Blockchain in finance and supply chain

Computer Science and Engineering (B.E./B.Tech) · Blockchain · free study notes for exams, placements and interviews

In short

Blockchain in finance and supply chain is the use of a shared, append-only ledger among parties who do not trust each other, so that each keeps the *same* record of a payment, a security, a loan or a consignment instead of reconciling private copies. In finance the pay-off is settlement finality, fewer reconciliation breaks and programmable money (CBDC, tokenised assets); in supply chain it is provenance, chain of custody, anti-counterfeiting and faster document flow across exporters, banks, carriers and customs. Indian practice is concrete: the RBI's digital rupee (e₹) retail and wholesale pilots, SEBI's mandated DLT system for security and covenant monitoring of debentures, IBBIC's inland letter-of-credit network among 18+ banks, MeitY's National Blockchain Framework / Vishvasya stack, and QR-code serialisation on specified drug brands. Examined in B.E./B.Tech blockchain and fintech electives as use-case design, trade-offs against a central database, and the economics; asked in interviews at TCS, Infosys, Wipro, Accenture, Deloitte, EY, Mahindra, ICICI/HDFC/Axis innovation teams and at supply-chain SaaS firms.

Explained

Why a shared ledger at all - the reconciliation problem

Classical finance and logistics are message-passing systems: SWIFT MT/MX messages, EDI, e-mail PDFs. Each party updates its *own* database from the message, so copies drift and must be reconciled.
A DLT replaces "my record + your record + reconciliation" with one record with many authorised writers, validated by consensus and made tamper-evident by hash-linking.
The test for whether blockchain is the right tool: (1) multiple writers, (2) no trusted intermediary or an expensive one, (3) parties have conflicting incentives, (4) a shared audit trail has value, (5) data must be tamper-evident. Fail any of these and a replicated SQL database with signed audit logs is cheaper and faster.
Immutability is cryptographic, not legal. Writing a wrong invoice to a chain does not make it correct; it makes the error permanent and provable. Corrections are made by *appending* a reversing entry.

Finance use cases, with the mechanism

Cross-border payments and remittances. Correspondent banking needs pre-funded nostro/vostro accounts, costs 2-6% on small retail corridors and takes 1-3 days. A DLT corridor settles on one ledger with an atomic swap (hash time-locked contract), freeing trapped liquidity. Limits: last-mile fiat on/off-ramps, FX, AML/KYC and sanctions screening are still off-chain; SWIFT gpi already credits many corridors same-day, so the gain is narrower than claimed.
Trade finance. A letter of credit involves applicant, issuing bank, advising/negotiating bank, carrier, insurer and customs exchanging paper. On a shared ledger the LC, invoice, packing list and bill of lading are one versioned object - cutting courier and discrepancy cycles from days to hours and preventing duplicate financing (the same invoice discounted at two banks) because the ledger shows the invoice already pledged.
Securities settlement and tokenisation. Tokenising cash and the security on one ledger permits atomic DvP (delivery versus payment): either both legs move or neither, removing principal risk. India already settles equities on T+1 (completed January 2024), with an optional T+0 same-day settlement introduced by SEBI for a limited set of scrips from 2024 - so the Indian incremental gain is in corporate bonds, repo and private assets, not cash equities.
Loans, debentures and covenant monitoring. SEBI's circular on Security and Covenant Monitoring using Distributed Ledger Technology (2022) requires issuers, debenture trustees, credit-rating agencies and valuers to record security creation, asset details and covenant compliance on a DLT platform - India's clearest regulatory mandate for enterprise blockchain.
CBDC - the digital rupee. The Finance Act, 2022 amended the RBI Act, 1934 so that "bank note" includes currency in digital form; the RBI launched wholesale (e₹-W) pilots (secondary-market G-sec settlement, call money) and retail (e₹-R) pilots in late 2022, later adding programmability (purpose-bound money for tenant-farmer credit, fuel allowances) and offline use. e₹ is a central-bank liability, token-based, intermediated by banks, with anonymity in small retail amounts; it is not a cryptocurrency and need not use a public chain. Pilot user and volume figures change frequently - quote the RBI's latest release rather than a remembered number.
Insurance and claims. Parametric crop or flight-delay cover settled automatically from an oracle feed; shared ledgers for reinsurance bordereaux and for fraud-pooling of claim histories.
KYC and identity. A shared KYC utility reduces duplicate onboarding; India's answer is already centralised - CKYCR (CERSAI), Aadhaar e-KYC and DigiLocker - so the DLT argument here is consent and audit trail, not storage. Never put personal data or Aadhaar numbers on-chain.
Crypto-assets (tax, TDS and FIU registration) are a distinct subject and are not covered here.

Supply chain use cases, with the mechanism

Provenance and traceability: each custody event (harvest, lot, shipment, temperature excursion, customs clearance) is a signed transaction keyed to a GS1 identifier - GTIN for the product, SSCC for the pallet, GLN for the location - usually modelled on the EPCIS event standard (what, when, where, why). One-up/one-down traceability becomes end-to-end.
Serialisation vs track-and-trace: serialisation gives each saleable unit a unique code (DataMatrix/QR); track-and-trace records where that code was scanned. India's Drugs Rules, 1945 require a QR/bar code carrying a unique product identification code on labels of specified (top-300) drug formulation brands, in force from 1 August 2023, and DGFT operates a track-and-trace regime for pharmaceutical exports. Neither is blockchain-based today - blockchain is a possible ledger *under* such a scheme.
Cold chain and IoT: sensors sign temperature/humidity readings; an oracle writes them (or their hash) on-chain, making breach evidence non-repudiable for vaccines, seafood and dairy. Garbage-in still applies: a mis-calibrated sensor writes a trusted lie.
Anti-counterfeit: consumers scan a code and see origin plus "first scan" status. This proves *the code* is genuine, not the goods - cloning a code is easy, so pair it with tamper-evident packaging or NFC.
Supply-chain finance: a verified purchase order or GRN on the ledger lets an MSME borrow earlier and cheaper. India's live comparable is TReDS (RBI-licensed invoice discounting platforms, mandatory onboarding for larger companies and CPSEs) plus GSTN e-invoice data - centralised but effective.
Documents and customs: e-bill of lading, certificate of origin, phytosanitary certificates. Legal gap in India: MLETR (electronic transferable records) has not been enacted; the Bills of Lading Act, 2025 replaced the Indian Bills of Lading Act, 1856, and the Information Technology Act, 2000 still excludes negotiable instruments, powers of attorney, trusts and wills from being executed electronically - so a tokenised negotiable BoL has no clean statutory basis here yet. Electronic records are admissible in evidence under the Bharatiya Sakshya Adhiniyam, 2023 with the prescribed certificate.
ESG and carbon: immutable chain-of-custody for conflict minerals, recycled content and emissions claims; feeds EU CBAM and EUDR-style reporting demanded of Indian exporters.
Indian examples: Coffee Board's blockchain marketplace for growers; diamond pipeline tracking used by Surat/Mumbai exporters (De Beers Tracr, GJEPC initiatives); warehouse-receipt and agri-finance pilots with NABARD support; MeitY's National Blockchain Framework / Vishvasya BaaS and the NBFLite sandbox from C-DAC for building such systems.

Design choices that get examined

Public vs permissioned: finance and supply chain almost always use permissioned chains - identified members, no mining, BFT consensus, instant finality, no public gas fee. Public chains bring censorship-resistance and open liquidity that regulated flows rarely need.
Consortium governance is the real hard part: who onboards members, who pays, who arbitrates a disputed entry, and who owns the data if the consortium dissolves. Contour, we.trade and Marco Polo - three well-funded trade-finance networks - all shut between 2022 and 2023 for lack of network effect, not for lack of technology. Quote this when asked for limitations.
Confidentiality: a competitor must not see your prices. Techniques: private channels/sub-ledgers, one-to-one private transactions with on-chain hashes, zero-knowledge proofs, and the common pragmatic pattern - keep data off-chain, anchor only its hash on-chain.
Oracles connect price feeds, GPS, sensors and bank confirmations; they are the main trust and failure point.
Interoperability: notary schemes, relays/light clients, and HTLC-based atomic swaps across ledgers; cross-chain bridges are the most attacked component in the industry.
On-chain vs off-chain data: storage on a replicated ledger is expensive and permanent; store documents in object storage or IPFS and the digest on-chain.
Token vs record: a *token* is bearer-like and transfers by itself (e₹, tokenised bond); a *record* merely evidences a right enforced off-chain (a GRN entry). Legal consequences differ entirely.

Advantages and limitations

Advantages: single version of truth; tamper-evident audit trail; fewer reconciliation breaks; atomic settlement removes principal risk; faster document cycles; programmable conditionality; provable provenance.
Limitations: throughput and latency far below card/UPI rails; privacy needs extra cryptography; immutability conflicts with the right to erasure (the DPDP Rules, 2025 bring the Data Fiduciary duties including erasure into force only from 13 May 2027 - until then IT Act s.43A and the SPDI Rules govern); governance and onboarding cost; garbage-in-garbage-out; legal recognition gaps for negotiable documents; key management - a lost private key is a lost asset; energy cost of proof-of-work (irrelevant to permissioned chains).

Key points

Shared ledger - one replicated record with many authorised writers, replacing per-party copies plus reconciliation.
Five-question test - multiple writers, no cheap trusted intermediary, conflicting interests, value in shared audit, need for tamper-evidence; else use a database.
Permissioned chain - identified members, BFT consensus, deterministic finality, no fees; the default for banking and logistics.
Atomic DvP - cash leg and asset leg move together or not at all; removes settlement principal risk.
HTLC / atomic swap - hash-lock plus time-lock lets two parties exchange across ledgers without an escrow agent.
e₹ (digital rupee) - RBI CBDC, retail (e₹-R) and wholesale (e₹-W) pilots since late 2022; legal basis from the Finance Act, 2022 amendment to the RBI Act, 1934; programmable, purpose-bound variants piloted.
SEBI DLT mandate (2022) - security and covenant monitoring for listed debt on a distributed ledger; India's firmest enterprise-DLT requirement.
IBBIC - Indian Banks' Blockchain Infrastructure Company, a bank consortium network for inland letters of credit and e-BG verification.
Duplicate financing - the same invoice discounted at two banks; prevented because the shared ledger shows the pledge.
GS1 identifiers - GTIN (product), SSCC (logistics unit), GLN (location); EPCIS carries the what-when-where-why event.
Serialisation ≠ track-and-trace - unique codes versus recorded scans; QR codes are required on specified drug brands from 1 August 2023.
Anchoring pattern - data off-chain, hash on-chain; cheap, private, still tamper-evident.
Oracle - the bridge to off-chain facts and the system's weakest trust link.
Immutability vs erasure - append a reversal, never edit; never write personal data on-chain.
Network-effect risk - Contour, we.trade and Marco Polo closed in 2022-23 despite working technology.
India's centralised rails already work - UPI, CKYCR, TReDS, T+1 (and optional T+0) settlement; a DLT proposal must beat these, not just beat paper.
MLETR not enacted in India; the IT Act, 2000 still bars electronic execution of negotiable instruments - a hard limit on tokenised bills of lading.

Formulas and examples

TPS = n_tx / T_b — n_tx = transactions per block, T_b = block interval (s); TPS in transactions per second
t_f = z × T_b — probabilistic finality latency; z = confirmations required (dimensionless), t_f in seconds
P(attacker overtakes) ≈ (q/p)^z — q = attacker's share of hashrate/stake, p = 1 − q, z = confirmations (simplified Nakamoto bound, valid for q < 0.5)
Merkle proof size = ⌈log₂ N⌉ × h — N = leaves (events), h = hash length (32 bytes for SHA-256); gives bytes per proof
Working capital released = (DSO_old − DSO_new) × (annual sales ÷ 365); annual saving = released × cost of capital (₹)
Ledger growth = (events/day) × (bytes/event) × 365 — bytes per year, per replicating node
Recall cost = units recalled × cost per unit (₹); traceability cuts the *units*, not the cost per unit

Example 1 - Merkle proof and anchoring cost (traceability). A traceability platform logs 1,048,576 (= 2²⁰) scan events in a season and anchors one Merkle root per day on a public chain.

Proof that one event is included = ⌈log₂ 2²⁰⌉ = 20 sibling hashes × 32 bytes = 640 bytes - verifiable on a handset.
Anchoring: 1 transaction/day → 365 transactions/year. At ₹50 a transaction, ₹18,250/year, versus 1,048,576 × ₹50 = ₹5.24 crore if every event were written on-chain. Full on-chain writing is ~2,900× costlier for the same tamper-evidence.

Example 2 - working capital from faster trade documents. Exporter with annual sales of ₹100 crore; DLT document exchange cuts DSO from 45 to 30 days; cost of capital 9%.

Daily sales = 100,00,00,000 ÷ 365 = ₹27,39,726.
Working capital released = 15 × 27,39,726 = ₹4.11 crore.
Annual interest saving = 4,10,95,890 × 0.09 = ₹36.99 lakh (≈ ₹37 lakh/year).
Compare with the platform's cost: if the consortium fee is ₹60 lakh/year, the project fails on this benefit alone and must also count discrepancy and courier savings.

Example 3 - can a public chain carry Indian retail payments? UPI ran at roughly 20 billion transactions a month in 2025 (take 20 bn as a round figure; NPCI publishes the current number).

Average TPS = 20 × 10⁹ ÷ (30 × 86,400 s) = 20 × 10⁹ ÷ 2,592,000 = 7,716 TPS; festival peaks are several times higher.
Bitcoin ≈ 7 TPS, Ethereum base layer ≈ 15-30 TPS. Shortfall ≈ 7,716 ÷ 7 ≈ 1,100× against Bitcoin.
Conclusion: retail payment rails need permissioned/high-throughput designs (or layer-2); this is exactly why e₹ pilots do not run on a public proof-of-work chain.

Example 4 - why probabilistic finality is unacceptable for settlement. Public chain, attacker controls q = 0.10 of hashrate, z = 6 confirmations, T_b = 600 s.

P ≈ (0.10/0.90)⁶ = (1/9)⁶ = 1 ÷ 531,441 = 1.88 × 10⁻⁶ - small, but non-zero.
Finality latency t_f = 6 × 600 = 3,600 s = 1 hour.
A permissioned BFT ledger with 3f+1 = 4 validators gives deterministic finality in seconds with P = 0 for f ≤ 1 faults - which is why bank consortia choose it.

Example 5 - narrowing a recall. A dairy finds a contaminated input used in one batch. Without lot-level traceability the recall spans a month's output of 50,000 packs; with ledger-recorded lot linkage it spans 2,000 packs. Cost per pack (product + logistics + destruction) ₹300.

Without: 50,000 × 300 = ₹1.50 crore. With: 2,000 × 300 = ₹6 lakh. Saving = ₹1.44 crore, plus brand damage avoided.

Criterion	Shared ledger (permissioned)	Central database / EDI
Writers	Many, mutually distrusting	One owner, others send messages
Reconciliation	Not needed - one record	Continuous, costly
Tamper-evidence	Hash-chained, each member holds a copy	Depends on the owner's controls
Throughput	Hundreds to a few thousand TPS	Tens of thousands TPS
Privacy	Needs channels / ZKP / off-chain data	Native (access control)
Failure mode	Governance deadlock, key loss	Owner outage or misuse

Use case	What blockchain adds	Indian reality check
Domestic retail payment	Little	UPI already instant and free to users
Inland letter of credit	Document single-truth, no duplicate finance	IBBIC bank network live
Listed-debt covenants	Shared, time-stamped compliance trail	Mandated by SEBI (2022)
Cash-equity settlement	Marginal	T+1 since Jan 2024; optional T₀ for some scrips
Export documentation	Faster, verifiable, fraud-resistant	MLETR not enacted; IT Act bars e-negotiable instruments
Pharma anti-counterfeit	Scan history, provable provenance	QR on specified drug brands since 1 Aug 2023 (not DLT-based)

Where it is used

Banking and fintech: trade-finance platforms (IBBIC, Infosys Finacle Trade Connect), e-bank-guarantee verification, supply-chain finance; roles - blockchain developer, solution architect, product manager, business analyst in bank innovation labs.
Central banking and market infrastructure: RBI e₹ pilots and the RBI Innovation Hub; SEBI-mandated DLT covenant monitoring built by depositories and debenture trustees.
IT services and consulting: TCS (Quartz), Infosys, Wipro, Tech Mahindra, LTIMindtree, Accenture, Deloitte, EY, PwC - delivery and advisory on consortium design, tokenisation and traceability.
Pharma, food and agri exports: serialisation and track-and-trace for formulation exports, organic and GI-tagged produce (coffee, spices, tea, basmati), cold-chain evidence for vaccines and seafood.
Gems, jewellery, metals and automotive: diamond pipeline provenance from Surat/Mumbai, recycled-content and conflict-mineral claims, tier-2 component traceability for recalls.
Government and public digital infrastructure: MeitY's National Blockchain Framework / Vishvasya BaaS and NBFLite sandbox, C-DAC; tamper-evident certificates, land- and property-record pilots in several states.

Interview questions

Q: When should a company *not* use blockchain? A: When there is a single writer or a trusted operator, when low latency and high throughput dominate, or when data must be deletable - a replicated database with signed audit logs is cheaper and faster.
Q: What exactly does atomic DvP remove? A: Principal (Herstatt-type) risk - the chance that one party delivers and the other fails to pay - because both legs are one indivisible ledger transaction.
Q: Is the digital rupee a cryptocurrency? A: No. e₹ is a direct liability of the RBI, denominated in rupees, legal tender, issued and intermediated through banks; it needs no public chain and no mining.
Q: Why do banks prefer permissioned chains? A: Identified, KYC'd members, deterministic BFT finality in seconds, no gas fees, controllable privacy, and a governance body that can answer to regulators.
Q: How would you keep competitors from seeing a buyer's prices on a shared ledger? A: Keep the document off-chain and anchor only its hash, or use private channels, one-to-one private transactions, or zero-knowledge proofs of the needed property.
Q: Blockchain cannot stop a supplier from entering false data - so what is the value? A: It makes the entry attributable, time-stamped and unalterable, so fraud becomes provable after the fact and repeat offenders are identifiable; truthfulness at input still needs audits, sensors and incentives.
Q: How does a shared ledger prevent duplicate invoice financing? A: Once a bank registers a pledge against an invoice ID on the common ledger, any other lender querying that ID sees the existing encumbrance before disbursing.
Q: Why did trade-finance consortia like we.trade, Contour and Marco Polo shut down? A: Network economics and governance, not technology - without most banks, corporates and carriers on one network, parties still fell back to paper and the subscription revenue never arrived.
Q: What is the conflict between immutability and data-protection law? A: A right to erasure cannot be honoured on an append-only ledger, so personal data is kept off-chain with only hashes or pseudonymous references on-chain; in India the DPDP Rules, 2025 bring erasure and related Data Fiduciary duties into force from 13 May 2027, with IT Act s.43A and the SPDI Rules applying until then.
Q: Can a bill of lading be tokenised and legally transferred in India today? A: Not cleanly - India has not enacted MLETR, and the Information Technology Act, 2000 excludes negotiable instruments from electronic execution; the Bills of Lading Act, 2025 replaced the 1856 Act but does not supply a token-transfer regime.
Q: What does GS1 have to do with blockchain traceability? A: It supplies the identifiers and event grammar - GTIN, SSCC, GLN and EPCIS - so that events written by different companies mean the same thing; without a shared data standard the ledger is just shared noise.
Q: Give one Indian regulatory mandate that actually requires DLT. A: SEBI's 2022 framework for security and covenant monitoring of listed debt securities, implemented on a distributed ledger by issuers, debenture trustees, rating agencies and valuers.

Common mistakes

Claiming blockchain "removes the middleman" in regulated flows - KYC, AML, sanctions screening, custody and dispute resolution remain, and someone must be accountable to the RBI or SEBI.
Treating immutability as data quality; a false entry becomes permanently false, and oracles/sensors can feed trusted lies.
Writing personal data, Aadhaar numbers or whole documents on-chain instead of hashing and storing off-chain.
Confusing the digital rupee with cryptocurrency, or confusing serialisation (unique codes) with track-and-trace (recorded scans).
Quoting public-chain throughput or finality as if it suited settlement - 7 TPS and one-hour probabilistic finality fail both tests.
Ignoring consortium governance and onboarding economics in a project proposal; this, not cryptography, is what killed the major trade-finance networks.
Benchmarking a pilot against paper rather than against the Indian rail it must displace - UPI, TReDS, CKYCR, T+1 settlement.