ECB Outlines Three Models: Decision Points in Focus

The ECB outlined three models for putting central bank money onchain, but the practical market signal for traders and institutions is a clearer regulatory pathway for tokenized settlement. By categorizing approaches as full DLT integration, hybrid issuance, or third-party tokenization, the ECB signals which infrastructure investments will likely comply with Eurosystem oversight. The material uncertainty is whether these models will accommodate existing stablecoin rails or force a separate settlement layer.

How the ECB's three models change settlement finality for traders

The practical question for any institution exploring digital settlement is whether the new infrastructure changes how money actually moves. The ECB's three models—known internally as the Pontes and Appia projects—answer that question by defining the relationship between the central bank ledger and the commercial bank ledger. Each model shifts who holds the liability and how settlement finality is achieved, which directly affects the liquidity and operational risk that treasury and payments teams must manage.

In the first model, the central bank issues a tokenized claim directly to end users, making the central bank the sole settlement agent. This gives the highest degree of finality because the liability sits on the central bank's balance sheet, but it also requires the central bank to manage retail-facing infrastructure, a role it has historically avoided. The second model places the tokenized claim at the commercial bank level, with the central bank providing only the wholesale settlement layer.

Here, the commercial bank absorbs the credit risk of its own tokenized liabilities, and the central bank's ledger clears only the net interbank positions. The third model is a hybrid: a common platform where both central bank and commercial bank money coexist in the same DLT environment, with smart contracts governing the settlement logic between the two liability types.

The material limit to watch is legal finality under each model. Tokenized settlement on a distributed ledger does not automatically inherit the same legal status as a conventional central bank transfer. Until the Eurosystem clarifies whether a DLT-based transfer of a tokenized central bank claim constitutes final settlement under the Settlement Finality Directive, the operational risk cannot be fully priced.

For a reader evaluating these models, the immediate check is whether your institution's treasury operations require the same legal certainty as TARGET2 or whether a contractual settlement framework is acceptable during the pilot phase.

Workflow checks for the direct tokenized model

The ECB's strongest supported model—direct tokenized central bank money—gives commercial banks a token claim on the central bank's balance sheet, settled on a shared DLT platform. In practice, this means the central bank issues a digital token that represents a direct liability, and commercial banks hold and transfer that token on the same ledger where securities or other tokenized assets live.

The operational advantage is atomic settlement: the asset and the payment leg settle simultaneously, removing the timing mismatch that creates credit risk in traditional delivery-versus-payment systems. The ECB's Pontes project tests exactly this workflow, using a dedicated DLT infrastructure that connects the central bank's existing settlement system to a tokenized asset ledger.

The mechanism works only if the central bank controls the token's issuance and redemption rules on that shared ledger. Commercial banks would submit a request to the central bank's node, which then mints or burns the token against the bank's reserve account held on the legacy TARGET system. The consequence for a trading desk or treasury operation is a single, verifiable record of the settlement event, visible to both the central bank and the commercial bank, without reconciliation across separate databases.

The Block's reporting confirms that the ECB is building this infrastructure through the Appia project, which focuses on the DLT layer itself, separate from the Pontes project's focus on the settlement interface.

The material limit is adoption scale. The ECB has not yet specified whether this model will support cross-border or multi-currency settlement, and the current tests involve only a limited number of participating institutions. A trading desk evaluating this infrastructure should confirm whether its counterparty banks are part of the ECB's pilot group and whether the specific asset class they settle—such as government bonds or money market fund shares—is included in the Pontes test scope.

Without that confirmation, the workflow remains a prototype rather than a production option.

Decision points: liquidity, counterparty risk, and model selection

The three-model framework introduces a control trade-off that institutions must weigh before choosing a path. Under the direct tokenized model, the central bank retains full control over the liability and settlement finality, but commercial banks lose the ability to manage liquidity across separate ledgers. The second model—synthetic central bank money—lets commercial banks issue their own tokenized liabilities backed by reserves held at the central bank, giving them more flexibility in liquidity management.

The third model, a liability transfer mechanism, moves existing central bank deposits across a DLT bridge without creating new token forms, preserving the current legal structure but adding settlement latency constraints.

The critical decision boundary is not technical feasibility but operational risk allocation. A commercial bank that prefers the direct token model gains atomic settlement on a single ledger but must maintain its liquidity buffer entirely in that token, which may not be fungible with off-chain reserve accounts during stress periods.

The synthetic model solves that problem by letting banks net intraday positions across systems, yet it introduces counterparty risk: the token is only as good as the issuing bank's reserve backing, and the central bank does not guarantee the token in the same way it guarantees direct liabilities. The liability transfer model avoids both token design and counterparty questions, but it depends on the bridge's throughput and may not support the transaction volumes required for wholesale settlement during peak trading hours.

For a trader or settlement operations lead, the practical check is which model your custodian or prime broker has signaled. The ECB has not mandated a single model; the Pontes and Appia projects are testing all three in parallel. If your institution's settlement flow requires real-time finality across multiple asset classes, the direct token model offers the strongest guarantee but the narrowest liquidity pool.

If you need to preserve existing reserve accounts and netting workflows, the synthetic model is the more pragmatic fit—but only if your counterparty's reserve backing is verifiable on-chain. The unresolved condition is interoperability: no model yet solves how a token from one central bank's DLT infrastructure settles with a token from another jurisdiction's system. That gap defines the next decision point after model selection.

For traders and settlement operators, the key decision check is whether the direct tokenized model's settlement finality justifies the loss of multi-ledger liquidity management, or whether the synthetic model's flexibility outweighs the added credit risk from the issuing intermediary. The ECB has not committed to a single path, and the Pontes and Appia projects remain experimental, so the practical next step is to monitor which model gains adoption in live wholesale trials before reallocating collateral or custody workflows.

Reference

• https://www.theblock.co/news/regulation/2026-10-02-ecb-outlines-three-models-for-putting-central-bank-money-onchain-417552