Open, permissioned and hybrid offers

The XRP Ledger has had one open exchange since it launched. Anyone can trade there. The ledger matches orders and does not care who placed them.

For a regulated bank, that is a problem. Its rules forbid trading with people it has not checked. On the open exchange, it cannot know who is on the other side.

A permissioned DEX is a walled room inside the same exchange. A permissioned domain is the guest list at its door. Only accounts with the right credential can place orders there, and their orders only meet each other.

Offers now come in three kinds.

• Open. The normal kind. Trades with anyone on the open exchange.
• Permissioned. Lives only inside one room. Trades only with others in that room.
• Hybrid. Stands in the doorway. It can trade with the room and with the open exchange. It tries the room first.

There can be many rooms. Each belongs to one domain. Rooms do not connect to each other. One transaction can use one room, never two.

One limit to know: AMM pools stay outside. A pool cannot fill an order inside a room, and a domain cannot fence off a pool.

A room has only the orders its members place. So prices inside can differ from the open exchange, and there may be less to trade against.

The permissioned DEX went live on mainnet on 2026-02-18. It needs Credentials and Permissioned Domains, which were live before it.

Placing offers. OfferCreate gains:

• DomainID: the permissioned domain's ledger entry ID. The offer goes into that domain's order book for the pair.
• tfHybrid (0x00100000): makes the offer hybrid. DomainID is required with it, or the result is temINVALID_FLAG.

If the sender is not a member of the domain, or the domain no longer exists, the result is tecNO_PERMISSION. The transaction also deletes the sender's expired credentials.

Matching, from xrpl.org:

Payments. A cross-currency Payment can carry DomainID. It then consumes only offers from that domain's DEX. Both the sender and the recipient must hold valid credentials for the domain. The field has no effect on a payment that is not cross-currency.

Structure. No single ledger entry represents a permissioned DEX. It exists as all order books that share a domain ID. A book is created when a valid offer is placed with that ID and deleted when empty. Each DEX can have books for any number of pairs.

• Auto-bridging works inside one domain if the needed offers are all there.
• One transaction can use several books of the same domain. It cannot use two different domains.
• Hybrid offers match the permissioned DEX first when placed.

Invalid offers. A permissioned offer becomes invalid when:

• The owner's credential expires or is deleted.
• The domain's list changes and the owner holds none of the new credentials.
• The domain is deleted.

Invalid offers are treated like unfunded ones. They cannot execute, and they are removed when a transaction next modifies their book. An offer can turn valid again, for example when an expired credential is renewed before the offer is removed.

Reading. book_offers accepts a domain field and returns that DEX's offers in place of the open book's. An Offer entry in a permissioned DEX carries DomainID.

Roles. A permissioned DEX needs at least two traders, a domain owner and a credential issuer. One account may hold several roles. The traders must be different accounts.

Related: The DEX, AMM, Credentials as a gate.