A tokenised transfer is final when the law says so, and the ledger only tells you when it is hard to undo
Final settlement is a legal moment, fixed by the law that governs a settlement system and by its rules. A ledger supplies a technical moment after which reversing a transfer is impractical. The two coincide only when the ledger sits inside a system the law protects, as Hong Kong's first tokenised green bond did through the HKMA's Central Moneymarkets Unit. Elsewhere the moment rests on contract, and on public chains it rests on a checkpoint the issuer has to name.
- Problem
- A payment system has a legal moment after which a transfer cannot be undone. On a shared ledger, when is that moment, and who defines it?
A transfer is final when the law governing the system that settled it says it can no longer be reversed, including by a court administering a failed participant’s insolvency. A ledger cannot confer that status on its own. What a ledger provides is a technical point after which changing the record is impractical. For tokenised settlement to be safe, the two points have to be defined and have to line up. In Hong Kong that happened in 2023 because the tokenised bond settled through a system the law already protects. In Singapore and India the tokenised trials settle in central bank money, but the documents published so far do not describe the legal basis of their finality. On a public chain, the issuer has to choose the point and write it down.
The problem
The Principles for Financial Market Infrastructures, the global standard for payment and settlement systems, require a system to define “the point at which settlement is final” and add in a footnote that final settlement “is a legally defined moment” (CPMI-IOSCO PFMI, 2012, Principle 8, key consideration 1 and footnote 86). Existing systems meet this through statutes that protect designated systems from insolvency law.
Tokenised settlement is now moving real value in all three markets. The HKMA’s EnsembleTX pilot settles tokenised deposit transfers between banks (pilot entry). MAS settled interbank overnight loans between DBS, OCBC and UOB in wholesale central bank digital currency (CBDC) in November 2025 (pilot entry). India’s Demat 2.0 settles tokenised corporate bonds against the RBI’s wholesale e-rupee through the Unified Markets Interface (pilot entry). SEBI lists “implications for clearing, settlement finality and the roles of MIIs” among the things the Demat 2.0 pilot is meant to test (SEBI FAQ, Q21).
For public chains the question has reached capital rules. MAS’s April 2026 proposal lets banks hold tokens on permissionless chains at the lower Group 1 capital treatment only if “there must be a point of finality defined for the underlying blockchain”, documented and made available to users (MAS consultation paper, Annex D para 2(b); Wire).
How it works
Some terms first. Settlement is the transfer that discharges an obligation: the buyer gets the bond, the seller gets the cash. Delivery versus payment (DvP) means the asset moves only if the payment moves. Atomic settlement means both legs happen as one transaction that either completes entirely or fails entirely. Real Time Gross Settlement (RTGS) is the central bank’s system for moving money between banks one payment at a time. A designated system is a payment or settlement system that a statute names for protection.
Two kinds of finality matter. Legal finality is the moment after which a transfer is “irrevocable and unconditional” in law (PFMI, para 3.8.1). The main threat it guards against is insolvency: statutory finality protects transfers settled through a designated system from being reversed under insolvency and winding-up law if a participant fails (HKMA, Bond Tokenisation in Hong Kong, para 36). Technical finality is the moment after which the ledger’s record cannot practically be changed.
One trade: Hong Kong’s first tokenised green bond
In February 2023 the Hong Kong government issued HK$800 million of one-year tokenised green bonds. The HKMA’s Central Moneymarkets Unit (CMU), Hong Kong’s settlement system for debt securities, cleared and settled it on Goldman Sachs’ GS DAP platform, a private blockchain (HKMA release, 16 February 2023). The HKMA’s report on the issuance, Project Evergreen, sets out each step (HKMA, Bond Tokenisation in Hong Kong, August 2023, paras 6 and 7).
1. Pricing day (T). Books were built and the bonds priced off-chain, as for any bond. The CMU, acting as “Tokenisation Registrar”, created the smart contracts that would represent the bonds on the ledger, and as “Cash Token Manager” created the contracts for Hong Kong dollar cash tokens.
2. Cash in (T+1). Each syndicate bank paid ordinary Hong Kong dollars equal to its subscription into the CMU’s account in the HKD RTGS system, which settles interbank payments one by one across the HKMA’s books (report, footnote 3). This leg is an ordinary central bank money payment.
3. Cash tokens minted. The banks asked the CMU to mint cash tokens for the amount paid. Each cash token is a claim on the HKMA for one Hong Kong dollar (para 33). The tokens were transferred to the banks’ cash token accounts on the platform.
4. Instructions and approvals. A settlement program generated two sets of instructions: bond tokens from the government to the banks, and cash tokens from the banks to the government. The government, the banks and the CMU each approved them.
5. Atomic DvP. The program executed both transfers “atomically”, so the bond and the cash moved together or not at all. Payment in cash tokens discharged the government’s obligation under the bond terms (para 33).
Where the legal moment sits. The CMU is deemed a designated clearing and settlement system under section 55 of the Payment Systems and Stored Value Facilities Ordinance (Cap. 584), and deemed to hold a certificate of finality. Transfer orders settled through it are protected from insolvency and winding-up law, so they “are irrevocable and will not be reversed by the insolvency of a participant” (para 36). The HKMA’s release adds that the on-chain records “will be the legally definitive and final records of ownership” for parties on the platform. The ledger’s record and the protected system’s record were the same record.
What made that possible. The platform was the CMU’s own. The report says that a different ledger platform would get statutory finality only if the HKMA designated it under the Ordinance, and otherwise the parties “may achieve settlement finality by agreeing it contractually” (paras 37 and 38). The report does not say how far a contractual agreement would hold against insolvency law; the statutory kind is the one it describes as protecting transfers from it.
The same trade on a public chain
On Ethereum, technical finality comes in steps. Time is divided into 12-second slots and 32-slot epochs. The first block of each epoch is a checkpoint. When validators holding two-thirds of the staked ether vote for a pair of checkpoints, the later one becomes “justified” and the earlier one “finalized” (ethereum.org: proof of stake). To reverse a finalised block, an attacker would lose at least a third of all staked ether. If the chain fails to finalise for more than four epochs, a mechanism called the inactivity leak bleeds stake away from validators voting against the majority until the rest can finalise again (same source).
Before a checkpoint is finalised, a block can still be dropped. The Basel Committee’s research group reports that such “orphaned” blocks occur at a daily frequency, and that businesses set their own conventions for how deep a transaction must be before they treat it as done (BCBS Working Paper 44, August 2024, section 2.3.2). It estimates the cost of reversing technical finality on large chains such as Ethereum in “the billions of euros” (footnote 9).
No statute in Hong Kong, Singapore or India designates Ethereum. A bond settled there has technical finality at the finalised checkpoint and legal finality only where a contract or the issuer’s rules say so. MAS’s proposed condition asks the issuer to name that point: “All transactions on the blockchain are considered final only when the blockchain specific point of finality has been met or exceeded” (Annex D para 2(b)). The Basel paper warns that even where the legal moment is defined, probabilistic settlement “may still cause misalignment between legal finality and technical settlement” (section 2.3.2).
| CMU tokenised bond (2023) | Bond settled on a public chain | |
|---|---|---|
| Who runs the ledger | The CMU, on a private platform | Independent validators |
| Technical finality | When the CMU’s platform records the atomic transfer | When the block’s checkpoint is finalised |
| Legal basis | Statute: CMU is a designated system under Cap. 584 | Contract or the issuer’s rules |
| Binds a liquidator | Yes, for transfer orders settled through the CMU | Depends on insolvency law recognising the contract |
| Cash leg | Cash tokens that are a claim on the HKMA | Whatever token the parties choose |
Why it is built this way
Legal finality exists to contain one bank’s failure. PFMI says the legal basis “including the insolvency law, must acknowledge the discharge” of an obligation for it to count as final, and that “a well-reasoned legal opinion is generally necessary to establish the point at which finality takes place” (PFMI, para 3.8.4). Designation statutes give that protection only to named systems, and each names the systems rather than the technology. Singapore’s Payment and Settlement Systems (Finality and Netting) Act “was designed to be technology-neutral, allowing MAS to designate critical payment and settlement systems regardless of the technology used” (MAS speech on the 2018 amendment bill).
That explains why Hong Kong’s first tokenised bond ran inside the CMU. Settling through a system the law already covered gave the bond statutory finality from the first trade, and the HKMA presented the offering as showing that Hong Kong’s legal environment is “flexible and conducive” to such issuances (HKMA release). The cost was that the platform operated under the CMU, and only distributors the CMU approved could take part (HKMA report, para 5).
The central bank money choice follows from the same standard. PFMI asks settlement systems to settle money in central bank money “where practical and available” to avoid credit and liquidity risk (Principle 9). The tokenised settlement pilots that central banks run in these markets all do so: CMU cash tokens, EnsembleTX’s interbank leg through RTGS, MAS’s wholesale CBDC, and India’s wholesale e-rupee. That leaves one question for each: when the payment is final.
On a public chain, the moment of finality should be the one the protocol itself computes: Ethereum’s finalised checkpoint. It is defined in the protocol’s rules, documented, and would cost an attacker at least a third of all staked ether to reverse, which the Basel paper puts in the billions of euros (BCBS WP44, footnote 9). The issuer’s contract and published rules should record that point, not replace it with an operator’s book. That is what MAS’s proposal asks of issuers (Annex D para 2(b)), and it puts trust in the system’s rules rather than in a settlement agent’s ledger entry.
The gap is insolvency law. A contract that points to the checkpoint may not hold against insolvency law, and statutory designation exists to close exactly that gap. Closing it would take a finality law that recognises a protocol’s finalised state, which no statute in the three markets does yet.
In our markets
Hong Kong has the only tokenised settlement in the three markets whose legal finality is published. The 2023 bond settled through the CMU with statutory finality (HKMA report, para 36). The government’s fourth digital green bond, priced on 28 September 2026 at about HK$20 billion, offered three ways to settle its Hong Kong dollar tranche: the traditional rail, tokenised central bank money, and, for the first time, tokenised deposits through EnsembleTX (HKMA release, 29 September 2026). EnsembleTX settles banks’ tokenised deposit transfers through the HKD RTGS system for now, with a planned move to tokenised central bank money on a 24/7 basis (HKMA release, 13 November 2025). The HKMA has not said whether EnsembleTX itself is a designated system.
Singapore has a finality law that can reach any technology, and has not said how it applies to the ledger it trials. MEPS+, the Singapore dollar RTGS system, is designated under the Finality and Netting Act, which protects transfer orders, netting and settlement from being reversed on a participant’s insolvency (MAS speech, 2018). MAS’s November 2025 trial on the SGD Testnet settled real overnight loans, recorded in the banks’ “official books and regulatory filings”, with atomic settlement of multiple assets among the Testnet’s functions. The release does not mention designation or finality (MAS release, 13 November 2025). For public chains, MAS’s capital proposal makes a documented point of finality a condition for banks (Annex D para 2(b)).
India attaches finality to determination rather than payment. Section 23 of the Payment and Settlement Systems Act, 2007 makes a settlement under an approved procedure “final and irrevocable”, and its explanation places that moment when the amounts payable are determined, “whether or not” they are actually paid (Payment and Settlement Systems Act, section 23). The RBI’s wholesale e-rupee has settled government securities trades since November 2022 and now settles tokenised certificates of deposit and Demat 2.0 bonds through the Unified Markets Interface (pilot entry). SEBI’s FAQ describes Demat 2.0’s DvP as atomic, “either both legs settle or neither does” (Q9), and lists settlement finality as a matter the pilot will test (Q21). No RBI or SEBI document found for this piece says whether the Demat 2.0 ledger or UMI is an authorised system under the 2007 Act.
The case against
RTGS already gives final settlement in real time. PFMI asks for final settlement “intraday or in real time” where necessary (PFMI, Principle 8), and the HKD RTGS system, MEPS+ and India’s RTGS already provide it in central bank money. The alternative design keeps the cash leg in RTGS and puts only the asset on a ledger, linking the two so the asset moves when the RTGS payment is final. That is how EnsembleTX settles between banks today (HKMA release, 13 November 2025), and the Hong Kong government’s fourth digital bond still offered the traditional rail alongside the tokenised options. On this view, a tokenised cash leg adds a new legal question without removing an old risk.
Atomicity is not finality. SEBI’s FAQ says atomic DvP “eliminates the risk” of one party delivering without being paid (Q9). That removes principal risk inside the ledger. It does not decide whether a court would treat the completed transaction as irrevocable if a participant failed the same day. The Hong Kong report makes the same distinction: the CMU’s statutory finality, not the platform’s atomicity, protects transfers from insolvency law (para 36).
Technical finality is never absolute, on any ledger. The Basel paper notes that technical settlement finality “is also probabilistic in permissioned systems or centralised traditional systems”, citing the 2016 theft of US$81 million from Bangladesh Bank (BCBS WP44, footnote 9). Private ledgers remove validator risk but keep the risk of hacking and operator error. The legal moment is what settles disputes after either kind of failure.
The on-ledger cash leg is worth the legal work. With both legs on one ledger, the code settles them together or not at all, so neither party has to rely on the other, or on a settlement agent, to deliver after being paid (SEBI FAQ, Q9; HKMA report, Table 1). An RTGS-linked design gets a similar result, but leaves that assurance with the operators who link the two systems. What the atomic design still needs is the legal moment set out above.
What to watch
- The HKMA’s move of EnsembleTX interbank settlement to tokenised central bank money, planned for around the end of 2026, and whether it designates the system or relies on contract.
- MAS’s details on the tokenised MAS Bills trial settled in CBDC, promised for 2026, and any statement on the SGD Testnet’s status under the Finality and Netting Act.
- SEBI and RBI findings from the Demat 2.0 pilot on settlement finality and the roles of market infrastructure institutions.
- MAS’s final rules on public-chain tokens, including how it words the point-of-finality condition.