Tokenizing $3.7 quadrillion: how the DTCC pilot works.

Controlling the rail ultimately comes down to ensuring the token, the underlying security, and the money remain synchronized at every stage. Here is that mechanism, traced through the largest live example we have: the tokenization pilot now underway at the DTCC.

What is tokenization?

A tokenized security is a record, on a programmable ledger, of an asset whose legal ownership still sits inside a regulated system. The token is a faster copy. That distinction splits tokenization into two models: native issuance and depository backed tokenization. In native issuance, the asset is created on the ledger and has no life anywhere else. In depository backed tokenization, a real security keeps living in its existing home, a regulated depository, and a token is issued against it.

The DTCC pilot is the second kind. In its own framing, the tokens “represent legal ownership within an existing regulated depository rather than synthetic exposure.”

The DTCC pilot: what we know so far

In December 2025 the SEC granted DTC a no action letter opening a three year runway to tokenize securities on public or private blockchains. The DTCC processed more than $3.7 quadrillion in securities transactions last year.

The pilot starts narrow and widens. First with US Treasuries, then Russell 1000 equities and major ETFs. It settles on permissioned institutional chains, starting with the Canton Network. More than 50 firms sit in the working group, including BlackRock, Goldman Sachs, JPMorgan, and Ondo Finance. It is set to go live gradually in October 2026.

How it works

The flow is the depository model made programmable when a security is immobilized at DTC. A token is minted against it on Canton through DTCC’s ComposerX platform, which handles minting, management, and settlement. The token then trades and settles onchain, and on redemption it is burned and the security is released.

Whether that flow can be trusted comes down to three parts.

i. The binding: keeping the token true to the security underneath it

In the DTCC model the underlying never leaves the depository. The security is immobilized in the Depository Trust Company’s book entry system, and a token is issued against it. The control that matters is that the lock and the mint are a single event. The security is segregated at the instant the token is created, and the token’s supply is held equal to the locked balance. If those two numbers can drift apart, even for a moment, counterparty risk walks back in through the side door.

When the two ledgers disagree, which one wins? In a depository backed design the answer is fixed by construction. The depository record is the legal position. The token is evidence of it, subordinate to it, and redemption always reconciles back to it. Redemption includes: the token is burned, the underlying security is unlocked, and legal title moves through the depository the way it always has.

ii. The cash leg: settlement is a question about money

A trade is settled when the asset and the money move together, or neither does. That is what delivery versus payment (DvP) means, and atomic means the two legs are welded into one all or nothing step with no gap between them. In US markets, that gap is currently one business day. Equities and Treasuries have settled on a T+1 cycle since May 28, 2024. For that one day, one party has delivered and one is waiting to be paid.

Closing the gap onchain requires the money to be on a ledger in a form that can settle in the same breath as the asset. Circle, the issuer of USDC, sits in the DTCC working group, which points toward stablecoin implementation in the near future.

iii. Finality

Finality comes in two kinds, and a technical account has to keep them apart.

Protocol finality is the moment a transaction can no longer be reversed on the ledger. On a permissioned chain running Byzantine fault tolerant consensus it is deterministic and immediate: once the validator quorum commits the block, it is done.

Legal finality is the point at which the law treats ownership as irrevocably passed, enforceable against a third party and against a bankruptcy trustee. A block can be technically final while legal finality sits undefined, because unless a statute says the committed ledger state is the settled legal position, a court can still unwind it.

DTCC’s design answers this in an efficient way. Since the token is subordinate to the DTC record, and that record already carries settlement finality under existing US securities law, the token inherits its finality rather than having to establish new law. A chain that does not sit on top of an existing depository gets no such inheritance. It has to be granted legal finality directly, by statute or by regulatory recognition that its committed state is the settled position. That is what any national settlement rail needs to answer before the engineering even begins.

Why the Canton Network

DTCC is not running this on a public chain. It partnered with Digital Asset to tokenize DTC custodied securities on Canton, and the reasons are the same reasons a public chain would not work.

Canton is built for institutions that cannot broadcast their positions. On a public ledger every balance and trade is visible to everyone, which is a non starter when your holdings move markets. Canton inverts that. It uses sub transaction privacy, where a validator receives only the data relevant to its own users, and a routing layer that moves sealed messages it cannot read. Each institution runs its own validator, so it keeps custody of its own data while still settling atomically with the rest of the network.

Those strengths come from one choice, and the choice has costs. Critics point out that Canton is permissioned rather than public. Validators are vetted and approved, self custody and anonymous wallets are not supported, and governance concentrates among a set of “supervalidators” that read like a roster of financial incumbents. Because no node replays the full transaction history, you cannot cryptographically audit total token supply the way a public chain allows. One developer called the model “privacy by fragmentation instead of cryptography.” Canton’s answer is that these are features for regulated markets, and that regulators can be added as monitoring nodes.

Both sides are right, and that is the point.

Canton’s design is well matched to regulated settlement, and it is a permissioned system run by a defined group. DTCC co-chairs the Canton Foundation with Euroclear. A permissioned rail is exactly as sovereign as the institutions permissioned to run it.

Questions we keep getting