Late July 2026 pushed India’s Carbon Credit Trading Scheme (CCTS) draft rules for steel, cement, and aluminum into the center of every carbon market conversation. Exchange founders, CTOs, and compliance officers building for this moment are discovering an uncomfortable fact: the trading software that works for the EU ETS does not work for CCTS. The reason is mathematical, not regulatory. An emissions intensity trading engine solves a fundamentally different equation than a cap-and-trade allowance engine, and most off-the-shelf platforms were never built to solve it. This post is for the people who will feel that gap first: platform architects evaluating vendors, ESG directors signing off on compliance software, and institutional desks preparing to trade Carbon Credit Certificates (CCCs) once CCTS trading goes live. It walks through why traditional trading engines break under intensity-based markets, what an emissions intensity trading engine actually has to calculate, and how the underlying architecture should be structured to handle it correctly. What Is an Emissions Intensity Trading Engine? An emissions intensity trading engine is the compliance calculation layer inside a carbon trading platform that continuously measures a facility’s performance against a variable, output-linked emissions benchmark rather than against a fixed annual allowance. Where a cap-and-trade engine only has to compare emissions to a static number, an emissions intensity trading engine has to recompute the benchmark itself every time production changes. That distinction is the entire reason CCTS-ready software looks structurally different from EU ETS-style software. Why Cap-and-Trade Math Doesn’t Transfer to CCTS Every mature compliance market runs on an underlying formula that its trading software must evaluate continuously, for every obligated entity. The formula is what separates a working platform from a spreadsheet with a nice UI. The Cap-and-Trade Formula The EU ETS, California’s Cap-and-Trade Program, and most first-generation carbon markets are built on a static allowance model: Allowance − Actual Emissions = Surplus or Deficit A regulator issues a fixed number of allowances per compliance period. A facility either stays under its allocation or it doesn’t. The software’s job is comparatively simple: track a known ceiling against a measured output, and settle the difference. This is why so many commercial trading engines built originally for EU ETS-style markets hardcode a fixed-allowance assumption directly into their settlement logic. The CCTS Formula India’s CCTS does not issue a fixed cap. It issues a Greenhouse Gas Emission Intensity (GEI) target — a ratio of permitted emissions per unit of industrial output, notified sector-by-sector and product-by-product by the Bureau of Energy Efficiency. Under this baseline-and-credit design, an obligated entity’s compliance position depends on a variable, not a constant: (Production Volume × Target Intensity) − Measured Emissions = Surplus or Deficit Notice what changed. Production Volume is not fixed; it moves every shift, every batch, every reporting cycle. That means the baseline against which a facility is judged is a moving target, recalculated continuously as output changes. A steel plant that runs at 60% capacity in April and 95% in May does not have a fixed emissions budget it can check against once a quarter. It has a floating threshold that an emissions intensity trading engine has to recompute in near real time. This single difference – a constant becoming a variable is why cap-and-trade platforms retrofitted for CCTS tend to produce compliance positions that are technically wrong the moment production volume shifts. The Software Problem: Why Off-the-Shelf Emissions Intensity Trading Engines Break Most commercial carbon trading platforms were architected around three assumptions that CCTS violates outright: An emissions intensity trading engine has to reject all three assumptions. It needs production data flowing in from ERP systems, emissions data flowing in from Continuous Emissions Monitoring Systems (CEMS), and a calculation layer that treats both streams as live inputs to a formula that never stops moving. Bolt that logic onto a matching engine designed for fixed allowances, and the surplus or deficit figure it reports will drift out of sync with reality within days. Design Assumption Cap-and-Trade Engine Emissions Intensity Trading Engine Compliance baseline Fixed annual allowance Dynamic: Production Volume × Target Intensity Update frequency Periodic (monthly/annual) Continuous, near real-time Primary data inputs Emissions data only Emissions data + live production/output data Credit generation trigger Allowance issuance schedule Outperformance against a moving intensity benchmark Risk of drift if unhandled Low — baseline is stable High — baseline shifts with every production cycle Recalculation trigger Compliance period close Every CEMS reading and ERP production update Engineering the Fix: A Dynamic Calculation & Allocation Microservice Any credible emissions intensity trading engine has to be engineered as its own service, not as an add-on module. Here’s the architecture that makes it work. The fix is architectural, not cosmetic. Rather than embedding compliance math directly inside the order matching engine — the same mistake that made registry migrations so painful for platforms wired directly to upstream data sources — the right approach separates concerns into two distinct systems: This separation matters because the two systems have fundamentally different failure tolerances. A matching engine has to be fast and deterministic. A compliance calculation layer has to be correct under constantly changing inputs, closer in spirit to a real-time risk engine than a simple ledger. What an Emissions Intensity Trading Engine Actually Has to Do A properly built emissions intensity trading engine ingests two live data streams and reconciles them continuously: The calculation layer then runs the CCTS formula against both streams continuously: Architecting it this way means an emissions intensity trading engine gives obligated entities something a fixed-allowance system never could: a live, continuously updated view of their compliance position, instead of a number they only trust once a year. Reliability Requirements Every Emissions Intensity Trading Engine Inherits Because a CCTS-focused emissions intensity trading engine is reacting to two independent, high-frequency data streams rather than one static allowance table, it inherits the same reliability requirements seen in any high-throughput financial system: None of this is exotic engineering. But it is engineering that a fixed-allowance cap-and-trade platform, retrofitted with a CCTS label, will not have
CORSIA Phase I closes out its compliance window between 2024 and 2026, and something quietly expensive has been happening on every desk trading Article 6-eligible inventory: CORSIA settlement lag. Not price risk. Not supply risk, although that exists too. A slower, more mechanical problem: the gap between when a trade is agreed and when it actually clears, and it is costing airlines, brokers, and exchanges real money every single week. This post is for the people who feel that gap directly: exchange founders building compliance-grade trading infrastructure, CTOs responsible for uptime and settlement integrity, and ESG or carbon fund managers who need certainty that the credit they bought this morning will still be theirs, cleanly, by end of day. Why CORSIA Settlement Lag Exists in the First Place CORSIA-eligible credits carry a specific compliance signature: a host-country Letter of Authorization (LoA) confirming that a Corresponding Adjustment (CA) has been or will be applied under Article 6 of the Paris Agreement. That signature is what separates a credit airlines can legally retire against their CORSIA obligation from a credit that looks identical on paper but carries none of that protection. The problem is where that verification actually happens. On most platforms today, it happens manually, after the trade is agreed, not before. A compliance officer or broker pulls a PDF, checks a registry reference number by eye, maybe emails a national registry contact to confirm a host-country attestation, and only then releases funds or clears the trade. During CORSIA’s most active trading hours, that manual review queue backs up. What should be a same-day settlement becomes a multi-day wait, and that wait is CORSIA settlement lag in its purest form. In numbers, the shape of the problem looks like this: Factor Manual Verification Reality LoA/PDF cross-check time Hours to multiple days per trade National registry API response variance Inconsistent across host countries, no unified standard Peak-hour trade backlog Queued behind other manual reviews Double-selling exposure High, since sovereign registries do not talk to each other in real time Counterparty risk during lag window Rises with every hour price moves against either side None of this is a compliance failure in the legal sense. Every credit involved may be perfectly legitimate. The failure is architectural: verification sits in a slow, disconnected, human-mediated layer instead of inside the settlement pipeline itself. The Software Problem Nobody Is Pricing In Here is the part that gets missed in most CORSIA commentary, which tends to stay at the policy level. CORSIA settlement lag is not a regulatory problem waiting on ICAO or a host government. It is a systems design problem, and it sits squarely inside the exchange’s own technology stack. Three specific failure modes show up again and again on platforms that have not solved this: Each of these failure modes translates directly into either a lost trade, a compliance exception that has to be manually unwound, or a client who moves their volume to a competitor with faster clearing. CORSIA settlement lag is not an inconvenience. It is a line item. Why Batch Verification Cannot Scale With CORSIA Phase I Demand Most exchanges built their compliance-checking logic the same way they built everything else in the voluntary carbon market era: as an overnight batch job or a manual queue, because volumes were low enough that nobody needed anything faster. CORSIA changes that math completely. Phase I demand for CORSIA-eligible emissions units runs into the hundreds of millions of tonnes, against a supply of authorized inventory that has consistently lagged behind. That imbalance means every unit with a confirmed corresponding adjustment carries a real premium, and premium assets attract fast-moving, high-frequency trading behavior — exactly the environment where batch-style verification breaks down first. Reduce CORSIA settlement lag using batch logic, and the fix is temporary at best. Volume simply outgrows the review queue again within a quarter. This is the same category of design mistake carbon market infrastructure keeps repeating: putting compliance-critical logic in the slowest layer of the system instead of the fastest. The Engineering Solution: An API Middleware and Verification Oracle The fix is not more people reviewing PDFs faster. It is a structural change to where and when verification happens. The pattern that actually resolves CORSIA settlement lag is a dedicated API Middleware and Verification Oracle — a service layer that sits between the order matching engine and every national Article 6 registry endpoint a platform touches. Here is how that architecture actually functions in practice: This is the architectural difference between a platform that treats CORSIA settlement lag as an unavoidable cost of doing business, and one that treats it as a solved engineering problem. What Changes for Airlines, Brokers, and Compliance Desks The people reading this closely — airline compliance managers, carbon brokers, institutional trading desks — are the ones who feel CORSIA settlement lag as risk exposure, not abstraction. Here is what an automated CA verification oracle actually changes for each of them: A Comparison: Manual Review vs. Oracle-Verified Settlement Dimension Manual PDF/Batch Review API Middleware and Verification Oracle Verification timing After trade agreement Before order matches Time to clear Hours to multiple days Seconds to minutes Double-selling protection Weak, relies on human cross-checking Structural, enforced at the settlement layer Scalability under Phase I volume Breaks down under peak load Scales with registry API throughput Audit trail Manually assembled, inconsistent Cryptographically verifiable, automatic Institutional buyer confidence Erodes with each delayed trade Reinforced by consistent, fast clearing Why This Cannot Be Bolted on as a Front-End Feature A recurring mistake in carbon market software is treating compliance verification as something that can live in the interface layer, a checkbox a trader could, in theory, bypass through a direct API integration or an internal override. CORSIA settlement lag will not actually go away if the oracle only checks orders placed through a website UI while institutional desks connecting through a raw API skip the check entirely. The verification oracle has to be enforced at the settlement layer itself, where funds
On June 30, 2026, a quiet administrative deadline reshaped the entire legacy carbon market. Only 415 of the more than 1,500 Clean Development Mechanism projects hoping to transition into the UN’s new Article 6.4 mechanism secured host-government approval in time. China and India, together home to two-thirds of all applicants, declined to back the bulk of their own project pipelines. The result: hundreds of millions of legacy CDM credits, some estimates put the total closer to a billion when combined with related CDM-era volumes, are now stranded outside the compliance perimeter of the Paris Agreement Crediting Mechanism. Carbon desks are calling them “zombie credits.” That label is more than a headline. It describes a real, structural problem sitting inside every exchange, registry, and corporate carbon ledger that holds CDM-origin inventory: units that were tradable yesterday and are not tradable today, with no clean mechanism in most systems to say so. This is not a policy story anymore. It is a software story. And it is exactly the kind of software story that separates exchanges running a real carbon credit invalidation protocol from exchanges that discover the hard way, mid-audit, that their data model was never built to handle one. This post lays out why a dedicated carbon credit invalidation protocol has become non-negotiable infrastructure for any platform holding legacy carbon inventory, what breaks when exchanges try to bolt this logic onto existing systems instead, and what an actual carbon credit invalidation protocol engineering solution looks like. Why Zombie Credits Are a Data Problem, Not Just a Policy Problem Most exchanges and registries were architected around a simple assumption: once a credit is issued and verified, its eligibility status is stable. A credit might move from “available” to “retired” as it changes hands and gets used against a claim, but the underlying compliance backing rarely, if ever, changed after issuance. Article 6.4’s rocky transition period has broken that assumption completely. A credit that was fully eligible for international compliance markets on June 29, 2026, could lose that eligibility overnight on June 30, depending entirely on a host government decision that had nothing to do with the credit’s project quality, vintage, or verification history. The credit itself did not change. Its regulatory backing did. A carbon credit invalidation protocol exists precisely to handle this category of event: a large, sudden, externally triggered shift in the eligibility status of inventory that is already sitting in accounts, portfolios, and trading books. Without one, exchanges face three compounding risks: None of this is hypothetical. It is happening right now, in real portfolios, on real registries, because most legacy carbon software was never designed to absorb a regulatory event of this scale. Read: The Conditional Allowance Engine: Integrating Rule-Based Microservices to Handle Europe’s New Post-2030 ETS Mechanics The Architecture Problem: Why Flat Ledgers Cannot Absorb a Regulatory Shock The deeper issue is architectural, not procedural. Most carbon registries and exchange back-ends inherited their data model from simple asset-tracking systems: an ID, a quantity, a vintage, and a binary status column. That model works fine when eligibility is decided once, at issuance, and never revisited. It falls apart the moment eligibility becomes contingent on an external event a host government’s transition decision, a Supervisory Body ruling, a documentation deadline slipping past. A flat status field cannot represent “was valid, is now frozen pending review, may become valid again if the host country reverses course before the December 2026 documentation deadline.” It can only represent “valid” or “not valid,” and updating that field through a manual process is exactly how cross-clearing errors and audit gaps happen. This is the same category of design failure we have flagged in other corners of carbon market infrastructure: compliance-relevant state that lives in the wrong layer of the system. If invalidation logic sits in a front-end filter, a UI toggle a compliance officer forgets to check, or a nightly batch script someone forgets to run, then any direct API integration, any institutional desk connecting outside the standard interface, will bypass it entirely. A carbon credit invalidation protocol has to be enforced at the data and settlement layer, where a trade actually clears, not wherever happens to be easiest to bolt on after the fact. Building a carbon credit invalidation protocol into that layer, rather than the interface layer, is what actually closes the gap. The Engineering Solution: An Asset Invalidation State Machine The fix is not a bigger status column or a more frequent manual review cycle. It is a structural pattern: a carbon credit invalidation protocol built as an Asset Invalidation State Machine, sitting as its own service layer between the registry feed and the exchange’s core trading and settlement systems. Here is how that pattern actually works in practice, conceptually, for any exchange or registry evaluating how to build this internally: The approach outlined here reflects how Techaroha designs resilient carbon market infrastructure for evolving regulatory environments. It illustrates an architectural pattern rather than a description of a specific client implementation. What Happens to Exchanges That Skip This The consequences of skipping a carbon credit invalidation protocol are not abstract. Consider the operational reality facing any exchange or corporate carbon desk holding legacy CDM inventory right now: The December 2026 documentation deadline is still ahead. More host-country decisions, more Supervisory Body rulings, and more shifts in legacy credit status are coming before this transition period closes. Exchanges that build invalidation logic into their core architecture now will absorb each of those events as a routine data update. Exchanges that don’t will be retrofitting under audit pressure, one manual correction at a time. Why This Matters Beyond Article 6.4 The zombie credit problem is the most visible example right now, but it is not a one-off. Carbon markets are entering a period where regulatory status is becoming a live, mutable property of an asset rather than a fixed one, set once at issuance and never revisited. The same pattern that governs CDM-to-PACM transition risk applies to any future regulatory shift
An ESG director we spoke with recently described her company’s carbon procurement stack in one sentence: “We have a spreadsheet that tells us what we bought, and a prayer that it holds up in an audit.” That sentence is about to become a liability. With the Science Based Targets initiative’s Corporate Net-Zero Standard V2.0 now formally recognizing commodity certificates, book-and-claim chains of custody, and a new category called Ongoing Emissions Responsibility, the flat, undifferentiated ledger most corporate carbon teams rely on is structurally unequipped for what auditors are about to ask. This post is about why a purpose-built book-and-claim carbon credit platform is no longer a nice-to-have for enterprises navigating V2.0, and what it actually takes to engineer one at the data layer, not just the reporting layer. Why SBTi V2.0 Broke the Old Carbon Ledger Model For most of the last decade, corporate carbon procurement tools have treated every credit the same way: an ID, a quantity, a vintage, a status of “retired” or “available.” That model was tolerable when the primary use case was voluntary offsetting against a single, simple claim. It is not tolerable anymore. SBTi’s Corporate Net-Zero Standard V2.0 introduces an implementation hierarchy that requires companies to distinguish between multiple, legally distinct instrument categories operating under different rules simultaneously. Commodity certificates and energy attribute certificates using mass balance or book-and-claim chains of custody are now formally recognized as legitimate implementation tools for certain scope 3 categories, but they are reported separately from the physical emissions inventory and must meet specific integrity criteria around activity matching and double-counting prevention. Separately, the standard introduces Ongoing Emissions Responsibility, a mechanism addressing the years a company continues emitting while working toward its target, which large companies must engage with formally from 2035 or disclose why they haven’t. A book-and-claim carbon credit platform has to hold all of this simultaneously: physical inventory data, decoupled environmental attribute certificates, neutralization-grade removal credits, and OER-eligible instruments, each governed by different eligibility rules, each needing to be queried, filtered, and reported on independently without contaminating the others. Treat these as one undifferentiated pile of “carbon credits,” and a compliance audit will find the gap immediately. The Architecture Problem: Why Linear Ledgers Can’t Model Book-and-Claim Most transaction ledgers, whether in a traditional database or a basic blockchain implementation, are built around a linear delivery model: an asset exists, it moves from party A to party B, and its state changes from “held” to “transferred.” That model works fine for a physical bar of gold or a single share of stock. It breaks down the moment you introduce book-and-claim. Book-and-claim, by definition, separates the environmental attribute of a low-carbon commodity from the physical product it describes. A sustainable aviation fuel certificate, for instance, can be sold, tracked, and retired entirely independently of the physical fuel itself, which may be consumed thousands of miles away by a party with no contractual relationship to the certificate buyer. A linear ledger has nowhere to put that split. It wants one asset, one owner, one location. Book-and-claim wants two parallel records — a physical delivery record and an attribute record that are related but never merged, and that can be independently audited, retired, and reported without either one silently inheriting the other’s status. This is the architecture problem a book-and-claim carbon credit platform actually has to solve: not “how do we record a transfer,” but “how do we record two distinct, cryptographically traceable claims against a single originating event, without ever letting them be double-counted against the same target.” The Software Solution: A Multi-Layered Attribute Schema The fix is not a bigger spreadsheet or a more detailed status field bolted onto an existing table. It’s a fundamentally different data model one where every credit or certificate is described not by a single status flag, but by a structured set of attributes that a query engine can filter against instantly. In practice, this means moving to a schema built around highly structured attribute storage, using an approach like JSON-B fields layered on top of relational tables with dedicated micro-indexes on the fields that compliance teams and auditors will query most often. Rather than a single “credit_status” column, each unit in a book-and-claim carbon credit platform carries a structured attribute object that can include: The engineering value of this approach is that these attributes live at the data layer, indexed and queryable, not buried in a PDF certificate or a manually maintained tag in a spreadsheet. When a compliance officer needs to pull every OER-eligible, Advanced-tier, book-and-claim certificate purchased in a given reporting year, that should be a sub-second, indexed database query, not a week of manual document review before an audit deadline. Read: Why Your Carbon Exchange Needs a Carbon Smart Order Router (Before Your Best Clients Route Around You) Dynamic Tagging: Isolating Permanent Removals From Temporary Reductions One of the more quietly dangerous failure points in legacy carbon ledgers is treating permanence as an afterthought, something noted in a project description rather than something the platform actively enforces. Under V2.0’s durability requirements, this distinction is not cosmetic. A company matching residual emissions against removals needs those removals to carry a storage duration genuinely comparable to the atmospheric lifetime of the emissions being addressed, and the standard proposes either a like-for-like matching approach or a phased transition toward more durable removals through 2050. A book-and-claim carbon credit platform designed for this reality doesn’t just store a “credit type” label. It structurally isolates permanent removal inventory from temporary reduction inventory at the query layer, so that a reporting dashboard, an API call, or an internal override cannot accidentally pull a temporary nature-based credit into a bucket that a company’s climate transition plan has designated for permanent removal matching. This is the same design principle that governs how we’ve approached credit-state architecture on Carbon Plant, our FSA-registered environmental impact exchange: state and category distinctions have to be enforced at the data and settlement layer, not left to a front-end filter that a direct
