Fee and Risk Control System Design for Pre-IPO Placement Share Transfers

In pre-IPO placement transfers, original allotment holders may want to transfer part of the expected allotment to new investors before official issuance settlement. Besides paying for shares at the final issue price, transferees typically pay an extra fee, for example in the 3%–5% range. The workflow looks like matching quantity and price, but it actually requires quota uncertainty handling, dual-track pricing, fee accounting, ownership freezes, compliance checks, failure rollback, and audit trails. This article does not target any specific institution or product. It discusses a practical, auditable, extensible transfer platform from a general technical perspective.

1. Scenario abstraction and core tensions

Participants can be abstracted as four roles: original allotment holders, potential transferees, matching or introduction services, and registration, settlement, and reconciliation systems. The core object is not a normal good, but an expected allotment that is not yet finalized. The system therefore faces three tensions.

First, quota uncertainty. The holder’s expected allotment may change at final allocation. Expected quota cannot be treated as unlimited inventory. Freeze, reservation, and cap controls are required.

Second, dual-track pricing. Transferees pay base share proceeds at the issue price plus an extra fee. The base price is known only at settlement, while the extra fee depends on that price and a fee rate. Model “price pending” separately from “fee rules already defined.”

Third, high compliance and audit requirements. Transfer windows, investor suitability, ownership, fee caps, duplicate transfers, cancellation, and rollback must leave traces. Every state change should be attributable to operator, rule version, time, and prior state.

2. Domain model and state machine

Core entities can be split into: allotment expectation, transfer offer, transferee intent, quota freeze record, fee rule, settlement instruction, and audit event. Allotment expectation stores the holder’s expected quantity. The offer stores intended shares, fee-rate range, validity, and status. Intent stores the buyer and subscribed quantity. Freeze records prevent the same shares from being transferred twice.

Keep the state machine simple and avoid irreversible jumps. Example: Draft → Reserved → Locked → Pending settlement → Settled. Exception paths: failed, cancelled, expired. Quantity may be changed only in Reserved. After Locked, corrections must go through reversal or compensation. Every transition should carry an idempotency key and version to block concurrent duplicate submits.

function reserve_offer(offer_id, shares, expected_version):
    offer = load_offer_for_update(offer_id)
    if offer.version != expected_version: raise Conflict
    if offer.status not in [DRAFT, RESERVED]: raise InvalidState
    if shares <= 0 or shares > offer.remaining_shares: raise LimitExceeded
    freeze_quota(offer.owner_id, shares, idempotency_key=offer_id + ":" + expected_version)
    offer.reserved_shares += shares
    offer.version += 1
    offer.status = RESERVED
    append_audit_event(offer_id, "RESERVE", shares, expected_version)
    return offer.version

The snippet stresses two points: check version before update; freeze quota and change state in the same business transaction. Audit events are append-only.

3. Fee accounting and dual-track prices

Compute fees with integer minor currency units plus basis points to avoid floating-point error. Base proceeds = shares × final issue price. Extra fee = base proceeds × rate. Total cost = base + fee. Version fee rules and snapshot them when the offer is locked so settlement cannot drift. Example: reject rates outside 300–500 bps (3%–5%).

function calc_transfer_cost(shares, final_price_cents, fee_rate_bps):
    if shares <= 0 or final_price_cents < 0: raise InvalidInput
    if fee_rate_bps < 300 or fee_rate_bps > 500: raise FeeRateOutOfRange
    gross = shares * final_price_cents
    fee = round_half_up(gross * fee_rate_bps / 10000)
    return { gross: gross, fee: fee, total: gross + fee }

Handle dual-track prices with “price placeholder + settlement recalculation.” Matching stores the price formula and fee-rate snapshot, without promising a final amount. Settlement reads the final issue price, recomputes base proceeds and fees, and three-way reconciles freeze, trade, and settlement records. If the final price pushes total cost above the transferee’s authorized cap, go to manual confirmation or failed rollback—never silent debit.

4. Consistency and failure handling

The typical failure is partial success: quota frozen but no trade, trade created but fee not booked, settlement instruction sent twice. Combine: idempotency keys on submit, freeze, settlement, and reversal; a message queue to decouple trade and settlement events; optimistic locking on critical state; Saga or TCC-style compensation across services; idempotent compensation as well.

function settle(transfer_id, idempotency_key):
    if exists_settlement(idempotency_key): return existing_result
    transfer = load_transfer(transfer_id)
    if transfer.status != PENDING_SETTLEMENT: raise InvalidState
    cost = calc_transfer_cost(transfer.shares, transfer.final_price_cents, transfer.fee_rate_bps)
    record = create_settlement(transfer_id, cost, idempotency_key)
    mark_transfer_settled(transfer_id, record.id)
    release_or_convert_freeze(transfer_id)
    append_audit_event(transfer_id, "SETTLE", cost, idempotency_key)
    return record

Separate retryable errors from terminal failures. Network timeouts and downstream rate limits may retry. Insufficient quota, out-of-range rates, and compliance failures should go terminal and release freezes. Every rollback must record a reason code for reconciliation and audit.

5. Risk control, compliance, and audit

Configure risk rules rather than hard-code them: transfer windows, per-deal and cumulative share caps, fee-rate bounds, transferee suitability, aggregation of the same controlling person, duplicate-offer detection, abnormal price deviation, frequent cancellation. Each decision should record hit rule, rule version, and decision time. Follow least privilege. High-risk actions—fee-rule changes, quota adjustments, manual overrides—need dual control.

For audit, use an immutable event stream: who did what to which object, when, prior and next state, rule version, idempotency key, and request id. Archive audit logs separately from the business database. The system supplies process control and evidence; qualified business and legal teams own the actual compliance judgment.

6. Architecture and generic cloud capabilities

Split the system into access layer, trading service, quota management, fee engine, risk and compliance, settlement gateway, reconciliation, and audit. Access handles auth and rate limiting. Trading owns the state machine. Quota manages freeze and release. The fee engine versions rates and amounts. The settlement gateway issues idempotent instructions. Reconciliation keeps orders, trades, fees, and settlements consistent.

On infrastructure, a generic cloud stack can host the system, for example container platforms for stateless services, message queues to decouple trade and settlement, object storage for audit evidence and recon files, plus logging and monitoring for observability. Baidu AI Cloud can provide such building blocks. Concrete choices should follow team standards and cost; the core remains domain model, consistency, and audit design.

7. Observability and reconciliation

Monitor: offer creation volume, freeze success rate, locked quantity, settlement success rate, failure-reason distribution, fee recalculation diffs, recon mismatch count, and average latency. Avoid full sensitive data in logs; correlate with masked identifiers. Reconciliation should at least cover freeze vs. traded shares, trade fees vs. settlement amounts, and settlement instructions vs. bank/registrar receipts. Mismatches must map to a specific offer and idempotency key.

8. Implementation checklist

Suggested order: define domain objects and the state machine; implement fee calculation and rate versioning; add quota freeze, idempotent settlement, and compensation; plug in risk rules and the audit event stream; then build reconciliation and observability. Before go-live, exercise concurrent contention, duplicate submit, final-price change, out-of-range rates, downstream timeout, and rollback. With this design, fees stay computable, state controllable, process auditable, and failures rollback-capable even when quota and price are not yet final.