The trading and risk platform
you can own, audit, and extend.
OpenTRMS runs the full trade lifecycle for FX, money markets, derivatives and fixed income — with an immutable audit trail and an AI control room your operations team can actually trust. Self-hosted. No license metering. No black box.
Built on Java 21 · Spring Boot · PostgreSQL · Spring AI + MCP
A trading platform that answers to four people at once.
TRMS decisions don't get made by one team. OpenTRMS is built so each stakeholder gets a clear, defensible answer — not a feature checklist.
Capture any product. Settle any way. See the book in real time.
FX, money markets, IRS, bonds, repos and structured deals on one ledger. Traders book in seconds; ops moves on without re-keying.
See asset coverage Risk, audit & controlEvery change is immutable, attributed, and replayable.
Event-sourced from day one. The history is the system of record — no after-the-fact reconciliations, no spreadsheet trail, no "trust us".
How the audit trail works CIO & architectsReplace your TRMS instead of renewing it.
Java 21 and PostgreSQL — boring, durable, hireable. No proprietary runtime. No vendor cliff in three years. Your stack, your roadmap.
Read the architecture CISO & securityRead the code. Host it yourself. Control your data plane.
Open-source code you can audit line by line. Run it air-gapped, in your VPC, under your IAM. No phone-home, no escrow, no surprise license audit.
Audit the codeOne ledger for everything your treasury actually trades.
Most "modern" platforms cover a slice and silently push the rest into spreadsheets. OpenTRMS books FX, money markets, fixed income and derivatives against the same event store — so positions, P&L and exposure stay consistent without nightly stitching.
Rates
- ›
- ›
- ›
- ›
- ›
- ›
FX
- ›
- ›
- ›
- ›
- ›
Credit
- ›
- ›
Equity
- ›
Instruments
- ›
- ›
- ›
- ›
One position model. One P&L. One audit trail. No more end-of-day stitching between siloed systems.
Follow one trade from capture to closeout.
A trading platform isn't a feature list — it's the path a deal walks every day. Here is that path on OpenTRMS, told from the seat of the person who actually does the work.
- 01
Captured
Front officeA trader books a 5Y USD interest-rate swap with ABC Bank. One screen, one click — or one sentence to the AI desk assistant.
- 02
Validated
STP engineLimits, counterparty, product schema and credit checks run in milliseconds. Eligible trades flow through; exceptions stop and explain themselves.
- 03
Approved
Middle officeA scoped approval chain routes the trade to the right desk head. No self-approval, no shortcuts — every signature is recorded as an event.
- 04
Confirmed
OperationsConfirmation flows out, the deal is locked, and the position updates on the trader's blotter and the risk desk's exposure view at the same time.
- 05
Settled
Treasury / settlementsNetting collapses cashflows by counterparty and currency. Payment messages (MT103/MT202) are generated and dispatched on schedule.
- 06
Accrued & valued
Finance / riskEnd-of-day rebuilds curves, accrues interest, marks the book to market and posts journals — every step is an event you can replay.
- 07
Closed out
Back officeAt maturity or termination, rule-driven matching offsets positions and the deal walks cleanly off the book — with the full history intact.
Behind every state change: a typed event, an immutable hash, an authorised user, a correlation id. Reconstructing what happened on any day, for any deal, is a query — not an investigation.
Your audit trail isn't a report. It's the platform.
Most TRMS vendors bolt audit tables onto a CRUD database and hope. OpenTRMS is event-sourced from the first commit — the history of every deal is the deal. Audit, control and risk teams get the answer they actually want: a single, attributed, replayable timeline.
-
Nothing is overwritten — ever.
Every state change appends a new event. The history of a deal is the deal. Auditors stop asking "show me the change log" because the change log is all there is.
-
Tampering breaks the chain, visibly.
Every event is hashed and linked to the previous one. Insert, delete or modify any record and the chain refuses to reconcile — no quiet edits, no "lost" rows.
-
Immutability enforced by the database, not by trust.
UPDATE and DELETE on the event table are revoked at the PostgreSQL level. Application bugs cannot rewrite history. Neither can a misbehaving DBA.
-
Every action is attributed.
User, scope, correlation id and timestamp are part of the event. "Who approved this?" is a one-line query, not a forensics project.
-
Replay any day, on demand.
Rebuild the book as it stood at any point in time. Reconcile to a regulator, run a what-if, or unblock a dispute — without freezing production.
A live hash chain
An operations control room that never sleeps — and never lies about what it did.
The boring half of trade ops — chasing breaks, pulling confirmations, summarising P&L moves — is exactly the work an agent should own. OpenTRMS gives your team agents that act through the same controls a human does, leave the same audit trail, and stop the moment they hit a limit.
-
Agents that go through your controls, not around them.
Every agent calls the same domain services as the REST API. Same scopes. Same approval chains. An agent cannot do anything a user with its scope couldn't do.
-
Human-in-the-loop where it matters.
The agent proposes; the human approves. Material actions never auto-execute, and every proposal is recorded as an event — including the one you rejected.
-
Plug into your AI stack, not ours.
Built-in MCP server: any MCP-compatible client (Claude, internal agents, Copilot-style IDEs) talks to OpenTRMS out of the box. No bespoke connectors, no proprietary protocol.
-
Your data stays where it is.
Self-hosted. Bring your own model. The agent runtime sits next to your event store — not in a vendor cloud you don't control.
$ opentrms ops review --book G10-RATES
› Anything I should look at before EOD?
Agent:
3 trades exceed the +/-2σ price band on the desk:
#45215Y USD IRS · ABC Bank · +3.1σ
#45442Y EUR IRS · DEF Sarl · −2.4σ
#456110Y GBP IRS · GHI plc · +2.8σ
Flag for review? [Y/n] Y
✓ 3 deals routed to Head of Rates
✓ Events appended · correlation b3f9e1
$
Closing the day shouldn't be a leap of faith.
EOD is where most TRMS deployments quietly fall apart — partial runs, mystery breaks, finance and risk arguing over whose number is right. OpenTRMS runs EOD as a sequence of attributable events, each one reproducible from the same audit trail your auditors will read.
Cut-off
Cut-off lands and the desks stop booking. The system snapshots the book at a single, attributable point in time — no "as of when?" arguments at 7am.
Curves & rates
Fixings come in. Discount and projection curves rebuild from the snapshot, not last night's leftovers. Every input is recorded; every output is reproducible.
Accruals
Interest accrues on every open position. Finance gets numbers they can tie back to specific trades and specific days — not aggregate fudge.
Mark-to-market
The whole portfolio is valued: IRS, FX, bonds, options. Greeks, DV01, PV01 fall out of the same model your trading desk used yesterday.
Journals & margin
Posting rules turn valuations into journal entries; margin is calculated against the same numbers. Finance and risk see the same truth.
Settlements
Cashflows are netted by counterparty and currency. Payment messages are produced and queued, ready for SWIFT or your bank rails.
Sign-off
Every step is an event. Skipped, retried, late? You can see it. The next morning's reg report is pulled from the same trail, not retyped.
One trail from cut-off to sign-off. If something needs to be re-run, it's a replay — not a rebuild.
A trading platform you can read end to end.
For your CISO, your audit committee, and the architect who has to live with this for a decade: the entire codebase is open source. There is no escrow, no "trust the vendor", no surprise re-licensing. The logic that prices your book is the logic in this repository.
Sealed Deal Lifecycle — 11 States, Compiler-Enforced
DealStatus is a sealed interface with one record per state. The compiler enforces exhaustive pattern-matching — no forgotten cases, no stringly-typed strings leaking into business logic.
public sealed interface DealStatus
permits DealStatus.Draft, DealStatus.PendingReview, DealStatus.Confirmed,
DealStatus.Settling, DealStatus.Settled, DealStatus.Accounted,
DealStatus.Matured, DealStatus.Terminated, DealStatus.Rejected,
DealStatus.Cancelled, DealStatus.ClosedOut {
String value();
static DealStatus fromString(String s) {
return switch (s) {
case "draft" -> new Draft();
case "pending_review" -> new PendingReview();
case "confirmed" -> new Confirmed();
case "settling" -> new Settling();
case "settled" -> new Settled();
case "accounted" -> new Accounted();
case "matured" -> new Matured();
case "terminated" -> new Terminated();
case "rejected" -> new Rejected();
case "cancelled" -> new Cancelled();
case "closed_out" -> new ClosedOut();
default -> throw new IllegalArgumentException("Unknown DealStatus: " + s);
};
}
record Draft() implements DealStatus { public String value() { return "draft"; } }
record PendingReview() implements DealStatus { public String value() { return "pending_review"; } }
record Confirmed() implements DealStatus { public String value() { return "confirmed"; } }
// ... 8 more states
} AI Deal Agent — Natural Language Trade Capture
A Spring AI ChatClient agent that implements human-in-the-loop deal capture: gather terms, preview before booking, confirm before executing. Pure Java — no Python orchestration.
var(--wb-warning);">@Component
public class DealAgent {
static final String SYSTEM_PROMPT = """
You are a deal capture assistant for a Trading and Risk Management System.
You help traders book financial deals. When capturing a deal, always show a preview first
and ask for confirmation before executing. Available product types: swap, spot, forward,
option, repo, deposit. Asset classes: rates, fx, credit, equity, money_market.
Workflow for deal capture:
1. Gather all required information from the user.
2. Call captureDeal to generate a preview and confirmation token.
3. Show the preview to the user and ask: "Shall I proceed with booking this deal?"
4. Only call confirmCaptureDeal if the user explicitly confirms.
""";
public String chat(String userMessage) {
return chatClient.prompt()
.system(SYSTEM_PROMPT)
.user(userMessage)
.call()
.content();
}
} SHA-256 Hash Chain — Tamper-Evident Event History
Every event in the store is chained to its predecessor via SHA-256. Replaying the chain and comparing hashes reveals any insertion, deletion, or modification — making audit trail falsification cryptographically detectable.
var(--wb-warning);">@Component
public class HashChainService {
public static final String GENESIS_HASH =
"0000000000000000000000000000000000000000000000000000000000000000";
/** Computes SHA-256( previousHash + canonicalJson(payload) ) */
public String computeHash(String previousHash, Object payload) {
var canonical = canonicalJson(payload);
var input = (previousHash + canonical).getBytes(StandardCharsets.UTF_8);
return sha256Hex(input);
}
/** Verifies an entire ordered chain — returns broken position on tampering. */
public HashVerificationResult verifyChain(List<Event> events) {
var previousHash = GENESIS_HASH;
for (int i = 0; i < events.size(); i++) {
var event = events.get(i);
var expectedHash = computeHash(previousHash, event.payload());
if (!expectedHash.equals(event.hash())) {
return HashVerificationResult.broken(i, event.version(), expectedHash, event.hash());
}
previousHash = event.hash();
}
return HashVerificationResult.ok(events.size());
}
} A pilot you can stand up in an afternoon.
No multi-month implementation project, no rooms full of consultants. Clone the repository, bring up the stack with Docker, and book your first trade against a real PostgreSQL ledger.
Ready to replace your multi-million dollar trading system?
Walk us through your book. We'll walk you through how OpenTRMS would run it — on your infrastructure, against your controls, with your team.
Open source · No license metering · Enterprise support available