One payment, start to finish.

A request names who is being paid, in what, how much, and by when. It encodes to a link, a QR and an NFC tap from the same bytes, and it carries everything a wallet needs to act on it without fetching anything.

On Canton Canton provides the parties and the instrument. The request references them; it does not invent an identity system.

The payer opens it in their own wallet. The wallet reads the request against the profile and renders what will move before it asks for a signature. A request it cannot read is refused with a named reason rather than half understood.

On Canton Canton settles it through the Token Standard registry for that instrument. The transaction is built as a prepared transaction and signed by an external party key that never leaves the payer.

The settlement lands on the payee's own participant, carrying the request's reference in its metadata. Whoever can read the transfer can read that reference, so it should be one you are content for them to see.

On Canton Canton decides who sees it, and the answer is not us. For Canton Coin, measured: the payer, the payee and the instrument registry can read the identifier, and a party that took no part reads nothing. The registry is a signatory of the template, so this is structural rather than a choice of ours. Other registries can make further parties of their own able to see a transfer; the reader set belongs to the instrument, not to Payvol.

The reference is what connects the payment to the request that asked for it. Matching becomes classification: amount, timing, instrument, receiver and policy answered separately, so a payment that is the right amount to the wrong account does not read like one that is late.

On Canton Payvol classifies and hands over. The ERP closes.