ANTON

FutureChain is the rails.
ANTON is what you hold.

A phone wallet, merchant tools and a public API — all settling through the same fail-closed compliance gateway. Keys stay on the device. Nothing reaches the chain unscreened.

Surface

Four pieces, one settlement path

Each is a different way in. All of them produce the same thing: a signed PACS.008 that has to pass compliance before it can enter a block.

ANTON Pay

Android live

Self-custody phone wallet

Send and receive, scan a merchant QR, hold your own keys. iOS is planned, not shipped.

ANTON Business

Web

Merchant tools

Payment requests with order envelope and expiry, scheduled transfers, budget pools, and reconciliation that exports the underlying message.

ANTON Comm

Mobile + web

Contact-bound payments

Messaging with identity attestations, so paying someone does not mean pasting a 38-character address and hoping.

Public API

Live

`rpc.futurechain.eu`

TLS 1.3, a fixed endpoint allowlist, per-install bearer tokens, and rate limits enforced at the edge before anything reaches a node.

Custody

The key never leaves the device

Self-custody is easy to claim and easy to quietly compromise. The specific design here is that the private key is generated on the phone, stored in hardware, and signs inside that hardware — so it is never present in application memory where it could be read or logged.

Stage	What happens
Seed	A 24-word BIP-39 mnemonic is generated on the device and never transmitted. You are asked to write it down and verify three random positions.
Derivation	An Ed25519 keypair via the FutureChain SDK. The address is Base58 over a versioned SHA-256 hash of the public key, with a checksum.
At rest	Wrapped with AES-256-GCM by a key held in the Android Keystore — a key that cannot be exported from the secure hardware.
Signing	The key migrates into a native signer where signing is `digest → signature`. It does not re-enter JavaScript.
Authorisation	Every send, seed reveal and wallet wipe is gated on biometrics. An optional passphrase adds a second factor, rate-limited with exponential back-off.
Address binding	Registering an address requires an Ed25519 proof-of-control signature over a timestamped challenge, so one install cannot claim another's address.

Losing the 24 words means losing the funds. That is what self-custody means, and no part of the system can recover them for you.

Send

What actually happens when you pay

The order matters: screening is not a step that can be skipped or retried afterwards, because an unscreened payment is not a valid payment.

Scan

The merchant QR decodes to a destination, amount, order reference, purpose code and expiry.

Travel Rule tier resolves

The amount determines how much originator and beneficiary detail must accompany the transfer.

You approve

Biometric prompt naming the amount and destination, plus the passphrase if you have set one.

Signed on the device

The SDK builds the PACS.008 and signs it locally. The key stays in secure hardware.

Submitted and authenticated

Posted to rpc.futurechain.eu. The install's bearer token is verified at the edge before the request reaches a node.

Screened — the step that can refuse

Heimdall checks sanctions, jurisdiction and wallet risk. If it cannot answer, the payment does not settle. Fail-closed, not fail-open.

Settled

Included in the next block, roughly 13 seconds, and readable on the explorer with its ISO message intact.

In development

Agents that can pay — and still be accountable

Software agents increasingly transact for someone: buying compute, settling API usage, paying each other. The usual answer is an API key on a company card, which produces no audit trail worth the name and no way to bound what the agent may spend.

An ANTON agent holds its own wallet and its own address, so its payments carry a real debtor identity — an auditor can answer who authorised what, not merely which process ran. Spending authority is granted narrowly and can be revoked without rotating the wallet underneath. Every payment is screened like any other, and the agent never has unilateral spending power: a human approval stays in the loop.

Status: in active development. The wallet, signing and settlement paths below it are live today; the agent layer on top is not yet shipped. We would rather say that than imply otherwise.

Scope

What this is not

Being specific about the edges is more useful than another list of capabilities.

Not	Because
Anonymous	Identity data binds to transactions through the ISO 20022 Travel Rule fields. Screening for AML risk is not the same as profiling users, but it is not anonymity either.
Permissionless	Compliance signers are authorised and the chain has a company name attached to it. That is deliberate — it is what makes it defensible in an audit.
A smart-contract platform	No Turing-complete programmability. The value here is compliance-signed settlement, not general computation.
A stablecoin	FTC is the native settlement unit. Its value can fall as well as rise.

FutureChain is the rails.ANTON is what you hold.