On a Tuesday morning in late March, I pulled the on-chain transfer logs for the three largest tokenized Treasury products. Combined assets: somewhere north of $2.4 billion. Combined on-chain transfer volume over the trailing thirty days: under $90 million. That is a turnover ratio of roughly 3.7% per month. The primary dealer market in U.S. Treasuries clears a multiple of outstanding float every week.
The tokenization is real. The trading is not.
This gap โ between the size of the assets issued and the frequency with which the tokens actually move โ is the thing nobody in the press-release economy wants to discuss. When the Chairman of the Commodity Futures Trading Commission says he endorses mass tokenization to transform markets, the headline writes itself. The ledger tells a different story. I have spent the better part of a decade reading ledgers, and ledgers are never impressed by endorsements.
So let me be precise about what was said, what it technically implies, and where the code โ or the absence of it โ creates the real risk.
Here is the raw signal, stripped of amplification. The CFTC Chairman, Selig, publicly endorsed mass tokenization as a mechanism to transform financial markets. Three claims sit inside that sentence, and only three. A regulator with jurisdiction over commodity futures, options, and derivatives thinks tokenization is directionally good. The ambition is mass โ scale, not a pilot. And the outcome is conditional: it depends on the evolution of the regulatory framework.
That last clause is the most important one and the least quoted.
The CFTC is not a market participant. It does not issue tokens, custody assets, or settle trades. It sits at the top of the industrial chain as a gatekeeper โ the institution that decides whether a category of activity is legally permitted to scale. When a gatekeeper speaks, the market hears permission. What it actually receives is a conditional.
Now the background the brief omits, because a news brief omits everything technical. Tokenization in the institutional sense means converting a claim on an off-chain asset โ a Treasury bill, a money market share, a commodity, a fund interest โ into a cryptographic token whose ownership is recorded on a distributed ledger. The issuance half of this is solved. It has been solved since roughly 2019. You can mint a compliant security token today using ERC-3643 or ERC-1400, with on-chain transfer restrictions, an allowlist registry, and a claim-issuer topic that enforces KYC at the token layer. I audited an early version of one of these registries back in 2018. The mint function worked. It always worked.
The settlement half is not solved. And settlement is where the money actually is.
Let me walk the stack the way I walk a contract โ function by function, because the abstraction hides the failure modes.
Layer one: issuance. A transfer agent, usually a regulated entity in the U.S., receives a subscription, verifies the investor against an allowlist, and mints the corresponding balance. The allowlist is an on-chain mapping updated by an admin key. There is no decentralization here. There is a regulated intermediary with a signing key. That is not a criticism. It is the design. A tokenized Treasury is a bearer instrument with a permissioned transfer function.
Layer two: transfer. Here the first real friction appears. Compliant security tokens restrict transfers at the contract level. When you call the transfer function, the contract checks whether the sender is allowed, whether the recipient is allowed, whether the transfer violates a lockup, a jurisdiction rule, or a holding-period constraint. These checks are necessary for legal compliance and expensive to execute. Each transfer can cost several hundred thousand gas. On a congested block, that is real money.
Cost is not the interesting problem, though. The interesting problem is that a permissioned transfer function reintroduces the trusted party the architecture was supposed to remove. The allowlist has an admin. The admin can freeze. The admin can, depending on the implementation, seize. If you have ever wondered what centralization risk means in practice, it is not the validator set. It is the multisig that holds the whitelist-admin role. Entropy wins. Always check the fees โ and always check who holds the upgrade key.
Layer three: settlement. This is the layer the Chairman's statement is really about, whether he knows it or not. And the math here is unforgiving.
Traditional securities settlement is T+1. The U.S. moved to T+1 in May 2024. A trade executed Monday settles Tuesday. During that window, buyer and seller are each exposed to the other's credit. That exposure is managed by clearinghouses, which mutualize the risk and post margin.
Tokenized settlement promises atomic delivery-versus-payment. The token moves and the cash moves in the same transaction, or neither moves. No counterparty window. No clearinghouse margin. The theoretical elimination of settlement risk.
Here is the IF/THEN the press releases skip.
IF settlement is atomic on a single ledger, THEN both legs must live on that ledger. Cash must be tokenized too. You cannot atomically settle a token against a wire transfer, because the wire settles on Fedwire โ a different system with a different finality clock. The moment you bridge two settlement systems, you reintroduce the counterparty window you were trying to eliminate.
This is not hypothetical. It is the central engineering constraint of the entire tokenization thesis, and it is almost never discussed in policy discourse. The CFTC Chairman can endorse mass tokenization. He cannot tokenize the dollar. That is the Federal Reserve's decision, and the Fed has been โ let me be diplomatic โ measured. FedNow is not a blockchain. A tokenized money market fund that settles against a tokenized Treasury on the same chain is a closed loop. The moment that loop touches real cash, it opens.
Let me quantify. Suppose a $500 million tokenized repo book. Suppose the cash leg settles on a 90-minute delay through a correspondent bank. During those 90 minutes the book carries unsecured exposure of $500 million times the probability of counterparty default over the window. At a baseline default intensity of 40 basis points annualized โ optimistic for some of the entities that want to play here โ the expected loss per settlement is roughly 500 million times 0.0040 times the fraction of a year represented by 90 minutes, or about $342.
Per settlement. Multiply by daily settlement volume. Multiply by 250 trading days. The clearinghouse existed to absorb exactly this. Remove the clearinghouse without removing the two-system latency, and you have not removed the risk. You have moved it onto the balance sheet of whoever holds the open leg.
That is the number the endorsement does not contain.
Layer four: the oracle. A tokenized asset needs a price. A tokenized fund share needs a NAV. The NAV comes from off-chain accounting โ the fund administrator computes it, usually once a day. That number has to get on-chain. It gets there through an oracle, which is a trusted feed, which is a single point of failure with an economic attack surface.
I spent two weeks in August 2021 simulating EIP-1559 fee market dynamics, and the lesson generalizes: any system with a privileged update path has a non-linear failure mode under stress. The oracle is the privileged update path of the tokenization stack. If the NAV feed lags, arbitrageurs pick off the stale price. If the NAV feed is wrong, the mint and redemption functions execute at the wrong price, and the loss lands on the remaining holders. This is impermanent loss in a different costume. Impermanent loss is real. Do your math โ and when the LP is a fund administrator pushing a price every 24 hours, the loss is not impermanent. It is realized the moment someone front-runs the update.
There is a deeper point. In traditional finance, trading ahead of a stale NAV is called late trading. It is illegal, and it is enforced. On-chain, it is a function call. The smart contract does not know the difference between an informed redemption and an uninformed one. It executes the math. So either you close the redemption window around the NAV update โ reintroducing batch settlement, the thing you were trying to escape โ or you accept the leak. There is no third option at the protocol level. The third option is a gatekeeper with discretion, which is the traditional system you left.
Layer five: interoperability. Tokenized assets will not live on one chain. They will live on Ethereum, on the L2s, on permissioned chains like Canton, and on whatever institutional chain comes next. Moving value between them requires a bridge, and every bridge is a trust assumption wearing a marketing budget. Different message-passing protocols, same question: who validates the message, and what happens when they are wrong?
The Wormhole exploit cost $326 million. Ronin cost $624 million. Nomad cost $190 million. These were not exotic zero-days. They were access-control and validation failures in code that had been audited. If institutional tokenized assets start flowing across bridges, the bridge becomes the most valuable attack target in the system, because it aggregates custody of assets that are, by definition, legally recognized property.
Here is the Layer2 angle, since that is my day job. The institutional tokenization thesis assumes a settlement layer with strong finality and predictable fees. Ethereum L1 has neither, consistently. It has probabilistic finality that improved after the Merge but still reorgs under extreme conditions, and it has fees that spike by an order of magnitude during congestion. L2s offer better fee predictability but introduce their own finality delays. The withdrawal challenge period on an optimistic rollup is seven days โ seven days longer than T+1. A zk-rollup compresses that, but proof generation cost and recursion depth create their own latency floor. I spent five months in 2025 verifying the soundness proofs of a leading zk-rollup, and I found an edge case in the recursive SNARK verification โ a state-derivation attack that was theoretical but not impossible. The point is not that the system is broken. The point is that instant settlement is a marketing term. Every settlement layer has a finality clock, and none of them is zero.
Let me put the fragmentation problem in numbers, because it is the second-order effect nobody models. There are now, by my count, more than fifty production L2s and app-chains competing for institutional settlement flow. The value that could plausibly move to tokenized rails within three years is measured in the low trillions. Split that across fifty venues and you average tens of billions per venue โ which sounds large until you model liquidity depth. Order book depth scales sub-linearly with venue total value locked. A $500 million tokenized Treasury position on a venue with $20 billion locked might face 30 to 50 basis points of slippage to exit in a single day. That is worse execution than the traditional market it is supposed to replace.
This is the same disease I diagnosed in the L2 wars. Dozens of rollups, the same small pool of real users, each fragmenting the liquidity that made the whole thing work. Tokenization will reproduce the pattern at institutional scale unless the settlement layer consolidates. Nothing in the CFTC's endorsement addresses consolidation, because regulators do not choose technical winners. They choose legal categories.
Layer six: jurisdiction. Tokenized assets do not have a single regulatory character. They inherit the character of the underlying. A tokenized Treasury bill is, under the Howey analysis, probably a security โ an investment of money in a common enterprise with an expectation of profit from the efforts of the issuer, at least during initial distribution. A tokenized commodity โ a claim on gold, or a physically settled futures position โ falls closer to the CFTC's remit. A tokenized derivative is squarely a CFTC product.
So when the CFTC Chairman endorses mass tokenization, he is endorsing a category that, in its largest and most liquid segment โ Treasuries, money market funds, fund interests โ sits mostly on the other side of the jurisdictional line. The brief's silence on the SEC is not an oversight. It is the whole story. Two agencies, overlapping mandates, a boundary contested since at least 2018, and a market that cannot scale without a single answer to the question of who approves this.
The practical consequence for builders is brutal. If you are building a tokenized asset platform in the U.S., you are building for a regulatory map still being drawn. The market-structure legislation that would resolve it has been in committee for years. Until it passes, the compliance function of any tokenization platform is a set of legal opinions, not a set of rules. Legal opinions do not scale. Rules scale.
The clearinghouse is the most misunderstood institution in this debate, so let me price it. A central counterparty does three things: it novates trades so each side faces the clearinghouse instead of each other, it nets offsetting exposures across a member's book, and it holds a default fund sized to survive the failure of its largest member under stressed conditions. That default fund is not free capital sitting idle. It is the price of mutualized risk, and it is priced into every trade.
When tokenization advocates say atomic delivery-versus-payment eliminates the need for a clearinghouse, they are describing a world where each trade is gross-settled, bilateral, and pre-funded. That world exists. It is called gross delivery-versus-payment, and it is capital-inefficient by construction, because every participant must hold the full notional in liquid form at all times. The clearinghouse exists precisely because gross bilateral settlement is expensive. It compresses. It nets. It frees capital.
So the tokenization thesis contains a hidden trade. You gain the elimination of the counterparty window. You lose the capital efficiency of netting. For a market that runs trillions in daily volume, that trade is not obviously favorable. The right answer is probably a hybrid โ tokenized settlement for the tail of the market that benefits from 24/7 gross settlement, and netted clearinghouse settlement for the high-volume core. But nobody is selling the hybrid, because the hybrid does not fit on a slide. It is a spreadsheet, and spreadsheets do not trend. Entropy wins. Always check the fees โ and in this case, check the capital charge.
Let me also price the compliance layer, because it is where the marginal economics actually bite. A permissioned token requires, per transfer, a check against an allowlist, a check against jurisdictional rules, potentially a check against holding-period constraints, and an audit trail. In the traditional system, most of this is handled at the account level once, not at the trade level every time. The account is onboarded, verified, and then trades freely within its entitlements. On-chain, if the enforcement is at the token layer, the check runs on every transfer.
That is a structural cost inversion. The traditional system amortizes compliance over an account's lifetime. The on-chain system, if implemented naively, re-prices compliance on every movement. At institutional volumes, that is not a rounding error. It is a line item that grows with activity โ which means the more successful the token is, the more the compliance cost scales. You have built a system where success is punished. The fix is to push enforcement off the token layer and into the account layer โ which is exactly what the traditional system does โ but then you have reinvented the account, and the token becomes a receipt. That is fine. It is honest. It is just not the revolution. It is a receipt with better hours.
Now the incentive parallel, because I have watched this movie before. In 2020, during DeFi Summer, every protocol discovered that liquidity mining could manufacture total value locked. Emit a governance token and the chart goes vertical. Stop the emissions and the chart reverts to the mean, because most of that capital was mercenary. The yield was the product. The protocol was the subsidy.
Tokenization has a structural cousin. The growth of tokenized assets is currently subsidized by a yield differential and narrative momentum. Institutions park in tokenized Treasuries not because the on-chain rails are better โ the turnover data above says they are not โ but because the yield is competitive and the optics are forward-looking. If the yield differential closes, or the narrative cools, the assets stay and the activity does not. Same pattern: headline assets grow, on-chain velocity flatlines. The tokenization is the subsidy. The settlement is the product. And the settlement does not yet exist at scale.
The FTX lesson belongs here too. I spent four months in 2022 and 2023 reverse-engineering FTX's withdrawal engine. What I found was not a smart-contract bug โ there was no smart contract. It was a database with a user interface. The balances users saw were rows in an internal ledger the operator could write to at will. The collapse was not a failure of cryptography. It was a failure of custody architecture disguised as a technology company.
Tokenization, done badly, reproduces this exactly. If the token is a claim on an off-chain asset held by a custodian, and the custodian's books are the real ledger, then the on-chain token is a mirror of an internal database. The mirror can be accurate. It can also be a lie. A regulatory endorsement does not audit the custodian. It does not verify the reserves. It says the category is welcome. Welcome is not the same as verified.
This is why the trustless framing of tokenization is wrong at the root. A tokenized Treasury is not trustless. It is trust-minimized at the cryptographic layer and fully trusting at the custody layer. The chain guarantees that the token moved. It guarantees nothing about whether the asset behind the token exists. That guarantee comes from the custodian, the auditor, and the regulator โ three off-chain entities, each with its own failure mode.
Now let me define what mass would actually require, because the word is doing a lot of unexamined work. For tokenization to be mass, three conditions must hold simultaneously. A settlement asset that is legal-tender equivalent and lives on the same ledger as the securities. A finality guarantee faster than T+1 that is legally recognized. A consolidated venue with enough depth to absorb institutional order flow. Today, condition one is partially met by stablecoins โ but stablecoins are not legal tender and carry issuer credit risk, which is precisely the risk you were trying to remove. Condition two is met by no public chain, because no jurisdiction has granted legal finality to a probabilistic ledger. Condition three is actively contradicted by venue fragmentation. So the honest answer to will mass tokenization happen is: not until at least two of those three conditions flip, and none of them flip because of a speech.
Let me model the timing, because vague timelines are how narratives survive. The legislative cycle for market-structure reform is measured in years. The Fed's decision on a tokenized settlement asset is measured in years. Venue consolidation is measured in cycles. The earliest credible window for anything resembling mass institutional tokenized settlement is 2028, and that is the optimistic case. The base case is that tokenization remains a high-asset, low-velocity wrapper on traditional assets through the end of the decade โ useful for collateral mobility and round-the-clock subscription windows, not for the settlement transformation the Chairman is describing.
I want to be fair to the technology, because a genuine improvement is buried in the hype. Even at low turnover, tokenized collateral has a real function: it can move between counterparties outside banking hours. A repo desk that needs to post collateral at 2 a.m. on a Sunday cannot wire a Treasury. It can, in principle, transfer a tokenized Treasury in seconds. That is a real operational gain โ round-the-clock collateral mobility, programmability of margin calls, automatic substitution.
But note what that gain is. It is an operational efficiency, not a settlement revolution. It reduces friction in the plumbing. It does not eliminate the clearinghouse, because the cash leg still settles on Fedwire. The tokenized collateral is faster. The cash is not. In a repo, the cash leg is the point. The people who understand this are the ones building collateral networks, not the ones issuing tokens. Watch the collateral networks. That is where the actual engineering is happening, and it is boring, which is why nobody covers it.
Three signals will tell you whether this is real. Watch the turnover ratio of tokenized Treasury products. If it stays under 5% monthly, you are looking at a wrapper, not a market. Watch the settlement architecture: when a platform claims atomic settlement, check whether both legs are on-chain. If the cash leg settles on Fedwire or through a correspondent bank, it is not atomic, and the counterparty window is still open. Watch the admin key distribution: if the top tokenized platforms run upgradeable proxies with small multisigs, the trustless claim is marketing. And watch the SEC. If the SEC stays silent, the CFTC endorsement is half a green light, which is no green light.
I keep coming back to 2017 because the pattern is so clean. In 2017, the pitch was that everything would be tokenized. Equity, real estate, art, your car. The tokens would be liquid, programmable, global. The technology existed โ ERC-20 shipped in 2015 and worked fine. What did not exist was a legal character for the tokens and a settlement function that meant anything. The tokens had no claim on anything enforceable, and they settled in a market with no finality guarantee and no cash leg. The boom ended because the underlying claims were empty, not because the code was broken. The code was fine. The code was always fine.
The 2025 version has the legal character โ a tokenized Treasury is a real claim on a real asset, enforceable in a real court. What it still lacks is the settlement function. The cash leg is off-chain. The finality is probabilistic. The venues are fragmented. So we have inverted the 2017 failure mode without eliminating it. Then, the claims were empty and the rails worked. Now, the claims are real and the rails are incomplete. Both are reasons to be cautious. Neither is a reason for euphoria.
Here is the angle that gets missed. The endorsement is not primarily a technology policy. It is a jurisdictional move. The CFTC's remit is commodities and derivatives. By embracing tokenization, the agency positions itself as the natural regulator for tokenized commodities and tokenized derivatives โ the two categories it already controls โ and stakes a claim in the broader fight over who governs digital assets. The silence on securities is strategic, not accidental.
If that reading is correct, then the announcement tells you less about the future of settlement and more about the institutional politics of two agencies competing for turf. That matters because the technology cannot scale without a single jurisdictional answer, and the agency that is louder is not necessarily the agency that controls the relevant assets. Treasuries and fund interests โ the largest tokenizable pool โ belong to the SEC's world, not the CFTC's.
The blind spot in the optimistic reading is the assumption that a regulator's enthusiasm accelerates adoption. It can also freeze it. Builders do not deploy capital against a contested boundary. They wait for clarity, and clarity is the one thing a contested boundary never produces quickly. Meanwhile, the market does what it always does with ambiguity: it prices the narrative, not the mechanism. 2017 vibes. Proceed with skepticism.
The tokenization thesis is directionally correct and temporally overstated. The technology that solves issuance has existed for years. The technology that solves settlement โ legal-tender cash on the same ledger, legally recognized finality, consolidated depth โ does not exist, and no endorsement creates it. Watch the Fed, not the CFTC. Watch the cash leg, not the token. And when someone tells you the markets are about to be transformed, open the transfer logs. The ledger does not lie, even when the press release does.