Digital Twins in Capital Markets: Legal Certainty and Perfected Securities Interest on Canton

Tokenization stopped being an abstract concept some time ago. Over two weekends in 2025, a group that included Bank of America, Citadel Securities, Société Générale, Tradeweb, and the DTCC ran real repo trades against tokenized US Treasuries on the Canton Network, with real cash moving outside normal settlement hours.

The technology worked; what decided whether the trade could be trusted was quieter: the legal question of who owns the asset, and whether that ownership holds when things go wrong. The need for this shift is real, with stablecoins alone passing 300 billion dollars in circulation during 2025.

This article looks at what a digital twin is, why legal certainty is the real gate for adoption rather than speed, and how perfected securities interest translates onto Canton. The pilots referenced here were run by market infrastructure players and their partners, not by PixelPlex, so we write as engineers who build on Canton and Daml for clients. None of it is legal advice, and market opinion on several points is still split.

What a digital twin is (and what it is not)

The word “twin” does a lot of quiet work here, and getting it wrong is where many projects start to wobble.

The definition worth memorizing

A digital twin, in the sense that matters for capital markets, is not a marketing metaphor. It has a working definition adopted from the US Commodity Futures Trading Commission’s Global Markets Advisory Committee.

In the CFTC GMAC Digital Asset Classification Approach and Taxonomy published in March 2024, a digital twin is described as an controllable electronic record that represents an asset already immobilized on another system of record, and reconciled with that original record so that ownership is reflected precisely.

The CFTC is not the only body drawing these lines. The EU’s MiCA regime classifies digital assets too, though it leans on what a token represents, such as e-money or an asset reference, rather than on whether it mirrors something recorded elsewhere (MiCA). We use the CFTC’s language here because the twin-versus-native split is the cleanest way to reason about collateral, but the two frameworks overlap more than they conflict.

Read that slowly. The asset already exists somewhere else, usually at a traditional central securities depository or registrar. The token does not replace it. It points to the asset, mirrors it, and stays reconciled with it.

Twin versus native

The taxonomy draws a hard line between a digital twin and a digital native. A digital native is the primary record of value. It is not recorded anywhere else and needs no reconciliation, because there is no second book to reconcile against.

Bitcoin is the textbook native asset, while a tokenized Gilt is the textbook twin. The distinction is not academic, because it changes the entire legal analysis.

If the token is native, you have to build a legal framework around something that only exists in digital form. If the token is a twin, the underlying asset still sits inside a legal regime markets have used for decades, and the token is simply a better set of books.

Digital twin vs digital native

Not every tokenized bond is a twin

Not every token that tracks a Treasury is a digital twin. The label only fits when the token represents direct ownership of a specific underlying security and stays reconciled with it. Plenty of products are something else: shares in a money-market fund that holds Treasuries, tokens issued by an offshore SPV, or price wrappers that track a bond without granting the legal rights of owning it. In those structures you are a step removed from the asset, which matters enormously in a default.

The distinction turned concrete in July 2026, when the DTCC ran its first live tokenized trades in stocks, ETFs and US Treasuries with more than two dozen firms, including JPMorgan, Goldman Sachs and BlackRock. Its model converts existing securities into blockchain-based twins that keep the same ownership, dividend and governance rights, rather than minting a new asset (CoinDesk). That is the difference between a twin and a wrapper, and it is the whole point.

Why reconciliation is the hidden pillar

The reconciliation requirement is the part people skip, and it is arguably the most important word in the definition. A twin is only trustworthy for as long as it agrees with the source of record. If the token says one owner and the CSD (Central Securities Depository) says another, it is worthless as collateral, because nobody can rely on it in a dispute.

This is why a serious tokenization design spends most of its effort on the plumbing between the two ledgers rather than on the token itself. Any credible real world asset tokenization platform development effort has to answer one question first: how does the on-chain record stay provably in sync with the off-chain one at every moment of the asset’s life, including during a default? Get that wrong and the legal certainty you were chasing evaporates.

How it works on Canton

On Canton the mechanism is not a nightly batch that re-matches two databases. Because the parties share one ledger and the rules are written in Daml, everyone entitled to a transaction sees the same state at the same time, so there is nothing to reconcile after the fact (Digital Asset). The obligation does not vanish, though. Rules like MiCA and the GENIUS Act still require issuers to reconcile client assets and reserves on a set schedule, so the ledger has to produce that evidence on demand.

A worked example: tokenized gold

Gold is the sharpest illustration of why the twin model is useful. Everyone agrees gold is high value and low risk, yet it is rarely used as collateral because the physical metal is awkward to move and store.

In the pilot, the answer was to tokenize it in two parts. One token, a Standard Gold Unit, carried the monetary value, representing something as granular as one gram of pure gold. A second attributes token recorded purity, weight, and location. Together they let the market treat gold of trusted integrity as collateral regardless of where the bars physically sat.

The point is not the token structure but the result: the physical gold never had to move for its value to become mobile. That is the twin model working as intended, which is to immobilize the real asset, mirror it faithfully on-chain, and let the mirror travel. The same logic underpins how an asset tokenization company approaches any illiquid holding, from real estate to commodities.

Where the confusion usually starts

Teams new to this tend to treat the token as the asset. On Canton, with the right approach, the twin is not a separate asset at all. It is an operational and record-keeping layer over something that already has a legal home.

Paul Landless, Partner and Co-Head of Fintech at Clifford Chance, put the practical consequence plainly. He described the twin “as an operational and record-keeping tool rather than an asset,” noting that this framing means “some of the legal and regulatory issues can be reduced while avoiding extensive surgery or a wholesale reset of established product and asset documentation” (Euroclear & Digital Asset pilot report, 2024; hereafter the pilot report).

That single reframing, twin as record rather than twin as new asset, is what makes the rest of this article possible.

Why legal certainty is the real blocker

Ask an engineer what stops tokenized collateral from scaling and you will hear about latency or interoperability. Ask a collateral desk and you will hear about certainty. The desk is closer to the truth.

Ownership, not the promise of ownership

The point of collateral is not to sit prettily on a ledger. The point is that when your counterparty defaults, you can take the asset, sell it, and make yourself whole.

That only works if the ledger entry reflects ownership itself. Not a claim on ownership, not a derivative representation, and not an IOU that has to be chased through three intermediaries on a Monday morning.

This is exactly the concern that leading collateral houses raised during the 2025 Treasury trades. The industry review of those trades records the priority bluntly: firms want to ensure “that the tokenized ledger entries reflect ownership, not the promise of ownership, with no derivatives or impediments during a default” (Treasuries On-Chain downloadable report, Value Exchange & Digital Asset, 2026; hereafter the Treasuries On-Chain report). Speed is a feature and certainty is the product.

The size of the prize, and the size of the gap

The collateral market is starved of eligible assets while sitting on a mountain of ineligible ones. There are over 145 trillion dollars in global fixed income securities alone, yet only a small fraction of the world’s marketable assets is actually mobilized as collateral today, a share the report puts at roughly one in ten.

Everything else is stranded, not because it lacks value, but because it cannot move with certainty when it is needed. Closing that gap is precisely what a serious Web3 consulting engagement sets out to do.

The frictions are not exotic. The Treasuries On-Chain report found that 58% of participants face real problems in collateral management and margining today, driven by manual processing on both sides of every trade and reconciliation across an average of eleven separate locations. Add the simple fact that collateral stops moving when the settlement window closes on Friday evening, and the everyday cost is obvious. This is why collateral desks, not just technologists, are now driving these projects.

Collateral frictions today vs the tokenized model, by category

The treasury cost of standing still

Uncertainty is expensive in ways that never appear on a single invoice. It shows up in three habits in particular:

• Burning carry: parking collateral in non-yielding cash over a weekend instead of holding a yield-bearing security.
• Buffering: setting aside as much as 4% of total collateral obligations as reserves just in case, capital that then cannot be reused elsewhere.
• Guessing: calculating exposures on Friday night and hoping the estimate holds until Monday.

Put numbers on it and the case becomes hard to argue with. The Treasuries On-Chain report estimated 54 million dollars in annual operational savings in the US alone from automating collateral movements and reconciliations, without sacrificing risk or income.

Meanwhile, a further 268 billion dollars in existing stablecoin holdings sat immobile, unable to be used as collateral, mainly because firms could not mobilize them without giving away their positions on a public chain. Turning that idle balance into working collateral without leaking positions is exactly the kind of problem that institutional DeFi development now sets out to solve.

Certainty without rewriting the rulebook

Here is the counterintuitive finding, and it is good news for anyone worried that on-chain collateral means years of legal reengineering. Legal certainty does not necessarily require amending the master agreement at all.

Boika Deleva, Counsel at Clifford Chance, observed after the pilot that “while legal certainty is important, it can be done in platform rulebooks or other agreements between the parties without necessarily amending the master agreement” (pilot report).

In other words, the certainty can live in the platform rules and in the code, provided the design respects the existing contractual framework rather than fighting it. That is a design brief, and it shapes how Daml development is approached on Canton, where business logic and legal intent are written into the same smart contracts.

Perfected securities interest explained

This is the technical heart of the article, and it is where blockchain either earns the trust of a collateral desk or loses it.

What perfection means in plain terms

In secured finance, a security interest is the right a lender or collateral taker has over an asset pledged to them. “Perfecting” that interest is the set of steps that make the right enforceable against the rest of the world, not just against the counterparty.

A perfected interest is what lets the secured party take control and liquidate the collateral if the borrower defaults, and do so with priority over other claimants. In traditional markets, perfection often depends on control: the ability to direct what happens to the asset without needing the defaulting party’s cooperation. The whole exercise of tokenizing collateral only means something if perfection survives the move on-chain.

Encoding control in the contract and the code

The pilot’s most interesting legal outcome was that perfection can be expressed in two reinforcing places at once. Kelly Mathieson, Chief Business Development Officer at Digital Asset, described the shift this way.

Parties are “agreeing on the technical and operations workflow, in addition to having agreed the legal control,” and on Canton “an activity over a secured asset cannot happen unless both parties agree.” The result, in her words, is that “this is perfected securities interest, now also provided in the app code and workflow, as well as in the legal contract” (pilot report).

That is the design pattern worth internalizing. The legal contract still says who controls the asset under what conditions, and the Daml smart contract enforces the same rule at runtime. Control becomes a property of the system, not a promise on paper alone.

Building that correctly is exacting work, which is why a smart contract audit is not optional on collateral logic where a single flaw can break the enforceability of a lien.

Where control lives: legal contract layer vs Daml code layer vs operational workflow

The twin and the underlying asset, locked together

A subtle but decisive detail: in the pilots, both the digital twin and its corresponding real world asset were locked to the transaction. When a default was triggered, the secured party could take control of the token and the underlying asset in one motion.

This is what closes the gap that skeptics point to. If you could seize the token but not the underlying Gilt, the token would be a decoration. Because control extends to both, the perfected interest is real rather than symbolic.

Why the underlying legal framework still applies

Because the twin represents something that already exists and is already governed by established law, its creation does not spawn a new asset that needs its own regime. As the Clifford Chance analysis of the pilot put it, when you speak of a digital twin on Canton you are “really speaking about a different, better set of books and records.”

From that perspective, a new legal agreement or statutory regime may be unnecessary. Existing agreements can carry the weight, sometimes with slight modification to account for the new books. This is why teams doing Web3 smart contract development for regulated collateral spend as much time with lawyers as with compilers.

Default and closeout: proving control in practice

Most blockchain demos stop at the happy path. The pilots did the opposite – they ran the trade all the way into a counterparty default, because that is the only scenario where perfected interest is actually tested.

Why the default scenario is the whole point

Collateral exists for the bad day. A design that settles beautifully on a normal Tuesday but cannot be enforced when a prime broker fails has proven nothing that matters.

The Gilts, Eurobonds and gold pilot extended the lifecycle deliberately to include default, precisely to show that the secured party could take legal possession when it counted. That is the difference between a technology demonstration and evidence a risk committee can actually use.

The offline steps you cannot skip

One honest detail from the pilot deserves emphasis, because it punctures the idea of a fully automatic default. The on-chain seizure began only once the required offline procedures, meaning documentation and signatures, had taken place.

The blockchain did not replace the legal process. It executed that process faithfully and instantly once the process authorized it. Human judgment and legal authority decide that a default has occurred and that closeout is warranted, and the code then carries out the transfer at a speed manual settlement never could.

The code is not the contract

It is worth being blunt about what the code does and does not do. A smart contract that executes a seizure is not, by itself, a legally binding agreement. Courts enforce it only if the usual contract requirements are met, and only in jurisdictions that recognize it. In the US, a few states such as Arizona say so explicitly, while most leave it to ordinary contract law (The Bulldog Law).

That is why serious builds use a hybrid. A plain-language legal agreement sets out the parties’ intent, the dispute-resolution path, and who may change the code, and the Daml logic executes against it. When a counterparty behaves badly or a partial execution has to be unwound, the written agreement is what a court reads. How far this holds varies by jurisdiction, which is a research question in its own right (regulation overview).

What happened at closeout

In the default sequence, the defaulting prime broker had already pledged cash and gold in variation margin calls and securities lending trades, with those assets locked to their respective transactions. When the default was declared, the central counterparty requested a closeout and took ownership of the assets from the cash and gold custodians.

The secured party selected the collateral to seize, the custodian approved, and ownership of the asset moved immediately from the defaulting party to the secured party in an atomic transaction. Control passed cleanly, and the token and the underlying asset went together, the kind of cross-custodian settlement that only holds up with disciplined custom software development.

Closeout steps: action, participants, outcome

Auditability that stands up in court

Throughout the process, the transfer of ownership was fully traceable and auditable on Canton, and, in the language of the pilot report, could “stand up in a court of law.” That phrase is doing important work.

A perfected interest is only as good as your ability to prove the chain of control after the fact. An immutable, permissioned record of exactly who controlled what and when is not a nice extra; it is part of the legal certainty itself.

Master agreements: what changes (GMRA / GMSLA annexes)

If the token is a twin and the underlying legal framework still applies, the natural question is what, if anything, needs to change in the documents that govern these trades.

The Digital Assets Annex

The market did not wait long to answer. ICMA and ISLA, with Clifford Chance as counsel, published a Digital Assets Annex for the GMRA, the Global Master Repurchase Agreement, and a parallel Digital Asset Annex for the GMSLA, the Global Master Securities Lending Agreement.

Rather than tearing up the master agreements, the annexes extend them. They set out standardized terms and clarify which categories of tokenized securities count as eligible collateral. This is standardization layered onto proven documentation, not a rewrite.

When you amend, and when you do not

Whether you need to touch the master agreement at all depends on the agreement. Some already give parties the flexibility to contractualize their securities delivery through DLT platforms, in which case little needs to change.

Others may need slight modification to acknowledge the new books and records and to confirm that the twin and its original are both inside the scope of the agreement. The honest summary is that positions in the market differ, and any firm should take its own legal advice rather than assume one path fits all. It also helps to pair that advice with hands-on blockchain consulting so the chosen documentation and the code are designed to say the same thing.

GMRA vs GMSLA Digital Assets Annex: scope and coverage

Same asset, same risk

The cleanest mental model for all of this came out of the 2025 Treasury trades. The assets were not derivative representations of the underlying Treasuries. They carried the same legal and economic rights, so the familiar “same asset, same risk” analysis held (Treasuries On-Chain report).

Joel Stainton, Head EMEA Futures & Options and OTC Clearing at Bank of America, captured the goal in one line: “this has to be a case where a bond is just [treated as] a bond.”

That is the bar. If a tokenized bond behaves legally and economically like a bond, the market can adopt it without reinventing itself. If it behaves like a strange new instrument that needs its own rulebook, adoption stalls.

Getting a token to sit correctly inside securities documentation is detailed work that touches token design directly, which is where experience in security token offering platform development pays off.

Eligibility is the adoption switch

There is a practical gatekeeper that sits above all the documentation: eligibility. A tokenized asset only becomes useful collateral when central counterparties, central banks, and collateral takers agree to accept it. If they accept tokens, liquidity grows and financing providers pile in. If they do not, the token has no home.

Eligibility, in turn, depends on the legal certainty and risk management discussed above, which is why these threads are not separable. Encouragingly, the market is already moving. Live margining using tokenized collateral is running at leading central counterparties such as Eurex, and 29% of banks and brokers said they planned to use tokenized collateral in 2026 (Treasuries On-Chain report).

The cash leg matters too

Collateral trades have two legs, and the cash leg went on-chain as well. In the Treasury repos, regulated stablecoins served as the cash, minted and redeemed on Canton to enable near-instant, atomic settlement.

That opens a second pool of liquidity that has largely sat idle: stablecoin holdings that could not be mobilized because of privacy and permissioning constraints. Designing that cash leg to behave predictably against securities collateral is a specialized corner of cryptocurrency development, and it is advancing fast.

What this means for firms building on Canton, and why PixelPlex

Strip away the detail, and the message for anyone planning to build is simple. Legal certainty and perfected securities interest are the keys to adoption of tokenized collateral.

Canton lets you anchor control in two places at once: in the code, through Daml smart contracts, and in the legal contract, through documentation the market already trusts. That dual anchoring is the core of what Canton Network development services are built to deliver.

The size of the opportunity

The prize is not incremental. Roughly 90% of the world’s marketable assets are not used as collateral today, and tokenization is the most credible path to changing that.

The mobility gains are just as concrete. Because trading and delivery can run around the clock rather than only during the weekday settlement window, tokenization adds roughly 120 hours of financing activity a week, about five extra days that were simply not available before. Tokenized collateral turnover already runs at about 4 trillion dollars a month, and 85% of firms now name intraday liquidity management as the key benefit of distributed ledger technology (Treasuries On-Chain report).

This is already production, not just pilots

The strongest evidence is what already runs live partly on Canton, alongside Hyperledger Besu:

• Broadridge has run its Distributed Ledger Repo platform on Canton since 2023 and now settles trillions of dollars of repo every month (Ledger Insights).
• The DTCC moved tokenized Treasuries, stocks and ETFs into live trading in July 2026, with a full service launch planned for later in the year (Genfinity).
• Franklin Templeton brought its Benji tokenized-fund platform to Canton (Nasdaq), and JPMorgan plans to extend its JPMD deposit token from Base to the network (J.P. Morgan Kinexys).

Part of that execution is the trading and liquidity layer around the collateral itself, since new pools of eligible assets need venues and rails that can handle them under the same privacy and certainty rules. That is where collateral infrastructure meets white-label crypto exchange development, giving institutions regulated places to move newly mobile assets.

The build checklist

A production tokenized collateral system is not one feature. It has to bring several disciplines together:

• reconciliation between the twin and the source of record that holds under stress;
• control logic that enforces the secured party’s rights at runtime;
• a closeout path tested before the happy path;
• sub-transaction privacy so participants see only what they are entitled to;
• an audit trail that would satisfy a court.

Each of those is a discipline. None of them is where you want to be learning on the job with live collateral.

The demand behind this is not speculative. Analysts at Citi have projected that tokenization of real-world assets could reach 5.5 trillion dollars by 2030, and, as the live deployments above show, the infrastructure has already moved from announcements to production.

Canton sub-transaction privacy: who sees what across a tokenized repo

Why PixelPlex

Our teams have built and run real applications on the network, including:

• Console Wallet – non-custodial browser wallet; users hold their own Canton assets.
• Canton Loop – self-custody wallet with biometric sign-in, onboarding in minutes.
• CC View – explorer that shows if a transaction is settled and how the network is doing.
• CC Tag – human-readable tags that replace long wallet addresses.
• 5N ID – one-time KYC reused across the ecosystem, cutting signup drop-off.

That is production experience with the exact primitives, control, privacy, and lifecycle handling that a collateral system depends on.

Just as important is the shape of the team. Tokenized collateral is not a smart contract in isolation. It is a business analyst who understands repo and margin, a solution architect, Daml and Canton engineers, backend and frontend developers, DevOps, and QA, working as one unit.

When a build needs to reach into an existing enterprise stack, that same team provides the blockchain development services to connect on-chain workflows to systems that were never designed for real-time settlement.

Start from the risk, not the demo

If you take one thing from all of this, let it be the order of operations. Begin with the legal and default questions, then design the control model, then build the workflow, and treat the interface as the last mile rather than the first.

From pilot to production: capability checklist for a tokenized collateral build

The firms getting tokenized collateral right are the ones who understood that certainty is the product, and who engineered for the bad day before they polished the good one. Whether your first step is a feasibility study, a token design, or a full platform, the pattern holds, and it is one our Web3 wallet development team applies on every engagement where control and custody have to be provably correct.