Risk, collateral and protection
Financing a commodity trade means holding a bundle of quite different risks and then taking them apart. This page is the taxonomy, the security stack that addresses it, and — importantly — what protection does not do.
The risk taxonomy
| Risk | The question it asks |
|---|---|
| Existence | Do the goods exist, in the stated quantity and quality? |
| Title | Does the borrower own them, and can that be established independently? |
| Security | Is the lien or pledge validly created, perfected, and correctly ranked? |
| Priority | If several parties claim the same goods, who actually comes first? |
| Control | Can anyone release, substitute or move the goods without the lender? |
| Credit | Will the borrower or the buyer pay? |
| Price and basis | Does the value move against the advance before it is realised? |
| Performance | Does delivery, assay or documentation fail? |
| Legal and jurisdiction | Under which law does ownership pass, and where is enforcement real? |
| Liquidity | Can the position be exited when cash is needed, at a price near NAV? |
| Compliance | Sanctions, AML, provenance and export eligibility |
The first five are the ones outsiders collapse into "collateral", and they are five genuinely separate questions. A lender can be right about existence and wrong about priority, and lose everything.
The security stack
Our sources are emphatic that these are distinct concepts and that conflating them is how facilities fail:
Possession · custody · legal title · beneficial ownership · security interest · lien and priority · control · perfection.Two consequences follow.
Control is not location. Knowing where goods are is worth little if someone else can instruct their release. Release instructions matter as much as the warehouse address — which is why the control package is a pledge plus a custodian release undertaking, not a pledge alone.
Documents are weak without an independent verifier. A financing document is only as strong as some party's ability to confirm location and prevent unauthorised release, substitution or double pledge. This is the point at which tokenization is powerless: a token cannot repair a broken physical-control chain.
The canonical fraud
The same commodity, warehouse receipt, or receivable pledged to multiple financiers. Every lender believes it has collateral; only one may have first priority, or the asset may not exist at all.
This is the most expensive recurring failure in commodity finance, and it is worth understanding why it recurs: each lender's diligence is individually reasonable. The defect is only visible from a vantage point no single lender occupies.
It is also the clearest case for machine-checked state. In the Doré kernel a
second pledge over already-pledged stock is refused outright
(whr_double_pledge_rejected), as is a pledge over stock that does not exist
(whr_phantom_stock_pledge_rejected). Selling the same receivable twice is
refused in the receivables and factoring routes (rd_double_sale_rejected,
fac_route_double_sale_rejected), and repaying the same obligation twice in
the trade-loan route (tl_double_repayment_rejected). These are not detectors.
The state simply cannot be reached.
Protection: insurance, guarantees, and their limits
Protection changes who absorbs a defined loss. It does not supply capital and it does not create liquidity.
| Layer | What it covers |
|---|---|
| Cargo / specie | Physical goods against defined transit and storage losses. Does not automatically cover borrower default |
| Credit / non-payment | Failure to pay, insolvency, restructuring, acceleration |
| Political risk | Expropriation, transfer and convertibility, political violence |
| Guarantees | A third party's promise standing behind the obligor |
| Reinsurance | Moves part of the insurer's exposure to another balance sheet |
| Cut-through | Lets the insured claim directly against the reinsurer |
The four things protection does not do
It is not liquidity. Insurance improves recovery; it does nothing for tomorrow's cash need. A 90-day claim waiting period can reduce ultimate credit loss while leaving a severe short-term liquidity hole. Protection and liquidity are separate markets and must be underwritten separately.
It does not cover everything. Every policy has exclusions, and the exclusions are where the losses concentrate.
It may not be enforceable as assumed. Policy rights are not automatically assignable, and the party named as insured may not be the party expecting to claim.
It is not a substitute for capital. It changes loss allocation among existing balance sheets.
How this is formalized
Recovery amounts are bounded: insuranceRecovery and reinsuranceRecovery
are capped by limit, cap and actual loss, stacked_protection_le_loss prevents
layered cover from paying more than was lost, and no_double_recovery stops the
same loss being recovered twice.
Recovery timing is deliberately not modelled. The 90-day waiting period is
carried in the environment and then proved to be read by nothing
(eval_arch_ignores_unmodeled_params). We would rather record the sharpest
lesson in the source as an explicit exclusion than quietly assume it away.
NAV is not liquidation value
A closing discipline that applies to every page on this site. Net asset value is what the book says. Liquidation value is what a buyer pays under pressure, after recovery time. Haircuts must be set against the second.
And liquidity is not solvency: a fully solvent portfolio can face a liquidity crisis under a maturity mismatch with shallow or absent secondary markets. Most commodity-finance blowups are liquidity events wearing a credit costume.