> ## Documentation Index
> Fetch the complete documentation index at: https://kamino.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Concepts
> How collateral custody, Proof of Reserve, mirror tokens, and legal enforcement work together to enable off-chain lending
## The core innovation: collateral that never touches a smart contract
In standard on-chain DeFi lending, collateral is locked in a smart contract. The protocol enforces the loan because it physically controls the collateral — a borrower cannot withdraw pledged assets without first repaying.
Off-Chain Collateral removes this constraint. The collateral (native SOL, staked SOL, BTC) stays in a regulated custodian account at Anchorage Digital Bank. It never moves on-chain. Three mechanisms replace the smart contract lock:
| Mechanism | Role |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Chainlink Proof of Reserve | Publishes the custody balance on-chain so the smart contract can calculate LTV |
| Mirror token | Gives the borrower an on-chain representation of custodied collateral to post as Kamino collateral |
| Account Control Agreement | Legal contract that enforces the loan — the custodian follows Kamino's instructions, not the borrower's, when LTV is breached |
This structure lets institutional borrowers access USDC liquidity against assets they cannot or choose not to put on-chain — native SOL staking positions, BTC held at qualified custodians, or large positions where moving on-chain introduces its own counterparty risk.
***
## Chainlink Proof of Reserve (PoR)
Chainlink's oracle network reads Anchorage's custody systems directly and publishes the actual collateral balance on-chain in real time. This is what allows Kamino's smart contract to calculate LTV without the assets ever moving.
```
Collateral Value = PoR Balance × Asset Price Feed
```
The PoR feed is the authoritative source for borrowing capacity — the smart contract trusts this figure, not any borrower-supplied input.
**What PoR attests:**
* The balance of specific assets in the borrower's custodial account at Anchorage
**What PoR does NOT attest:**
* Solvency of the custodian
* Quality of custody operations
* Protection against custodian counterparty failure
PoR is a balance attestation, not a security guarantee. It confirms that assets are present in the account — it says nothing about whether the custodian is operationally sound or solvent.
If the Chainlink feed goes stale, Kamino can pause the relevant market to prevent operations based on outdated data. Multiple independent node operators in the Chainlink network reduce the risk of a single reporting failure triggering a false positive or masking a real LTV breach.
***
## Mirror tokens
A mirror token is a synthetic token representing a specific borrower's custodied collateral. It is minted by Kamino and scoped to that borrower's isolated market.
Key properties:
* Not traded on any market
* Not transferable to other protocols or wallets
* Has no independent value — it is a pure accounting unit
* Scoped to a single borrower's isolated Kamino market
When the Chainlink PoR feed attests \$10M of SOL in custody, the mirror token represents exactly that \$10M. The borrower deposits the mirror token into their isolated Kamino market and borrows USDC against it — up to the maximum 70% LTV.
**Lifecycle:**
| Stage | Mirror token state |
| ------------------------------------ | ----------------------------------------------------------------- |
| Collateral deposited at Anchorage | Minted, calibrated to PoR-attested balance |
| Loan active | Active — tracks PoR balance in real time |
| Full repayment, collateral withdrawn | Inert — PoR feed reports zero; nothing can be borrowed against it |
The mirror token is not burned at repayment. Once all collateral is withdrawn from Anchorage, the Chainlink PoR feed reports a balance of zero and the token becomes inert rather than destroyed.
***
## The Account Control Agreement (ACA)
The ACA is the legal enforcement mechanism for Off-Chain Collateral. It is the functional equivalent of a smart contract lock — applied in the legal domain rather than the technical domain.
It is a three-party contract between:
* **Borrower (pledgor)** — the institutional entity pledging SOL or BTC
* **Anchorage Digital Bank (custodian)** — holds the assets; neutral gatekeeper
* **Kamino / Collateral Agent (secured party)** — holds first-priority security interest on behalf of lenders
### Two operating modes
| Mode | Condition | Who can instruct Anchorage |
| ----------------- | --------------------------------- | ------------------------------------------------------------ |
| Joint control | Normal operation | Borrower and Kamino jointly — both must approve any movement |
| Exclusive control | After Notice of Exclusive Control | Kamino / Collateral Agent only — borrower is locked out |
Under joint control, neither party can move assets unilaterally. The borrower cannot withdraw collateral without Kamino's approval. Kamino cannot move collateral without cause.
Exclusive control is triggered when a borrower breaches the loan agreement — specifically, when LTV exceeds the 75% liquidation threshold. Kamino (through the Collateral Agent, Anchorage Innovations, LLC) issues a Notice of Exclusive Control to Anchorage Digital Bank. From that moment, Anchorage accepts no instructions from the borrower and executes the liquidation under Kamino's direction.
The ACA is governed under South Dakota law and structured under UCC Article 8, which treats the pledged collateral as a "financial asset" with Anchorage Digital Bank as the "securities intermediary." This structure perfects Kamino's first-priority security interest in the collateral.
***
## Solana epoch mechanics (staked SOL)
A Solana epoch is the protocol's \~2-day cycle between which staking rewards are distributed and staking/unstaking events settle.
Staked SOL cannot be instantly liquidated. Unstaking requires waiting until the end of the current epoch — a maximum of approximately 2 days. This creates a gap between when a Notice of Exclusive Control is issued and when the collateral can be converted to USDC.
**Staked SOL liquidation sequence:**
| Event | Timing |
| ------------------------------------------------------- | ----------------------------------- |
| Notice of Exclusive Control issued; unstaking initiated | Immediate |
| Unstaking completes | End of current epoch (max \~2 days) |
| Trade placed | \~24 hours before epoch end |
| Trade settlement | 24 hours after trade date |
| Total cycle | Maximum \~2 days |
The LTV parameters for staked SOL — 70% max LTV, 75% liquidation LTV — are set conservatively to account for this window. The 30%+ collateral buffer is intentional: it must absorb potential price movement during the unstaking period.
This is why the LTV for native SOL collateral (which settles instantly) differs from staked SOL (which requires epoch-end unstaking). The collateral type determines how quickly enforcement can complete, which determines how much buffer the protocol requires.
**Recovery window:** If collateral value recovers sufficiently before a trade is placed, the liquidation can be avoided. However, the SOL remains unstaked for the remainder of that epoch regardless — it cannot be re-staked mid-epoch. Once a trade is booked, it cannot be cancelled.
***
## Rolling loans and 3-month terms
Off-Chain Collateral loans operate on fixed 3-month terms. This is structurally different from standard variable-rate DeFi lending.
| Attribute | Standard On-Chain DeFi | Off-Chain Collateral |
| ------------------------ | ------------------------------------------------ | --------------------------------------------------- |
| Rate type | Variable — adjusts continuously with utilization | Fixed at origination for the full term |
| Repayment | Any time | Any time |
| Duration | Flexible | 3-month rolling |
| Renewal | N/A | Auto-renews at renegotiated rates unless terminated |
| Grace period at rollover | N/A | None — monitoring is continuous |
At the end of each 3-month term, the loan auto-renews unless the borrower fully repays or either party initiates termination. The interest rate is renegotiated at rollover. LTV monitoring and liquidation mechanics apply continuously across renewal periods — there is no grace period at the term boundary.
***
## Segregated custody and rehypothecation prohibition
### Segregated custody
The borrower's collateral is held in a dedicated Pledgor Account at Anchorage Digital Bank. This account is legally and operationally distinct from:
* Anchorage's own balance sheet assets
* Other clients' custodied assets
Segregation means that if Anchorage were to face insolvency, the borrower's collateral in the Pledgor Account would not be available to Anchorage's general creditors. The assets belong to the borrower (subject to the ACA's security interest), not to Anchorage.
### Rehypothecation prohibition
Rehypothecation is the practice of a custodian re-using client collateral — lending it out, pledging it, or using it in financing activity. In traditional finance, this is routine and generates returns for custodians.
Anchorage is contractually prohibited from:
* Lending the pledged assets
* Pledging or encumbering them in any form
* Using them in any trading or financing activity
This prohibition holds regardless of market conditions or any instruction from the borrower. The collateral must remain inert in the Pledgor Account at all times while the ACA is in force.
Rehypothecation prohibition and segregated custody together mean the collateral has one purpose: backing the loan. It cannot be deployed, loaned, or encumbered elsewhere without breaching the ACA.