Machine-coded banking policies.
Pre-committed exit routes on BTX.

Customers, banks, auditors, and regulators all need to know what happens when the normal path breaks. The normal path is easy to explain: a customer deposits dollars, the bank allocates reserves, the issuer mints the stablecoin, users transfer, a user redeems, the issuer burns or locks the redeemed tokens, and the ledger batches are anchored to BTX.

The harder questions are the ones a serious product has to answer in advance. What if a bridge batch is funded but settlement does not complete? What if the issuer has to pause redemptions? What if a payout fails? What if an account is frozen by mistake? What if the issuer winds down the product or the operator disappears? What if customers need proof of their claims?

Pre-committed exits answer those questions before the incident happens. They turn recovery from an afterthought into part of the original transaction design — and they give every party in the system a defined, evidence-bearing claim to work from when things deviate from the happy path.

For a bank stablecoin, an exit leaf should carry the identifiers, amounts, claim type, trigger condition, destination, policy reference, evidence pointer, and status. The actual customer information does not have to be public — the public BTX commitment only needs the root. Customers, auditors, and regulators receive the proofs they are allowed to see.

The claim_type may be a bridge timeout refund, a redemption claim, a failed-payout recovery, a wind-down claim, a frozen-balance review, or a migration claim. The trigger_condition may be a block height, a redemption SLA deadline, a failed-payout status, a bank-approved wind-down event, a regulator instruction, or a migration snapshot. Each leaf points back to a policy_id and version, so the rule that authorised the exit is itself committed and audit-traceable.

Exit routes must be governed by policy. Every route should point to a policy root that answers who approved it, what rule allowed it, what customer rights apply, what deadlines apply, what evidence must be preserved, who can override it, and how it is audited. Exit routes are powerful — a bad exit policy could let an operator redirect value. A good one makes the route predictable, controlled, and reviewable.

An exit root is also not enough on its own. Somebody has to be able to verify the leaves. The issuer should define where exit evidence is stored and who can retrieve it: customers can pull their own exit proof; auditors can pull aggregate proofs; regulators can pull supervised proof sets; the bank holds the full operational record; the public can verify the BTX root and any public attestation. That structure keeps customer privacy intact while preserving full auditability of the system as a whole.

A customer should be able to prove that their balance event was included in an anchored batch, that their redemption request was accepted, that their pending redemption appears in the exit tree, that their payout was completed or is still pending, that their claim appears in a wind-down root if wind-down happens, and that the policy version governing their claim is identifiable. That proof never has to reveal any other customer — only the path and evidence for the one customer's claim.

An auditor should be able to prove total issued supply, total pending redemptions, total exit claims, reserve coverage after haircuts, completeness of redemption queues, whether exit claims reconcile to ledger balances, whether anchored roots match internal records, and whether policy changes were approved before they were used. This is where pre-committed exits stop being a technical feature and start being a control framework — the same set of roots that runs the product also satisfies the auditor and regulator without a separate parallel system.

And BTX, on its side, does not pretend to be the bank. BTX does not decide whether a customer passed KYC, whether a reserve asset is legally eligible, whether a T-bill is correctly valued, whether a fiat payout settled, whether a frozen account should be released, or whether a regulator order is valid. Those decisions belong to the issuer L2, the bank, legal counsel, compliance, treasury, custodians, auditors, and regulators. BTX provides the public commitment layer — and the commitments it provides are exactly the ones that make the bank's claims harder to rewrite after the fact.

Pre-committed exit routes make the BTX bank-stablecoin design more credible. They turn recovery from an afterthought into part of the original transaction design. They give customers a clearer claim, auditors a better trail, operators a safer runbook, and the bank a stronger control framework.

The split is straightforward. Use the issuer L2 to enforce the banking rules. Use BTX to anchor the action root, the policy root, the data root, and the recovery-or-exit root. That gives the product a practical exit architecture without pretending the MVP stablecoin is already a native BTX asset — and it gives every party in the system a defined, evidence-bearing place to land when the normal path breaks.