Tokenised Collateral: ESMA's Default Test

Tokenised collateral looks quick until a clearing member fails and the central counterparty needs cash, not a token moving between wallets. On 9 October, the European Securities and Markets Authority asked whether EU clearing houses can safely use tokenised assets as collateral. Its call for evidence is pointed: explain the route from an asset posted as margin to money available during a default. A fast ledger transfer is one step on that route. It is not the destination.

What a clearing house actually needs

A central counterparty, or CCP, sits between buyers and sellers of cleared trades. It collects margin and default fund contributions from clearing members so that one member's failure does not immediately become everyone else's problem. The collateral has to be worth something, legally available to the CCP and usable in time. ESMA's paper says it is investigating how tokenisation affects those tests, rather than proposing to widen the categories of assets a CCP may accept.

That distinction is worth holding onto. A government bond does not become safer because its record has moved onto a ledger. Its credit and market risks are still its credit and market risks. But the route to sell or finance that bond might change. If the CCP must wait for a custodian to reconcile a token with the conventional securities record, or for a platform to admit a buyer, the asset may be perfectly good and still arrive too late as usable liquidity. ESMA asks respondents to spell out those dependencies in its question on default handling, not to offer a faster transaction screenshot.

Picture a member that has posted a token representing an otherwise eligible bond. The member defaults. The CCP needs to enforce its rights, identify the underlying holding, move it to a buyer or repo counterparty, and receive spendable funds. If a step stops at the boundary between ledger and custodian, transfer speed tells you little about recovery time. This is a hypothetical stress test, not a report of a failed transaction.

Our earlier piece on tokenisation and settlement dealt with when a transaction is complete. Collateral adds a harsher question: after it is complete, can the clearing house turn its claim into money when the member has gone?

A digital twin has two records to defend

ESMA separates two broad models. A "digital twin" represents an asset that continues to be held in ordinary custody or central securities depository infrastructure. A native tokenised asset is issued, held and transferred directly on a ledger. Hybrid arrangements can mix the two. The label alone does not say who owns the asset or how a CCP gets it. The legal and operating documents have to do that work.

The twin model is attractive because it can leave a familiar bond in familiar custody while adding a faster way to identify or mobilise it. It also creates a second record. ESMA asks which one wins if the token ledger and the underlying register disagree. Its paper describes reconciliation with the custodian or depository as a possible step before the CCP can sell, repo or otherwise realise the collateral. A system can be efficient on a quiet day and painfully dependent on manual confirmation on the one day that counts.

Native issuance removes that particular split, but it does not remove the need for a market or a working payment route. A token can settle on its home ledger while the buyers, liquidity providers or cash settlement mechanism the CCP needs are somewhere else. ESMA asks how conversion would work under stress, including the timing and certainty of access to funds. An asset that nobody can buy on the needed terms is no help simply because its ownership history is tidy.

For a twin, show the legal owner and authoritative record, then run a discrepancy and a custodian outage. For a native asset, show how the CCP transfers it to a buyer or finances it, then run a platform outage and a thin market. Time the whole path to cash, not the first ledger hop. ESMA has asked for evidence; it has not endorsed a winning model.

Control of a wallet is not control of the claim

The awkward work is legal. ESMA notes that a token qualifying as a financial instrument does not automatically make its ledger record sufficient to create or protect ownership under national law. It asks whether control of a wallet or private key has legal significance for title transfer, pledges and enforcement. If an intermediary fails, the CCP needs rights a court will recognise, not a dashboard showing a green tick.

Client collateral raises another problem. Clearing members may post assets connected to their clients, whose positions and collateral might have to move to a backup member after a default. ESMA distinguishes technical separation, such as different wallets and permissions, from legally effective segregation. A clever smart contract might prevent a transfer inside one application while leaving a fight over whose assets sit in an insolvent intermediary's estate. It also asks whether wallet permissions and platform access would allow those client positions to be ported in time.

The Dutch AFM and DNB made a related point in a joint study published on 7 October. They say current Dutch law provides no basis for securities issued, held and transferred exclusively as tokens. Firms therefore often keep a conventional record beside the ledger, which can leave doubt about the legal significance of the token record. That finding is about Dutch securities law, not a blanket ruling against tokenised collateral across the EU. It does show why an elegant ledger design can still depend on an old register.

Legal finality is similarly specific. ESMA says the moment a transfer looks complete to a system may not be the moment insolvency law treats it as irrevocable. In a mixed ledger-and-custody arrangement, the CCP must know when its collateral is actually posted and protected against a later challenge. If operational confirmation runs ahead of that legal point, a margin report could count an asset the CCP cannot safely rely on. This is not a semantic argument about what "settlement" means. It changes what the risk desk thinks it has.

Faster margin can demand more liquidity

ESMA's paper makes an unfashionable observation about speed. Automated transfers and shorter settlement cycles could reduce friction, but they could also pull margin demands into a tighter part of the day. Several firms using similar triggers might reach for the same eligible assets at once. The paper asks whether that synchronised behaviour changes intraday liquidity risk and how haircuts should reflect any new exposure. It does not claim that tokenisation has already caused such a squeeze.

A haircut is the discount applied to collateral value to allow for risk while the asset is turned into funds. If a conventional bond has a deep market but its tokenised form needs a restricted platform or a conversion step to reach that market, the relevant waiting time may be different. ESMA asks whether an otherwise eligible asset's tokenised form affects sale, repo or conversion under stress. It also raises wrong-way and concentration risks where value or liquidity depends on a particular issuer, platform or counterparty. Faster processing is useful only if the next market is open when the CCP arrives.

The operational test is just as blunt. A compromised private key, failed reconciliation, smart-contract error or outage can stop collateral moving while the underlying asset still exists. ESMA calls for end-to-end testing across the CCP, custodians and technology providers, including default simulations and stressed conversion into usable funds. A demo that proves the token can be issued has not tested the failure it was meant to cover.

ESMA is taking submissions until 15 January 2027. It plans to assess responses in the first quarter of 2027 before deciding whether action within its remit is warranted. Nobody has received a blanket green light. The useful evidence will show who can enforce the claim, which record controls, how clients are protected, what fails when the platform fails, and how long the path to cash takes in a default. Until then, a fast token is a promising component, not a clearing-house backstop.