Hook
On September 10, 2024, a coalition of exchange operators — Nasdaq among them, Boerse Stuttgart Group, and several unnamed members — delivered a single ask to Brussels. Raise the ceiling on the EU's tokenized securities pilot. Remove it if you can. Let the sandbox scale.
Buried in the announcement was the only sentence that matters: existing tokenized projects have already breached the cap.
Read that again. A regulatory sandbox, designed to constrain risk while technology proves itself, has participants running hot against a statutory limit. The limit is not a technical parameter. It is a political one — an insurance policy written in 2022 against a failure mode the regulator could not model.
The EU's DLT Pilot Regime caps the value of securities that can be admitted to trading or settled through distributed ledger infrastructure. Approximately EUR 6 billion for a standalone DLT trading venue or settlement system. Roughly EUR 9 billion where trading and settlement are combined under a single license. Cross those numbers and the exemption collapses. The entity is dragged back into full CSDR and MiFID II compliance — the exact rules the pilot was constructed to temporarily suspend.
When an industry asks to be uninsured, the correct question is not whether it is right. The correct question is what the insurance was costing it.
Context
The DLT Pilot Regime entered into force in March 2023, two years after the European Commission proposed it under the Digital Finance Strategy. It created three new license categories: the DLT multilateral trading facility, the DLT settlement system, and the combined DLT trading and settlement system. Each was granted a temporary carve-out from parts of EU securities law — settlement discipline obligations, the requirement that securities be booked in a central securities depository, and selected MiFID II conduct rules.
The carve-out was time-boxed. It was also size-boxed.
The design logic was defensible on paper. Regulators wanted to observe distributed ledger settlement inside a perimeter where a failure could not cascade into the broader market. That requires capping the value at risk. Capping the value at risk also caps the observable behavior. These two constraints sit in direct opposition, and the coalition's letter is an attempt to resolve that opposition in favor of observation.
What the signatories do not say is that the regime was never designed to be a growth channel. It was designed to be an instrument of evidence collection. The Commission wanted to know whether DLT settlement behaves differently from conventional settlement under stress. It did not want a parallel market.
Two years in, the composition of the coalition tells you more than its argument. The signatories are exchanges. Not issuers. Not custodians. Not central securities depositories. Exchanges and the technology vendors that sell to exchanges. Nasdaq does not merely operate a venue; it licenses matching engine and market surveillance software to other venues, including venues that would run DLT infrastructure if the exemption were widened. Boerse Stuttgart Group has operated a DLT-focused segment since 2019 and has been building institutional-grade tokenized issuance and settlement capacity for half a decade.
The commercial exposure is direct and quantifiable. A ceiling on pilot volume is a ceiling on the addressable market for the market infrastructure those firms sell into. That is a legitimate commercial interest. It is also not the same thing as a public interest argument, and the letter blends the two without separating them.
The 2024 backdrop matters. Tokenized treasury products crossed meaningful notional thresholds earlier in the year. Institutional money market funds began appearing on public chains as representations of off-chain assets rather than as crypto-native instruments. The RWA narrative moved from thesis document to allocation memo. Into that environment, a coalition arguing that Europe's regulatory container is too small reads as timely. It is also convenient, and convenience is not evidence.
Core
Strip the lobbying language. What remains is a claim about methodology: that a system cannot be validated below a certain scale.
That claim is probably correct. It is correct for reasons the coalition is unlikely to state plainly, because the plain version implicates the signatories themselves.
The cap constrains liquidity formation, not throughput
There is no disclosed TPS figure in the pilot filings. No published settlement latency distribution. No contention analysis. That absence is not accidental. Nobody has run a DLT settlement system at a load where throughput becomes a binding constraint, because the ceiling is low enough that the question never has to be answered.
What the ceiling does constrain is two-sided flow. Order book depth is a function of participant count and notional. Take a commercial paper and bond issuance pipeline worth several billion euros, spread across a handful of issuers and a small set of institutional buyers, and lock it inside a fragmented permissioned network. You do not get a market. You get a settlement record with a matching engine attached to it.
The failures worth finding do not live at low volume.
During my audit of the 0x Protocol v2 order book matching logic in 2018, I spent three months reading the contract line by line from a Jakarta apartment, cross-referencing every branch against the whitepaper's stated intent. Seven critical edge cases surfaced. Every one of them was load-dependent. Integer overflow in the fill accounting did not trigger at retail order rates. It triggered when the matching loop processed fills in rapid succession, where an intermediate accumulator crossed a boundary before the next validation executed. At one order per second, the contract is bug-free. At a thousand, it is not.
I submitted those findings directly to the repository. No disclosure campaign. No coordinated announcement. The point was never attention. The point was that a system's real behavior only becomes visible under conditions the designer did not anticipate, and those conditions correlate with volume.
The same principle applies to DLT securities infrastructure. Atomic delivery-versus-payment across a permissioned ledger has an untested failure surface: contention between the settlement instruction queue and the cash leg confirmation, under conditions where multiple instructions target the same liquidity. That contention is invisible at a few hundred million euros. At scale, it is where settlement finality stops being a legal concept and starts being an engineering one.
The cap does not prevent the technology from working. It prevents anyone from finding out whether it works.
The permissioned architecture is the risk, not the ledger
The EU pilot runs on permissioned infrastructure. Node admission is controlled by the operator. Operators hold freeze authority, whitelist control, and forced intervention rights. Participants clear KYC, AML, and investor suitability screens. Decentralization is not a design goal here. Accountability is.
That is a defensible architecture. It is also an architecture whose risk profile has almost nothing to do with the cryptographic layer, and the coalition's argument for scale does not touch it.
In November 2022, I spent two weeks reconstructing Alameda Research's wallet clusters after the FTX collapse. Over 500,000 ETH transfers traced across Ethereum and Solana. The ledger was transparent the entire time. Every commingling event between customer funds and proprietary trading accounts was, in principle, visible to anyone running the right queries against public state.
The chain remembered what the CEO forgot.
FTX did not fail because the ledger was opaque. It failed because custody was concentrated in an entity that also controlled the reconciliation process, and no external party verified that reconciliation continuously. The transparency was theoretical. The verification was absent. Trust is a variable; verification is a constant.
Apply that logic to tokenized securities. The distributed ledger does not remove counterparty risk. It relocates it. The operator that controls node access also controls the ability to freeze a settlement mid-instruction, reverse a transfer, or delay a corporate action distribution. A regulated operator is a better-governed counterparty than an offshore exchange. It is still a counterparty, and the pilot's ceiling means the counterparty exposure aggregates slowly enough that the systemic question stays theoretical.
The coalition's argument for raising the cap does not address this. It cannot, because addressing it would concede that the ceiling is doing two jobs at once. It limits systemic exposure. It also limits the accumulation of operator-level power inside a small number of licensed venues.
The cash leg is the bottleneck nobody named
The letter asks to test tokenized issuance, trading, and settlement. Securities issuance. Securities trading. Securities settlement.
It does not mention the payment leg.
Atomic DvP requires two legs that settle simultaneously and unconditionally. Digitize the securities leg while the cash leg resolves through correspondent banking on a T+1 cycle, and you get a hybrid: an instant ledger entry waiting on a slow payment rail. The atomicity is nominal. The settlement window is bounded by the slower leg, and the slower leg is the one the pilot does not control.
The Eurosystem has run exploratory work on central bank money settlement for DLT transactions. The Bundesbank-ECB trigger solution experiments are the most cited. That work is exploratory. Wholesale central bank money is not available as a general settlement asset to pilot participants on demand. Commercial bank money can be tokenized, but tokenized commercial bank money is a claim on a bank, which reintroduces exactly the credit risk the securities leg was supposed to isolate.
This is the interoperability problem, and it is structurally harder than the volume ceiling. The coalition cannot fix it by lobbying. It requires the Eurosystem to commit to a production settlement asset that does not yet exist. Raising the cap without resolving the cash leg produces a larger version of the same incomplete atomicity — more volume moving through a settlement process whose finality depends on an institution outside the ledger.
Silence in the code is where the theft hides. Silence in a regulatory proposal is where the unpriced dependency lives.
The fee pool and the double game
Strip away the technological framing and the economic structure is simple. Tokenized securities do not create a token economy. They create an infrastructure fee pool.
Whoever performs issuance, custodianship, settlement, and market-making captures fees. The pilot's ceiling directly caps that pool's size. That is the mechanical reason exchanges are lobbying and — just as informatively — the mechanical reason several incumbent infrastructure providers are quiet.
If DLT trading and settlement systems are permitted to scale, they absorb functions currently performed by central securities depositories and parts of the intermediary chain. Settlement fees migrate. Corporate action processing migrates. Asset servicing migrates. CSDs understand this. Their response has been a dual strategy: participate in the pilots so they remain inside the room, and support volume ceilings so the migration stays slow enough to reposition against.
The coalition is therefore not a monolith, and its internal cohesion is weaker than the joint statement implies. Exchanges want throughput and market data revenue. Custodians want asset segregation, legal finality, and indemnification against operator error. Settlement providers want the transition to occur after they have rebuilt their own service lines. A letter that says "raise the cap" papers over three incompatible commercial timelines, and a regulator reading it carefully will notice that none of the signatories committed to a shared settlement architecture.
There is also a distributional question the letter does not raise. If the pilot expands while access remains restricted to qualified institutions, the on-chain footprint stays inside a permissioned enclosure and produces no measurable effect on public market structure, public chain activity, or retail participation. Expansion benefits the signatories. It may not benefit anyone else, and the coalition's framing implies a broader public benefit it has not argued for.
Volatility is just noise; liquidity is the signal — and the signal here is who gets to bill for the liquidity once it exists.
The exemption cliff
Here is the risk the coalition's argument omits entirely.
The DLT Pilot Regime grants temporary exemptions. Temporary means expirable. If the exemption is not extended at its review point, every project operating under it faces a compliance cliff: migrate back to traditional infrastructure, or suspend operations. The cost of migration is bounded. This is not a protocol that dies without its community. It is a business process that reverts to the prior rail.
That bounded reversibility cuts both ways. It makes the ecosystem resilient to failure, which is good regulatory design. It also means the ecosystem's moat is the license, not the network effect. There is no two-sided lock-in yet. There are not enough issuers and not enough buyers for winner-take-all dynamics to emerge, and a raise of the ceiling would not create them on its own. Network effects in securities settlement come from liquidity depth and from the cost of switching settlement venues mid-portfolio. Neither exists at pilot scale.
The coalition wants the ceiling raised. It does not want to discuss what happens when the exemption dates out. Prioritizing the first over the second suggests the signatories are optimizing for the addressable market over the next eight quarters, not for the structural durability of European DLT market infrastructure. That is a reasonable corporate strategy. It is a poor foundation for a regulatory argument, and it is the argument they made.
Contrarian
The bulls are not wrong about everything, and the coalition's strongest case is the one it undersells.
A regime that cannot be validated cannot be extended responsibly. Regulators need evidence before they renew an exemption. Evidence requires volume. Volume is capped. The cap is therefore self-defeating from the regulator's own epistemic standpoint. If ESMA and the Commission want a defensible decision at review, they need pilot data that only expanded scale can generate. The coalition is, in effect, arguing that the ceiling prevents the regulator from doing its own job. That is a stronger position than 'we want more business,' and the letter does not push it hard enough.
It is also why a partial raise is more probable than a refusal. Regulators do not need the coalition to be right about commerce. They need to be able to write a review that says something.
The second thing the bulls get right: regulatory competition is real and measurable. The UK's Digital Securities Sandbox, jointly operated by the Bank of England and the FCA, launched in 2024 without the same fixed notional ceilings. Switzerland has had a DLT Act with clear legal foundations and commercially operating infrastructure since 2021. Singapore's Project Guardian runs a broader asset-class remit with less licensing friction. If EU pilot participants cannot demonstrate scale, the case studies that inform global institutional adoption get written in Zurich and London, and the EU's regulatory first-mover position decays into a footnote.
The third point is the one crypto-native readers will misread, and it deserves to be stated flatly. This is not an asset class. Tokenized securities are traditional instruments with a new settlement layer. There is no token to buy. Value accrues to the exchanges, custodians, and settlement providers on the signatory list — and to the listed equity of those firms, not to a governance coin bolted onto a permissioned ledger. Any interpretation of this news as a bullish signal for RWA tokens is a category error, and the error is being made in real time.
Every exit liquidity pool leaves a footprint. The footprint here is in the equity of infrastructure operators and in the policy calendar. It is not in a token chart.
Takeaway
The letter is not a signal. It is a mid-process input with no regulatory response attached, no binding effect, and no third-party validation. The priceable events are downstream: ESMA technical feedback, a formal European Commission proposal, and the exemption review timeline. Until one of those lands, this is a lobbying artifact, not a market event.
My expectation is a conditional raise rather than removal — a higher ceiling bundled with liquidity minimums, investor protection conditions, and a phased asset-class rollout, debt before equity. Full removal would abandon the risk-control rationale the regime was built on, and no regulator does that without data it does not yet have. The number to watch is not the cap. It is who audits the operator's reconciliation process, and whether that verification is continuous or annual. Every tokenized security is a claim on an institution. The ledger does not change that. Only the audit cadence does.