Skip to main content
Request a demo
Financial assets

Treasury Tokenization

Short-dated sovereign debt held to maturity, issued as a permissioned token with daily accrual and redemption at par.

Standards, ordered by control over a transferFour token standards as rungs, from one where anyone may hold up to one where a transfer can be refused by the contract itself.ERC-20anyone may holdERC-1155batched, still openERC-4626a vault around oneERC-3643a transfer can be refused

Definition

Treasury tokenization represents a claim on a portfolio of short-dated government bills held by a custodian. The instrument accrues rather than trades: its value at any moment is the amortised cost of the underlying paper plus accrued interest, and it redeems at par on a known date.

What it solves

  1. Idle cash earning nothingTreasury exposure has historically required a brokerage relationship and a minimum. A tokenized claim moves the minimum down to whatever the issuer sets.
  2. Settlement latency on redemptionsA holder who needs cash waits on a settlement cycle. A register that knows exactly who holds what can process a redemption the moment the policy allows it.
  3. Opaque backingThe single question every holder asks is what actually backs it. A custody attestation attached to the instrument answers it with evidence rather than assertion.

How it works

  1. Bills are bought and heldA custodian holds the underlying paper in a segregated account in the vehicle’s name.
  2. Units represent a proportional claimEach unit is a fraction of the portfolio, not of one specific bill.
  3. Value accrues dailyA valuation is recorded against the asset on a stated cadence, and yield accrues rather than being distributed as coupons.
  4. Redemption pays at the prevailing valueUnits are burned and the holder is paid, priced at a valuation somebody signed rather than one the system inferred.

Architecture

A custody account holding the bills, an oracle or manual valuation feed recording the portfolio value on a schedule, a permissioned token whose transfer rules encode the eligibility restrictions, and a redemption engine that burns units and recognises the payable in a single transaction.

How the platform is arrangedFour stages — asset, compliance, offering and register — connected left to right, all enclosed by a single transaction boundary that rests on a double-entry ledger.AssetStructured and documentedCompliancePolicy in forceOfferingA book that is derivedRegisterHolders of recordOne transaction boundaryA movement and the entries behind it commit together, or neither doesDouble-entry ledgerEvery movement, both sides, in minor unitsBalanced at COMMIT
Four stages inside one transaction boundary, on one ledger. A register that disagrees with the cash is not a state the software can reach.

Tokenization lifecycle

  1. Vehicle establishedA fund or SPV able to hold sovereign paper in the target jurisdiction.
  2. Portfolio purchasedBills bought and lodged with the custodian.
  3. Units issuedSubscriptions allocated and issued against settled cash.
  4. Accrual and reportingValuations recorded, holdings reported, attestations published.
  5. Redemption or maturityUnits retired at the prevailing valuation.

Supported token model

Permissioned fungible token. Every unit is identical and interchangeable, so fungibility is correct. Transfers depend on who the recipient is, so the standard must carry an on-chain eligibility check — a plain fungible token cannot express that and is the wrong instrument.

Asset requirements

What must be true before this can responsibly be tokenized at all.

  • A custodian holding the underlying bills in the vehicle’s name, in a segregated account.
  • A stated valuation methodology and cadence — amortised cost or mark to market, and who signs it.
  • A liquidity policy covering how redemptions are met when bills have not matured.
  • Independent attestation of holdings at a stated frequency.

Compliance considerations

  • Almost always a security; the classification must be settled per jurisdiction before offering.
  • Eligibility is typically restricted to professional or accredited investors in most jurisdictions.
  • Concentration and jurisdiction rules are encoded as policy and evaluated on every subscription and transfer.
  • Proof of reserve is a disclosure obligation as much as a technical one.
A compliance policy as ordered rulesRules are evaluated in sequence and the first match decides. A subject matching no rule is denied, and a fact the platform does not know never satisfies a rule.Subjectan investor's facts#1Screening hit is openreject#2Country in the blocked listreject#3Professional or institutional, verifiedallowMatched no ruledenyFirst matchdecides. A laterallow cannot undoan earlier reject.Eligibility comesfrom a rule saying so.
Rules are data, evaluated in sequence, and the first match decides. A subject matching nothing is denied — eligibility comes from a rule saying so, never from no rule objecting.

Investor workflow

  • Verify identity to the standard the instrument requires.
  • Subscribe against published terms and fund by reference.
  • Receive units; value accrues without any action.
  • Redeem within the policy’s notice period, or transfer where permitted.

Issuer workflow

  • Establish the vehicle and custody.
  • Configure the token and the redemption terms.
  • Publish policy, open the offering, allocate and issue.
  • Record valuations on cadence and publish attestations.
  • Process redemptions against the prevailing valuation.

Payments

Subscriptions are matched by reference and held as an investor liability until allocation settles. Redemption proceeds are recognised as a payable to the holder at the moment the units are burned, and discharged when the payment is recorded.

The payment railMoney is matched to a subscription by its reference and no other attribute, then screened and settled. Provider adapters for card and crypto rails are not built, and are drawn as an absent component.ReferencechecksummedFunds arrivebank or custodyReconcilereference or nothingScreenAMLSettlesecond authoriserSuspense (2900)unidentified, and visibleNo reference matchProvider adaptersCard, local rail, stablecoinNot built — the registry ships empty
A reference is the only thing that matches money to a payment. Everything else is an exception for a person, and unidentified credits post to suspense where they stay visible.

Lifecycle servicing

Servicing is valuation-led rather than distribution-led: there are no coupons to pay, so the recurring obligations are recording the portfolio value, publishing attestations and meeting redemptions.

How a distribution is splitA funded pool is divided among holders of record as at the record date using largest-remainder allocation, then withholding is deducted from each holder's gross rather than from the pool.Funded poolone exact amountRegister as atthe record dateRebuilt from confirmedmovements, not today’sbalancesNet to the holderWithheld, from that holder’s grossThe lines sum to exactly what was fundedLargest-remainder allocation, so no minor unit is created or lost. Rounding each slice independently leaves the issuer a few units out every cycle.There is no per-jurisdiction withholding matrix in this build — one rate is entered per run.
Holders of record as at the record date, split by largest remainder so the lines sum exactly, with withholding taken from each holder’s gross rather than off the top of the pool.

Secondary transfer

Transfers are permitted between eligible holders subject to the same policy as issuance. Because the instrument accrues rather than paying income, a transfer carries the accrued value with it and needs no ex-date handling.

The transfer gateA transfer request passes through eight compliance checks. Any single failure refuses the transfer; the same gate is evaluated off-chain and on-chain.Senderholds unitscanTransfer( )Sender holds the unitsNeither party frozenLockup expiredRecipient eligible under policyJurisdiction permittedInvestor type permittedHolding limit not breachedSanctions screening clearRecipientunits move, or none doOne implementation. The Solidity module and the register evaluate the same rules.
One implementation of the gate, not two. The function the register calls is the same one that mirrors the Solidity compliance module check for check, so an off-chain gate and an on-chain gate cannot drift.

Risks

Named plainly. An instrument whose risks are only in a footnote has been mis-sold before it has been issued.

  1. It is not a bank depositThere is no deposit insurance. The holder is exposed to the vehicle, the custodian and the sovereign.
  2. Liquidity mismatchOffering daily redemption against paper that matures on fixed dates is a mismatch that must be funded, disclosed and stress-tested.
  3. Valuation stalenessA valuation recorded weekly and redeemed against daily transfers value between holders.
  4. Custodian concentrationOne custodian is one point of failure, and an attestation describes a moment rather than a state.

How we support it

  • Valuation records with a stated method and an accountable signatory.
  • A redemption engine that burns units and recognises the obligation in one transaction, so a holder’s units are never destroyed without the payable existing.
  • Per-holder ledger accounts, so “how much of our cash belongs to this investor” is a balance rather than a query somebody has to write correctly.

Questions

Is the yield guaranteed?

No. It reflects the underlying paper less fees, and the underlying is subject to sovereign and reinvestment risk.

How quickly can I redeem?

Within the notice period the instrument’s terms set. Instant redemption requires a liquidity buffer, which is a cost the terms must account for.

What proves the bills exist?

A custody attestation at a stated frequency. It evidences what an attestor observed at a point in time, which is a meaningful control and not a continuous guarantee.

Next steps

Bring an instrument you are actually considering. Structuring something real is the only way to judge whether the model fits.

Request Enterprise DemoAll tokenization topics