# Subnets and routing

A bank or consortium can run its own SQRL instance from the same codebase. Members hold full state, outsiders see commitments, and value moves between subnets through the canonical ledger. Supervisors join as observers that replay what they regulate.

> Part of the SQRL documentation, section "Protocol".
> Rendered page: https://docs.sqrl.tech/protocol/network/subnets

## Banking subnets

A subnet is a complete SQRL deployment: its own contract registry, its own validator quorum drawn from its members, its own state.

* **Members hold full state; outsiders see commitments.** Members replay and validate everything, exactly as on the canonical ledger. Non-members see only the subnet's state-root commitments anchored on Bitcoin. Confidentiality comes from data distribution, not new cryptography.
* **Integrity comes from Bitcoin.** Every subnet call is anchored with the same protocol stamps and anchor-outpoint binding as canonical traffic. A subnet cannot rewrite its history without contradicting the Bitcoin chain, and a supervisor or auditor given the subnet's data can re-derive its entire state from public anchors.
* **Membership comes from the canonical ledger.** A subnet joins the wider network by registering periodic checkpoints, its state root, height range and validator attestations, with the subnet registry on the canonical ledger. Each registration carries the subnet's anchoring rent, settled by burning XRB. A subnet that stops registering checkpoints keeps its internal integrity but leaves the network.

Registered checkpoints are the precondition for everything a subnet joins the network to obtain: cross-subnet routing, access to the Lightning hub layer and its AMMs, and standing in supervisor tooling.

## Cross-subnet routing

Value moves between subnets, and between a subnet and the public asset layer, through the canonical ledger, not through bilateral trust between banks. The canonical ledger routes value into or out of a subnet only while that subnet holds a current registered checkpoint.

When an institution in Subnet A pays one in Subnet B, the debit appears in A's next checkpoint, a canonical settlement record anchors the transfer on Bitcoin and is attested by the validator quorum, and the credit appears in B's next checkpoint. Two patterns carry the value:

* **Anchored settlement** for wholesale, non-urgent flows: net positions clear in a [batch settlement](/protocol/lightning/batch-settlement) call on the canonical ledger.
* **Lightning routing** for instant flows: a registered asset moves over multi-asset channels between the banks' hubs, converting currency in flight if the corridor crosses a currency boundary.

A counterparty can check both facts that make a route safe without trusting the sending bank: the sending subnet holds a current checkpoint, and the settlement record is attested by staked validator seats and anchored to Bitcoin.

## Supervisors and observer nodes

A supervisor receives an observer node on the subnets relevant to its mandate: a full replaying node with read access to the instruments it regulates and no write or governance capability. It does not trust the subnet's members; it re-derives state from the subnet's data and the public Bitcoin anchors, so supervision is continuous and provable rather than periodic reporting.

At contract level, issuer contracts expose observer roles: designated keys with read access to holder lists, balances and event history. The observer feed runs over the post-quantum transport profile, so it cannot be harvested today for decryption later. Travel Rule and AML obligations are met at the participant layer through identified onboarding, off protocol.