A borrower takes one bill of lading, one invoice or one warehouse receipt to two lenders and draws against it twice. Each lender's file is complete and clean. The fraud exists only in the space between the two banks, and neither can compute it alone, however good its own controls are.
Mirror checks for it without either lender showing the other anything. Each lender commits the financed document inside its own building, with the dates of the financing. The operator compares opaque commitments it cannot reverse. A lender that asks about its own document gets back a signed record saying "this document is under financing by N institutions at overlapping dates", naming nobody.
Status: the routes, the command and the SDK methods are built and tested. No lender uses them today, and nothing on this site should be read as saying otherwise.
How it works#
1. One key for the consortium. Every participating lender holds the same locator key. It has to be consortium-wide: two lenders on one cargo are not counterparties and share no bilateral corridor. The operator never holds it.
2. The claim, made offline. Inside the bank, the bander commits the document and every alias the bank holds for the same shipment, and signs the claim with the lender's member key:
mirror-bander exposure-claim --in exposure.json --secret-file consortium.txt --key member.jwk --out claim.jsonexposure.json holds the document, the bank's alias rows for it and the financing window. Nothing else: an amount, a borrower or a commodity in that file is refused by name.
{ "locator": { "type": "bl", "value": "MEDU1234567" },
"aliases": [ { "shipment": "S-1", "locators": [
{ "type": "bl", "value": "MEDU1234567" },
{ "type": "inv", "value": { "invoice_no": "INV-77", "invoice_date": "2026-09-01", "incoterms": "CIF", "hs4": "7403" } } ] } ],
"drawn_at": "2026-09-10", "matures_at": "2026-12-10" }3. Post it. claim.json is the exact body of POST /exposure/commit: commitments, the window, the time, the signer's key id and the signature. Post it from your own integration, with the SDK (mirror.exposure.commit(claim)), or from an agent (agents).
4. Ask about your own document. Signed in as the member, ask POST /exposure/collisions with one of your commitments, or mirror.exposure.check(claim) for all of them. The operator answers only about documents you committed with a verified signature.
Different documents, one cargo#
A registry of identical documents misses the case where two lenders finance different paper for the same goods. Each lender's alias rows say which documents it holds for one shipment, and all of them are committed, so a lender holding the bill of lading meets a lender holding the invoice.
| Locator type | What it commits |
|---|---|
bl, awb, lc | A bill of lading, a master air waybill, a letter of credit number |
inv | An open-account invoice as a composite: number, date, Incoterms and HS heading, all four or none |
ctr, imo | The cargo itself: an ISO 6346 container, or an IMO ship number, bound to the port and day of loading. Only for a full container load or a full cargo |
wr, po | A warehouse receipt, a purchase order, each with its issuer's identifier |
einv | A registered tax e-invoice id, which a borrower cannot reword |
ucr, vin, bar | A unique consignment reference, a vehicle identification number, a bar or ingot number |
The answers#
For each opaque document, one of five readings:
| Reading | What it means |
|---|---|
concurrent_exposure | Two or more distinct institutions, each verified by its own signature, financed this document at overlapping dates. A reason to look, never a finding against anyone. |
sequential_only | Two or more institutions, but their windows do not overlap: ordinary refinancing on the face of it. |
single_financier | One institution's several drawings. A lender cannot collide with itself. |
unattributed_only | Only unsigned claims name it, so no institution can be counted. |
undetermined | An unsigned, undated or future-dated claim shares the document and could hide a second lender. Never read as clean. |
The record you can forward withholds every member id and every date: it states the document's opaque commitment, the reading and the number of institutions, and it verifies offline against the operator's published key. Your own loan file tells you which document it is.
Why a fake duplicate cannot be manufactured#
- Institutions are counted by verified signature, not by message. One lender posting the same document ten times is one financier.
- An unsigned claim can never make a second financier. It can only stop a clean reading.
- A forged window fails. The signature covers the dates, so editing them after signing is refused (
attribution.unverified).
What the operator learns, stated plainly#
For each opaque commitment, which members committed it and the dates they asserted: a financing calendar per opaque document, and a rough measure of each member's book. Never the document, the borrower, the amount, the currency, the commodity or the counterparty.
The honest limits#
- Dates are as asserted. A backdated drawing can make concurrent financing look sequential, and nothing here proves an exposure existed on the day claimed.
- No collision proves little. It means no other participating lender committed the same document, signed, under the same key, with overlapping dates, within the retention window. A lender that is not on the rail is invisible.
- The consortium key is a shared secret. Any key holder can commit a document it merely guesses, and learn whether another lender holds it. Answering only about documents you committed narrows this; it does not remove it. A leaked key exposes every document ever committed under it.
- The same reference is narrower than the same cargo. One letter of credit can cover several drawings. The narrow keys (
inv,ctr,imo) exist for that reason. - Mirror computes no score, makes no filing decision, and moves no money.
Against the established registry#
MonetaGo is the established answer to duplicate financing. Its service has been offered over SWIFT since 2022 and was selected for the Association of Banks in Singapore's Trade Finance Registry. It is live, with banks, in the markets it covers; Mirror is not live with any lender. If your bank already belongs to a registry that covers your market, use it.
We have not reviewed MonetaGo's system and describe none of its internals. These are the questions to ask any duplicate-financing service, including this one:
| Question | Mirror's answer |
|---|---|
| Does the service see the document, or a derivative it could reverse? | Opaque commitments under a key the operator never holds. It cannot reverse them; any key-holding member can test a guess. |
| Do two lenders holding different documents for one cargo meet? | Yes, through each lender's alias rows and the cargo keys (ctr, imo). |
| Are the dates part of the check? | Yes: overlap of the asserted financing windows, not only "financed before". |
| Can one participant fake a duplicate? | No. Institutions are counted by verified signature; one lender cannot collide with itself. |
| What does the alert reveal, and to whom? | A count of institutions, signed, to a lender that committed the document. No names, no dates. |
| Can an examiner check the answer without the vendor? | Yes. The record verifies offline against the published key. |
| Is mispricing on unique documents in scope? | Yes, on the same rail: the price reconciliation, where no document is ever duplicated. |
See also the typologies for what else the rail reaches, and the boundary register for its limits.