Tokenised markets have quietly merged words that the law keeps apart. Settled is an engineering fact: the ledger has updated, and reversing the update is somewhere between expensive and practically impossible. Final is a legal status: the routes by which the transfer could be unwound — insolvency avoidance above all — have been closed by law, and what survives is a defined set of residual claims that leave the transfer standing. Yours is a documentation fact: in the collateralised markets that move the real money, title changes hands by contract twice a day, and the question of whose the asset is has an answer that shifts by the hour. The first is produced by software. The second is produced only by law, and granted to named systems. The third is produced by a stack of agreements the ledger does not record.
This essay separates the three. Finality in the incumbent system is a manufactured privilege — built once mechanically, after Herstatt, and once legally, through the Settlement Finality Directive — and a chain confirmation enjoys none of it by default. The worst quadrant is a transfer that law can still revoke but operations cannot unwind. Three legal families close three different doors — property statutes make the transfer real, negotiability rules make it stick against title defects, system designation makes it stick against insolvency — and reproducing infrastructure-grade finality requires them to line up on the same transfer. The September 2026 ESCB response to the MiCAR review has now conceded the premise at the official level; what remains is the mechanics, and the repo market is where all three questions interlock at once.
On 14 September 2026, Tokenovate announced the execution and settlement of an intraday repo on the Canton Network — contract logic expressed in the FINOS Common Domain Model, the cash leg settled in USDC (Tokenovate, 2026). As an exhibit it is close to perfect, because an intraday repo is the one instrument in which every claim this market makes about itself must hold simultaneously: the transfer must be settled, or the trade does not exist; it must be final, or the collateral cannot be relied upon; and it must be yours, or there is nothing to repo in the first place — title to the same securities passing, by design, twice before lunch.
Every tokenisation deck compresses those three claims into one sentence: settlement is instant and final. The first half is an engineering claim and is often true. The rest is legal, and it is almost never examined. The international standard is unambiguous about which kind of claim matters: Principle 8 of the CPMI-IOSCO Principles for Financial Market Infrastructures defines final settlement as the irrevocable and unconditional transfer of an asset, and states, in terms, that finality is a legally defined moment (CPMI-IOSCO, 2012). Not a computational one. Everything downstream — netting, collateral, default management, the machinery of loss allocation — hangs on knowing which transfers can still come back.
The same month as the exhibit, the premise stopped being contrarian. In its response to the European Commission's MiCAR review consultation, the European System of Central Banks called for EU-level harmonisation of the private-law treatment of tokenised assets — property, corporate and insolvency law by name — and stated that assessing a settlement arrangement means assessing settlement finality, intraday liquidity and default procedures, not the prudential soundness of a technology (ESCB, 2026). When the institutions that manufacture finality for a living tell the legislator the token layer does not yet have it, that argument is over. This essay is about what the concession leaves open: three questions hiding inside one word, each answered by a different body of law, none answered by the ledger.
The vocabulary this essay insists on was forced into existence by a single afternoon. On 26 June 1974, German supervisors closed Bankhaus Herstatt at the end of the Frankfurt business day. Herstatt's foreign-exchange counterparties had already paid their Deutsche Mark legs, irrevocably, through the German system; the matching dollar legs were due in New York, hours behind, and never arrived. The counterparties' transfers were settled. Their trades were not. The loss had a shape no one had a word for — principal paid away against value never received — and the word the official sector eventually coined for it was Herstatt risk (CPSS, 1996).
The instructive part is what the fix was not. It was not a statute making FX transfers irrevocable — irrevocability was precisely the problem, since the Mark payments could not be called back. The fix, twenty-eight years later, was mechanical: CLS, launched in 2002, settling both legs of an FX trade simultaneously or not at all. Payment-versus-payment does not make transfers harder to reverse. It makes them conditional on each other, so that the failure mode is a trade that never happens rather than a payment stranded halfway.
This matters for the present argument because atomic delivery-versus-payment on a ledger is CLS's trick generalised — and it is a genuine achievement. Linking the legs kills principal risk, the oldest and largest settlement risk there is. But note precisely what it kills. Atomicity guarantees you are never left having paid without receiving. It says nothing about whether what you received can later be taken away. The first problem was solved by a machine. The second required a statute — and the statute is the subject of the rest of this essay.
Finality feels like a natural property of payment systems because the wholesale world has enjoyed it for a generation. It is worth remembering how recently it was built, and out of what.
Before the Settlement Finality Directive, several European insolvency regimes carried some form of the zero-hour rule: the insolvency of a participant took legal effect retroactively, from the first moment of the day it was declared. Every payment the failed bank had made that morning — settled, booked, spent onward by its counterparties — was open to unwind. A single failure could pull the thread on an entire day of interbank settlement, converting one insolvency into a systemic event through the legal system rather than through the market. The transfers were settled. None of them was final.
The Directive's answer was not technological. It was a carve-out: transfer orders entered into a designated system are shielded against insolvency law — for a qualifying order, no unwind, no zero-hour retroactivity, no revocation after the moment the system's rules define (Directive 98/26/EC). That is what finality is, stripped of its aura: an insolvency-law privilege, granted by statute to named systems that purchase it with regulation, oversight and rulebooks. It attaches to the designation, not to the machinery. Run the identical software outside a designated system and the privilege simply is not there.
Finality is not a property of the ledger. It is a privilege granted by statute — and privileges have perimeters.
This is the point the tokenisation literature reliably inverts. It treats finality as something ledgers have and asks whether the law will recognise it. The actual structure is the reverse: finality is something the law confers, and the question is whether any statute confers it on this venue, this asset, this transfer. For most of the market, in most jurisdictions, the honest answer is still no.
What a ledger produces is technical finality, and it comes in grades. Proof-of-work offers probabilistic finality: the likelihood of reversal falls with each confirmation and never reaches zero. Proof-of-stake offers economic finality: reversal is possible but constructed to be ruinously expensive. Permissioned networks running BFT consensus — the institutional standard — offer deterministic finality: once a supermajority of known validators signs, the protocol provides no reversal path, provided the validator and consensus assumptions hold, which is a governance statement, not a law of nature (Bank of England, 2026).
All three are statements about the difficulty of reversal. None is a statement about its lawfulness. The CPMI-IOSCO guidance on stablecoin arrangements names one failure mode: legal finality thought achieved, then a fork reverses technical settlement — the law said done, the ledger said otherwise (CPMI-IOSCO, 2022). The mirror image matters more for securities and gets far less attention: technical settlement holds, and the law acts anyway. A court recognising a defrauded transferor's claim does not need the protocol's cooperation. It has a defendant.
The precise vocabulary, then: the chain makes transfers irreversible, in varying degrees, as a matter of engineering. Finality requires transfers to be irrevocable — a legal term of art whose content the applicable framework defines. Irreversible is a fact about software. Irrevocable is a verdict about insolvency. Deterministic consensus closes the distance on the technical side completely — and moves the legal side not one centimetre.
Who, concretely, can still come after a transfer the ledger regards as done? Three claimants — and one distinction that sorts them, because it is the distinction finality is actually made of: an attack that unwinds the transfer, and a claim that leaves the transfer standing while reaching the person, the position or the proceeds. Finality law closes the first door. It never promised to close the second.
The mistaken or defrauded transferor. Unjust enrichment, fraudulent misrepresentation, breach of trust — the ordinary law of obligations does not switch off because the asset moved on a chain. Where the protocol cannot return the asset, the remedy converts into a personal claim against the recipient: the residual exposure that technical irreversibility cannot answer, because it was never aimed at the register in the first place.
The insolvency administrator. Avoidance actions — preferences, transactions at undervalue, transfers in the suspect period — are the sharpest tool in every insolvency code, and they are aimed at exactly the transfers that have already settled. This is the true unwind risk, and the one the finality statutes exist to extinguish: inside a designated system, the Directive shields qualifying transfer orders from them. Outside one, a transfer that settled with perfect atomicity three months before the petition is a candidate for clawback like any other, and the ledger's opinion on the matter is not solicited.
The conflicting court order. Freezing injunctions, sanctions designations, constructive trusts imposed over traceable proceeds. None of these attacks the finality of the transfer itself; each constrains what the holder may now do with a position whose on-chain history is pristine — a reminder that even perfected finality is a promise about one door, not a grant of immunity.
Now name the worst quadrant, because market design should be built around it: a transfer that is legally revocable and operationally irreversible. The law orders an unwind the machinery cannot perform, so the reversal is executed as a new transaction — a fresh liability, a damages award, a compelled re-transfer — layered on top of a register that still shows the original as valid. Someone must own the machinery for reversing the irreversible, and in the current market that someone is the courts, operating retail, case by case, at litigation speed. The incumbent system's genius was never that reversals could not happen. It was that a statute said exactly when they no longer could.
The legislative response of the last half-decade sorts into three families, and the essential observation is that they close different doors. Conflating them is how venues end up believing they have finality when they have one-third of it.
Property statutes make the transfer real. Liechtenstein's TVTG, Switzerland's ledger-based securities under Art. 973d ff. CO, Germany's eWpG, France's DEEP regime: the mechanisms differ — the token as container of the right, constitutive register entries, statutory equivalence to certificated form — but the function is common: transferring the token transfers the right itself, with effect against third parties (TVTG, 2020; Art. 973d ff. CO, 2021; eWpG, 2021; Ord. 2017-1674). This is the foundation — without it a token transfer moves nothing but data (see The Wallet Does Not Tell You). But effectiveness is not immunity. A transfer that validly conveyed the security can still be avoided, enjoined or reversed by the claimants of Section V. Property law answers what moved; it does not answer whether it can be taken back.
Negotiability rules make the transfer stick against title defects. The 2022 UCC amendments' Article 12 gives a qualifying purchaser of a controllable electronic record the take-free protection historically reserved for negotiable instruments: an acquirer who takes control, for value, in good faith and without notice takes free of competing property claims (UCC Art. 12, 2022 Amendments). UNIDROIT's Principles on Digital Assets generalise the same rule as the innocent-acquirer principle (UNIDROIT, 2023). This protects the acquirer against the defrauded transferor and the tracing claim. It does not protect the transfer against the transferor's own insolvency administrator, and it protects the system against nothing at all.
Designation makes the transfer stick against insolvency. The Settlement Finality Directive's protection was always available, in principle, to a DLT infrastructure willing to become a designated system — the DLT Pilot Regime made the path explicit (Regulation (EU) 2022/858). That so little of the market took it is the revealing fact. And unlike the token layer, the designation layer has been through its full-scale test: Lehman's European entities defaulted as participants in designated systems, the day's settlement stood, and the Commission's own review of the framework found no fundamental shortcoming (European Commission, 2023). The Commission's December 2025 package now proposes replacing the Directive with a Settlement Finality Regulation — a directly applicable EU text that would harmonise the three defined moments on which everything turns (entry into the system, irrevocability, finality), extend designation onto DLT-based infrastructures and to registered third-country systems, and amend the Financial Collateral Directive alongside (European Commission, 2025). It is a proposal, not law: as of this autumn the file is being negotiated by the co-legislators, with the Council still working through the text line by line. But it is an admission, in legislative form, that the gap between chain settlement and legal finality is real and was never going to close itself. Industry is negotiating its boundary questions as if adoption were a matter of when: ISDA's commentary spends its pages on precisely the points — the moment of entry, the moment of irrevocability, whose rules define them — that only matter because finality is a defined legal moment and not a hash (ISDA, 2026).
The three families are complements, not substitutes. Property law makes it a transfer. Negotiability makes it stick against bad title. Designation makes it stick against death. Which doors a venue needs depends on which failure it is being asked to survive — but to reproduce the finality that incumbent infrastructure delivers in the Principle 8 sense, the three have to line up on the same transfer. The sober census of 2026 is that most tokenised venues stand on one statute, market by appointment on the strength of it, and describe the result as final.
The United States is running the experiment in the opposite order. Commercial law arrived first: Article 12 is enacted in more than thirty states plus the District of Columbia, with New York — the default governing law of American financial contracts — effective from June 2026, and the UCC's Permanent Editorial Board has shown how Article 12 control over a token can establish Article 8 control over the uncertificated security it represents (ULC/ALI, 2022–2026; PEB, 2026). The acquirer's door is closed as firmly as commercial law closes doors. Then came market structure, by exemption: the SEC's Innovation Exemption order of September 2026 opens conditional tokenised trading of NMS securities on venues relieved of exchange registration (SEC, 2026). Which leaves the question the order's conditions circle without answering: where does system-level finality live when such a venue fails? The incumbent American stack derives its insolvency protection from a lattice of designated, regulated utilities — netting statutes, clearing agency rulebooks, FMI resolution treatment. A venue operating outside that lattice settles on the strength of contract and state commercial law: strong protection for the individual acquirer, and no statutory answer to the day the venue itself, or its largest participant, enters proceedings with a book of settled-but-attackable transfers. Commercial law was built to allocate title between two parties. Holding a market together through a failure was always the designation layer's job — and the exemption, by construction, operates outside it.
Now take the opening exhibit seriously and run it, because the repo market is where the third question lives. A repo under a Global Master Repurchase Agreement is not a secured loan dressed up; it is a true sale with a repurchase obligation. Title to the collateral passes outright to the cash provider at the open leg and passes back at the close (ICMA GMRA, 2011). In an intraday repo, the interval is hours: yours flips twice before lunch, by design, because outright title is what makes the collateral usable, reusable and close-out nettable. The question "whose is it" does not have a state as its answer. It has a schedule.
Run the tokenised version and the three questions come back separately. Settled? Yes — deterministically, in seconds, securities leg against cash leg, atomically. Final? Under which designation? The venue is not one, and the cash leg is a stablecoin: a redemption claim on a private issuer, which is exactly why the ESCB's response insists that a settlement asset be assessed on finality, par convertibility and default procedures rather than on the elegance of its rails, and why it anchors wholesale tokenisation in central bank money (ESCB, 2026). Yours? Only if the property statute of the relevant register says title passed — and only for as long as the GMRA says it is. Each answer comes from a different place: the protocol, the (missing) designation, the documentation stack. The ledger records one of the three.
The collateral branch of European law makes the dependence explicit. The Financial Collateral Directive strips formalities from collateral enforcement and shields close-out netting from insolvency interference — but its protections attach to collateral that has been provided, which the case law reads as possession or control (Directive 2002/47/EC). For a token, control is precisely the property the statutes of Section VI are still in the business of defining. The collateral question and the property question are the same question in different documentation (see Who Holds the Asset?) — which is why the proposed Settlement Finality Regulation amends the FCD in the same breath as it replaces the SFD. The legislator, at least, has noticed that the doors are one wall.
And the exhibit makes a deeper point without meaning to. Intraday repo exists because instant settlement is expensive. Deferred net settlement let a day's obligations collapse into a small residual; gross, atomic settlement demands the full amount now, every time, and the gap is bridged by intraday credit — a service that was always there and always priced, first invisibly inside the netting window, now visibly on a repo desk's book at term granularity of hours. An earlier essay in this library assumed immediate, irrevocable finality as tokenisation's natural endpoint (Why Are We Still Posting Collateral); the correction is that the immediacy is real and priced, while the irrevocability is a statute that has not yet been extended. The honest version carries a caveat: atomicity and netting are a continuum of cycle length, and shorter cycles genuinely cut margin. But the headline stands. Instant finality does not remove the cost of the settlement day. It relocates it — out of the netting set and onto the funding book — and then charges for it by the hour.
Title transfer has one more consequence the ledger flatters to conceal: what is outright yours, you may pass on. Reuse of collateral — rehypothecation in its various dress — is the quiet engine of collateral velocity, and it turns yours from a state into a chain: A owes redelivery of equivalent securities to B, who owes them to C, none of which appears on any register, because the register records transfers and the obligations live in the stack of agreements above it. A ledger makes the reuse visible as movement and leaves the redelivery obligations exactly where they always were: in the documentation. The mark at which reused collateral is carried through that chain is a further discretion with consequences of its own — a subject this library will return to.
Risk that is not extinguished is borne, and borne risk leaves traces. The finality gap leaves three visible ones.
It is priced as legal opinions — one per combination of chain, register statute and insolvency jurisdiction, recurring with every protocol upgrade, a fixed cost that lands on the issuer alongside all the others the wrapper carries (see Quo Vadis, Tokenised Securities). It is priced as haircuts and exclusions: collateral frameworks and repo documentation that will not accept an instrument whose transfers an administrator could revisit, which is one of the quieter reasons a natively issued token outside the designated perimeter cannot be financed. And it is priced as structure: the wholesale market's refusal to hold the gap at all is a standing force pushing tokenised settlement inside the incumbent perimeter — into designated systems, hybrid depositories and central-bank-anchored cash legs, which is the market-structure meaning of Pontes. The absorption of the chain world by the institutions it was meant to replace is usually told as a story about licences and distribution. It is also, and perhaps first, a story about finality: the incumbents are not merely where the clients are. They are where the statute is.
The named failure mode of the whole arrangement follows from the one property finality shares with all insolvency protections: it is tested exactly once, at the worst possible moment. A venue's settlement speed is verified ten thousand times a day. Its finality is verified in its first major insolvency, in front of a judge, against an administrator with statutory avoidance powers and every incentive to use them — and by then the answer is a fact about the past. So the gap is priced where it is visible — in the opinions, the haircuts, the structure — and unpriced where it is largest: in the insolvency tail no tokenised venue has yet been through. That is not an argument that the gap is theoretical. It is an argument that its price is still an estimate made by lawyers rather than a number set by a loss.
The chain compressed settlement from days to seconds, and the prospectuses compressed three words into one. The compression of the words was the error. Ask the three questions separately, of any instrument, and the diagnostic assembles itself. Is it settled? — ask the machine; it will answer honestly. Is it final? — ask which statute designates this system, and if the answer is none, the answer is no. Is it yours? — ask the documentation, and ask again at the close leg. Software can make reversal arbitrarily expensive; only law can make it irrevocable; and only the stack of agreements above the register can tell you whose it was in the meantime. Until all three answers hold on the same transfer, read every tokenised settlement claim with the one-word edit that makes it true: instant, yes. Final, pending. Yours — for now.
Written in a personal capacity. Analytical views only — not legal or investment advice.
Julian Gretzinger — Investor and writer on monetary history, real wealth mechanics, and financial markets. substack.com/@juliangretzinger