From Pontes to Appia: How Europe Is Rebuilding the "Cash Leg" for Tokenised Securities

In the exploration of tokenised financial markets, the digitisation of the asset side (such as on-chain bond issuance or fund tokenisation) often captures the most attention. Yet within the design of Financial Market Infrastructure (FMI), what truly determines whether the entire trading system can operate securely and achieve compliant settlement has always been the other half of the clearing and settlement equation—the Cash Leg.

Two flagship initiatives recently unveiled by the European Central Bank (ECB) and the Eurosystem—the Pontes Pilot, scheduled for initial rollout in Q3 2026, and the Appia project, slated to deliver a comprehensive long-term blueprint by 2028—clearly showcase Europe's approach to next-generation securities settlement infrastructure: while assets can migrate to new ledger architectures, the ultimate anchor of value settlement and credit must remain firmly rooted in Central Bank Money.

1. Why Is Settlement Even More Critical When Securities Are Already on the Blockchain?

On August 19, 2026, the Eurosystem officially announced the roster of 61 member institutions for the Appia Contact Group, comprising major European commercial banks, Central Securities Depositories (CSDs), market operators, and public-sector representatives^[1]. Launched in September 2026, this group is tasked with steering both the rollout and evolution of the Pontes Pilot and co-designing the long-term infrastructure blueprint for Europe's tokenised financial ecosystem^[2].

In terms of engineering milestones, the ECB's Pontes Pilot has also entered a critical launch window. These moves send a clear signal to the industry: Europe's application of Distributed Ledger Technology (DLT) in wholesale finance has transitioned from fragmented Proofs of Concept (PoCs) into system-level infrastructure integration.

For fintech practitioners, the pivotal lens through which to examine this transition is: when the Securities Leg is already distributed across diverse external market DLT platforms, how can the Cash Leg be settled safely and effectively?

In the lifecycle of modern securities transactions, every trade consists of two independent yet tightly coupled operational legs:

1. The Securities Leg: Responsible for recording ownership changes and transferring securities;
2. The Cash Leg: Responsible for executing the debit, transfer, and delivery of countervalue funds.

To eliminate principal risk between counterparties—preventing scenarios where "the seller delivers securities but never receives cash" or "the buyer pays cash but never receives securities"—traditional finance relies on mature Delivery versus Payment (DvP) mechanisms.

Tokenisation alters the ledger medium of asset ownership records, smart-contract-driven business rules, and how trade instructions circulate. However, moving securities onto a blockchain does not automatically make settlement risk disappear. If securities reside on a public or consortium blockchain while funds remain in commercial bank accounts, a central bank Real-Time Gross Settlement (RTGS) system, or another isolated ledger, the market still operates across two distinct ledgers. This architecture does not inherently resolve synchronisation between the two legs.

While blockchain-native Hash Time-Locked Contracts (HTLCs) can achieve "atomic swaps," they address only execution atomicity at the technical protocol level. They cannot resolve the underlying credit risk of the settlement asset or establish legal settlement finality.

Consequently, as tokenised securities scale toward mass adoption, the decisive bottleneck lands squarely on the design of the cash leg: what monetary asset should the market use to settle these transactions?

2. Why Do Tokenised Securities Still Require Central Bank Money as the Cash Leg?

In tokenised asset markets, potential candidates for the cash leg generally include commercial bank tokenised deposits, fiat-backed stablecoins, and tokenised central bank reserves issued directly by central banks.

In advancing wholesale financial tokenisation, the ECB has consistently emphasised that central bank money is the safest settlement asset in the financial system^[3]. This stance does not stem from reluctance toward emerging technology, but rather reflects foundational prudential principles of financial market infrastructure:

1. Fundamental Differences in Credit and Liquidity Risk

What defines the safety of a settlement asset is not its technological format (whether it is a token), but whose liability it represents on a balance sheet:

In wholesale financial markets, daily transaction volumes routinely reach hundreds of billions of euros. If large-value securities settlement between institutions relies on the liability of a private commercial entity as the intermediary, a midday liquidity crunch or insolvency at that institution could trigger systemic cascading defaults across the entire settlement chain. Central bank money, backed by sovereign credit as the ultimate liability, is the only settlement medium that eliminates this credit risk at the systemic level.

2. Legal Settlement Finality

On a distributed ledger, achieving consensus and committing a transaction to a block constitutes technical state confirmation. Under insolvency law and financial regulatory frameworks, however, settlement finality is legally established only when a payment reaches an officially recognized "irrevocable and unconditional" status.

The EU Settlement Finality Directive (SFD) explicitly defines designated settlement systems that enjoy legal protection. The ECB's settlement architecture mandates that settlement finality in euro central bank money must be strictly anchored in the officially operated pan-European real-time gross settlement system (TARGET2 / T2). This legal certainty cannot be replicated by private tokenised networks through purely technical means.

3. Preserving the Singleness of Money

If different DLT securities platforms issue or adopt disparate private stablecoins and commercial bank tokens that cannot be converted seamlessly at par (1:1 face value) into central bank base money on demand, the market risks price tiering and liquidity fragmentation. As the common value anchor for all commercial money, central bank money ensures that regardless of which technological ledger an asset circulates on, the unit of account and settlement currency remains unified.

3. Dissecting Pontes: An Interoperability Bridge Linking External Market DLT with Central Bank Settlement Infrastructure

The positioning of the ECB's Pontes is straightforward: it is not a "super-chain" run by the central bank to monopolise all securities issuance and trading, but an interoperability bridge architecture designed to connect external market DLT platforms with Eurosystem TARGET Services^[4].

This means European exchanges, CSDs, and fintech platforms can continue leveraging public, consortium, or proprietary DLT platforms for the securities leg according to their business needs. Pontes provides standardized interoperability mechanisms that allow these platforms to seamlessly invoke central bank cash leg settlement capabilities.

1. Pontes Dual-Track Cash Settlement Models

According to the ECB's published Business and User Requirements Documents^[5], Pontes designs two parallel cash settlement routes to accommodate varying levels of technical maturity and liquidity management preferences across institutions:

• Model 1: Eurosystem DLT Cash Token Model

Participating banks lock reserve liquidity within the T2 system, prompting the officially maintained Eurosystem DLT to mint an equivalent amount of central bank Cash Tokens. During securities settlement, security tokens on the external market DLT and cash tokens on the Eurosystem DLT are delivered peer-to-peer and synchronously via a cross-ledger protocol. Although cash tokens can circulate intraday within the Eurosystem DLT, their underlying legal settlement finality remains tightly coupled to T2 reserve accounts.

• Model 2: Direct T2 RTGS Settlement Model

For traditional banks that have not yet deployed DLT nodes, or for settlement scenarios involving ultra-large core assets, Pontes allows settlement instructions triggered on external market DLTs to directly execute reserve account transfers within the T2 RTGS system. Only after T2 returns proof of successful debit and credit does the external blockchain release the security tokens to the buyer.

2. Cross-Ledger DvP Coordination: The Hash-Link Protocol

When the securities leg and cash leg run on two independent ledgers, the core technical challenge is guaranteeing an "all-or-none" outcome.

Pontes employs a communication and coordination mechanism based on Hash-Lock and Time-Lock principles:

1. Pre-locking Phase: The seller's securities are locked by a smart contract on the market DLT, and the buyer's cash (or cash tokens) is locked simultaneously within the Eurosystem settlement domain, governed by a unique cryptographic pre-image;
2. Settlement Trigger Phase: The settlement coordinator reveals the secret key, and both ledgers verify the key and execute asset releases simultaneously within a valid time window;
3. Timeout Protection Mechanism: If a communication failure or validation error occurs on either side within the specified window, the lock expires, and assets on both sides automatically revert to their respective origin accounts, eliminating unilateral counterparty risk.

1. Identity of Liability: Both Pontes Cash Tokens and wholesale CBDCs represent direct legal liabilities of the central bank to commercial financial institutions on the balance sheet, carrying the highest credit rating of wholesale central bank money.
2. Institutional Role and Independence: A conventional wholesale CBDC (wCBDC) represents an independent digital currency regime possessing full statutory currency status and an autonomous operational framework spanning issuance, circulation, remuneration, and intraday liquidity management. By contrast, the Cash Token currently deployed in Pontes is essentially a tokenised representation of central bank money dependent on existing T2 RTGS reserve liquidity. Its creation requires a 100% reserve lock in T2 accounts. Designed to enable cross-ledger interoperability, it does not constitute a standalone currency separate from T2.

4. From Pontes to Appia: From "Interoperability Bridge" to a "Tokenised Financial Ecosystem"

If Pontes resolves the immediate challenge of how DLT securities currently entering the market can safely access central bank money, Appia represents the ECB's top-level institutional blueprint for future financial market infrastructure.

The ECB clearly delineates its tokenisation roadmap into a near-term engineering track and a long-term ecosystem blueprint:

In its strategic roadmap published in March 2026, the ECB highlighted that Appia will extend far beyond payment settlement to explore the following domains^[6]:

• End-to-End Asset Lifecycle Management: Covering registration and issuance, trade matching, custody, and corporate actions such as dividend and coupon distributions for tokenised securities;
• Ecosystem-Wide Programmability: Establishing unified smart contract security standards to enable automated, multi-leg transactions across institutions and asset classes (e.g., automated collateral substitution, programmatic repo transactions);
• Preventing European Market Fragmentation: Mitigating the risk of repeating historical European capital market fragmentation caused by disparate national ledger implementations, creating an integrated infrastructure aligned with the Digital Operational Resilience Act (DORA) and the EU DLT Pilot Regime.

The formation of the Appia Contact Group in August 2026 establishes a direct collaborative mechanism between the central bank and 61 leading financial institutions, ensuring the future Appia blueprint incorporates practical market feedback from commercial banks, clearing houses, and custodians.

5. Next-Generation Financial Market Infrastructure Through the Lens of Pontes, Appia, and Project Agorá

Comparing the Eurosystem's Pontes and Appia with Project Agorá, led by the Bank for International Settlements (BIS), reveals foundational consensus among major global central banks exploring tokenised financial infrastructure.

In July 2026, Project Agorá completed real-value testing. Central banks from major monetary jurisdictions and 28 leading private financial institutions executed 17 cross-border wholesale payment scenarios, settling approximately 800,000 Swiss francs in live transactions^[7]. The tests demonstrated collaborative settlement between tokenised central bank reserves and tokenised commercial bank deposits in a programmable environment, while verifying integration with legacy systems via ISO 20022 financial messaging standards.

The practical experience of both initiatives underscores a vital reality: the key competitive differentiator for next-generation financial market infrastructure is not creating a single monolithic blockchain that subsumes all assets and trades, but establishing secure, compliant, and legally definitive interoperability across diverse asset ledgers, commercial bank money ledgers, and central bank base money ledgers.

Industry debates have long centered on whether institutions should choose Ethereum, Corda, or bespoke private consortium chains. From a realistic financial operating perspective, the global asset universe is far too vast, diverse, and jurisdictionally distinct to be forced onto a single physical ledger. The more viable evolutionary trajectory unfolds in three layers:

1. Pluralistic Asset Ledgers: Diverse market segments adopt appropriate DLTs or electronic book-entry platforms tailored to their specific performance and compliance requirements;
2. Central-Bank-Anchored Settlement: Central banks build interoperability gateways like Pontes to ensure that wherever assets are traded, large-value wholesale settlement always resolves in central bank reserves;
3. Standardised Protocol Interconnection: Standardised cross-ledger coordination protocols (such as Hash-Link and ISO 20022) achieve deterministic atomic settlement across heterogeneous systems.

Just as the success of the internet did not rely on consolidating global computing into a single supercomputer, but rather on standard communication protocols connecting millions of heterogeneous devices into a unified network, the future of financial market infrastructure will be built on efficient interoperability across heterogeneous ledgers.

While tokenisation redefines the efficiency of asset ownership recording and transfer, the final settlement of financial transactions will always hinge on the fundamental credit nature of money.

References

[1]: European Central Bank. (2026-08-19). Eurosystem establishes Contact Group for Appia project. ECB Market Infrastructure News. https://www.ecb.europa.eu/press/intro/news/html/ecb.mipnews260819.pt.html ↩

[2]: European Central Bank. (2026-05). Box 5: Towards a tokenised financial ecosystem in the euro area. Financial Integration and Stability Report. https://www.ecb.europa.eu/press/fie/box/html/ecb.fiebox202605_05.en.html ↩

[3]: European Central Bank. (2026-03). Eurosystem comprehensive payments and settlement strategy. ECB Publications. https://www.ecb.europa.eu/press/pubbydate/2026/html/ecb.eurosystemcomprehensivepaymentsstrategy202603.en.html ↩

[4]: European Central Bank. (2026). Pontes: Exploring central bank money settlement of wholesale financial transactions recorded on DLT platforms. ECB TARGET Services Overview. https://www.ecb.europa.eu/paym/target/pontes/html/index.en.html ↩

[5]: European Central Bank. (2026-03-24). Pontes Pilot – Service Description Document (SDD) & User Requirements Document (URD). Eurosystem Market Infrastructure and Payments. https://www.ecb.europa.eu/paym/target/target-professional-use-documents-links/pontes/shared/pdf/ecb.pontes260324_SDD.en.pdf ↩

[6]: European Central Bank. (2026-03-11). Update on the Eurosystem work on new technologies for wholesale central bank money settlement. ECB Press Release. https://www.ecb.europa.eu/press/pr/date/2026/html/ecb.pr260311~14ddf51a77.en.html ↩

[7]: Bank for International Settlements. (2026-07). Project Agorá: Progress update on real-value testing and wholesale cross-border payments. BIS Innovation Hub. https://www.bis.org/project/agora ↩

Originally published by Luminale Fintech Observer: https://luminale.cn/articles/from-pontes-to-appia-rebuilding-cash-leg-for-tokenised-securities-en