The two-rail operating model: what tokenisation in production means for asset management operations

What it is

Tokenisation stopped being a pilot this week. On Monday 21 September the Eurosystem switched on Pontes, the bridge that lets tokenised wholesale transactions settle in central bank money. The following evening the FCA's chief executive told a City audience that firms are done with sandboxes. And DWS confirmed it will offer tokenised versions of its Xtrackers ETF range, while admitting the revenue is years away. That combination, infrastructure live, regulator pushing for production, product owners committing before demand exists, is what a market looks like when it crosses from experiment to operating reality.

For asset management operations, the crossing has a specific name: the two-rail operating model. Every firm will run, for years, two parallel chains for the same instruments. The traditional rail: CSD, custodian, registrar, batch reconciliation. The digital rail: on-chain ownership records, digital securities depositories, settlement in central bank money through bridges like Pontes or platforms like HSBC Orion. The investor sees one fund. The operations team sees two of everything.

Why it matters now

The regulators have decided the pace. The FCA and the Bank of England will publish a joint tokenisation roadmap, and the FCA intends to consult on safeguarding rules for tokenised investment assets because, in its own words, tokenisation "can't be allowed to leave ambiguity about ownership." The Treasury has confirmed the first digital gilt, DIGIT, will be issued by Q1 2027 on HSBC Orion, with a planned bilateral link to LSEG's depository. This is no longer a market structure debate. It is an operating model requirement with dates attached.

The pressure is uneven. Funds Europe's survey of 77 asset managers found 88% consider it likely they will offer tokenised versions of their ETFs, yet few have pilots running today. The capability has to be built before the demand is measurable, and capability-building is precisely the layer that gets deferred: it has no revenue case, only a risk case.

The risk case is real. A tokenised share class has two ownership records, two settlement paths, two custody chains and one set of investors expecting identical servicing. Every bridge between the rails, interoperability, reconciliation, safeguarding, is a new point of failure with no incumbent owner. In an industry where the regulator has just measured operational resilience and found the weaknesses concentrated in hand-offs, third parties and ageing infrastructure, the second rail arrives as an ungoverned extension of the first.

What firms should do

Three things, in order.

First, draw both rails before you build either. Map where the digital rail will touch the existing model: ownership records, settlement, corporate actions, reconciliation, reporting. If the map cannot show both rails and the bridges between them, any pilot will quietly construct a second, undocumented operating model, and the first incident will be how the firm discovers it.

Second, treat the bridges as first-class components. A Pontes connection, a digital securities depository link, a custodian's digital capability: these are not integrations, they are infrastructure. They need owners, controls and documented failure modes, the same governance a firm would apply to a new custodian relationship.

Third, reconcile on the rails' terms. Two sources of truth and one set of investors means the reconciliation layer must be designed for both records from day one, and the exception queue needs an owner who understands both rails, not one.

The opmodal perspective

This is where process ownership and governance stop being abstractions. The Architecture Canvas captures an operating model across its process, system and data layers, and exposes what the two-rail problem really is: a hand-off problem. The digital rail tends to be built by enthusiasts in a corner. The bridges get owned by nobody. The documentation lags the build, and the model decays before it is even drawn.

The firms that will run two rails well are not the ones with the best tokenisation technology. They are the ones whose operating model can show both rails, the bridges and the owners on one canvas, so that the second rail is governed like the rest of the model rather than bolted onto it. Tokenisation does not create a new governance problem. It makes the existing one impossible to ignore.

Keep reading: Process ownership: the discipline that keeps operating models alive, and The business blueprint: one connected picture of how your organisation works.