Project Ensemble is the HKMA-led wholesale CBDC and tokenisation sandbox that turned Hong Kong into the most architecturally explicit "tiered ledger" jurisdiction in APAC. The model puts a wholesale CBDC settlement layer operated by HKMA at the base, tokenised deposit and tokenised asset layers operated by licensed commercial banks above it, and a set of API standards designed to make those layers interoperate without forcing every participant onto a single ledger. For a tokenisation product team, Ensemble is the reference example of the architecture several other APAC jurisdictions are converging on, and the path from sandbox to production matters because that is where the HKMA's posture on cross-bank interoperability and on the scope of tokenised assets eligible for wCBDC settlement gets resolved. As of late April 2026, HKMA had not published a comprehensive Phase II milestone update in the surfaced raw entries, so the architectural picture below is read from earlier published material plus the broader hong kong regulatory direction.

The tiered-ledger model

The cleanest way to describe Ensemble is as three logically separated layers:

The wCBDC settlement layer sits at the base. HKMA operates the wholesale CBDC, which is central-bank money on a permissioned ledger restricted to the licensed bank population and approved direct participants. Settlement of interbank obligations between Ensemble participants resolves on this layer. The wCBDC is not retail-facing, does not circulate outside the participating institutions, and does not substitute for bank money in customer-facing flows. Its job is to provide the central-bank-money settlement asset for the layers above.

The tokenised deposit layer sits above the wCBDC. Each commercial bank participating in Ensemble runs its own tokenised deposit infrastructure, representing customer deposits as on-chain claims against the issuing bank. A tokenised deposit is the customer's bank-money claim represented in a programmable form. It is not a stablecoin. It carries the issuing bank's credit risk. It does not have a redemption right at par against an HQLA reserve; it has a depositor's claim against the bank. Cross-bank movement of tokenised deposits requires settlement on the wCBDC layer, because a tokenised deposit at Bank A is a claim on Bank A and cannot become a claim on Bank B without an interbank settlement step.

The tokenised asset layer sits alongside the tokenised deposit layer rather than above it. Asset issuers, asset managers, and infrastructure providers can issue tokenised funds, tokenised bonds, and tokenised carbon credits onto ledgers that participate in Ensemble. Settlement against the tokenised asset is delivery-versus-payment with the cash leg cleared on either the tokenised deposit layer (for retail-facing or intra-bank flows) or the wCBDC layer (for interbank or institutional flows where central-bank money is required).

The interoperability story is the part that distinguishes Ensemble from a single-ledger CBDC pilot. Ensemble does not require every participant to migrate to a single chain or single technology stack. The architectural commitment is to API standards that allow heterogeneous ledgers, including bank-internal stacks and external infrastructure such as Canton-based or Fabric-based networks, to settle DvP and PvP atomically across the layers. Whether that commitment holds at production scale is one of the live questions the path to production is meant to answer.

Asset-class scope in earlier sandbox phases

The earlier sandbox phases under Ensemble exercised the architecture against three named asset classes:

Tokenised funds. Asset managers in Hong Kong have been the most visible early participants, particularly for tokenised money-market funds and tokenised authorised funds. The asset-class pairing with the tokenised SFC-authorised funds framework (covered separately under hong kong's regulatory developments) is deliberate: Ensemble provides the cash-leg settlement infrastructure that an SFC-supervised tokenised fund needs to be tradeable on a regulated venue with credible DvP.

Tokenised bonds. Hong Kong issued tokenised green bonds in 2021 and 2023 as standalone pilots before Ensemble formalised the architecture, and the tokenised-bond track inside Ensemble inherits that history. The 2023 issuance proved that an HKD-denominated tokenised bond could clear through the existing institutional infrastructure; the Ensemble architecture extends that proof to the wCBDC settlement leg.

Tokenised carbon credits. The carbon-credits track is the more experimental of the three. The asset-class question, whether a tokenised carbon credit is a security, a commodity, or a sui generis instrument, is unsettled in most jurisdictions, and Ensemble provided one of the few institutional-grade venues to test the settlement plumbing against a non-financial-asset use case. The lessons from that track are most relevant for any operator looking at sustainability-linked tokenisation products outside the conventional fund and bond shape.

The asset-class scope deliberately stops short of tokenised equities and tokenised private credit at the sandbox stage, although neither is foreclosed. The choice to start with funds, bonds, and carbon credits reflects the assets where the legal-construction question (see Tokenisation, defined) is closest to resolved in Hong Kong, and where the institutional counterparty population is most ready.

Participant banks

The participant population in Ensemble is drawn from the licensed bank population in Hong Kong, with the largest international and domestic bank groups visible in earlier published material. As of late April 2026, HKMA had not published a fully updated participant roster in the surfaced raw entries, and operators tracking the pilot should treat any participant list reported in secondary press as provisional. What is more durably true is that the architecture is designed around a multi-bank tokenised deposit layer rather than a single bank's infrastructure, which is what distinguishes Ensemble from an internal bank tokenised-deposit programme.

Participation is not identical to integration. A bank can be a named Ensemble participant for the wCBDC sandbox without yet running a production tokenised deposit ledger interoperable with the wCBDC layer. The graduation question is which participants have moved from sandbox-only participation to running production tokenised deposit infrastructure that settles against the wCBDC, and HKMA has been deliberate about not pre-announcing that line.

API standards and interoperability

The interoperability commitment in Ensemble is operationalised through a set of API standards intended to allow different ledgers and different technology stacks to participate. The standards cover identity and entitlement (which counterparty can act on which asset on which ledger), settlement instruction (the messaging shape for atomic DvP and PvP across layers), and reconciliation (the messaging shape for confirming settlement finality and posting the obligation against the wCBDC layer). The practical effect is that a tokenised fund issued on a Canton-based ledger can settle against a tokenised deposit at a participating bank that runs a different stack, with the cash leg cleared on the wCBDC layer if institutional and on the tokenised deposit layer if intra-bank.

The architectural alternative, "everyone on a single chain," was deliberately rejected. The reasoning, drawn from earlier HKMA published material, is that a single-chain model would force technology-stack convergence as a precondition for participation and would put HKMA in the operational position of running the only ledger of record for the entire commercial-bank tokenisation stack. Neither was acceptable. The API-standards model preserves the principle that commercial banks operate their own customer-facing infrastructure and that HKMA operates only the central-bank-money settlement layer. That is also the principle that distinguishes the wholesale CBDC question from a retail CBDC question, which Ensemble does not address.

Path from sandbox to production

The graduation question is the most operationally important one for any participant or counterparty. A sandbox is a controlled environment for testing flows that are not yet production-grade. A production deployment means real customer obligations, real legal finality, and real supervisory oversight on a continuous basis. The transition involves at least three discrete questions:

Legal finality. Does settlement on the wCBDC layer constitute legal finality under Hong Kong law in the same way that settlement through CHATS does today. The answer must be yes for the wCBDC to function as a wholesale settlement asset; the question is whether HKMA reaches that designation through existing payment-systems law or through a new instrument.

Participant licensing. Which tokenised-asset issuers are eligible to issue onto Ensemble's tokenised asset layer in production. The fund-side answer routes through SFC supervision (see SFC HK). The deposit-side answer routes through banking supervision. The cross-asset-class case for, say, a tokenised carbon credit issuer that is neither a bank nor a regulated fund is more open.

Supervisory perimeter for the API standards. If the standards become a precondition for cross-bank tokenised settlement in Hong Kong, they become regulatorily load-bearing in a way that goes beyond a sandbox commitment. Whether HKMA gazettes the standards as supervisory requirements, publishes them as voluntary guidance, or routes them through an industry body is a meaningful design choice that has not been publicly resolved.

The path is not "sandbox closes, production opens" in a single step. It is more likely to be a graduated production rollout where particular asset-class flows go live first (tokenised funds and tokenised bonds are the obvious candidates), with carbon credits and any new asset classes following at a slower cadence.

Comparison with Project Guardian, Acacia, and PIP

The four major APAC sandboxes diverge on architecture in ways that matter for any product team picking a jurisdiction:

MAS Project Guardian (Singapore) is the broadest in asset-class scope and the most public on workstream pilots, including tokenised wealth management, FX, and fixed income. Guardian does not make the same architectural commitment to a tiered-ledger model. The cash leg in Guardian pilots has run variously on tokenised deposits, regulated stablecoins, and bank money on conventional rails, with the choice driven by the workstream rather than by an overarching wCBDC architecture.

Project Ensemble (Hong Kong) is the most architecturally explicit on the tiered-ledger commitment and on the wCBDC as the central-bank-money settlement asset. Ensemble's asset-class scope has been narrower than Guardian's in the early phases.

RBA Project Acacia (Australia) has been the most academically published of the four, with detailed working papers on the wholesale CBDC design space. Acacia's pilot scope on real-world institutional flows has been narrower than either Guardian or Ensemble in production terms, although the published research output has been more cited internationally.

FSA Japan Payment Innovation Project (PIP, see Payment Innovation Project) is the most pragmatic of the four. PIP has graduated specific institutional pilots into production-track work, most visibly the Nomura-Mizuho-JSCC tokenised JGB collateral trial on Canton Network announced in April 2026. PIP does not make the same architectural commitment as Ensemble to a wCBDC layer; the cash leg in Japanese pilots routes through tokenised deposits and trust-issued stablecoins rather than through a central-bank-money tokenised settlement asset.

The takeaway for an operator: Ensemble is the right reference if the product needs central-bank-money settlement on a tokenised rail. Guardian is the right reference if the priority is asset-class breadth and access to a broader counterparty pool. PIP is the right reference if the priority is graduating an institutional pilot into production with megabank counterparties. Acacia is the right reference if the priority is reading the working-paper-grade analysis of wholesale-CBDC design choices.

Cross-border implications

The cross-border story is where Ensemble interacts with the broader APAC settlement infrastructure. Three threads are visible:

mBridge under post-graduation governance. mBridge graduated from the BIS Innovation Hub in 2024 and continues under the participating central banks' governance. HKMA is one of those central banks. The interaction question is whether the wCBDC layer in Ensemble eventually connects to mBridge as the cross-border settlement leg for HKD-denominated wholesale flows. Public material has been thin on this through late April 2026.

Bilateral settlement bridges. Several of the participating bank groups in Ensemble run their own cross-border settlement infrastructure, including JPM Kinexys, Partior, and Fnality. The Ensemble architecture does not preclude those bridges; it provides a wCBDC settlement layer that they could potentially settle against on the HKD leg.

BIS Innovation Hub Hong Kong Centre. The Hong Kong Centre's research agenda has touched wholesale CBDC, tokenised assets, and cross-border settlement from inception. The relationship between the Centre's published research and HKMA's operational Ensemble work has not been re-stated post mBridge graduation, and operators tracking the space should expect a clarifying communication in the next reporting period.

Open questions

• HKMA had not published a comprehensive Phase II milestone update in the surfaced raw entries through late April 2026.
• The graduation criteria for moving from sandbox to production participation are not publicly specified.
• The interaction between Ensemble's wCBDC layer and licensed stablecoins under the Stablecoins Ordinance perimeter is not architecturally resolved in public material.
• The cross-border story, particularly the mBridge interaction, is the most opaque element of the public picture.

Related

• Project Ensemble.
• hong kong.
• HKMA.
• BIS Innovation Hub.
• Payment Innovation Project.
• Canton Network for the technology-stack reference relevant to Ensemble's API-standards interoperability.
• Tokenisation, defined for the legal-construction questions that underpin tokenised assets in any of the layers.
• Permissioned blockchains for the validator and governance context relevant to the Ensemble API standards.