Digital Assets

Six Mechanisms That Decide Whether an Asset Can Be Tokenized

Not the token standard — the machinery underneath it. Six interactive simulations of the mechanics that govern tokenized funds: atomic settlement, the compliance subgraph, mirror-record drift, NAV staleness, liquidity transformation, and a scoring model for what gets tokenized next.

August 8, 2026·1 min read
TokenizationFund ServicesSettlementMarket MicrostructureDigital AssetsSimulation

Most writing on tokenization argues about whether it will happen. That question is settled: money market funds, private credit feeders and bank deposits are already on chain. The open question is narrower and more useful — for a given asset, what has to be true mechanically before a token is anything more than a second copy of the register.

Six mechanisms answer that. Each one below is running live. Drive the controls and watch the constraint bind.

01

Atomic delivery versus payment

Two ledgers, one commit. A hashed timelock makes settlement all-or-nothing across systems that share no coordinator, no clock and no legal entity.

IN FUND SERVICING: a subscription where the cash leg is a tokenized deposit and the share leg is a fund share token — the entire case for T+0, and the only part of tokenization that removes a real cost line rather than moving it

1 propose
2 lock cash
3 lock shares
4 reveal
5 settled
Cash leg — tokenized deposit
Investor 1,000,000 USD
Fund 0 USD
idle
Share leg — fund share token
Investor 0.00 units
Fund 250,000.00 units
idle
Settled0
Reverted whole0
Partial settlement0
Cash locked$0

Idle. Run a settlement, then try to break it.

The counter that matters is the third one. It stays at zero under every failure you can inject, because neither leg debits on lock — the lock is an encumbrance, and only the preimage reveal converts it to a transfer. The asymmetry is doing the work: the share leg's timeout must expire strictly before the cash leg's, so the party who learns the secret first is never the party who can still walk away. Invert that ordering and you have built a free option for the counterparty rather than a settlement system. What survives from the old world is the encumbrance itself; what disappears is the two-day window in which the fund carries counterparty exposure it did not price.
02

The compliance subgraph

Every transfer is a boolean predicate over both parties' claims. The permitted-transfer relation forms a graph, and tradable float is bounded by its largest connected component — not by the number of tokens issued.

IN FUND SERVICING: Reg D 506(c) accreditation, jurisdictional whitelists, lockups and holder caps compiled into the transfer function itself — the whole substance of the ERC-3643 style permissioned standards

US180kUS40kUS120kUS220kEU160kEU35kEU95kUK110kUK70kSG130kSG25kCH90k
Node fill = eligible to transfer at all. Ring = accredited. Line = a legally executable transfer between that pair.
Permitted pairs10 / 66
Largest component5 holders
Tradable float60%
Stranded islands0

Active predicates: accreditation, jurisdiction whitelist (US, EU, UK), lockup. Issued supply 1275k units; 60% of it sits inside one tradable component.

Turn every rule on and the holder base fragments into jurisdictional islands: the token is fully compliant and almost entirely illiquid. Turn them off and you have a bearer instrument you cannot lawfully issue. The real design space is the middle, and the metric nobody quotes in a tokenization pitch is the one on the right — float = supply held by the largest eligible component / total supply. A fund can tokenize a billion dollars and produce a market of forty million if its holder set partitions. This is also why the feeder-fund wrapper dominates in private markets: one feeder per jurisdiction keeps each component internally complete, at the cost of never merging them.
03

Mirror-record drift

When the official register stays off chain and the token is a mirror, the two are eventually consistent. The size of the inconsistency is not a mystery — it is Little's law.

IN FUND SERVICING: the model actually shipping today — the transfer agent keeps the master securityholder file and the chain carries a mirrored record, so every in-flight event is a position that exists in one book and not the other

predicted λW = 4.8records present in the register but not yet final on chainpeak 10
In flight now0
Observed mean0.0
Predicted λW4.8
Breaks at last strike0

Vertical rule = NAV strike. Whatever is in flight at the strike is a reconciliation break the following morning.

The observed average converges on L = λW and there is nothing you can do about it except shrink one of the two terms. Latency is bounded by the chain's finality; arrival rate is bounded by your own distribution success. Which means the operational cost of a mirrored design scales with adoption — the better the token sells, the more breaks the transfer agent clears at cut-off. Push the rate up and watch the strike-time break count climb linearly. The honest read is that mirroring is a migration strategy with a running cost, not a destination: the cost only goes to zero when the mirror becomes the register and the reconciliation has nothing left to reconcile.
04

NAV staleness and the arbitrage band

A fund share is priced once a day. A token trades continuously. The gap between them is not mispricing — it is the accumulated diffusion since the last strike, bounded by whatever it costs to arbitrage against the primary market.

IN FUND SERVICING: the reason a tokenized share class either needs an intraday NAV capability or a creation and redemption mechanism borrowed wholesale from the ETF world

3 trading days
Mean |premium|
Max premium
Time outside band
Strike interval24h

Green step = struck NAV. Shaded band = the no-arbitrage corridor. Light line = secondary token price.

Mean absolute premium scales as σ√Δt, so quadrupling the strike frequency halves it — a cheaper lever than any amount of secondary market-making. That is the entire quantitative argument for intraday NAV in a tokenized share class, and it is why money market funds went first: at a stable NAV with sub-1% volatility, σ√Δt is small enough that a daily strike already keeps the price inside the friction band, and the token can trade at par all day without anyone arbitraging it. Push the volatility slider toward an equity fund and the band stops containing the path. At that point you are no longer distributing a fund share; you are running an ETF, and you need authorised participants, a creation unit and a basket.
05

Liquidity transformation and the first-mover premium

Tokenizing an illiquid asset does not make it liquid. It relocates the illiquidity into a queue, and a queue with a fixed buffer at its head pays the front of the line out of the back.

IN FUND SERVICING: tokenized private credit and private equity feeders sold on 24/7 transferability with minimums as low as $500, against an underlying that settles in weeks

parNAV left for holders who stayedredemption order, first to last
First out receives100.00
Last out receives97.82
First-mover premium218 bps
Stayers left with97.75

No swing, no gate: early redeemers exit at the last struck NAV, funded by forced sales, and the haircut lands on whoever is still in the queue.

The first-mover premium is the price of a run, and it is created by the wrapper, not the asset — the underlying loans never repriced. Turn on swing pricing and it collapses to roughly zero, because each redeemer now pays their own liquidation cost instead of socialising it onto the people behind them. That single toggle is the difference between a tokenized feeder that behaves like a fund and one that behaves like a bank without deposit insurance. The uncomfortable part for the distribution story: swing pricing is exactly the feature that removes the instant, at-par liquidity the token was sold on. You can have the 24/7 exit or you can have par, and the honest products price the difference rather than hiding it in a buffer.
06

What gets tokenized next

Not a forecast — a scoring model. Six factors decide the order, and a fixed-cost break-even decides whether the vehicle is big enough to bother. Move the weights and watch the queue reorder.

IN FUND SERVICING: the actual question on a product roadmap — which fund lines justify a tokenized share class in the next eighteen months, and which are a pilot that never scales

01
Government money market fund
$2.4m
02
Tokenized bank deposit
$3.0m
03
Direct US treasuries
$900k
04
Repo and collateral mobility
$2.3m
05
ETF share class
$360k
06
Investment grade credit
$360k
07
Mutual fund share class
$400k
08
Auto and consumer loan pools
$360k
09
Private credit feeder
$650k
10
Trade receivablesbelow break-even
$150k
11
Private equity feeder
$525k
12
Insurance linked securitiesbelow break-even
$240k
13
Voluntary carbon creditsbelow break-even
$80k
14
Real estate equitybelow break-even
$240k
Lines clearing cost10
Below break-even4
Top of queueGovernment money market fund

Break-even compares annual run cost against bps of operating spend the format actually removes, applied to a typical vehicle size for that asset class.

Under any weighting that respects what institutions are actually paying for, the same four sit at the top: government money market funds, tokenized deposits, direct treasuries and repo collateral. They win on collateral reuse — the ability to post the same instrument twice in a day is worth more than any settlement saving. Private credit and private equity feeders score highly on access economics and badly on everything else, which is exactly the profile of a product that raises headlines and modest assets. Drag the cost slider up and watch the bottom half fall away: real estate equity, carbon, receivables and cat bonds all fail on vehicle size long before they fail on technology. The constraint is not whether you can tokenize them. It is whether the line is large enough to amortise a second register.

The common thread: every one of these mechanisms is a constraint on who may hold, when, and at what price — and none of them is a property of the token. Atomicity is a lock ordering. Float is a subgraph. Drift is a queue. Premium is a diffusion. The run is a buffer. Tokenization does not relax any of them. What it does is make each one explicit and executable, which is genuinely valuable and considerably less than what it is usually sold as.

All simulations run client-side; parameters are illustrative and calibrated to public disclosures, not to any single fund.

Share this article