XRP Ledger Retests Permission Delegation Feature: Banks Can Separate Payments and Compliance

The XRP Ledger network is preparing to activate a feature that allows account owners to grant limited permissions to other parties to make payments or approve customers, without having to hand over full control keys over their assets. The feature, called PermissionDelegationV1_1, entered a 14-day countdown on September 21 after securing support from 29 of the network's 35 trusted validators. If the minimum 80 percent support threshold holds, the feature will activate on October 5, 2026 at 11:18 UTC.

This marks the XRP Ledger's second attempt to introduce a permission delegation mechanism. The previous version was canceled because it contained a flaw that allowed attackers to make other accounts bear transaction fees that were not properly signed. A vulnerability report stated that the system at the time checked permissions before verifying signatures, so certain failures were still charged fees and could potentially drain victims' XRP balances. A community tester reported the flaw on September 15, 2025, and validators were asked to reject the amendment.

The fixed version was shipped through xrpld 3.3.0 software, which changes how the system rejects invalid transactions so that it no longer charges fees before signature verification is complete. According to XRPL documentation, each account can grant up to 10 permissions to delegates, and those permissions can later be modified or revoked by the main account.

For the financial industry, the ability to separate operational duties from security keys is a fundamental need. Conventional banks have long separated payment, compliance, and operational functions into different teams or systems. With this feature, stablecoin issuers can grant limited access to internet-based compliance systems to approve customer accounts, while the main keys remain stored offline. Separate operational accounts can also be granted permission to make payments without the authority to change keys or delegate further.

"This separation of authority allows payment and compliance systems to carry out specific tasks without granting broad authority over the issuer's assets," reads the core explanation in the XRPL document.

Validator trust is the main determinant. If support drops below 28 validators during the countdown period, the activation clock will be reset. This mechanism reflects the XRP Ledger's consensus design, which emphasizes stability and caution, especially for changes that touch on the security of funds.

In the Asia Pacific region, including Indonesia, the adoption of stablecoins and blockchain-based payment infrastructure is drawing increasing attention. Otoritas Jasa Keuangan (OJK) and Bank Indonesia are drafting a regulatory framework for crypto assets and stablecoins, while domestic industry players are beginning to explore the use of decentralized ledgers for cross-border payments. The permission delegation feature could be an added value for custodian service providers and stablecoin issuers operating in Indonesia, because it enables the separation of duties without compromising asset security.

However, challenges remain. Regulators in Indonesia demand strict governance and audit standards. The ability to delegate permissions on a limited basis can ease compliance, but it also demands robust risk management so it does not become a new loophole. Market players need to scrutinize how this feature is implemented in practice, including the permission revocation mechanism and audit trail.

Going forward, the success of PermissionDelegationV1_1 will be an indicator of whether the XRP Ledger can attract the interest of financial institutions that have so far been wary of the custody risks of digital assets. If successful, it is not impossible that other networks will adopt a similar approach. The question is, will regulators in Indonesia and Asia Pacific move fast enough to adjust the legal framework to accommodate this kind of delegation model?