Tokenized asset settlement still has two legs: the asset must reach the buyer and the cash must reach the seller. Delivery versus payment, or DvP, links those transfers so one becomes final only if the other does. Tokenization changes where the records live. It does not remove principal risk, liquidity needs or the legal work behind finality.
Sources checked October 15, 2026. This guide explains infrastructure, not an investment product.
Start with the two legs
A securities trade creates a delivery leg and a payment leg. If the seller delivers the asset but the buyer’s cash never arrives, the seller can lose the full principal. DvP is the mechanism that prevents that outcome by making delivery conditional on payment.
The Bank for International Settlements describes three established DvP models:
| Model | Asset leg | Cash leg | Main trade-off |
|---|---|---|---|
| DvP 1 | Gross, trade by trade | Gross, trade by trade | Low principal risk, higher liquidity demand |
| DvP 2 | Gross | Net at the end of the cycle | Less cash needed, but an operator must keep the legs linked |
| DvP 3 | Net | Net | Highest netting efficiency, more dependency on the settlement system and its rules |
Tokenized platforms often gravitate toward DvP model 1 because individual transfers are easier to coordinate than multilateral netting on a distributed ledger. That can shorten the settlement cycle, but it may also require participants to hold more cash or eligible liquidity throughout the day.
Four ways to place the asset and cash records
The word “on-chain” hides an important architecture choice. The asset and cash records can sit in four different arrangements.
- Both legs stay in account-based systems. This is the traditional model: a central securities depository records the asset and an RTGS or commercial-bank system records cash.
- The asset is tokenized, cash stays in an account. The token platform must coordinate final delivery with a payment in an RTGS or bank account.
- The asset stays in an account, cash is tokenized. The securities infrastructure must link its book-entry transfer to the cash-token transfer.
- Both legs are tokenized. They may share one ledger or sit on separate ledgers that must interoperate.
A single ledger can make the conditional exchange technically simple: the system validates both sides and commits them together. Across two systems, “atomic” is a business and legal property, not just a smart-contract label. Timeouts, messaging failures and different definitions of finality can leave one side uncertain about the other.
Central bank money and commercial bank money are not interchangeable
Settlement assets carry the credit risk of the claim they represent. Central bank money is generally treated as the safest money in its own currency. A token issued by a commercial bank is a claim on that bank, even when the token moves on a modern ledger.
The CPMI’s report on wholesale digital tokens therefore asks infrastructure designers to make the claim explicit:
- who issues the token;
- what legal right the holder has;
- which assets or funds back it;
- how issuance and redemption work;
- who can hold and transfer it;
- when transfers are available;
- and what happens if the issuer, operator or participant fails.
“Backed one for one” is not enough on its own. The arrangement still needs rules for segregation, redemption, insolvency and access to the backing asset.
An RTGS link can keep the cash leg off the token platform
Project Helvetia tested two approaches on the SIX Digital Exchange test environment.
In the first, wholesale central bank digital currency existed on the same DLT platform as the tokenized securities. Both legs could settle there. In the second, the tokenized asset moved on the DLT platform while the cash leg settled in the Swiss RTGS system. The systems coordinated the two legs.
The experiment found both approaches feasible in its test setup. The trade-off was structural. Putting central bank money on the token platform opened more room for simultaneous settlement, but created new policy, governance and operational questions. Linking the platform to the existing RTGS system looked closer to established arrangements, while limiting some of the DLT platform’s functionality.
That is a useful design lesson for a fintech or bank: a new asset ledger does not automatically require a new form of money. It may require a reliable bridge to the money system already used for final settlement.
Atomic settlement does not remove every risk
When both legs settle together, principal risk can fall sharply. Other risks remain.
Liquidity risk. Gross, near-instant settlement can require cash and assets to be available earlier than in a netted end-of-day process.
Operational risk. A validator failure, network interruption, bad instruction or smart-contract defect can stop settlement. The transaction may fail safely while still exposing the parties to replacement-cost risk.
Legal risk. The system must define when ownership transfers, when the cash obligation is discharged and which record prevails in insolvency.
Interoperability risk. Two ledgers can have different clocks, identifiers, operating hours and finality rules. A connector has to reconcile all of them.
Asset-servicing risk. Coupons, redemptions, corporate actions and freezes must remain tied to the legally recognized holder after issuance.
This is why tokenized collateral, discussed in what the CFTC allows for margin, is only one layer of the operating model. The settlement and custody arrangements still have to work.
A practical architecture checklist
Before choosing a tokenized settlement design, document the answers in plain operational terms.
- What exactly is the token: a security, a deposit claim, a fund interest or a record of another asset?
- Which entity is the issuer, registrar, custodian and settlement agent?
- Where does each leg become final?
- Can the asset transfer be rolled back after the cash leg is final?
- What liquidity must each participant pre-position?
- How are failed, queued and partially processed instructions reconciled?
- Which identity and permissions govern wallets or accounts?
- How do sanctions, asset freezes and court orders reach the ledger?
- How are corporate actions and income distributions recorded?
- Which evidence can an auditor or insolvency administrator read without relying on one vendor?
The answers determine whether the design is a true settlement system or only a token interface over conventional custody and cash accounts.
