Wholesale CBDC Settlement
Wholesale CBDC settlement gives regulated institutions a central bank money cash leg for DLT-based securities transactions — the highest standard of payment finality recognized under PFMI Principle 9.
Definition
Wholesale CBDC settlement uses central bank money to settle DLT-based securities and payment transactions between regulated financial institutions. It is the preferred institutional cash leg because it combines programmable settlement workflows with the highest standard of payment finality. The underlying problem it solves is specific: how a regulated institution can access risk-free central bank money as the cash leg of a DLT-based trade without routing through a correspondent bank operating on a separate legacy system on a different settlement clock.
Every securities transaction has two legs: a securities leg and a cash leg. Settlement risk is the risk that one leg completes while the other does not. Delivery-versus-payment (DvP) frameworks eliminate settlement risk by conditioning the release of securities on the simultaneous delivery of funds. When DvP settlement runs across DLT infrastructure — tokenized bond platforms, digital repo networks, smart contract-based collateral management — the cash leg must also settle on the DLT rail or via a synchronized interoperability link to retain DvP integrity. Wholesale CBDC settlement is the institutional answer to which form of money can serve as that cash leg, and with what legal finality.
Why central bank money is the regulatory standard
Under PFMI Principle 9, the BIS CPMI-IOSCO framework directs financial market infrastructures to use central bank money for settlement wherever practical and available. Settlement in commercial bank money introduces commercial credit risk: a claim on a commercial bank is not risk-free. Correspondent bank failures, account freezes, and intraday liquidity stress demonstrate that the cash leg of a securities transaction carries credit exposure that central bank money does not. Wholesale CBDC settlement is the mechanism by which central banks are extending CeBM access to DLT settlement rails, satisfying Principle 9 in programmable market environments.
Why banks care now
The urgency for wholesale CBDC settlement has intensified as capital markets tokenization moves from pilot to production. Digital bond issuance volumes are growing — Siemens, EIB, and sovereign issuers across Europe have executed tokenized bonds requiring an institutional cash leg. Repo modernization initiatives are testing DLT-based intraday liquidity facilities that require programmable CeBM. Cross-border settlement inefficiencies — the correspondent banking chain that introduces overnight delays and counterparty risk across time zones — make real-time PvP settlement in central bank money a commercial priority. And as collateral mobility becomes a competitive differentiator, the ability to move tokenized collateral and settle the cash leg in real time, in CeBM, without waiting for an RTGS batch window, is shifting from aspirational to operational.
Settlement money hierarchy — cash leg options for DLT-based transactions
| Settlement medium | Issuer | Credit risk | Operating window | PFMI Principle 9 status |
|---|---|---|---|---|
| Central bank money (CeBM) | Central bank | None | RTGS hours (expanding) | Preferred |
| Commercial bank money | Commercial bank | Counterparty credit risk | RTGS hours | Acceptable where CeBM unavailable |
| Electronic Money Token (EMT) | Licensed EMI / bank | Reserve-backed, regulated | 24/7 continuous | Conditional — MiCA compliant |
| Payment stablecoin (non-EMT) | Issuer-dependent | Reserve quality varies | 24/7 continuous | Not recognized |
The three Eurosystem settlement models
Between May and November 2024, the Eurosystem conducted exploratory work on new technologies for wholesale central bank money settlement, engaging 64 eligible participants across nine jurisdictions and settling approximately €1.6 billion in central bank money through real transactions and controlled experiments. The RTGS interoperability model — linking DLT platforms to existing T2 infrastructure rather than replacing it — was the common architectural thread across all three approaches tested.
The Bundesbank Trigger Solution is the most operationally conservative model. The DLT platform generates a trigger instruction upon confirming that settlement conditions are met, transmitting it to T2 to initiate a conventional reserve account transfer. The central bank money never moves to the DLT network — it remains in T2 at all times. The trigger synchronizes the DLT securities leg with the RTGS cash movement, preserving DvP integrity without DLT-native CeBM. Settlement finality is RTGS finality, declared by T2. This model underpinned the majority of real-value transactions during the Eurosystem's exploratory work, including Siemens AG's €300 million digital bond and Slovenia's inaugural EU sovereign digital bond.
The Banque de France DL3S Full DLT Interoperability solution creates a bidirectional bridge between the DLT settlement environment and T2. Rather than a one-way trigger, DL3S maintains active synchronization between on-chain transaction state and RTGS processing state, supporting more complex settlement scenarios — including multilateral netting across DLT participants before a single net RTGS movement is triggered. Finality is still declared by T2, but the architectural coupling between DLT platform and RTGS is tighter, representing a closer approximation of the long-term integrated model.
The Banca d'Italia TIPS Hash-Link solution uses cryptographic commitment schemes to achieve atomic settlement between DLT transactions and TIPS (TARGET Instant Payment Settlement) cash movements. A cryptographic hash is derived from the settlement commitment. The DLT platform locks the securities transfer against this hash; the TIPS cash leg locks against the same hash. When both legs confirm, the hash is revealed and both transfers complete simultaneously — neither can complete without the other. TIPS operates continuously rather than within T2 business hours, making this the only Eurosystem model with a 24/7 settlement rail. However, a critical operational nuance applies: while the TIPS rail itself is continuous, the central bank money liquidity backing wholesale CBDC transactions is still largely sourced from T2 reserve accounts during RTGS business hours. Outside those hours, institutions may find that the wCBDC liquidity pool is constrained even when the TIPS rail remains technically available. This is the distinction between rail availability and settlement capacity — a 24/7 pipe through which liquidity does not always flow.
Settlement asset versus settlement rail — logical and physical finality
A structural distinction that operations teams must model correctly is the difference between the settlement asset and the settlement rail. In the Bundesbank Trigger Solution, no central bank money token exists on the DLT network. What crosses the boundary between T2 and the DLT platform is a signal: the Trigger ACK, confirming that the reserve account transfer has completed in RTGS. The DLT platform treats this ACK as the proof of settlement finality and releases the securities to the buyer. Finality on the DLT is therefore logical — the DLT recognizes settlement as complete based on the T2 confirmation signal, not because CeBM moved to the DLT network.
This logical-versus-physical distinction has direct operational implications. The T2 settlement confirmation timestamp — not the DLT event timestamp — is the authoritative finality record for books and records purposes. The on-chain securities release is settlement evidence; the T2 ACK is settlement finality. For post-trade operations teams modeling Rule 17a-3 compliance on DLT-based transactions, the Trigger ACK is the event that triggers the ABOR position update, not the on-chain DLT confirmation.
The operating window constraint
The Trigger Solution and DL3S interoperability bridge depend on T2 for the cash leg. T2 operates on defined business hours — approximately 05:00 to 18:00 CET on TARGET business days. DLT-based transactions requiring wholesale CBDC settlement via these models cannot complete outside T2 hours, regardless of what the DLT platform supports. A tokenized bond settling on a Sunday, a digital repo unwind triggered by a margin call on a public holiday, or a collateral transfer at 21:00 CET on a weekday — none of these can access T2-dependent CeBM. And as noted above, even the TIPS Hash-Link model, while operating on a 24/7 rail, faces liquidity constraints outside RTGS hours.
This operating window constraint is not a technical failure of wholesale CBDC. It is a structural feature of the current interoperability phase, where central banks have chosen to bridge DLT platforms to established RTGS rather than replace RTGS with DLT-native CeBM. The Eurosystem's February 2025 decision to expand its wholesale CeBM initiative — pursuing both a short-term interoperability offering and a longer-term integrated solution — explicitly acknowledges this constraint as a design consideration.
MiCA-regulated EMTs operating on public blockchain networks — EURC on Ethereum or Stellar, for example — carry genuine 24/7 liquidity. An institution requiring T+0 settlement of a DLT-based repo transaction on a Sunday has no T2-dependent CeBM available and no TIPS liquidity in the wCBDC pool. It can use a MiCA-compliant EMT. This is not a workaround; it is the intended architecture of a dual-rail settlement environment: CeBM where available, regulated digital cash where CeBM is not. Today, MiCA-regulated EMTs are the only settlement medium that combines 24/7 liquidity with regulatory recognition — making them operationally necessary for time-critical DLT settlement events outside RTGS hours.
The interbank perimeter and the EMT last mile
Wholesale CBDC settlement is architected for the interbank settlement layer — the net position between regulated financial institutions settling aggregate exposure in central bank money. The Bundesbank Trigger Solution, DL3S bridge, and TIPS Hash-Link all operate at this layer: Clearing Member A's T2 reserve account credits Clearing Member B's. This is where wCBDC operates. It does not reach the commercial leg: the allocation of securities to end-client accounts, the sub-account credit at the custodian, the confirmation to the buy-side fund. That leg runs outside the wCBDC perimeter.
This creates a structural two-layer settlement architecture. The interbank net settles in CeBM. The gross client leg — individual trade allocations, end-client confirmations, intraday settlement of a fund's DLT position — is where MiCA-regulated EMTs complete the ecosystem. USDC and EURC are not competing with wholesale CBDC settlement. They are settling the gross client transactions that wCBDC's interbank architecture cannot reach, and settling them 24/7 when wCBDC's operating window is closed. The ecosystem is not CeBM versus EMT. It is CeBM for interbank net settlement and EMT for gross client settlement — the last mile of a settlement chain that begins in central bank money.
Cross-border wCBDC: mBridge and PvP settlement
Cross-border securities settlement introduces a further dimension. Payment-versus-payment (PvP) settlement requires synchronized cash leg finality across two or more currency systems. The BIS Innovation Hub's mBridge project, developed with the central banks of Hong Kong, Thailand, the UAE, and China, demonstrated cross-border PvP settlement in wholesale CBDC across multiple currencies and jurisdictions, using a shared DLT coordination layer above each currency's own RTGS. mBridge is the leading proof of concept for wholesale CBDC settlement in the cross-border multi-currency context, addressing the correspondent banking chain and sequential settlement risk that conventional cross-border processing introduces.
Project Meridian FX, a BIS Innovation Hub initiative explored with the Bank of England, tested FX settlement using a synchronization approach to PvP in a two-currency wholesale CBDC context. No equivalent multi-currency CeBM settlement capability currently operates at production scale in European institutional markets, though the Eurosystem's long-term integrated solution is expected to address cross-border foreign exchange settlement.
Fnality International — the private-sector Utility Settlement Coin initiative operating as a Bank of England-recognized payment system — represents the commercial complement to central bank-operated wholesale CBDC settlement systems. Fnality's model uses tokenized commercial bank central bank reserves as a safeguarded settlement asset, seeking CeBM-like settlement efficiency through regulated structures rather than direct central bank issuance. The first live sterling transaction in the Fnality Payment System occurred in December 2023.
Why adoption remains measured
The barriers to wholesale CBDC settlement adoption are not primarily technical — the ECB's 2024 exploratory work demonstrated that DLT-CeBM interoperability is achievable at production scale. The barriers are legal, structural, and institutional. Legal finality frameworks must be updated to recognize DLT settlement records as authoritative under insolvency law, replicating the protections of the Settlement Finality Directive for DLT environments. Central banks must resolve privacy architecture — wholesale transactions must remain confidential between counterparties while satisfying AML and sanctions screening obligations. Legacy RTGS inertia creates a high bar for infrastructure migration. And the interoperability-first approach reflects a deliberate regulatory choice: preserve the safety properties of established settlement infrastructure while enabling controlled DLT adoption. The long-term integrated solution that the ECB's Governing Council committed to in February 2025 remains under design. What is certain is the direction.
Settlement money hierarchy — PFMI Principle 9
Devancore Glossary · devancore.com
How it works
Wholesale CBDC settlement operates through one of three technical models, each representing a different level of integration between DLT platforms and existing RTGS infrastructure. The model determines where finality is declared, how DvP integrity is maintained across the DLT-RTGS boundary, and whether settlement is constrained to RTGS operating hours.
1. DLT-to-RTGS trigger (Bundesbank model)
The DLT platform, upon confirming that settlement conditions are met, places the securities in a smart contract-enforced lock — a conditional hold that prevents delivery until the cash leg confirms. A trigger instruction is transmitted via an interoperability adapter to T2. T2 processes a conventional transfer between the buyer's and seller's reserve accounts, debiting one and crediting the other in central bank money. Upon confirmation, T2 issues a Trigger ACK to the DLT platform. The DLT platform receives the ACK, treats it as the proof of cash finality, and releases the securities from the conditional hold to the buyer's DLT account. The central bank money never moves to the DLT network — the ACK is the synchronization mechanism, not a token transfer. Finality is logical: the DLT recognizes settlement as complete based on the RTGS confirmation signal. The T2 settlement timestamp is the authoritative finality record, and the Trigger ACK is the books-and-records event that triggers the ABOR position update.
2. Interoperability bridge (Banque de France DL3S model)
The DL3S bridge creates a bidirectional connection between the DLT settlement environment and T2. Rather than a one-way trigger, the bridge maintains active synchronization between on-chain transaction state and RTGS processing state, handling protocol translation between DLT transaction formats and T2 settlement instructions. Complex settlement scenarios — multilateral netting across DLT participants before triggering a single net RTGS movement — are more naturally accommodated under DL3S than under the pure trigger model. Finality is still declared by T2, but the architectural coupling is tighter, and the system supports a richer set of settlement use cases.
3. Hash-link atomic settlement (Banca d'Italia TIPS model)
The TIPS Hash-Link mechanism uses a cryptographic commitment scheme to synchronize DLT and cash leg settlement atomically. A cryptographic hash is derived from the settlement instruction parameters. The DLT platform locks the securities transfer against this hash; the TIPS cash leg locks against the same hash simultaneously. When both legs confirm readiness, the pre-image is revealed and both transfers complete in the same atomic operation — neither can complete without the other. Cash finality is declared by TIPS at the moment the pre-image is revealed. Because TIPS operates continuously, this model has 24/7 rail availability. In practice, however, central bank money liquidity is largely sourced from T2 reserve accounts during RTGS hours, which can constrain actual settlement capacity outside business hours even when the rail is technically open.
4. The cash rail decision at settlement time
For institutions operating across DLT and traditional markets, the practical question is which cash leg is available for each settlement event. During T2 business hours on TARGET business days, wholesale CBDC settlement via the Trigger Solution or DL3S is the PFMI Principle 9-preferred option. Outside T2 hours, T2-dependent CeBM is unavailable, and TIPS Hash-Link liquidity may be constrained. The available cash legs at that point are commercial bank money via bilateral arrangement, or MiCA-regulated EMTs on continuous blockchain networks — the only settlement medium combining 24/7 liquidity with regulatory recognition. The routing decision depends on transaction type, counterparty capability, time of settlement, and jurisdiction-specific regulatory requirements. Where the CeBM rail is unavailable and an EMT is used, the deviation from the PFMI Principle 9 preferred medium must be documented with operating window gap as the rationale.
5. Cross-border PvP settlement
For cross-currency transactions requiring PvP settlement, both currency legs must achieve finality simultaneously or through a synchronized mechanism that prevents one leg from completing without the other. The BIS mBridge platform achieved this by operating a shared DLT coordination layer above the RTGS systems of four central bank participants — HKMA, Bank of Thailand, CBUAE, and PBoC — with each currency leg settling in its own RTGS while the shared DLT layer enforced PvP synchronization. The architecture translates the two-party DvP problem into a multi-currency, multi-RTGS coordination problem, with the DLT as the settlement synchronization backbone rather than the settlement system itself.
Eurosystem wCBDC — three settlement models
Devancore Glossary · devancore.com
Eurosystem wCBDC — three settlement models
Devancore Glossary · devancore.com
In Devancore™
Devancore settlement router — cash rail hierarchy
Devancore Glossary · devancore.com
Devancore's settlement orchestration layer is built to be money-agnostic — routing the cash leg of a DLT-based transaction to the optimal available settlement medium at the moment of settlement, whether that is CeBM via a configured Trigger Solution adapter, a MiCA-regulated EMT on a continuous blockchain network, or commercial bank funds via SWIFT. This architecture reflects the operational reality of wholesale CBDC settlement today: CeBM access is available within defined windows and on specific platforms, and operations teams need a system that routes intelligently rather than one that presupposes CeBM availability at all times.
Rail-aware settlement routing and PFMI compliance trail
For each settlement event, Devancore identifies the available cash leg options at the time of settlement — CeBM (via configured RTGS interoperability adapters), EMT (via on-chain EMT networks), or conventional funds (via SWIFT or local payment rails) — and routes to the optimal available rail. The routing decision is logged with its rationale. If CeBM is the PFMI Principle 9 preferred rail and it is available, the settlement instruction is generated accordingly. If CeBM is unavailable — due to RTGS operating window, platform incompatibility, or counterparty capability constraint — the alternative rail and the reason for deviation are recorded in the audit log. For firms subject to PFMI Principle 9 obligations, this audit trail is the operational proof of compliance: CeBM used whenever available, documented alternatives selected when it was not.
CeBM finality reconciliation — Trigger ACK to ABOR
When a DLT-based securities transaction settles via the Trigger Solution, finality is declared by T2, not by the DLT platform. Devancore receives the T2 Trigger ACK and uses it as the authoritative finality event — updating the securities position and the ABOR cash entry simultaneously at the T2 confirmation timestamp, not at the on-chain release timestamp. For TIPS Hash-Link transactions, where TIPS declares finality for the cash leg and the DLT platform confirms the securities leg atomically, both confirmations are captured with their precise timestamps in the audit log, satisfying Rule 17a-3 books and records requirements and providing the finality lifecycle evidence that examiners require.
Dynamic rail failover — USDC when CeBM is unavailable
When a wholesale CBDC settlement event falls outside RTGS operating hours — or when the CeBM liquidity pool is constrained despite the TIPS rail being technically available — Devancore initiates an automatic failover to the configured digital cash rail. The cash leg is routed to the firm's MiCA-regulated EMT settlement pathway, generating the corresponding EURC or USDC transfer instruction to the counterparty's on-chain wallet. The switching event is logged with the operating window gap as the documented rationale, the regulatory classification of the EMT alternative is confirmed against the MiCA compliance register, and the settlement completes on the EMT rail with T+0 finality. When T2 reopens, Devancore reconciles the EMT settlement against the nostro record and updates the ABOR with the correct settlement category — EMT cash distinguished from CeBM cash, both visible in the same unified position view. This failover capability means that time-critical settlement events — collateral calls, repo unwinds, margin-triggered deliveries — are never blocked by RTGS operating windows.
Hybrid cash ledger — CeBM, EMT, and nostro unified
Institutions operating simultaneously in CeBM-settled DLT markets, EMT-settled on-chain markets, and conventional SWIFT-settled markets face a reconciliation problem that does not exist in single-rail operations: three cash ledgers, three finality models, and three sets of settlement evidence that must reconcile to a single accounting position. Devancore maintains a unified cash position view that reconciles CeBM balances (T2 reserve account), EMT balances (on-chain wallet), and conventional nostro balances (SWIFT MT 940/942 or ISO 20022 camt.052/053) in a single accounting view. The settlement medium of each transaction is recorded as a field on every position entry, enabling operations teams to report separately on CeBM-settled, EMT-settled, and conventionally settled flows — the breakdown regulators and treasury teams require as wholesale CBDC settlement adoption expands and institutions operate across multiple cash rails simultaneously.