What breaks when a tokenized asset and its payment don’t move together
The token has already moved.
It cleared the chain in under a minute. The new owner’s wallet shows the position. The blockchain confirms it, immutably, without ambiguity. By every measure that matters to the ledger, the deal is done.
The payment has not arrived.
It is somewhere in the wire transfer system — routed, queued, subject to correspondent bank review, potentially flagged for a compliance hold on a Friday afternoon in a jurisdiction the sending bank doesn’t cover over the weekend. The seller is watching a dashboard that says one thing. Their bank account says another. And the asset they just delivered is, at this moment, sitting in someone else’s wallet with no legal or practical mechanism to retrieve it.
This is the gap. It has a name in classical settlement theory — the exposure window — and it has been the central problem of securities markets since long before the blockchain existed. What makes the tokenized version particularly surgical in its damage is that the gap opens not as a known, managed feature of a multi-day settlement cycle, but as an accidental byproduct of the uneven speeds at which different parts of a deal move. The technology is faster on one side than the other. And in that asymmetry, the entire deal’s risk migrates to a single party — instantly, completely, and silently.
The architecture of the exposure
To understand what breaks, you have to understand what the ideal looks like. Delivery-versus-Payment — the atomic settlement of an asset in exchange for payment — is a fundamental requirement in both traditional financial markets and blockchain-based systems. The premise is simple: the asset moves if and only if the money moves. Exchange-of-value settlements such as DvP eliminate principal counterparty risk in settlement through the condition that final settlement of the delivery of an asset occurs if and only if final settlement of the corresponding payment occurs.
That conditionality is everything. It is the difference between a transaction and a bet.
Atomic settlement, or atomicity, refers to the simultaneous settlement of a transaction. Non-digital securities transactions often require intermediaries to finalize the transaction; these intermediaries include central securities depositories and centralized clearinghouses. The innovation that tokenization theoretically brings to the table is the collapse of that intermediary-driven delay into a single, indivisible moment. Onchain transactions often settle atomically, meaning the asset transfer and payment happen simultaneously.
The word “often” is doing a great deal of work in that sentence.
In practice, the reality of most tokenized-asset deals — particularly those involving real property, private credit instruments, fund interests, or any asset whose payment leg runs through traditional banking rails — is that the two sides of the transaction do not move together. They move on different systems, governed by different clocks, constrained by different rules, and finalized at different moments. A token can move in seconds while the legal asset, custodian, price feed, or redemption process may not. Swap “legal asset” for “payment” and you have the anatomy of the problem exactly.
The structure that emerges from this mismatch is not atomic settlement. It is sequential settlement with an exposure window in the middle — which is, functionally, the same risk architecture that plagued traditional T+2 markets, dressed in new infrastructure.
The first leg moves. Now what?
Consider how a tokenized real estate transaction typically unfolds in practice. A commercial property interest has been structured through a special purpose vehicle. Most tokenized RWAs are structured through a Special Purpose Vehicle. The SPV legally holds the asset, and investors purchase tokenized shares in that entity. The token represents the investor’s claim on that SPV — and through it, on the underlying property. The deal terms are agreed. The parties are ready.
Someone moves first. In most deals, it is the token — because the token is the thing that can move instantly, programmatically, and without human intervention once authorized. The seller transfers the token. It clears in seconds. The blockchain records the new owner’s wallet address with cryptographic certainty.
Then the payment leg begins its journey through the traditional financial system.
In traditional finance, trade execution and trade settlement are separated by time — often T+1 or T+2 days. During this window, a counterparty could go bankrupt, causing the trade to fail and potentially triggering a cascade of losses across the market. Wire transfers across jurisdictions do not move on the same timeline as blockchain confirmations. Correspondent banking relationships introduce processing queues. Compliance reviews — particularly for cross-border transactions involving large sums — introduce holds that can stretch from hours to days. A wire that leaves New York at 4:30 PM may not credit an account in Singapore until Tuesday morning.
During that interval, the seller has delivered the asset. The buyer holds it. The payment has not arrived.
This is the exposure window — and every hour it remains open, it carries principal risk: the risk that the paying party fails to complete its obligation after the delivering party has already completed theirs. The buyer could send payment but not receive the asset, or the seller could deliver the asset but not receive payment. In the non-atomic case, both outcomes are possible. What determines which party bears the risk is simply which leg moved first.
The anatomy of a failed leg
The exposure window is not just a theoretical hazard. It has specific failure modes, each with a distinct character.
Counterparty insolvency mid-settlement
Standard securities settlement involves a one-to-two business day interval between trade execution and final settlement. During that window, both parties carry counterparty risk. The tokenized version compresses the asset leg to near-zero time — but if the payment leg still runs on traditional rails, the counterparty risk doesn’t disappear. It concentrates. The seller is now in the worst possible position: fully exposed, with no asset to recover and a contractual claim against a counterparty who may be illiquid, in default, or unreachable.
This is far from theoretical — the collapse of Lehman Brothers caused settlement failures across thousands of open transactions, and the March 2020 market stress event placed considerable operational strain on US Treasury market infrastructure. The pattern holds at every scale: stress events hit precisely when counterparties are most vulnerable, and it is in those moments that the sequential settlement structure fails most completely.
Cross-ledger coordination failure
Many tokenized-asset deals involve participants operating across different chains — the token issued on one network, the payment instrument (a stablecoin, a tokenized deposit, or a digital currency) residing on another. Institutional cross-chain settlement refers to finalizing trade obligations across two or more distinct blockchain networks. Unlike traditional siloed settlement, cross-chain settlement uses interoperability protocols to achieve atomic, simultaneous exchange between disparate ledgers.
But the coordination required to achieve true atomicity across ledgers is itself a system — and systems fail. Cross-ledger “atomicity” typically reintroduces extra failure modes, because coordination is itself a system that can fail, stall, or be disputed. Hash timelocks, bridge protocols, relay networks — each layer of coordination introduces a new point where one leg can complete and the other cannot. Several proposals including Hashed Timelock Contracts and API-based DvP mechanisms offer decentralized alternatives, but suffer from limitations such as race conditions, reliance on timeouts, and high on-chain complexity.
When a bridge stalls mid-transaction, or when a timeout expires before the second leg confirms, the deal is no longer atomic. One party may hold the token. The other may hold the funds. Both are in legal limbo until the dispute resolves — which, absent a clear contractual framework, can take considerably longer than the deal itself.
The payment leg falls back to off-chain
This is the most common failure mode in real-world deals, and it is also the least dramatic — which is exactly why it keeps happening. Atomic DvP is only as strong as the cash leg. Many projects can tokenize the asset side, but the payment side often falls back to off-chain transfers or credit exposure.
A deal is structured with good intentions. The token is onchain. But the buyer’s funds are in a bank account, not in a wallet. Converting those funds to an onchain payment instrument — a stablecoin, a tokenized deposit — takes time, requires relationships, and may run into its own compliance constraints. Rather than delay the deal, the parties agree to proceed: the token moves onchain, the payment follows via wire. It feels like a reasonable accommodation. It is, in structural terms, a sequential settlement with the seller bearing full principal risk for however long the wire takes.
That period could be four hours. It could be three business days. It could be indefinitely, if the payment is rejected at the correspondent bank level and has to be re-initiated.
The legal wrapper doesn’t help you here
There is a common assumption — understandable but dangerous — that strong legal documentation around a tokenized deal provides adequate protection against settlement asymmetry. The purchase agreement says the seller must deliver the token and the buyer must pay simultaneously. So doesn’t the contract enforce the DvP condition even if the technology doesn’t?
No. Not in any practically useful sense.
Tokenization is the representation of a financial asset or liability on a programmable digital ledger. The token exists on a blockchain. The underlying asset — a Treasury bond, a private credit instrument, a real estate claim, a fund share — continues to exist in the traditional financial system. The token and the asset are linked through a legal structure, typically a special purpose vehicle or trust, that establishes the token holder’s rights to the underlying claim.
That legal structure, robust as it may be, operates at the speed of litigation. If the payment doesn’t arrive after the token has been delivered, the seller’s remedy is a breach-of-contract claim against the buyer. That claim is real and theoretically recoverable. But recovery requires jurisdiction, process, time, and cost. Meanwhile, the token — the actual, onchain representation of the asset — is sitting in the buyer’s wallet. The seller is an unsecured creditor of a counterparty who may or may not have the funds, the will, or the legal accessibility to make them whole.
Tokenization of real-world assets is forcing finance to reconcile two systems: legal finality and digital efficiency. The real challenge is not technological scalability but jurisdictional coherence — ensuring that every tokenized claim can stand up in court as firmly as it executes onchain.
The contract enforces intent. It does not enforce settlement. Those are different things, and conflating them is one of the most expensive mistakes a professional can make in a tokenized-asset deal.
The reverse problem: payment first, token later
The asymmetry cuts in both directions. The scenario above involves the token moving first and the payment lagging. But the reverse is equally possible and equally dangerous — and it tends to emerge from a different set of deal dynamics.
A buyer, eager to signal commitment, wires payment before the token transfer is confirmed. The seller may have technical issues with the token transfer — a key management complication, a permissioned token transfer restriction requiring an additional approval step, a token standard that embeds compliance rules such as investor eligibility and transfer restrictions directly into the smart contract, used by institutional RWA issuers to enforce regulatory requirements onchain — or simply a delay in coordinating the onchain transaction. The payment clears. The token does not move.
Now the buyer is the exposed party. They have paid in full. The asset has not been transferred. Their recourse is, again, legal — slow, expensive, jurisdictionally complicated.
The risk that sits in the gap is not inherently one-sided. It belongs to whichever party moves first. In deals without robust technical coordination between legs, that determination is often made informally, by convention, by who has the cleaner infrastructure, or simply by who acts faster on the day. None of those are sound risk management frameworks.
What the gap costs, in practice
Translate the mechanics into numbers, because the abstract becomes real when denominated.
A tokenized commercial real estate interest at $4 million. Broker’s fee: 3%, split two ways between the listing side and the buy side. Closing advisor fee: another half percent. Total professional compensation at stake: roughly $170,000, distributed across four parties, each of whom relied on the deal closing cleanly.
Now the payment wire hits a compliance hold at the correspondent bank level. The hold is not a rejection — it is a review, standard procedure for a cross-border transaction above a threshold that varies by institution. The review takes three business days. During those three days, the token is in the buyer’s wallet. The deal is, in a legal sense, partially executed.
On day two, the buyer’s operating company files for creditor protection in its home jurisdiction. The payment is frozen as part of the estate. The token — which has already been delivered to a wallet controlled by the buyer’s corporate entity — becomes an asset of the estate.
The seller has no token. The seller has no payment. The seller has a claim in a foreign insolvency proceeding, denominated in a currency they may have to convert, governed by laws they did not anticipate, administered by a process that may take eighteen months or more to resolve.
The brokers, the advisor, the closing professional — none of them get paid. Their fees were contingent on a completed deal. The deal is not completed. The payments that were supposed to flow to each professional’s wallet are frozen along with everything else.
This scenario is not exotic. Fund administrators are discovering that settlement risk can cascade. A single failed redemption can delay NAV calculations, margin processes, and downstream reporting. In a single-asset deal, the cascade is simpler: one failed settlement leg wipes out every downstream payment that was contingent on it.
The payment leg is the weakest link
There is a structural reason why this problem persists even as tokenization matures. The asset side of a deal — the token itself — benefits directly from blockchain infrastructure: programmable transfers, cryptographic finality, transparent audit trails. But the payment side, in most institutional deals, still runs through banking infrastructure designed for a different era.
The growth of tokenized assets has created demand for an onchain form of cash to serve as the payment leg in DvP transactions. Two candidates have emerged: stablecoins and tokenized deposits. The distinction matters considerably. Stablecoins carry issuer default risk, uncertain capital treatment, and are ineligible for central bank settlement rails. Tokenized deposits, by contrast, carry deposit protection, receive standard capital treatment, and connect directly to central bank infrastructure.
This is not a minor technical footnote. It is the central structural problem of the entire tokenized-asset market. Until the payment leg achieves the same finality characteristics as the asset leg, the DvP promise cannot be fully honored. Most deals today operate in the gap between those two states — with a token that has the characteristics of cryptographic finality and a payment that has the characteristics of a wire transfer.
The benefits of tokenization are conditional rather than automatic. Tokenized markets may introduce new sources of fragility, including smart-contract vulnerabilities, operational dependencies, platform concentration, oracle risk, and stronger interconnections across financial infrastructures. The non-atomic settlement case is exactly the terrain where conditionality fails — not because of any single technical flaw, but because the deal spans two systems that were never designed to interlock.
The oracle problem and the off-chain wrapper
Even in deals where both the asset token and the payment instrument are onchain, the gap can open at a different layer: between the token and the thing it represents.
The underlying asset — a Treasury bond, a private credit instrument, a real estate claim, a fund share — continues to exist in the traditional financial system. The token does not become the property or the debt instrument; it represents a legal claim on it, mediated by a structure — an SPV, a trust, a custodial arrangement — that itself exists off-chain. In practice, legal structuring matters far more than the choice of blockchain, as most implementations rely on legal wrappers, custodians, and contractual mapping to ensure enforceability. Hybrid models — combining off-chain legal title with on-chain transferability — dominate the landscape.
In that hybrid model, the token transfer is fast. The legal title transfer — the actual update to the property registry, the updated SPV register, the custodian’s acknowledgment of the new beneficial owner — is slow. It operates on timelines set by legal process, not by block time.
One platform demonstrated this risk concretely: investors held tokens representing properties that were never legally secured or transferred, resulting in total loss. The blockchain ledger was correct; the off-chain legal wrapper failed.
This is the oracle problem expressed in human terms. The chain has no way to verify that what the token claims to represent is, at this moment, intact and correctly attributed. Achieving seamless capital efficiency necessitates resolving the fundamental friction between deterministic on-chain code and probabilistic off-chain reality, navigating the oracle problem and jurisdictional interoperability. When the off-chain wrapper fails — because a registry update was delayed, because an SPV’s beneficial ownership register wasn’t updated contemporaneously with the token transfer, because a custodian acknowledgment arrived after a dispute had already been filed — the token holder’s rights are not self-executing. They are contingent on a legal process that may not complete.
The exposure is not just that the payment didn’t arrive. It is that the asset itself may not have fully moved, even when the token did.
What the professional at the table actually needs
For the advisor, the broker, the closing attorney, or the settlement professional coordinating a tokenized-asset deal, these risk vectors translate into a concrete set of questions that need answers before any leg of the transaction moves.
Which leg moves first, and why? If there is a coordination mechanism ensuring both legs move simultaneously — or neither — what is it, and who is responsible for confirming it has operated correctly? If the payment leg runs through traditional banking rails, what is the realistic timeline to final credit, and what is the plan if a compliance hold intervenes? Who holds the token during any gap period, and under what legal authority?
Many fund administrators, custodians, and distributors remain unable to process tokenized transactions seamlessly within existing infrastructure. The professional at the table is often the person who discovers this mid-deal — not because anyone failed to do their job, but because the workflow was designed for the asset leg without adequately accounting for the payment leg.
The fee that the advisor earns, the commission that the broker closes, the compensation that each professional in the deal deserves — all of it is contingent on clean settlement. A deal that closes its token leg but fails its payment leg is not a closed deal. It is a dispute. And disputes are where professional relationships dissolve, liability appears, and years of hard-won reputation takes damage that no deal economics can repair.
When payment lands the same way the token does
The cleanest version of this problem — the version where it stops being a problem — is when the payment leg achieves the same properties as the asset leg. Not faster. Not more transparent. The same. Onchain. Final. Reaching its destination the instant the deal closes, with no float, no correspondent bank queue, no compliance hold between the moment the buyer authorizes and the moment the seller confirms receipt.
When that condition is met, the gap closes. There is no exposure window because there is no window — the settlement is a single moment, not a sequence. The professional who structured the deal goes from managing a timeline to having nothing to manage: the money reaches every wallet it is supposed to reach, in the amounts it is supposed to reach them, the moment the transaction confirms.
This is where a tool like Shaka becomes relevant — not as a replacement for anything the professional does, but as the mechanism through which the payment leg achieves what the token leg already achieves. The deal has been negotiated. The broker’s split has been agreed. The advisor’s share is set. When the transaction closes, Shaka routes those payments onchain, directly to each wallet, in a single transaction, simultaneously. No one sends a wire to one party and hopes they forward the rest. No one waits for a clearing house to net the flows. The token moved atomically; the compensation follows it the same way.
The exposure window exists because money moves differently than tokens. Atomic DvP is only as strong as the cash leg. That principle applies equally to the deal itself and to every payment that flows out of it. Making the cash leg as strong as the asset leg — onchain, final, split correctly on arrival — is how the anatomy of the gap is sealed.
The point of no return
There is a moment in every tokenized-asset deal where the risk picture crystallizes — the point at which one leg has moved and the other has not, and the parties are no longer in a position to unwind what has been done. Call it the point of no return.
Before that moment, a deal that hasn’t settled is simply a deal in process. Both parties carry exposure, but the exposure is symmetric and manageable. A problem can surface and the transaction can be restructured, delayed, or cancelled with minimal damage.
After that moment, the exposure is no longer symmetric. One party has delivered. One has not. The delivering party has surrendered leverage. Whatever rights they retain are legal rights — real, potentially enforceable, but slow and expensive to exercise. The receiving party, whether through genuine distress or opportunistic delay, now holds all the practical power.
In practice, atomicity introduces digital asset settlement exposure to new failure points. If either leg lacks funding, authorization, or system availability at execution time, settlement fails outright. There is no grace period. No overnight margin call. The transaction simply does not occur. The inverse is also true: if one leg completes and the other does not, there is no automatic reversal. The blockchain does not roll back a confirmed transaction. The wire transfer does not recall itself. The point of no return is real, and the professional who manages the deal must know exactly where it falls.
The mechanisms underpinning the circulation of tokens represent an intriguing opportunity for fixing the settlement of traditional securities that typically involve two major stages: the exchange of securities and the exchange of payments. As one banking advisor put it, the payments stage is a major pain point, because in order to settle payments at least several days have to pass between the actual booking of the transaction and its actual settlement.
That pain does not vanish because the asset has been tokenized. It migrates — from the asset leg, where tokenization has genuinely solved it, to the payment leg, where the old problems persist in familiar form. The professional who understands this migration is the one who structures a deal that actually closes. The one who doesn’t may spend the next quarter explaining why a deal that was technically confirmed on the chain never actually settled.
The gap as institutional memory
What is particularly instructive about the non-atomic settlement problem is how it replicates, in a new medium, a set of risks that the financial industry has spent decades engineering around.
Delivery versus payment became a key recommendation from G-10 central banks to strengthen securities settlement infrastructures and reduce systemic risks in global financial markets — not as a theoretical preference, but as a direct response to the settlement failures that cascaded out of the 1987 equity market crash. The lesson was that sequential settlement creates correlated failure: when markets are stressed, the parties most likely to default on their payment obligations are exactly the parties whose defaults are most damaging. The gap is not random; it opens widest at the worst possible time.
Tokenization has not changed that dynamic. It has, if anything, sharpened it — because the speed asymmetry between a token leg and a payment leg is greater than the speed asymmetry between two legs of a traditional T+2 settlement. The token clears in seconds; the wire takes days. The gap is wider in relative terms, even if the deal feels more modern.
One framework distinguishes between complete tokenization, where the token embodies legally enforceable rights, and incomplete tokenization, where the token acts primarily as a digital representation with limited standalone legal effect. Most deals in the market today fall somewhere between those poles. The professional’s job is to understand exactly where on that spectrum a given deal sits — and to manage the settlement structure accordingly, not assume that the presence of a token means the problems of sequential settlement have been solved.
They have not been solved. They have been relocated. And in that relocation, they have become the responsibility of everyone at the closing table — which means, as much as anyone, the professionals who structure and coordinate the deal.
The gap is still there. The question is who builds across it.
