor's signature, and it makes that signature checkable by anyone.

Trust boundaries

The only trusted assertion in the system is the anchor's signature over a payment notification. If that signature does not verify, MACH does nothing: no settlement, no partial state, and no retry against an unverified payload.

The standards MACH composes

MACH does not invent a new interface for banks or lenders. It composes existing Stellar Ecosystem Proposals into one executable path:

Note

Two of these standards are still moving. We label them as proposed rather than final on purpose. MACH is built against them and contributes to them, but a specification that overstates the maturity of its dependencies is not one an engineer should trust.

The SEP Stack documents each one: what MACH calls, what it assumes, and what breaks without it.

Where to go next