Delivery versus Payment is the foundational primitive of securities settlement. It is also the easiest place to see why tokenised rails are not a wholly new construct but a re-implementation of a model the BIS specified in the early 1990s, on infrastructure that was not technically possible at the time. Operators who can map a tokenised settlement design onto the BIS three-model taxonomy can talk to regulators and clearing operations heads in language they already use. Operators who cannot end up reinventing the vocabulary in the room.
DvP, defined
Delivery versus Payment links the asset leg to the cash leg so that one transfer occurs if and only if the other does. The phrase entered the vocabulary through the BIS Committee on Payment and Settlement Systems' 1992 Delivery versus Payment in Securities Settlement Systems, often called the Parkinson Report. The report responded to failed-trade incidents at major central securities depositories in the late 1980s, where one leg had been performed and the other had not, leaving counterparties exposed to losses outside the trade economics.
The Parkinson framework remains the working reference. The 2012 CPMI-IOSCO Principles for Financial Market Infrastructures restate it; the 2024 CPMI tokenisation taxonomy reaffirms it. When a regulator asks how a tokenised settlement design handles DvP, they are asking which of the three models it implements, and how.
The three models
Model 1, gross-gross. Both legs settle gross, simultaneously, transaction by transaction. Every trade consumes assets and cash at full nominal value at the moment of settlement. Highest atomicity, highest funding cost. Fedwire Securities is the canonical example: securities transfer against funds transfer, trade by trade, in central bank money. Real-time gross settlement (RTGS) systems on the cash side typically pair with Model 1 on the securities side.
Model 2, gross-net. The asset leg settles gross during the day; the cash leg nets across many trades and settles at one or more end-of-day cycles. This is how many CSD-correspondent-bank arrangements have historically operated. The asset settles finally during the day, but cash obligations accumulate on a multilateral basis and settle in netting batches.
Model 3, net-net. Both legs settle on a netted basis at defined cycles. Trades accumulate during the day, the netting engine computes the multilateral net obligation per participant, and settlement happens in batches against a CCP or a settlement bank that absorbs any participant default. Most efficient on liquidity, since participants only fund the net obligation. Largest residual settlement risk if the central cycle fails, and highest reliance on the CCP or settlement bank as the default mutualiser.
The trade-off across the three models is real. Model 1 minimises settlement risk but maximises liquidity demand. Model 3 minimises liquidity demand but concentrates risk in the netting cycle. Model 2 sits in between. Markets historically chose Model 2 or Model 3 because the funding cost of Model 1 was prohibitive at scale: pre-funding gross obligations across thousands of daily trades requires balance-sheet capacity that most participants do not have.
Tokenised DvP is essentially Model 1 without the historical drag
The architectural insight of tokenised DvP via smart contract is that it is structurally Model 1, gross-gross, atomic, transaction by transaction. Both legs sit on the same ledger (or are linked across ledgers via a coordinator pattern). The smart contract that updates the asset balance is the same contract that updates the cash balance, in a single indivisible operation. Either both legs commit or both revert.
What changes is the funding cost. Historical Model 1 was expensive on liquidity because settlement happened in batches with predictable timing, and participants had to stage gross balances in advance and leave them there until the cycle completed. Tokenised Model 1 settles in seconds, on demand. The gross balance only needs to exist at the moment of settlement. Intraday substitution and intraday repo can refresh the funding within the same business day. The Model 1 atomicity guarantee is preserved; the funding penalty that historically pushed markets toward Model 2 and Model 3 is materially reduced, though not eliminated.
This is the technically substantive reason institutions care about tokenised rails. Speed is the marketing claim. Model 1 atomicity at near-instant funding cost is the structural change.
The TCN-relevant case
The Tokenized Collateral Network on Kinexys is the cleanest production example of atomic Model 1 DvP at GSIB scale. When a participant posts BlackRock BUIDL or another tokenised MMF (money-market fund) as collateral against a derivatives position, the asset leg (the MMF token) and the cash leg (or the on-chain collateral acceptance acknowledgment) settle atomically. If either side fails, neither happens. The historical alternative was a multi-day workflow: redeem the MMF for cash, wire the cash to the collateral account, and book the collateral in the counterparty's system. That workflow had a settlement window measured in business days, and it tied up working capital for the duration.
The TCN compresses that to seconds, and (more importantly) closes the settlement window. The credit exposure that previously existed during the multi-day collateral movement no longer exists because the protocol does not allow the asset leg to commit unless the acceptance leg does. The mechanics here are not a wholly new invention; they are a Model 1 DvP design implemented on a permissioned ledger that the BIS framework already classifies.
The same pattern extends across tokenised collateral programmes more broadly: see tokenised collateral for the cross-issuer view, and atomic DvP mechanics for the engineering choices.
Part 3 takes the same DvP logic and applies it to FX, where the historical accident is Bankhaus Herstatt and the institutional response was CLS.