Securities and Money Must Move "Delivery Versus Payment": What Risk Does DvP Actually Prevent?

Suppose A buys bonds with a face value of 100 million yuan from B.

Once the trade is executed, two settlement obligations arise at the same time:

The securities trade is not truly complete until both legs have been completed.

When people think about securities trading, they often focus on whether the money has arrived. But in securities markets, money and securities are two different assets, usually recorded in different accounts and infrastructures. Securities are generally registered, held in custody, and settled through a central securities depository and its securities settlement system. Funds, meanwhile, are settled through commercial bank accounts, central bank accounts, or payment systems.

The challenge in securities settlement is coordinating two assets, two ledgers, and two settlement processes.

I. What Happens in a Securities Trade

Trade, clearing, and settlement are not the same stage in a securities market.

Clearing arrangements differ across markets. In some markets, a central counterparty intervenes; in others, the trading parties or their settlement agents handle the subsequent processing directly. Whatever the structure, execution does not mean settlement is complete.

Trade confirmation establishes "who agrees to buy and who agrees to sell." Settlement completion means that "the securities and money have been finally transferred according to the rules."

The securities leg is not the act of sending an electronic file. Securities settlement normally takes the form of a transfer of securities rights through account records and the applicable legal framework. Changes in the books must be consistent with ownership of rights, account control, and settlement rules.

A securities trade is not just a payment. It contains a securities leg and a cash leg at the same time. The securities leg delivers the securities entitlement; the cash leg delivers the corresponding settlement funds.

II. When the Two Legs Fall Out of Sync, Risk Emerges

If the securities leg and cash leg are not reliably linked, two situations may arise.

First, B may have irrevocably delivered bonds worth 100 million yuan to A, while A's funds have not completed final settlement.

Second, A may have irrevocably paid 100 million yuan, while B's bonds are ultimately not delivered.

One party has handed over the full value of its asset without receiving the corresponding asset. This is Principal Risk in securities settlement. ^[1][2]

Principal Risk Is Not the Same as Replacement Cost Risk

Suppose A agrees to buy an asset for 100 yuan. After the trade is executed, the counterparty defaults, and A can only buy a similar asset back from the market for 102 yuan. A's loss may then be 2 yuan, which is closer to replacement cost risk.

In another situation, A has irrevocably handed over 100 yuan to the counterparty but has not received the asset. A may then be exposed to the full 100 yuan of principal.

It would be too simple to say that the absence of DvP necessarily results in a principal loss. But when the securities leg and cash leg lack a sufficiently strong conditional link, trading participants are exposed to principal risk.

When the transaction amount is large, or when many institutions depend on the same settlement arrangement, the loss and liquidity pressure faced by one institution may spread to other settlement participants, creating a broader market impact.

III. DvP Links the Securities Leg and Cash Leg

Delivery versus Payment, abbreviated as DvP, means that the delivery of securities is made against payment. ^[2]

DvP establishes a conditional relationship: the final delivery of securities should be reliably linked to the final payment of the corresponding funds. One leg should not be allowed to complete final settlement on its own without reliable protection for the other leg.

A common implementation works as follows:

1. Lock the securities first;
2. Confirm that the corresponding payment has been completed, or that an irrevocable payment guarantee has been obtained;
3. Release the securities so that they can be transferred to the buyer.

Therefore, to determine whether a system has truly implemented DvP, we need to examine:

• When do the securities leave the seller's account?
• When do the funds leave the buyer's account?
• Have the funds settled finally, or can the payment still be revoked?
• Does the securities record already have final legal effect?
• If one leg fails, can the other leg be prevented, rolled back, or covered by a guarantee mechanism?
• What risks do settlement participants and the system operator bear during the intermediate stage?

BIS's landmark 1992 report on DvP grouped securities settlement systems into three main models. The main difference between the models is whether the securities leg and cash leg are settled transaction by transaction or on a net basis. ^[1]

Model 1: Gross Securities, Gross Cash

In Model 1, both the securities leg and the cash leg are settled gross, in full for each transaction:

When A buys 100 million yuan in bonds from B, the transaction corresponds individually to:

• B delivering 100 million yuan in bonds to A;
• A paying 100 million yuan in funds to B.

Once this trade is completed, the next trade is processed. Every securities and cash movement has a clear corresponding transaction, and the boundaries between transactions are also clear.

Model 1 is closest to the everyday idea that "one securities delivery corresponds to one payment." Its main advantage is that the settlement relationship is straightforward and the final status of each transaction is easy to confirm. The trade-off is a higher liquidity requirement.

If there are 100 trades in a day, participants may need to keep preparing securities and funds at different times instead of waiting for all trades to offset one another and then paying a smaller net amount.

Model 1 can be understood this way: every time one truckload of goods is delivered, the payment for that truckload is settled at the same time.

Model 2: Gross Securities, Net Cash

In Model 2, the securities leg is settled transaction by transaction, while the cash leg is settled net over a settlement cycle:

For example:

• A must pay B 10 billion yuan over the course of the day;
• B must simultaneously pay A 8 billion yuan.

After netting, the cash leg may require A to pay B only 2 billion yuan.

This arrangement reduces the amount of funds that ultimately need to be transferred and helps lower intraday liquidity usage. But it also creates a problem: the securities may already have been delivered transaction by transaction, while the funds must wait until the end of the settlement cycle for final net settlement.

Model 2 cannot simply be understood as "deliver the securities first and pay at night." Before the funds settle finally, there must be a reliable payment guarantee. For example, the system operator or the buyer's bank may provide an irrevocable payment commitment and control its own risk by placing a lien on the securities, taking collateral, or using another credit arrangement.

BIS's analysis of Model 2 points out that when securities are delivered before the final transfer of funds, the seller may face principal risk. A payment guarantee can reduce this risk, but the risk does not disappear; it may instead shift to the bank or system operator providing the guarantee. ^[1]

If the buyer's bank ultimately cannot honor its payment commitment, the guarantor may face credit risk close to the amount of the principal. If a participant cannot make up the net funds, the system may also face liquidity risk.

Model 2 therefore requires further questions: Who guarantees that the seller will receive the money before the funds settle finally? When does that guarantee take effect? What does the system do if the guarantor also encounters problems?

Model 3: Net Securities, Net Cash

In Model 3, both the securities leg and cash leg are settled on a net basis:

During a settlement cycle, the system first records a large number of trades and then calculates the net amount each institution ultimately needs to deliver and receive.

At final settlement, participants may need only to:

• Deliver a net amount of a particular security;
• Pay one net amount of funds.

Compared with gross settlement transaction by transaction, Model 3 can further reduce the amount of securities and funds that actually need to move, lowering liquidity requirements.

The trade-off is that more transactions become interdependent before final settlement. If an institution cannot deliver securities or pay funds, the system must handle the situation according to predetermined rules, for example:

• Recalculate the net obligations of other participants;
• Liquidate collateral;
• Draw on liquidity arrangements;
• Use a default fund or other risk resources;
• Reschedule unsettled trades;
• Assess whether the failure could cause a systemic settlement interruption.

Model 3 does not mean that a system is necessarily more dangerous, just as Model 1 does not mean that it is safer in every situation. Different models change the timing of settlement, the use of liquidity, and how risks are allocated. The ultimate level of safety also depends on collateral, credit support, liquidity arrangements, participant admission, and default-management mechanisms.

Comparing the Three Models

Here, Gross and Net describe whether settlement obligations are completed transaction by transaction or after offsetting them against one another and settling the net amount. Real-time and Deferred in payment systems, by contrast, describe when settlement takes place. The two pairs of concepts are related, but they cannot be equated directly. ^[2]

All three models can support DvP. The difference lies in how the system links the securities leg and cash leg, and who bears the risks during the intermediate period before final settlement.

IV. DvP Also Requires Settlement Finality

DvP answers the question: How are the securities leg and cash leg conditionally linked?

Settlement Finality answers the question: When do the securities and funds each complete an irrevocable, unconditional, final transfer?

These concepts do not replace each other.

The appearance of securities in an account does not necessarily mean that the securities rights have transferred finally. If the record can still be reversed because of system rules, legal procedures, or settlement failure, the interface status alone is not enough to conclude that settlement is Final.

The appearance of funds in an account does not necessarily mean that the funds have settled finally either. If the payment can still be revoked, returned, or covered by another settlement arrangement, it likewise cannot be treated as Final Settlement without further qualification.

In Model 1, securities and funds usually move transaction by transaction, so their final statuses are relatively easy to match.

In Model 2, the securities may already have settled transaction by transaction while the funds do not settle finally until the end of the cycle. A payment guarantee and other credit arrangements therefore become important links between the two legs.

In Model 3, both securities and funds may wait until the end of the cycle for net settlement. The system needs to ensure that the net settlement of both sides can proceed under the same set of conditions.

DvP can be understood as an interlock between two doors, while Finality confirms that one of the doors has truly been locked. The interlock arrangement has clear meaning only when we know what "locked" means.

DvP primarily addresses principal risk, so it should not be mistaken for a way to eliminate:

• Replacement cost risk between trade execution and final settlement;
• Liquidity risk when a participant is temporarily unable to obtain funds or securities;
• Operational risk arising from system failures, communication interruptions, and manual errors;
• Legal risk arising when legal rules, asset rights, and settlement arrangements are inconsistent;
• Market risk that may arise during default management.

V. From CSD and RTGS to Atomic DvP

In traditional securities markets, the securities leg and cash leg are usually completed in different systems.

A CSD is an institution that provides functions such as central securities depository services. It handles book-entry registration after securities are issued, securities custody, and the confirmation and registration of the rights that securities holders have against the issuer. An SSS is a securities settlement system used to process settlement instructions, lock securities, and transfer them by book entry. It links with an external payment system to implement DvP and complete the exchange of securities and funds. The organizational structures and functional boundaries of the two may differ, or related services may be provided by the same infrastructure operator. ^[2]

For this reason, DvP generally cannot require securities and funds to exist in the same database. Instead, the two systems must achieve synchronization through messaging, asset locking, payment confirmation, and conditional release.

For example:

1. The securities system locks the bonds held by the seller;
2. The cash system processes the buyer's payment;
3. The cash system returns confirmation that payment has completed or that reliable payment protection has been obtained;
4. The securities system releases the bonds and completes the transfer of the securities leg.

In this model, the two assets are still recorded in different ledgers, but the two systems establish a conditional relationship through coordination mechanisms.

What Does Project Acacia Show?

In 2026, the Reserve Bank of Australia and the Digital Finance Cooperative Research Centre published the final report of Project Acacia. The project tested 20 wholesale tokenized-asset market use cases involving assets such as government bonds, corporate bonds, repos, funds, and deposits. It also tested several types of settlement money, including: ^[3]

• RBA Exchange Settlement Account, or ESA, balances;
• Experimental wholesale central bank digital currency;
• Tokenized commercial bank deposits;
• Stablecoins.

One important finding from Project Acacia was that tokenized-asset platforms can connect to existing payment infrastructure through synchronization mechanisms to achieve DvP, without placing the securities and funds on the same ledger. ^[3]

In these use cases, a coordination relationship was established between tokenized-asset platforms and RITS, the real-time gross settlement system operated by the RBA. Assets could first be locked on the tokenized platform, while funds were settled through the existing payment system and ESA balances, after which the assets were released. ^[3]

This highlights several points:

First, putting securities on a blockchain does not mean that central bank money must also be put on a blockchain.

Second, recording securities with DLT and choosing the asset used for final settlement are two different questions.

Third, a tokenized market can continue to use existing central bank settlement accounts, or explore wholesale central bank digital currency, tokenized deposits, or stablecoins. Different settlement assets bring different credit, liquidity, access, and legal arrangements. ^[3]

In materials related to Project Acacia, the RBA noted that many of the benefits of tokenized markets could be achieved using existing ESA balances; wholesale central bank digital currency was not a prerequisite for launching a tokenized market. The key question is whether the cash leg has sufficiently reliable settlement properties and can establish an effective synchronization relationship with the securities leg. ^[4]

What Does Atomic DvP Mean?

If the securities and funds are both written into the same indivisible execution logic, this can go further and form Atomic DvP.

The basic meaning of Atomic Settlement is that multiple transaction legs either all succeed or all fail.

For example, a smart contract simultaneously controls a security token and a settlement-asset token:

• If the buyer does not have enough funds, the securities are not transferred to the buyer;
• If the securities cannot be delivered, the funds are not transferred to the seller;
• If all execution conditions are met, both transfers are completed under the same set of rules.

This arrangement can shorten the coordination chain between two systems and may also reduce manual reconciliation and intermediate states.

But atomic settlement is only the last step. Before settlement, the system still needs to address:

• Whether the security token truly represents an enforceable securities right;
• Whether the settlement-asset token has reliable issuance and redemption arrangements;
• When the ledger record acquires final legal effect;
• How the system will recover if it fails;
• What responsibilities are borne respectively by the token issuer, platform operator, and settlement participants;
• Whether the assets can be returned safely after a failed transaction.

Atomic DvP does not add a new DvP model. It changes how the two legs are coordinated, how conditions are executed, how settlement assets are connected, and whether multiple asset transfers can be written into one atomic transaction logic.

Conclusion: Three Questions Securities Settlement Must Answer

Once we move from payment systems into securities settlement systems, the focus expands from "when will the money settle?" to "when will the other asset be transferred?"

The problem can be divided into three layers:

First, how is the money settled?

This corresponds to infrastructures such as payment systems, settlement accounts, and RTGS.

Second, when can settlement be considered truly complete?

This corresponds to Settlement Finality, which requires a clear determination of when the securities and funds each become irrevocable, non-reversible final transfers.

Third, when a transaction involves both money and securities, how do we prevent one party from completing only half of it?

This is the problem DvP is designed to address.

Models 1, 2, and 3 also show that even when the goal is to reduce principal risk, the market does not have only one settlement method:

• Gross settlement provides a clear one-to-one relationship for each transaction, but requires more intraday liquidity;
• Net settlement can reduce the amount of funds and securities that actually move, but requires more complex payment guarantees, collateral, and default-management mechanisms;
• Whether securities and funds are settled gross or net is not the same question as whether settlement is real-time.

Securities settlement therefore does more than move securities and money from one account to another. It also has to determine:

• When the assets are transferred;
• When the transfer has final effect;
• Who bears the risks before final settlement;
• What happens to the other leg if one leg fails;
• Whether the settlement asset has the credit and liquidity properties required by market participants.

These questions remain in a tokenized market. The focus should not be only on whether the securities have been put on-chain, but on how the on-chain securities leg can establish effective DvP with a reliable settlement asset.

References

[1]: BIS Committee on Payments and Market Infrastructures, Delivery versus payment in securities settlement systems (1992): https://www.bis.org/cpmi/publ/d06.pdf ↩

[2]: BIS, On the future of securities settlement: https://www.bis.org/publications/future-securities-settlement ↩

[3]: Reserve Bank of Australia and Digital Finance Cooperative Research Centre, Project Acacia – Exploring the Role of Digital Money in Wholesale Tokenised Asset Markets: Final Report (May 2026): https://www.rba.gov.au/payments-and-infrastructure/central-bank-digital-currency/pdf/project-acacia-final-report.pdf ↩

[4]: Reserve Bank of Australia, Project Acacia overview: https://www.rba.gov.au/payments-and-infrastructure/central-bank-digital-currency/wholesale-central-bank-digital-currency/project-acacia/ ↩

Originally published by Luminale Fintech Observer: https://luminale.cn/articles/securities-settlement-dvp-principal-risk-en