The dual record

What it is

For a century, a security had one record. The register. One place where the position lived, one place where ownership changed hands, one place where income was paid and corporate actions happened. Every operating model in asset management, every custody agreement, every reconciliation process, is built on that single assumption. Last week, the assumption expired.

On 28 October, DTCC launched its Tokenization Service, minting tokenised representations, digital twins, of securities held at DTC, the depository that custodies more than $114 trillion in assets. The twins retain the ownership rights, investor protections and economic entitlements of their traditional counterparts. They can be converted between traditional and tokenised forms. They can be delivered to digital wallets. And the traditional record keeps running alongside.

The same week, Clearstream said the CSSF had authorised it to act as control agent under Luxembourg's Blockchain Law IV, letting asset managers issue tokenised fund shares without launching a new vehicle, a tokenised share class inside the existing umbrella. And Boerse Stuttgart's Seturion received a pan-European DLT Trading and Settlement System licence, the first exchange group to hold one.

Read those three announcements together and the shape of the next decade appears. This is not a migration, where the old system is switched off. This is a duplication, by design. The industry has decided that the same share will exist in two places at once, and the bridge between them is now part of the core infrastructure.

Why it matters now

Three reasons.

First, the scale is real and the participants are not experimental. Twenty DTC participants signed at launch: Alpaca and Apex, Barclays and Bank of America, Citi, Fidelity, J.P. Morgan, Morgan Stanley, State Street, UBS. The regulatory envelope is real too: a December 2025 SEC no-action letter covers Russell 1000 constituents, ETFs tracking major indices and U.S. Treasury securities. This is not a sandbox.

Second, the pattern is jurisdictional, not local. The depository layer moved in the United States, the fund register layer in Luxembourg, the settlement layer in Europe. ESMA is now consulting on tokenised collateral in central clearing, including the question of what happens to a token in a clearing member default. A firm that treats last week as an American story will meet it again in Europe, then in Asia, then in its own middle office.

Third, and least glamorously, the operational consequence is reconciliation. Corporate actions, income, proxies, collateral pledges: every one of those workflows now has a second source of truth. A dividend paid on the traditional register must be matched against the entitlement recorded on the network. A corporate action announced on one rail must be echoed on the other. None of these workflows has a standard for choosing which record it trusts. The breaks will not announce themselves. They will arrive as exceptions.

What firms should do

First, draw both rails on the same canvas. The traditional custody chain and the tokenised one, with every connection marked: the conversion gate, the wallet, the control agent. If your operating model cannot show both rails and the bridge between them, you do not yet have an operating model for what your custodian is already offering you.

Second, designate authority process by process. Decide, per workflow, which record is authoritative, and specify the reconciliation for the other one deliberately. The default, that the traditional register remains authoritative and the token follows, is a defensible choice. It is still a choice, and it should be signed off like any other operating model decision, not left to whichever analyst touches the file first.

Third, demand the governance of the bridge. Clearstream's control agent role, a named party that maintains the issuance account on the ledger, tracks the holding chain and ensures reconciliation, is the first clear answer to who oversees the duplication. Every manager whose custodian or administrator is now offering tokenisation should be asking who plays that role, how conversion evidence lands in the manager's own audit trail, and what happens to entitlements in a default. The bridge needs an owner before the tokens need a bridge.

The opmodal perspective

This is what the Architecture Canvas methodology was built for. Drawn honestly, the tokenised rail is a component like any other: a wallet with owners, a conversion gate with interfaces, a control agent with duties, each of them placed against the traditional register that already exists on the canvas. A firm whose model shows both rails can adopt each new tokenisation service as an upgrade to a component it already understands, and can answer the audit question, where does the position live, by pointing at the drawing.

The methodology's ninth principle applies with unusual force: sign-off is the beginning, not the end. A dual record is a process that will drift. The conversion rules, the reconciliation cadence, the authority designation, each of them needs owners, reviews and re-certification, because the moment two records exist for the same asset, the space between them starts accumulating exceptions. The firms that re-certify the bridge the way they re-certify their processes will keep the two records one truth. The firms that do not will keep two records and two truths, and discover which one the position actually lives in on the first contested corporate action.

Tokenisation has spent years being sold as a technology story. Last week it became an operating model story. The firms that draw the second record into their model now will be the ones whose middle office treats the token as routine. The firms that wait will meet it anyway, arriving through their custodian's terms of business, wearing the costume of a custody feature, and carrying with it a second register that nobody drew.

Keep reading

Process ownership: the discipline that keeps operating models alive

The business blueprint: one connected picture of how your organisation works