Tokenized Settlement: Atomic DvP, Three Models, and the Problem Nobody Solved

Speed was not the problem

Everyone talks about programmable money making payments faster. But FedNow settles in seconds. TIPS in Europe does too. Faster Payments in the UK.

Speed was solved years ago. What tokenized money changes is not the speed. It is what the payment can carry.

This post walks through how settlement actually works, what goes wrong, and how tokenized settlement fixes one specific part of the problem. It also covers where the hype oversells and what remains unsolved.

What settlement actually does

Settlement is the moment money or assets change hands for good. When you buy a stock, two separate things need to happen on two separate systems.

The asset needs to move from the seller to the buyer. That happens on one system, run by an entity called a CSD (Central Securities Depository). The CSD keeps the official record of who owns each stock or bond. When a trade happens, the CSD updates its records to show the new owner.

The money needs to move from the buyer to the seller. That happens on a different system called RTGS (Real-Time Gross Settlement). RTGS is run by the central bank. It moves money between bank accounts at the central bank, one payment at a time.

These two systems have to talk to each other. But they do not process at the same speed or the same time. The CSD processes during the day. RTGS also processes during the day but follows different schedules. The gap between the two is where risk lives.

The gap is not theoretical

In 1974, a German bank called Bankhaus Herstatt was closed by regulators at 16:30 local time. Earlier that day, it had received Deutschemarks from counterparties in Europe. Those counterparties had delivered their side of the trade. But Herstatt was shut down before it could send dollars to its counterparties in the United States. The European banks had paid. The American banks had not been paid back.

This event is called Herstatt risk or settlement risk. It is the risk that one side completes its part of the trade and the other side does not. The two legs of the trade happen in sequence, not together. The time zone gap between the two systems creates a window where one party is exposed.

The same gap applies to domestic securities settlement. You deliver the stock on day two (T+2) but the cash settlement might not finalize until later in the day. During that window, the seller has given away the asset but has not received payment.

The atomic alternative

Atomic settlement solves this by making the two legs inseparable. The term atomic comes from database theory. A transaction is atomic if it completes entirely or has no effect at all. Think of a light switch. It is either ON or OFF. There is no halfway position.

Applied to settlement, atomic means the asset transfer and the money transfer happen in the same transaction. Both complete together, or both fail together. There is no gap between them.

In practice, this works through a smart contract that acts as an escrow. Both the asset token and the money token go into the contract. The contract checks that all conditions are met. If they are, both tokens transfer simultaneously. If anything fails, both tokens return to their original owners. No partial state survives.

This is the same logic your bank uses when you transfer money between your own accounts. The bank either moves the full amount or does not move anything. It never moves half the money and stops. Atomic settlement applies that same guarantee to trades between different parties.

Three things that change

Speed was never the bottleneck. The research from McKinsey, the OECD, and Citi Institute all converges on the same conclusion. What changes is not how fast money moves. It is what money can do when it becomes a token on a shared system.

Availability. RTGS operates during specific windows. In most countries, that is 18 to 22 hours on business days only. No weekend settlement. No holiday settlement. Tokenized settlement systems like Fnality run on DLT that is always on. You can move a token at 3 AM on a Sunday. But there is an important caveat. The token moves on the DLT. The legal settlement finality the point where value is irrevocably transferred under law still depends on RTGS operating hours for conversion back to central bank reserves. The token layer is 24/7. The connection back to traditional money is not.

Atomic DvP on a single ledger. When both the asset and the payment live on the same distributed ledger, you do not need to coordinate between a CSD and an RTGS. A smart contract enforces the all-or-nothing rule natively. But this only works when both legs are on the same ledger. Cross-ledger atomicity swapping a Fnality token for a Partior token is still experimental. Hash Time-Locked Contracts (HTLCs) exist but have throughput limits that make them impractical for high-volume wholesale settlement.

Programmability. Money can carry rules. Purpose-bound payments. Automatic sanctions screening. Margin calls that execute themselves when prices hit a threshold. This is real. But complex AML patterns that need human judgment still need human oversight. The balance between automation and review is not settled. As Citi Institute put it in 2025, the shift is not from batch to real-time movement. It is from real-time movement to real-time intelligence.

Three models

Every tokenized settlement platform answers the same question. Whose money settles the trade? The answer determines how safe the system is, how fast it can operate, and how flexible it can be.

Model 1: Wholesale CBDC. The central bank issues digital tokens directly on its own permissioned DLT. Commercial banks hold these tokens the same way they hold reserves at the central bank today. The difference is that these tokens are programmable and can settle atomically. Settlement risk is eliminated because both banks hold value on the same ledger operated by the central bank. The key pilots are Project Jasper (Bank of Canada), Project Helvetia (Swiss National Bank and SIX Digital Exchange), and Project Dunbar (BIS and MAS). The trade-off is that the central bank has to build and run DLT infrastructure. That is expensive and takes years of development.

Model 2: Tokenized Reserves (Fnality). Banks pool their central bank reserves into a single account. A regulated entity called Fnality issues tokens backed 1:1 by those pooled reserves. Banks hold and trade these tokens among themselves for settlement. The tokens are claims on central bank money, but they live on a private DLT, not on the central bank's own system. Fnality has raised $321 million across two rounds (2023 and 2025) and has 15 major banks as stakeholders. GBP settlement is live. EUR and USD are in development. The trade-off is that this model combines central bank safety with DLT flexibility, but the legal structure is complex and only works among the pool's member banks. As Michelle Neal, CEO of Fnality, says: "You can tokenize assets all day long, but if the payment leg cannot settle with certainty and finality on chain, you are still carrying friction."

Model 3: Tokenized Deposits (Partior). Each bank issues its own tokenized deposit on a shared ledger. Settlement happens through atomic PvP (Payment versus Payment) both currencies move together or neither moves. Partior is a joint venture between JPMorgan, DBS, and Temasek. It supports six currencies: SGD, USD, EUR, AUD, JPY, and CNH. HSBC and BNY Mellon are joining the network. The trade-off is clear. This model is the easiest to deploy because it does not need new central bank legislation. But it settles in commercial bank money, not central bank money. If Bank A's token is backed by Bank A's balance sheet and Bank A fails, the token loses value. Credit risk remains between participants.

The cash island problem

Every bank wants to issue its own tokenized deposit. And every bank should be able to. But there is a catch. Each bank's tokens only work within that bank's network. Bank A's token cannot pay Bank B. Bank B's token cannot pay Bank C. The American Bankers Association calls this the cash island problem.

The industry is split on how to solve this. One camp wants a shared ledger where all tokens live on one platform. Project Agora (led by the BIS) is the main example. The other camp wants a network-of-networks where separate ledgers connect through an orchestration layer. The Canton Network, RLN (R3 Ledger Network), and Chainlink CCIP are examples. JPMorgan chose the Canton Network for Kinexys, not the shared ledger approach.

Most banks prefer the network-of-networks approach because they keep control of their own ledger. But control comes at a cost. Every connection between two networks needs to be built, tested, and maintained. Three networks need three connections. Ten networks need forty-five connections. The complexity grows faster than the value.

The contrarian angle

Here is the part that most coverage skips. The ECB ran 50 trials with 64 participants across three different approaches in 2024. All three proved the same thing. You can settle DLT-based trades in existing central bank money without issuing a wholesale CBDC.

The Trigger Solution uses a coordination node that monitors the DLT and triggers a conventional RTGS payment. The TIPS Hash-Link uses an instant payment hash that cryptographically proves settlement on-chain. The DL3S Extension connects T2S (the Eurosystem's securities settlement system) to DLT platforms. Two of these approaches are already flagged as production-ready.

This matters because it shifts the question from "which new money do we create" to "how do we connect what we already have." The bridging mechanisms matter more than the form of money.

The settlement layer retrofit

This is the most misunderstood part of tokenized settlement. Banks keep their existing message flows. The ISO 20022 messages do not change. The clearing systems do not change. The SWIFT network does not change.

The pacs.009 message still says "pay Bank B." What changes is how that payment settles at the end of the message flow. Instead of moving central bank reserves from Bank A to Bank B through RTGS during business hours, the settlement moves tokenized value on a shared ledger that operates 24/7.

This makes adoption far more realistic than the "replace everything" narrative suggests. Banks do not need to rewire their core systems. They do not need to change their message formats. They do not need to retrain their operations teams on new clearing workflows. One layer changes. The rest stays the same.

The open question

Every model works within its own network. Fnality's tokens settle atomically within the Fnality pool. Partior's tokens settle atomically within the Partior network. JPMorgan's Kinexys tokens settle atomically within the Kinexys network.

None of them talk to each other.

The real open question is not which model wins. The real question is whether the industry can agree on interoperability standards before fragmentation becomes permanent. Without standards, you have three settlement pools, all atomically settled, none compatible. A cash island is still an island, even if it settles atomically.

The settlement layer is being retrofitted, not replaced. That is the practical reality. But the coordination problem between different tokenized systems is still wide open.