The Pledge · Essay 01 of 04 · 4 November 2026
The Twin as Collateral
Title versus receipt, under a pledge
The Cash Leg asked whether the token still substitutes for money. The Plant asked what has to exist in the world first. This series asks what the token is for, once it exists. The unused field on the tape is Pledge.
Most institutional tokens are not a new asset. They are a twin of an asset already held on a register, issued so that the twin can be pledged without moving the original.
1. The claim, stated plainly
Public discussion of tokenisation usually begins with the token and asks what it is. This essay begins elsewhere, with what the token is for in the institutional designs now being built. In the principal institutional cases, the answer is narrower than the rhetoric suggests. The token is a second representation of an asset whose legal record remains where it was. It is issued so that the representation can travel, and be pledged, while the original stays still.
This is a claim about market structure, not about ontology. It does not say that a token cannot be the asset. It says that the arrangements being built at scale by established infrastructure providers treat the token as something other than the asset: a twin, a receipt, a representation that carries the same rights by agreement and by operation of rules rather than by being the record itself.
The claim is now testable against a live system. On 28 October 2026 DTC launched its Tokenization Service in production. It mints tokenised representations, “digital twins”, of securities already held at DTC. The underlying assets remain on DTC’s books. The first limited-production trades in July 2026, involving more than thirty firms, included collateral pledges, securities lending, Treasury and repo delivery-versus-payment, equity delivery-versus-payment and delivery-versus-delivery, and central counterparty margin workflows. Collateral mobility was among the first operational uses.
The essay proceeds in six steps: why collateral rather than trading is the natural first use; the two readings of a token, as register and as receipt; the design of the DTC Tokenization Service; what a pledge requires of any twin; the stress test when twin and register diverge under a pledged exit; and the strongest objections. It does not catalogue tokenised funds.
2. Why collateral comes first
The case for trading-first tokenisation rests on speed: shorter settlement cycles, atomic delivery against payment, round-the-clock markets. These are real attractions, but settlement for US equities and many other securities has already moved to a one-day cycle, and the marginal gain from further compression is modest for most participants.
Collateral is different, for four reasons.
First, collateral is a scarcity problem, not a latency problem
Margin requirements for cleared derivatives, uncleared derivatives, repo and securities financing create standing demand for high-quality assets. The relevant constraint is whether an eligible asset can be mobilised to the right counterparty or central counterparty at the right time, often across jurisdictions and across cut-off times that do not align.
Second, collateral movements are frequent, rule-bound and low in discretion
A margin call is a defined obligation with a defined remedy. This makes it a better candidate for automation than discretionary trading, where price discovery, liquidity and investor protection issues dominate.
Third, the incumbent infrastructure for collateral is fragmented
Assets sit in different depositories and custodians, each with its own operating hours, messaging standards and eligibility rules. Moving an asset from one location to another to meet a call can be slow or impossible within the window available. A representation that can move on a shared ledger, while the underlying holding stays put, addresses that problem directly.
Fourth, collateral use does not require the market to change its view of ownership
A pledge, unlike a sale, leaves the pledgor as the owner in economic terms. Regulators, depositories and issuers can therefore support collateral use without resolving every question about the legal status of a tokenised security in trading.
The last point matters most. A trading-first model asks the market to accept a new record of ownership. A collateral-first model asks the market only to accept a new means of mobilising an existing record. The second request is easier to grant, and that asymmetry explains much of the sequencing observed in practice.
DTCC’s own public framing is consistent with this ordering. The October 2026 launch announcement described the service as supporting “greater liquidity, collateral mobility and capital efficiency.” The July production trades tested precisely the workflows that constitute collateral use: pledges, securities lending, repo-style delivery-versus-payment, and CCP margin. Broader secondary trading was not the primary stated objective of the initial production environment. A related infrastructure layer, the DTCC Collateral AppChain, is planned for the first quarter of 2027 and is explicitly designed for near-real-time collateral management across markets and chains.
Institutional tokenised money-market and Treasury funds have found some of their clearest use as margin or collateral assets. Several infrastructure initiatives are framed around collateral mobility. Volumes vary widely, and some published figures are self-reported. The argument does not depend on any particular volume; it depends on where the design effort is directed.
3. Two readings of a token: register or receipt
The vocabulary of tokenisation tends to blur a distinction that matters greatly under a pledge. A token can stand in one of two relations to the asset it refers to.
Token as register
The token is the record of ownership. Transferring the token transfers the asset. There is no other authoritative record; if the ledger and some other record disagree, the ledger prevails by law or by rule. Native digital issuance, where the security is created on the ledger, aspires to this model.
Token as receipt
The token is a representation of an asset whose authoritative record is held elsewhere, typically on the books of a depository or issuer. Transferring the token transfers a claim against, or an entitlement derived from, the holding that backs it, according to the rules of the programme. The legal record does not move.
The terms title and receipt in this essay’s subtitle track this distinction. A title is the thing itself; a receipt is evidence of, or a claim to, the thing.
| Dimension | Token as register | Token as receipt (twin) |
|---|---|---|
| Authoritative record | The ledger entry itself | The depository or issuer’s books |
| Effect of transfer | Transfers the asset | Transfers a claim or entitlement under programme rules |
| Dependency | None beyond the ledger’s integrity | On the operator’s performance and reconciliation |
| Insolvency of intermediary | Residual or irrelevant | Central question: can the secured party reach the underlying? |
| Typical institutional use for existing assets | Rare at scale for widely held securities | Dominant design for mobilisation |
The distinction determines which questions a lawyer, a risk officer or a regulator must ask: where the authoritative record sits; who the obligor is; what happens in default of the intermediary; and which law governs the transfer. This essay’s contention is that, in collateral-first designs, the token is deliberately a receipt, and that this is a feature of the design rather than a limitation.
4. The DTC design as a case
The tokenisation service launched by DTCC for assets held at DTC provides a useful reference point because DTC is the central securities depository for the bulk of US market securities (more than $114 trillion in assets under custody) and because the design is stated in unusually direct terms. As publicly described, including in the SEC staff no-action letter of 11 December 2025, the service allows entitlements to eligible DTC-custodied assets to be represented as tokens on approved blockchain networks. The authorisation covers constituents of the Russell 1000, exchange-traded funds tracking major indices, and US Treasury bills, notes and bonds. At commercial launch on 28 October 2026 the service supported 34 securities across those categories, with twenty DTC participants having signed agreements. Networks at launch were the Canton Network and DTCC’s private Besu network. The no-action position is time-limited to three years from launch.
Three features of the design are structurally significant.
The legal record stays at the depository
The asset remains on DTC’s books. Securities continue to be registered in the name of DTC’s nominee, Cede & Co. Participants hold entitlements through DTC in the ordinary way. The token does not replace this record. When a position is tokenised, the securities are moved into a Digital Omnibus Account on DTC’s central ledger and cannot be moved by ordinary instruction until the matching token is burned. Official books and records for tokenised positions are maintained by LedgerScan, an off-chain system that reads the underlying blockchains in near real time. The blockchain is where the token moves; DTC’s scan of it is what counts as the official record.
The token is a representation that keeps the same ownership rights
Public descriptions stress that the tokenised entitlement carries the same rights as the conventional one: the same ownership, the same investor protections, the same entitlement to corporate-action proceeds, and the same CUSIP. DTCC has described the tokens as “digital twins” that retain the ownership rights, investor protections and economic entitlements of their traditional counterparts. The token is described as a different form of the same entitlement, not a different entitlement. Conversion between traditional and tokenised form is effected by mint and burn operations controlled by DTC.
Movement is mediated by the depository’s rules
Transfers of the token between registered wallets are reflected in LedgerScan and constitute settlement for those transfers, without a conventional T+1 cycle for the on-chain leg. Peer-to-peer transfers are available 24/7 on the same chain. Conversion between chains, or between traditional and tokenised form, operates within defined hours (reported as 2 a.m. to 6 p.m. Eastern Time on business days). DTC retains technical ability, via a root wallet, to reverse or control tokens under conditions requiring reversal. The depository operates the bridge between the two representations and is responsible for keeping them aligned.
This is the architecture of a twin. Two representations exist; one is authoritative; the other travels; and an operator is responsible for reconciling them. The design does not require the market to accept that a blockchain entry is a security. It requires the market to accept that a blockchain entry is a reliable, rule-governed representation of a security whose status is unchanged. Uniform Commercial Code Article 8 continues to apply; DTC continues to act as securities intermediary for the tokenised entitlements.
A further operational detail illustrates the twin character and its present limits. Under the no-action framework, DTC does not give tokenised entitlements collateral or settlement value when calculating a participant’s net debit cap or collateral monitor. The token can be mobilised for external collateral uses, but it does not yet function as collateral inside DTC’s own risk system.
The point is not unique to DTC. Other infrastructure and bank-led initiatives for tokenised collateral follow the same logic: a conventional holding remains in custody, while a digital representation is used to mobilise value across venues or to settle margin. Each such programme must answer the same question about the relation of twin to original.
It shows that the leading institutional design places the register first and the token second. It does not show that this ordering is permanent, nor that every institutional programme is built this way. Native issuance exists and is growing in specific segments. The argument is that where the aim is mobilisation of existing, widely held assets, the twin model is the dominant approach.
DTCC Tokenization Service timeline
| Date | Event |
|---|---|
| 11 Dec 2025 | SEC staff no-action letter authorising the service for three years from launch |
| 4 May 2026 | Timeline announced: limited production trades in July, commercial launch in October; industry working group of more than 50 firms |
| 15 Jul 2026 | Limited production trades, more than 30 firms, including collateral pledge, securities lending, Treasury and repo delivery-versus-payment, equity delivery-versus-payment and delivery-versus-delivery, and CCP margin |
| 28 Oct 2026 | Commercial launch: 34 securities, 20 participants, Canton and Besu networks |
| Q1 2027 (planned) | Collateral AppChain for near-real-time collateral management |
5. What a pledge requires of a twin
A pledge is a security interest in an asset, given to secure an obligation. Its usefulness depends on four properties, each of which a twin must preserve.
Creation and perfection
The secured party must obtain an enforceable interest, typically by control, possession or registration, so that the interest is effective against third parties and in insolvency. In US law, control is generally the route to perfection and priority for securities held through an intermediary under the Uniform Commercial Code. In the DTC design the token represents a security entitlement for which DTC remains the intermediary; control of the token is therefore control of an entitlement whose ultimate record sits at DTC.
Priority and uniqueness
The same asset must not be pledged twice to different parties without the second pledge being visibly subordinate or impossible. In a conventional register, this is solved by the register’s singularity. In a twin model, two records exist, and the system must ensure that the register does not recognise a pledge inconsistent with the one carried by the token, and vice versa. The DTC omnibus lock and burn requirement are technical measures directed at this problem.
Substitution
Collateral arrangements commonly allow the pledgor to withdraw pledged assets and replace them with others of equivalent value. This is the mechanism that makes collateral reusable and efficient. Substitution requires that the pledged asset can be released cleanly and returned to the pledgor’s free holding, and that the replacement can be taken in at the same time.
Enforcement and exit
On default, the secured party must be able to realise the asset: to sell it, to take title, or to have it transferred to its own account. On non-default release, the asset must return to the pledgor. In both cases, the end state must be a clean holding on the authoritative register.
A twin that can be created, transferred and traded on a ledger, but cannot be reliably exited into a clean register position, is a weaker form of collateral than the asset it represents. Everything above is a test of exit.
| Pledge requirement | What the twin must deliver | DTC design feature |
|---|---|---|
| Creation / perfection | Enforceable interest, typically by control | Token represents a security entitlement; control of a registered wallet |
| Priority / uniqueness | No undetected double pledge | Omnibus lock; burn required before register movement |
| Substitution | Clean release and replacement | Mint and burn conversion under DTC control |
| Enforcement / exit | Realisation, or return to a clean register position | Burn restores the position to an ordinary DTC account; LedgerScan is the official record |
6. The stress test: when twin and register diverge
The proposition that anchors this essay can be stated as a conditional: if the twin and the register diverge under a pledged exit, substitution has already failed.
The reasoning is straightforward. Substitution is the operation by which a pledged asset is released and another put in its place. It presupposes that the pledged asset can be identified with certainty, that the party releasing it has the right to do so, and that the register will recognise the release. If the token says one thing and the register says another, at least one of these presuppositions has failed, and the substitution cannot be completed on the terms the parties agreed.
Divergence can arise in several ways: a token transfer that is not promptly mirrored on the register; a register event, such as a corporate action, a freeze or a legal hold, that is not reflected on the token; a double pledge across the conventional and tokenised channels if locking is incomplete; failure of the operator or the bridge itself; and timing mismatches between continuous ledger operation and business-day conversion windows. In the present DTC design, full 24/7 mobility is limited to intra-chain transfers; cross-chain and form conversion remain on a restricted clock. In each case the failure is of the relation between two records, not of the token as technology. A trade that fails to settle can be retried. A pledge that cannot be exited cleanly has already failed in its function. The quality of a twin model is therefore best measured at exit, not at issuance.
7. Registers, receipts and the reconciliation burden
The twin design shifts the burden of integrity from singularity to reconciliation. A single register is internally consistent by construction. Two records are consistent only if some process makes them so.
Three approaches to that process can be distinguished.
Operator-controlled synchronisation
The depository operates both records, or controls the bridge, and guarantees equivalence by rule. This is the DTC model: LedgerScan, factory mint and burn, and the omnibus account. Its strength is that a single accountable party stands behind the relation. Its weakness is that the party becomes a point of concentration, and that the integrity of the twin depends on the operator’s systems and solvency.
Legal supremacy rules
The programme’s rules or the governing law state which record prevails in the event of divergence. If the register prevails, the token is a receipt in the strict sense: a claim to what the register says. If the ledger prevails, the token is closer to a register. A clear rule reduces uncertainty; an unclear or untested rule is a source of risk. In the DTC design the official books and records for tokenised positions are those maintained by LedgerScan; the chain is the movement layer.
Technical locking
Smart-contract or protocol-level mechanisms prevent actions on one record that would be inconsistent with the other. Their reliability depends on the completeness of the integration and on how they behave under exceptional conditions. The omnibus lock is one such mechanism.
None of these is sufficient alone. A credible twin model combines them: an accountable operator, an explicit hierarchy between records, and technical controls that make inconsistent states difficult to reach. The cost of this apparatus is not trivial, and it is a cost that a register-native design would avoid. That is the central trade-off.
8. Objections and alternatives
A balanced account should state the strongest objections to the claim.
Objection 1. Trading-first is already happening
Tokenised equities, funds and bonds trade on various venues, and some are issued natively.
Response. The claim concerns institutional designs by established infrastructure and the main locus of their effort, not the existence of any trading activity. Many current tokenised instruments are small in scale, confined to specific jurisdictions or investor classes, or structured as derivatives or wrappers. The DTC service’s first production trades were collateral and financing workflows; broader trading remains on the later roadmap.
Objection 2. The twin is transitional
If the model is a bridge to native issuance, the register-first view describes a passing phase.
Response. This is plausible. The transition may be long: a large stock of securities will remain on conventional registers, and the twin is how that stock is mobilised. Even under native issuance, a pledge will still require a record of encumbrances.
Objection 3. Twins reintroduce the problems tokenisation was meant to solve
A receipt against a register adds a layer rather than removing one.
Response. This is a fair criticism. The justification for the twin is feasibility, not elegance: it is the version existing law, custodians and regulators can accept without comprehensive reform. Net benefits depend on whether mobility gains exceed the costs of reconciliation and concentration. The DTC design preserves the existing indirect holding system under UCC Article 8.
Objection 4. The legal question is overstated
Contract and market practice can resolve divergence.
Response. Contract can allocate loss between parties, but insolvency and third-party priority are matters on which contract has limited reach. The cases that matter most for collateral are those that cannot be settled by the parties alone. The DTC no-action relief is limited, time-bounded and non-binding on the Commission.
9. What would count as evidence
The claim can be tested. The following observations would support or undermine it.
Supporting. Pilot and production programmes designed by depositories and large custodians continue to keep the legal record at the depository, and publish rules that state a hierarchy between register and token. Collateral mobility, not secondary trading, is the primary stated use case. Regulators grant relief or approvals framed around collateral, margin or financing use before broader trading use. The DTC service’s design and its July 2026 production trades are consistent with this pattern.
Undermining. Major depositories begin issuing natively on a ledger, with the ledger as the sole record for widely held securities. Secondary trading in tokenised forms grows faster than collateral use in measurable volume. Regulators approve trading venues for tokenised securities without any collateral-related precondition.
Revealing. The first publicised cases of divergence under stress, whether a failed substitution, a disputed priority or a halted bridge, and how courts and operators resolve them. These would show which readings of the token the law will actually support.
The last category is the most informative. The twin design is, in effect, a bet on the reliability of the relation between two records. Until that relation has been tested under adverse conditions, the design’s quality is a matter of specification and not of experience.
10. Conclusion
The institutional tokenisation of existing assets is better understood as an extension of the collateral system than as the birth of a new trading system. The principal designs keep the legal record where it is and issue a representation that can be mobilised. That choice reflects the nature of the demand: collateral is scarce, its movements are rule-bound, and a twin allows mobilisation without requiring the market to revisit its settled view of title.
The DTC Tokenization Service, now in production, is the clearest current illustration. The asset stays at the depository; the token is a digital twin that carries the same rights; movement is reconciled by the operator; and the first operational uses tested were collateral and financing workflows. The design’s risk lies in the relation between twin and register. A pledge is the use that tests this relation most severely, because it requires a single, enforceable answer to the question of who holds what, at the moment of release, substitution or default. If the twin and the register diverge under a pledged exit, substitution has already failed, and with it the premise on which the twin was issued.
Whether a token is a register or a receipt is not a philosophical question about what tokens are. It is a question about which record prevails when the two disagree. The answer, in the designs now being built, is the register, and the consequences of that answer are the subject of the essays that follow.
Next in the series, 11 November.
Note on sources
Descriptions of the DTC Tokenization Service reflect public announcements and regulatory materials available as of early November 2026, including the DTCC launch release of 28 October 2026, the July 2026 production-trade record, and the SEC staff no-action letter of 11 December 2025. Scope, timelines and operational details should be verified against current primary sources. This essay is analytical and does not constitute legal or investment advice.
Principal sources
DTCC, “DTCC Tokenization Service Goes Live,” press release, 28 October 2026.
DTCC, live production trades using DTC-tokenised assets, 15 July 2026.
SEC Division of Trading and Markets, no-action letter to The Depository Trust Company, 11 December 2025.
DTCC, “Paving the Way to Tokenized DTC-Custodied Assets,” press release, 11 December 2025.
DTCC, research on tokenised collateral and the Collateral AppChain, 13 May 2026.
Contemporary reporting and analysis of the 28 October 2026 launch, including Ledger Insights and CoinDesk, and the Sidley Austin note on the December 2025 no-action letter. Those accounts are secondary. The primary documents above are the record.