How default is handled on both sides of a forward contract.

Every forward contract is a promise to perform on a future date, and every promise eventually meets a counterparty that cannot keep it. A buyer's funding falls through. A seller's allocation slips. A facility loses power for a month. The question a risk desk should ask before it underwrites any forward exposure is not whether default can happen, but what, precisely, stands behind the contract when it does, and in what order those protections pay out. A vague answer is a red flag. The market that has thought hardest about this question can tell you exactly which dollar moves first.

This piece is that answer for a Rillor forward. We walk the default waterfall from both sides: what happens when the buyer fails before delivery, what happens when the seller fails to deliver, and the strict order in which deposit, performance bond, and make-whole remedies are applied. The model is deliberately borrowed from clearinghouse practice, where remedies are sequenced so that the defaulting party's own collateral is always exhausted before anyone else is touched. The difference is that a Rillor contract settles physically, so the final remedy is not just a cash payment, it is sourcing the actual hardware where possible. Read this as a risk memo, not a marketing page.

The principle: a symmetric, ordered waterfall

A default waterfall is a sequence of financial resources applied in strict priority to cure the loss from a default. The canonical version is CME Clearing's. When a clearing member defaults, losses are cured first from that member's own resources, its posted performance bond collateral and its guaranty fund contribution, then from the clearinghouse's own pre-funded contribution, then from the mutualized guaranty fund of non-defaulting members, then from capped assessments. The order is the design. The defaulting party's money is always exhausted before anyone else's is touched. It is worth noting that in managing past defaults, CME Clearing has never had to reach beyond the financial resources of the defaulted member itself. The deep layers exist; they have not been needed.

Rillor adapts that discipline to a bilateral OTC forward on physical hardware. There is no mutualized guaranty fund, because Rillor does not run a clearinghouse and does not novate every trade into a central counterparty. What it keeps is the ordering principle and its symmetry. Each side posts its own collateral at execution. When a side defaults, that side's collateral is applied first, in full, before any other remedy is reached. The non-defaulting party is made whole from the defaulter's resources, and only if those are insufficient does the contract reach for a secondary remedy. Critically, the waterfall is symmetric: the buyer and the seller each post collateral, each carries a defined remedy against the other, and neither side is left holding undefined risk.

Two collateral instruments anchor the whole structure. On the buyer side, a 10% deposit posted at execution into an independent escrow agent's account. On the seller side, a performance bond sized to the contract. These are the first dollars in the waterfall, and in the overwhelming majority of cases they are the only dollars that move.

Why these contracts can default cleanly in the first place

The reason this works is that the underlying is standardized and high value, so a defaulted position is a real, re-sellable asset rather than a bespoke headache. A Rillor contract references a standardized SKU, for example RIL-GX-B200-2T for a complete HGX B200 system, or RIL-NVL72-GB300 for a GB300 NVL72 rack. The NVIDIA GB200 NVL72 is itself a standardized rack-scale unit, 72 Blackwell GPUs and 36 Grace CPUs delivering 1,440 PFLOPS of sparse FP4 with 130 TB/s of NVLink bandwidth and 13.4 TB of HBM3E. These are not one-off configurations. They are fungible units with a deep, allocation-constrained demand base behind them, which is exactly why a defaulted position can be cured rather than written off. We walk the full clause set in anatomy of a Rillor forward contract.

Buyer pre-delivery default

Start with the more common case. A buyer executes a forward to take delivery of a system in a future delivery month, posts the 10% deposit, and then, before delivery, cannot or will not perform. Funding fell through, the project was cancelled, the team changed its mind. The seller has held allocation against this contract and may have incurred storage and carry. The risk desk's question: who eats that, and how is the seller protected.

The first remedy is the deposit. The buyer's 10% deposit is forfeited to the extent of the seller's actual, documented loss: storage, carry, and the contractual cancellation cost. On a B200 system contracting at, say, $340,000 per system, the deposit is roughly $34,000, sized so that for a normal cancellation it comfortably covers the seller's out-of-pocket cost of having held the unit. The seller is not chasing the buyer for a judgment. The collateral is already sitting in escrow, and the independent escrow agent releases it against the contract's cancellation terms.

The second remedy is re-listing. Because the contract is standardized, the position itself is an asset, and Rillor re-lists it to its verified buyer book. A B200 system for August delivery is fungible with any other B200 system for August delivery. There is a verified, KYC'd demand base that wants exactly that unit. Rillor markets the re-list to that book, and a replacement buyer steps into the delivery slot. The original seller delivers the hardware it always intended to deliver, to a different but equally verified end-customer of record, with NVIDIA channel compliance preserved on the new contract. The defaulting buyer is out its deposit; the seller is made whole and still ships; the system reaches a buyer who wanted it. The waterfall is short because the asset is liquid.

Why standardization makes the re-list fast

This is the load-bearing reason Rillor standardizes contracts rather than papering bespoke supply agreements. Standardization makes each contract fungible with every other contract of the same SKU and delivery month. That fungibility is what creates the liquidity to re-list and re-sell without renegotiating terms. It is the same property that lets exchange-traded positions change hands all day: the overwhelming majority of standardized contracts are liquidated or transferred before delivery precisely because no counterparty has to sit down and renegotiate the terms each time. The contract is the contract.

Contrast a bespoke purchase order with custom delivery, payment, and indemnity language. If that buyer walks, the seller is holding a position that nobody else's paperwork matches, and curing it means a fresh negotiation under time pressure. A standard Rillor contract has none of that friction: same six fields, same deposit mechanics, same channel handling, so the replacement buyer signs the same instrument the defaulter signed.

Seller non-delivery

Now the harder side. The buyer has performed, the deposit is in escrow, the buyer is ready to take delivery, and the seller fails to deliver. Allocation slipped, the unit went to a higher bidder, the seller's own upstream supply broke. The buyer is exposed: it planned a buildout around this delivery date and now has a hole in its capacity plan. The risk desk's question: is the buyer's money safe, and does the buyer get hardware or just damages.

The first remedy is the buyer's deposit. It is returned in full, immediately, from escrow. The buyer's 10% never funded the seller; it sat with the independent escrow agent precisely so that a seller failure cannot trap it. The buyer is whole on its own capital before anything else happens. The escrow account sits outside both parties' balance sheets, which is what makes the return clean and immediate.

The second remedy is the seller performance bond. This is the seller's own collateral, the mirror image of the buyer's deposit, and it is the next dollar in the waterfall. The bond is claimed to cover the buyer's loss from non-delivery: the difference between the contracted forward price and the cost of replacing that system in the prevailing market, plus the direct cost of the disruption. This is the seller's skin in the game, and it is why a verified seller's promise is worth more than an unsecured one.

The third remedy is sourcing. Because Rillor settles physically and the buyer usually wants the hardware, not a check, Rillor attempts to source the system from a secondary supplier where the channel allows. The OEM base is deep: an HGX B200 system can be filled by a Supermicro SYS-A22GA-NBRT, a Gigabyte G894-AD1-AAX5, a Dell PowerEdge XE9680L, an HPE ProLiant Compute XD685, or a Lenovo SR680a V3, among others, all qualified configurations of the same standardized SKU. If a secondary supplier can deliver, the buyer gets the system it contracted for, on or near the original date, with the performance bond covering any price difference. If no secondary source can deliver in the window, the remedy collapses to a make-whole: the buyer is paid out of the bond at the replacement cost, capped, and is free to procure elsewhere with funds in hand.

The make-whole cap

The make-whole step has a defined ceiling, and a risk desk should understand it precisely. Borrowing again from clearinghouse delivery rules: under CME Group's Chapter 7 delivery procedures, when a member fails its delivery obligation, the clearinghouse's sole obligation is to pay reasonable damages, capped at the difference between the delivery price and the reasonable market price at the time delivery was required, the replacement cost. The clearinghouse does not guarantee that physical delivery itself will happen. Rillor's make-whole follows the same logic. The contract does not promise the buyer infinite consequential damages. It promises the buyer its deposit back plus the bonded difference between the contract price and the replacement market price for the system at the time delivery was due. The bond is sized against that exposure, which is why it is not a token amount, and it is also why a risk desk underwriting the buy side should model replacement-cost risk, not assume the contract converts a non-delivery into a guaranteed physical fill.

The order, then, is unambiguous on the seller side: deposit returned to the buyer first, performance bond claimed second, secondary sourcing or capped make-whole third. The defaulting seller's own collateral, the bond, is what funds the buyer's recovery. No shared pool, no socialized loss.

Force majeure suspends, it does not default

A risk desk should separate genuine default from excused non-performance, because conflating them mis-prices both. Not every failure to deliver on the contract date is a default. A qualifying force majeure event (a natural disaster, a grid failure at the delivery facility, an export-control change that lawfully blocks a shipment) mutually suspends or extends the affected party's obligations rather than terminating the contract. The obligations resume once the impediment ends. The non-performance is excused, not penalized, so the waterfall does not fire.

Mechanically, a force majeure carve-out on a Rillor contract pauses the delivery clock. The deposit stays in escrow, the performance bond stays posted, and the delivery window extends by the duration of the impediment. Neither side forfeits collateral, because neither side defaulted; an outside force interrupted performance. If the impediment is permanent or runs past a defined long-stop date, the contract terminates on no-fault terms, deposit returned, bond released, with the carve-out specifying that outcome rather than leaving it to a fight. The point of writing the carve-out tightly is to keep ordinary commercial excuses, such as "our allocation slipped," out of it. Allocation slippage is a seller-performance failure and fires the bond. A grid failure at the facility is force majeure and suspends. The contract draws that line on paper so the risk desk does not have to litigate it later.

Rillor's dual role as backstop

There is one more layer that makes the waterfall more robust than a pure bilateral arrangement, and it follows from Rillor's structure. Rillor is both the neutral operator of the marketplace and itself a verified seller and underwriter that seeds liquidity. That dual role is not a conflict to hide; it is a backstop to deploy.

On a buyer default, if the verified buyer book does not immediately produce a replacement at an acceptable price, Rillor can step in as a backstop buyer of the re-listed position, taking the system into its own book and re-marketing it over time, so the original seller is made whole without waiting for the perfect external bid. On a seller default, where the channel allows, Rillor can step in as a backstop seller, sourcing the system itself to fill the buyer's order rather than collapsing straight to a cash make-whole. In both directions, Rillor's own balance sheet is a liquidity layer that sits behind the contractual remedies, used to keep a defaulted position from stranding either counterparty while the standard waterfall runs. It does not replace the deposit-then-bond-then-sourcing order; it makes the sourcing step more likely to deliver actual hardware. This backstop is one reason the marketplace can quote depth even when a specific bilateral pairing fails, and it is part of why funds and operators treat the venue as a real market rather than a bulletin board. The broader market layer that sits on top, the Rillor Compute Index licensed to exchanges and funds, is covered on the markets page.

Residual risk: what each side still carries

No waterfall removes all risk; it bounds it. A risk desk should underwrite to the residual, not to zero. After the remedies run, here is what each side still carries.

The buyer's residual risk is replacement-cost gap and timing. The deposit comes back and the bond covers the contracted-to-market price difference up to the cap, but if the replacement market has moved far above the contract price and beyond what the bond covers, the buyer absorbs the excess. The buyer also carries schedule risk: even a perfectly executed secondary sourcing may deliver days or weeks later than the original date, and a capacity plan pinned to an exact date carries that slippage. The buyer can manage this by sizing forward commitments against its own substitution flexibility, the same discipline laid out for the buy side on the buyers page and across the standardized SKUs in the SKU index.

The seller's residual risk is forfeiture and re-list spread. On its own default, the seller loses its bond, full stop. On a buyer default that the seller did nothing to cause, the seller is made whole on documented cost from the deposit, but if the re-list clears below the original contract price, the spread between the original and the re-list, net of the forfeited deposit, is the seller's residual exposure. In a backwardating compute market where deferred months trade below the front, that spread is real and a seller should price it into the contracts it writes. This is part of why a forward listing is standard channel pricing with defined remedies, not a margin giveaway, a point made for the sell side in why an OEM lists forward inventory on a forward market and on the for-OEMs page.

The shared residual, for both sides, is the limit of physical settlement under a stressed channel. Rillor settles physically and sources hardware where it can, but the contract is honest that under a severe supply squeeze, the seller-default remedy can resolve to a capped cash make-whole rather than a guaranteed unit. That is the same honest limit a clearinghouse states in its delivery rules, and stating it plainly is the difference between a market a risk desk can underwrite and one it cannot.

This is the underlying logic of why Rillor is a physical-delivery forward governed by the CFTC's forward-contract exclusion rather than an exchange-listed future. The regulator characterizes a forward as a commercial transaction between commercial counterparties who intend that physical transfer of the actual commodity will occur, with delivery deferred for commercial purposes, distinct from a future where the parties need not expect performance and frequently close out for cash. The entire default structure above (deposit, bond, sourcing, physical make-whole) is built around the intent to deliver. The remedies protect that intent. They do not convert the contract into a cash bet, which is the whole reason the index built on top of these contracts is hard to manipulate and worth licensing.

The summary a risk desk wants

Strip away the prose and the model is four sentences. The defaulting party's own collateral pays first, always. A defaulting buyer forfeits its deposit and the standardized position is re-listed to a verified book. A failed seller returns the buyer's deposit, forfeits its bond, and Rillor sources a replacement unit or pays a capped make-whole. Force majeure suspends rather than defaults, and Rillor's own book backstops the sourcing step. Underwrite to the residual gap above the cap, not to zero, and the exposure is bounded, defined, and symmetric on both sides.

If you run a risk or finance desk and want to walk the actual contract language, the bond sizing, and the escrow mechanics against your own underwriting standards, that conversation is the front door. Access is invite only.