Tokenizing Gilts, Eurobonds and Gold: Default-Tested Mobile Collateral on Canton

While the global universe of marketable securities has grown to over $295 trillion (comprising roughly $150 trillion in stock markets and over $145 trillion in bond markets), only US$39.1 trillion of that pool functions as active collateral. A 2024 pilot led by Digital Asset, Euroclear and the World Gold Council set out to close that gap, tokenizing sovereign Gilts, Eurobonds and physical gold on the Canton Network. The goal was to test whether real-world assets could settle as collateral intraday and on weekends, instead of only within banking hours on a five-day settlement clock. A related 2025 industry pilot applying the same approach to US Treasuries estimated $54 million in potential operational savings for US market participants alone, evidence that the model scales beyond a single asset class.

*Figures, quotes and workflow details below are drawn from the 2024 Digital Asset, Euroclear and World Gold Council collateral tokenization pilot and related 2024–2025 Canton Network market research. They reflect pilot-stage findings and point-in-time statistics rather than live production volumes.

Where this stands today

What this article describes was a test-network pilot, not a production system. The industry has moved fast since: a related 2025 pilot saw regulated institutions, including DTCC, Bank of America and Tradeweb, move real cash and tokenized US Treasuries through live weekend repo trades on Canton, a separate effort from the Gilts, Eurobonds and Gold work covered here.

On July 15, 2026, DTCC went further, running what it called its largest tokenization production event to date. More than 30 firms, including JPMorgan, BlackRock, Goldman Sachs and CME Group, tokenized Treasuries and equities and used them for real collateral pledges, repo, securities lending and margin calls, settling on both Canton and DTCC’s own Hyperledger Besu network. A full production service is scheduled to launch in October 2026.

That confirms that tokenized RWAs can move as collateral on the same legal footing as the assets behind them. The rest of this piece works through the mechanics that made that possible, and what a firm actually needs in place to do the same.

Why gilts, eurobonds and gold were the target assets

Sovereign bonds and gold make an unusual pair, but together they cover both ends of the collateral mobility problem. Gilts and Eurobonds are already deep, liquid instruments: in April 2025, there were over £2 trillion gilts in issue. In March 2026, Eurobond issuance from 12,000 issuers across 130 countries topped €15.3 trillion. Both asset classes already move through established repo and securities lending markets. This made them a practical starting point for testing whether a tokenized version could carry the same legal and economic rights as the underlying security.

Gold sits at the opposite end of the spectrum. ISLA and several CCPs already treat it as eligible collateral, and it holds value with less volatility than many other asset classes. What has kept it out of daily collateral flows is its physical form: bars have to be verified, vaulted and transported before they can change hands. This process may take days rather than minutes. Pilot findings frame this operational friction, rather than any doubt about gold’s worth, as the real barrier standing between a stable asset and an active one.

“By digitizing gold, we can overcome the perceived restrictions on moving and storing the physical metal, enabling this high-quality asset to be mobilized and used seamlessly within financial markets. To achieve this, the tokenization process must be able to specify a Standard Gold Unit (SGU™) that represents and transfers the monetary value of an agreed amount of pure gold.”

— Mike Oswin, Global Head of Market Structure and Innovation, World Gold Council, in a joint press release announcing the successful pilot

What a digital twin is and how the asset is tokenized

The pilot’s technical model rests on a concept borrowed from the CFTC’s Global Markets Advisory Council: the digital twin. As taken from the CFTC’s GMAC Digital Asset Classification Approach and Taxonomy, a digital twin is “an electronic controllable record representing an asset that has been immobilized on another system of record, and reconciled with that original system of record to ensure ownership is reflected precisely.” This sits in contrast to a digital native asset, which exists only on its own ledger and needs no reconciliation elsewhere.

In practice, the Gilt, Eurobond or gold bar never leaves its original custodial record. A linked token is created on Canton that mirrors that record and stays locked to it through every phase of the transaction, from the initial margin call or securities loan through to recall and eventual closeout.

This distinction carries real legal weight, not just technical weight. Since a digital twin is a record of the original asset, it doesn’t need a brand-new legal framework built around it. Legal counsel reviewing the pilot, Clifford Chance included, concluded that existing ISDA, GMRA and GMSLA agreements can generally still govern the trade, with only small additions needed to confirm that both the token and the original asset are covered. What keeps that legal position solid is simple: the token and the custodial record stay in sync at every step, and the underlying asset stays locked at the custodian throughout.

Pilot participants describe this fidelity as a “same asset, same risk” principle: the token carries the same legal and economic rights as the Gilt, Eurobond or gold bar behind it, without the added counterparty or valuation risk that a synthetic instrument would introduce. Getting that reconciliation layer right, so token and register never drift apart, is most of the underlying engineering challenge behind any Real World Asset tokenization platform.

A digital twin only works if there is always exactly one live copy of the asset that can be pledged at a time. If the token on Canton and the custodian’s own records ever disagree, even briefly, one side might show the asset as free to use while the other still shows it locked up elsewhere. That breaks the “same asset, same risk” promise, and a secured party can no longer trust the ledger if a default happens.

Canton prevents that kind of mismatch with three safeguards, built into the system:

• Immobilization: the real Gilt, Eurobond or gold bar is locked up at the custodian the moment it’s tokenized, so it can’t move independently of its digital twin.
• All-or-nothing transfers: every pledge, release or transfer updates the token and the custodian’s record at the same moment. Either both sides update together, or neither does, so there’s no in-between state where the two disagree.
• One active claim at a time: the system always knows whether a token is already pledged, so the same asset can never be committed to two deals at once.

Get these three right, and the token behaves exactly like the asset it stands in for. Skip any one of them, and the system quietly brings back the very settlement risk it was built to remove.

Inside the pilot: structure and transaction flow

The pilot brought together 27 organizations operating across 14 Canton nodes, running 11 distributed applications (six registries and five margin apps), to complete more than 500 transactions over a simulated three-day period. Investors, prime brokers, a combined CSD/CCP, custodians and collateral agents, and repo and securities lending agents each held a defined role, while eleven observer organizations tracked the exercise without transacting directly. Rather than relying on one shared ledger, each participant ran its own sovereign Canton node, with a Global Synchronizer service composing the atomic transactions that spanned multiple nodes and applications at once, coordination that counts as serious blockchain development work in its own right. That sovereign-node design is also what makes the network privacy-preserving: each node only receives the specific data elements it is entitled to for a given transaction, so a custodian, for example, never sees a counterparty’s full trading book, only the piece of the trade it is actually servicing.

The simulated lifecycle moved through repo, securities lending and margin calls in sequence, with each step settling atomically across the applications involved. A repo trade tokenized Gilts as collateral on day one, and the investor then reused those same Gilts to meet a cleared repo required value call, while the prime broker met a separate variation margin call in cash. By day two, the same prime broker was borrowing Eurobonds and pledging tokenized gold against them, then meeting another margin call with that gold rather than sourcing fresh collateral. Day three tested what happens once a participant fails to perform.

That combination, instant settlement plus strict privacy, is harder to pull off than it sounds: most blockchain designs can offer one but rarely both, since making several systems settle as a single move usually means giving everyone a shared view of the whole trade. Achieving atomic settlement and collateral movement on day one required the repo app, the Gilt and Eurobond registry, and the cash registry to update together as one transaction. The Global Synchronizer lets Canton do this without that trade-off: it confirms all three systems are ready and settles them together, while still keeping each node’s view limited to the slice of the trade it is party to.

The six-step transaction lifecycle

Mobilizing an immobile asset: the gold case

Gold posed a different design problem than the bonds. A bar of gold cannot be split, fractionally transferred or moved on short notice. Collateral obligations rarely match the size of a single bar, and metal vaulted in one location is of little use to a counterparty elsewhere.

The pilot’s answer was to separate value from physical description by splitting the asset’s digital identity into two distinct layers:

• Value Token (SGU™): The Standard Gold Unit represents the pure financial value (e.g., 1 gram of pure gold). It functions as a highly liquid instrument that can be instantly pledged or recalled, just like any other tokenized security.
• Attribute Token: A second, linked token carries the physical reality of the asset: its specific purity, precise weight, and exact vault location. These attributes provide the context necessary for accurate valuation, ultimate settlement, or physical delivery.

Splitting the token this way lets the pilot mobilize gold as collateral without physically moving a bar, turning a historically static asset into a pool of collateral that behaves like any other liquid security. Once minted, the SGU™ could be pledged against a margin call, released, and re-pledged elsewhere within minutes. Throughout this entire 24/7 lifecycle, the underlying metal stayed exactly where it was vaulted, and its custodian of record never changed.

“We recognize the immense value in industry experimentation to showcase the advantages of DLT for the market. As we strive to deliver even better and faster collateral mobilization for our clients, digital technologies like DLT will be key enablers for us to achieve this.”

— Olivier Grimonpont, Head of Product Management, Market Liquidity, Euroclear

Default and closeout: seizing tokenized collateral

Most tokenization pilots stop at a successful trade. This one went further, simulating a prime broker default on day three to test whether a secured party could take actual control of collateral once something goes wrong. By that point, the prime broker had already pledged cash and tokenized gold across several open positions, all locked to specific contracts on the ledger.

Once the default was declared, the prime broker was removed from the transaction flow and the secured party, the CSD/CCP in this case, requested a closeout. Custodians approved release of the locked assets, and ownership moved to the secured party in one atomic transaction under ISDA, GMRA and GMSLA default provisions. Because the Daml contracts will not execute unless every required party has already agreed to the terms, that transfer gave the secured party a perfected title, with the same legal weight as a manual closeout but without the delay. That enforceable, multi-party logic is what dedicated Daml development is built around.

Default and closeout workflow

One nuance the pilot’s legal reviewers were careful about, and worth reflecting here so the picture is not too smooth: the on-chain closeout does not remove the offline legal work, it runs on top of it. The atomic seizure starts after the required documentation and signatures are in place, and whether a firm needs to amend its master agreement at all depends on the wording of that specific agreement. Some ISDA, GMRA or GMSLA contracts already give parties enough flexibility to contractualize DLT-based delivery with no amendment; others need a limited rider to confirm the digital twin and its original are both in scope. Clifford Chance’s read was that legal certainty can often be established in a platform rulebook or side agreement rather than by reopening the master agreement, but “often” is not “always.”

The practical takeaway for a firm scoping this work: the code enforces the mechanics of a perfected security interest, but the enforceability of that interest still rests on getting the documentation layer right up front. A serious implementation treats the legal mapping (which agreements govern, what a default triggers, who signs before the closeout can fire) as a first-class part of the build, not an afterthought bolted onto working code. The ground has also shifted since the pilot: ISLA, ICMA and Clifford Chance have since published a Digital Assets Annex for the GMSLA, mirroring the earlier GMRA work, which gives firms a more standardized starting point than the pilot participants had.

What this means for firms building on Canton

The pilot answers two questions that treasury and collateral teams keep asking about tokenization: whether it solves the liquidity trap described above, and whether that mobility survives an actual default. Pilot findings answer yes to both. Gilts, Eurobonds and gold moved as collateral in real time rather than in weekend batches, and the closeout scenario traced its legal outcome back to existing master agreements rather than an untested framework.

A pilot proves a capability under controlled conditions. However, it does not prove that a given firm is ready to run it. The related Treasuries pilot was candid on this point: the hard part is rarely the blockchain, it is enterprise readiness. Three constraints tend to decide the timeline more than the technology does:

• Legacy dependencies: client onboarding, sanctions screening, booking and reconciliation still live in systems built for T+1 batches. Real-time settlement only delivers its benefit once those upstream processes can also operate in real time. Until then, a firm gets a fast settlement leg bolted onto slow surrounding plumbing.
• Eligibility and the network effect: tokenized collateral is only as useful as the set of counterparties, CCPs and central banks willing to accept it. Value grows once the takers say yes and stalls if they hold back, which makes early adoption partly a commercial and regulatory question, not just an engineering one.
• Operating-model choice: firms differ on whether to run their own Canton node or consume “nodes-as-a-service.” That decision shapes cost, control and how much of the identity, permissioning and custody stack a firm owns versus outsources, and it is best made before code is written, not after.

In practice, a move from pilot to production is less a single build than a sequence: scope which of a firm’s workflows are genuinely real-time-ready, map the governing legal agreements onto executable Daml logic, stand up node architecture and identity and permissioning, then integrate with the existing custody and booking systems that are not going away. The difficulty is that these steps must hold together atomically, exactly like the transactions they support.

Moving from pilot to production with PixelPlex

Navigating those three constraints, not re-proving the underlying technology, is what actually separates a stalled pilot from a live deployment. Connecting to this ecosystem still requires custom node architecture and complex smart contract logic on top of the legal and operational mapping described above. That is where PixelPlex acts as a technical partner and specialized implementer.

As an early adopter of the Canton Network, PixelPlex runs a dedicated engineering practice designed to take collateral tokenization projects from concept to live deployment. PixelPlex’s team consists of:

• Business analysts and solution architects who scope the integration and map complex legal workflows into technical logic.
• Daml and Canton developers who write the secure smart contracts required to enforce multi-party atomic settlement.
• Backend, frontend, DevOps, and QA engineers who carry the decentralized architecture to production.

Because expert Daml developers remain scarce industry-wide, PixelPlex actively runs internal Daml training programs to continuously grow this specialized bench.

This deep, hands-on practice has produced proprietary tooling designed to accelerate enterprise integration and manage the exact registry and custody workflows tested in the pilot:

• Console Wallet: Built for streamlining network operations, node deployment, and secure asset handling.
• CC View & CC Tag: Engineered to provide operational visibility and tracking across decentralized applications.
• 5N ID: Enforcing the identity, permissioning, and compliance workflows that institutional participants require.

Firms scoping Canton.Network development services usually start with the same concern the pilot’s legal reviewers raised: what happens at default. Digital Asset’s Kelly Mathieson framed the solution this way:

“What makes this different is that the parties are agreeing on the technical and operations workflow, in addition to having agreed the legal control. When you’re using Daml on Canton Network, an activity over a secured asset cannot happen unless both parties agree, and one such agreement is that one party, the Secured Party, can rightfully take control of the asset under pre-agreed conditions. This is perfected securities interest, now also provided in the app code and workflow, as well as in the legal contract.”

— Kelly Mathieson, Chief Business Development Officer, Digital Asset, in the report regarding the pilot

Translating strict legal control into executable code is the core challenge of enterprise blockchain. Delivering that perfected title and reliable execution is the standard PixelPlex builds toward on every engagement, whether the workflow spans a single asset class or several at once.