Tokenized bond pilot: go-live or stop
A bank is piloting a tokenized corporate bond on a permissioned DLT platform. Bonds and cash are represented on the platform, but the cash leg is still reconciled daily to the core ledger. In a 10-week pilot of 1,200 trades, there were 96 reconciliation breaks: 41 timing, 30 duplicate token mints, 15 incorrect coupon accruals, and 10 missing wallet mappings. Average break resolution is 2.4 days; the target is same-day. Platform availability is 99.5%, below the bank's 99.9% standard, and the DLT vendor's smart-contract audit covers only 70% of custom code. The business wants to go live with a $50 million issuance next month. Operations says it can add six temporary FTEs; risk says there are no material issues. The bank's operational-risk appetite allows no more than five unresolved breaks per 1,000 trades at go-live.
1. Assess whether the platform is ready for the $50 million issuance. Use the pilot data and risk appetite.
Read the worked answer
Not ready. The pilot produced 96 breaks in 1,200 trades, or 80 per 1,000, which is 16 times the five-per-1,000 appetite. Even if some breaks are timing-related, the high-severity causes are control failures: 30 duplicate mints indicate missing idempotency or authorization controls; 10 missing wallet mappings indicate onboarding and KYC gaps; and 15 coupon accrual errors indicate logic or data defects. Resolution at 2.4 days versus same-day means the operations model cannot yet support atomic settlement.
Availability at 99.5% versus 99.9% adds resilience risk, and 70% audit coverage leaves 30% of custom code unexamined. Adding six temporary FTEs masks the problem; it does not fix duplicate mints or smart-contract defects. A $50 million issuance would concentrate risk in an unproven process. Recommendation: no go-live on the current date; either delay or reduce to a tightly capped pilot with manual controls and a clear remediation plan.
2. Prioritize the remediation. What must be true before any go-live?
Read the worked answer
Priority order: first, duplicate token mints, with idempotency keys, unique trade identifiers, mint authorization, and reconciliation at issuance; second, wallet mapping, with whitelisting, a KYC-linked wallet registry, and four-eyes approval; third, coupon accrual, with an independent calculation oracle tested against the legacy system; fourth, timing breaks, moving toward atomic or near-atomic delivery-versus-payment, pre-funding cash, and automated reconciliation; fifth, availability, requiring redundancy, failover testing, and a 99.9% service-level agreement; sixth, audit, completing 100% of custom smart-contract code and remediating findings.
Go-live gates should include two consecutive weeks at or below five unresolved breaks per 1,000 trades, same-day resolution for high-severity breaks, zero duplicate mints in a stress test, 100% audit closure, and a tested kill switch. If these are not met, delay. Do not use temporary FTEs as the control.
3. How should the bank govern the go/no-go decision and manage the business pressure?
Read the worked answer
Use the operational-risk and technology-risk committees, with independent second-line challenge. The decision should be based on risk appetite, not the issuance calendar. Document pilot results, root-cause analysis, the remediation plan, and residual risk. Require the business sponsor to sign a risk acceptance only within appetite; a $50 million issuance outside appetite needs board-level approval and a credible contingency.
Set a staged go-live: a small issuance with manual reconciliation and daily break review, then scale after gates are met. Report to the regulator if the platform is material to settlement. Re-review the risk team's no-material-issues finding because it is inconsistent with 80 breaks per 1,000. The message to the business: a delay protects the franchise; a failed settlement on a tokenized bond would damage client trust and invite supervisory action.