The problem, and the proposed solution, in one page
Tokenised assets are settling on many chains at once, and liquidity is fragmenting because adoption is succeeding on every chain simultaneously.
Cross-chain settlement has two candidate designs: smart-contract bridges, which have been tried and have lost billions, and a trusted notary, the mechanism regulated finance has always used, and one that strengthens the incumbents who adopt it.
We propose a Cross-Chain Control Layer (the C3L): a trusted notary that holds both legs of a trade and releases them together, paired with a technology stack that lets an institution connect once and settle against any counterparty on any chain.
The design applies across asset classes, markets and institutions: wherever an incumbent already holds the trusted role it keeps it, SGX-DC for cleared derivatives, CDP for listed securities, Euroclear for the international securities it serves, and Hydra X can act as trusted party in private markets while supplying the technology throughout.
The design fits the Singapore context especially well, because it does not depend on the questions still open there: which tokenised cash instrument will settle the cash leg, and where MAS's several policy tracks will land. The same system works whichever instrument prevails and at whatever stage the policy has reached, so it can be built now and still holds once those answers arrive.
Section 02 · The case
Liquidity is the goal; fragmentation is the obstacle
Tokenisation exists to unlock liquidity, and succeeding on every chain now fragments it
Capital markets tokenise for one commercial reason: assets that settle instantly and move freely attract deeper pools of buyers, lenders and collateral takers.
The promise
On-chain settlement collapses multi-day cycles into seconds, frees collateral trapped in transit, and lets a single instrument serve investors in every time zone. Cornerstone institutions have committed: BlackRock's BUIDL, Franklin Templeton's on-chain money market fund, JPMorgan's Kinexys volumes, and DTCC's tokenised collateral pilots.
The obstacle
Each institution chose rational chains for rational reasons; in aggregate their choices scatter assets and cash across incompatible ledgers. Each chain is a closed pool, with its own assets, cash and participants, unreachable from another without leaving it entirely.
Until the market consolidates technically, increased adoption on today's architecture produces increased fragmentation; the success of adoption is itself tightening the constraint on liquidity.
Tokenisation removes the clearer on a single chain and recreates the need for one across many
Within one chain, atomic delivery versus payment removes the settlement intermediary outright: both legs move in a single transaction, and counterparty risk disappears at the ledger level.
Across chains, no such transaction exists; two ledgers cannot execute one atomic step, so one leg must be secured while the other moves.
That securing is a clearing function: the role tokenisation eliminated inside each chain reappears, unfilled, between them.
Whoever, or whatever system, fills that cross-chain role will define the market structure of tokenised capital markets; the open questions are who, and on what terms.
Section 03 · The system
The proposed system: a trusted party and a shared stack
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
We propose one shared system to defragment the chains, built from a trusted party and a technology stack
We propose one system to stand between the chains and settle trades whose legs sit on different ledgers.
A trusted notary
Holds both legs of a trade in segregated custody and releases them together, so neither party is ever exposed to the other.
A technology stack
Per-chain network adapters, an orchestration engine that sequences each settlement, and a single API gateway through which familiar capital-markets actions are expressed once and translated into each chain's native equivalent.
Together the two pillars would give every participant access to every connected chain through a single connection and a single verified record.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Two designs can settle across chains; bridges have failed, and the notary is already trusted
Smart-contract bridges secure the first leg by locking it in a contract and minting a claim against it on the other chain; the market has tested this design at scale, and it has broken repeatedly.
Chainalysis attributes roughly USD 2.8 billion of cumulative losses to bridge exploits; the Ronin bridge alone lost USD 625 million in a single 2022 incident.2
An exploit in April 2026 stranded wrapped assets across twenty chains, with losses near USD 292 million.1
No insurer prices bridge risk at institutional scale, and no supervisor examines a smart contract the way it examines a custodian.
A trusted notary secures each leg by holding it in segregated custody under licence and releasing the two together: the mechanism regulated finance has always used, supervised, insurable, and familiar to every risk committee.
No new concentration arises: the notary holds the legs but never owns them, so a notary failure leaves assets safe in segregated custody pending completion or unwind; credit risk stays where it already sits, with the CCPs and CSDs and their default waterfalls.
A notary also carries a strategic benefit no bridge can offer: it entrenches the incumbent who performs the role, turning a technology shift into a defence of existing franchises.
Regulated markets made this choice once before: CSDs and CCPs exist because counterparties would not hold each other's risk, and the same logic applies between chains.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Each market's trusted party can be whoever already holds that role there; where no incumbent exists, Hydra X can fill it
One design serves many markets: the trusted-party role arises wherever two legs must settle across chains, whatever the asset class, the market, or the institutions involved.
Close to home, SGX-DC can keep novation and clearing for SGX-cleared derivatives; CDP can keep depository of record for SGX-listed securities; and Euroclear can keep settlement and custody for the international securities it serves.
Deployment can take several forms: an incumbent can run a dedicated instance on its own premises, in its own cloud, or through a trusted partner such as Hydra X.
In markets with no incumbent in the role, private credit among them, a licensed party such as Hydra X can fill it.
Established markets are served by structural monopolies, the depository and the CCP, so the role passes naturally to them; newer markets have no such incumbent, and the role is open.
Naive adoption of atomic settlement would strip out settlement risk and, with it, much of the clearer's role; this design instead carries that role into a tokenised market, extending each institution's mandate across chains and entrenching its value there rather than stranding it.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Connect once, and settle delivery versus payment with any counterparty, whichever chains hold the asset and the cash
The system settles delivery versus payment between any two chains: the asset leg and the cash or collateral leg can sit anywhere the network reaches, and the notary releases them together.
An incumbent can run its own instance of the layer, but every instance speaks the same protocol and connects to the others, so a single connection reaches every counterparty on any instance.
Today the same trade needs correspondent arrangements: bilateral messaging, reconciliation, and prefunded nostro accounts, with settlement measured in days.
Swift remains the messaging network for flows that need messages; trades settled through the C3L need no separate messaging, reconciliation or prefunding, because settlement and its record are one event.
Network economics improve as each institution connects, making the single connection more valuable for those already on it.
A shared layer re-introduces a point of coordination, and that is deliberate: it federates rather than centralises.
Blockchains removed the intermediary within each chain, adoption then scattered liquidity across chains, and the layer answers that fragmentation. Each market's trusted party runs its own instance and the instances interoperate, so no single operator sits astride the whole market.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
The stack has three layers: institutions integrate once at the top, adapters absorb the chains at the bottom
The business logic layer, highlighted, is the product; connectivity is a commodity available piecemeal, and unifying it under one normalised stack is the work.
Network adapters connect to each chain and speak its native protocol; a normalisation layer expresses familiar capital-markets actions once and renders them into each chain's native equivalent.
Business logic runs on top as applications: issuance, distribution, secondary trading, collateral control and lifecycle servicing. New applications can be added as use cases accrete.
Institutions integrate against the APIs for bespoke use cases, or use the applications directly through API or UI; either way, the stack absorbs every chain-specific difference beneath them.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Three main methods move value across chains, each chosen to fit the trade
Escrowed exchange
The notary takes both legs into segregated custody and releases them together; it suits spot delivery versus payment between unrelated parties.
On chain: both tokens move into the notary's addresses, then out to the two parties together.
Native reissuance
An instrument is retired on one chain and issued on another under the same record; it suits relocating an asset permanently.
On chain: burn on the source chain, mint on the destination, under one record.
Lien without movement
The notary records an earmark that a controlling party can enforce, while the asset never leaves its chain; it suits collateral.
On chain: the token is frozen or escrowed in place under the controller's key; nothing is minted elsewhere.
These are the main methods rather than an exhaustive set; orchestration selects the one that fits each trade, and participants see a single settlement whichever mechanism runs beneath it.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Every part of the design already runs in regulated markets; only the setting is new
Segregated custody, escrow release, novation and liens are supervised mechanisms with decades of case law and rulebook precedent behind them.
The design relocates these mechanisms into the space between chains; it invents no new legal concept and asks no regulator to approve one.
Live precedents exist: DTCC has settled tokenised collateral in live pilots, and Euroclear and SGX operate digital securities under existing frameworks.
That leaves the cash leg as the only open question, and approval turns on it: which tokenised cash instrument a regulator will accept as settlement.
Two pillarsNotaryTrusted partyReachStackMethodsPrecedentBoundary
Where one party holds both legs, the chain adds no atomicity; the value lies elsewhere
When the notary holds both legs, releasing them together mirrors what a traditional ledger already does, and the chain adds no further settlement guarantee.
Four values survive: 1. a single connection into every pool of liquidity; 2. a single verified record across chains; 3. lifecycle logic programmed into the instruments themselves; 4. one place for supervision to look, a consolidated view of positions and flows that no individual chain can offer.
Confidentiality holds throughout: the consolidated record is visible to the supervisor, not to the public, which is exactly what institutional markets require.
Section 04 · Settlement archetypes
Four settlement patterns, each shown through a named but illustrative example
For a cleared derivative, SGX-DC can control collateral across multiple chains without moving any of it
Earmarked assets sit across chains with one CCP in control; on default SGX-DC enforces through the notary, and in normal course nothing moves.
A clearing member's eligible collateral already sits on multiple chains; today each chain is a separate operational silo with its own pledge process.
Tokenised money market funds are already accepted as collateral on major derivatives venues,6 and DTCC's collateral pilots use the tokenised US Treasuries it issues on chain;7 the eligible pool is forming now.
Control at default is the centre of the design: on a member failure, SGX-DC enforces its controlling claim and takes possession through the notary, meeting the standard that CCP rulebooks and regulators demand.
In this illustration SGX-DC holds a lien rather than possession; the earmarked asset may sit in an omnibus account or move to CCP-controlled custody, and the design accommodates both.
SGX-DC keeps novation and clearing in full; the C3L extends its collateral reach to every connected chain.
Listed equities are the clearest illustration: CDP can hold both legs and release them together
The share leg and the CBDC leg enter segregated custody, are verified, and released together; every later workflow repeats this pattern. Illustrative: subject to MAS programme access.
A tokenised SGX-listed share settles against Singapore dollar wholesale CBDC in a single atomic step, each leg arriving from a different chain.
CDP remains depository of record and clearer throughout, taking both legs into segregated custody and releasing them simultaneously; neither party is exposed at any moment, and its mandate is untouched.
For a cross-border bond, an international CSD such as Euroclear can be the notary, settling euro against euro across chains
Euro settles against euro across two chains, with one notary and one record; currency conversion is excluded by design.
A European issuer's tokenised bond settles against tokenised euro deposits held by an Asian investor, each leg native to a different chain.
Euroclear would perform the role it already performs for the international securities it serves: both legs into segregated custody, verified, and released to their new owners at the same moment, so the trade settles as one event with a single record.
Regulators are already sponsoring the pattern: Les Gardiennes, led jointly by Banque de France and MAS, runs repo in tokenised assets against tokenised money with UBS and Société Générale-FORGE.8
Settlement today routes through correspondent banks and prefunded accounts over several days; atomic settlement removes that delay, freeing capital and recycling collateral that would otherwise sit idle in transit.
For private credit, Hydra X runs the whole life of the note and captures the economics
The full instrument lifecycle runs on one system, from subscription through maturity, with programmable events at each stage.
No incumbent holds the trusted-party role in private markets; Hydra X fills it under its existing custody licences, issued by MAS, Malaysia's SC and Labuan's LFSA.
One party originates, allocates, settles and services the note end to end: subscription, drawdown, coupon, amendment and maturity run as programmed lifecycle events.
Lifecycle events can be built into the tokens themselves, coupon payments and early redemptions among them, or handled by the notary.
A bank can issue once and reach every pool at once, instead of betting on a single chain
A single issuance instruction fans out across every connected chain; the register remains one book.
For banks
Chain selection is today a forced wager: pick one chain and forfeit the investors on every other, or run parallel issuances and fragment your own register.
Through the C3L, one instruction would mint the same instrument on every connected chain under a single record; the register stays whole, serviced from one book.
BlackRock's BUIDL fund already spans seven chains because single-chain reach proved insufficient for a global investor base.6
A bank can supply the cash leg through its own deposit token, settling any asset as commercial bank money
Any asset on any chain settles against the bank's own liability; the cash leg extends the bank's deposit franchise onto the network.
For banks
A deposit token remains a claim on the bank: it is commercial bank money on a digital rail, not a new instrument class.
Every settlement on the network becomes demand for the bank's token, and settlement cash stays on the bank's balance sheet rather than draining to non-bank stablecoin issuers.
MAS's BLOOM initiative is building frameworks for tokenised deposits as wholesale settlement assets, with more than sixteen institutions on board,5 and JPMorgan's JPMD shows a global bank already moving.6
A bank can connect once to the C3L and drive cross-chain settlement from its own systems
One integration reaches every connected chain; the bank's systems see ordinary transactions, and the stack absorbs the rest.
For banks
One gateway integration replaces per-chain integration, key management, compliance review and node operations across the bank's whole footprint; existing order and settlement systems instruct cross-chain trades as ordinary transactions.
Custody choices stay with the bank: self-custody, sub-custody through Hydra X, or client segregation, per mandate.
One project buys the connection; every chain the network adds afterwards extends the bank's reach at no further cost.
The prize is measured in trillions, the failed alternative in billions, and the clock is already running
USD 16tn
Tokenised assets projected by 2030 (BCG)
BCG, 2022
USD 2.8bn
Cumulative bridge-exploit losses (Chainalysis)
Chainalysis
BCG projects USD 16 trillion of tokenised assets by 2030;3 McKinsey's conservative case is roughly USD 2 trillion excluding stablecoins and CBDC.4 Either figure dwarfs today's fragmented pools, and bridge exploits have already cost roughly USD 2.8 billion, the market's own price on the alternative design.2
DTCC is extending multi-chain collateral reach with broad launch targeted for October 2026, and global CSDs will not stop at their home markets.7
Whichever CCP first controls cross-chain collateral for its market widens its clearing membership beyond its home market, and positions like this are taken once.
The C3L is the infrastructure MAS policy is asking for
MAS has publicly warned against a market of “sub-scale walled gardens” and made open, interoperable networks the stated policy goal; a shared settlement layer is the direct answer.5
GL1 publishes the principles and toolkits for interoperable networks; it builds no infrastructure. The C3L is what a GL1-consistent settlement layer can look like in production, and the toolkit's 108 controls are the benchmark the build will meet.
Settlement assets are converging on MAS's own tracks: wholesale CBDC through the SGD Testnet and tokenised deposits through BLOOM map directly onto the cash legs the system settles.
Supervision gets one place to look: a single consolidated record of positions and flows across every chain, where today a supervisor must build the picture chain by chain.
No alternative pairs the licence with the stack; Hydra X's advantage is structural
Hydra X internal
Alternatives fall into three categories, and each supplies half the answer at most.
Messaging and interoperability layers
Swift's pilots and Chainlink's CCIP among them, move instructions only: they hold nothing, guarantee nothing, and cannot stand as notary.
Bank-owned rails
Payments infrastructure owned by a few banks, such as Partior; rivals hesitate to settle securities across a competitor's system, and none clears capital-markets instruments today.
Routing and networks of networks
Ownera's FinP2P and similar protocols route across networks but hold nothing and provide no trusted party; they must borrow one, and the trusted party is the product.
Hydra X pairs the two halves: a neutral, licensed trusted party under MAS, SC and LFSA supervision, joined to a production stack already running regulated digital securities.
Incumbents keep their roles; where they perform the notary function themselves, Hydra X can supply the stack beneath them, and neutrality is what lets it serve all of them at once.
Commercial potential is real: familiar fee structures that scale with adoption
Fees are indicative and would be set with partners; the revenue base is conventional, and each line scales with adoption.
Notary or clearing house
Clearing fees are the primary stream, scaling with settled volume as adoption grows.
Infrastructure owner
Access priced by subscription, flat or tiered, or by volume-based transaction or per-message fees; plus technology fees for applications and their maintenance.
Marginal cost falls as chains and participants join, because the build extends Hydra X's existing custody and Canton infrastructure; revenue compounds with network density while cost does not.
One scoped pilot can put SGX-DC in control of cross-chain collateral before the window closes
For SGX
This is a project worth SGX taking seriously: a collateral pilot with one clearing member, liens earmarked across the member's chains through the C3L, enforcement tested against a simulated default, and no rulebook change required at pilot stage.
Much of the build already exists: the tokenised infrastructure Hydra X is delivering for SGX carries forward into a dedicated C3L instance, on premises or in SGX's own cloud, connected to the wider network.
This is offensive as well as defensive: the first CCP to accept earmarked cross-chain collateral widens its clearing membership beyond its home market, and DTCC's October 2026 launch sets the clock.
A first workflow can target MVP deployment by 2027.
A bank can move first in the two modes where being first compounds
For banks
This is a project worth a bank taking up early, in the two modes where the first mover holds the advantage.
Commercially, the bank's deposit token becomes the settlement cash leg across the network, and a single issuance reaches every connected chain from one register; both earn fees from the first workflow.
Strategically, the first mover sets the convention later entrants must match, in both the cash leg and cross-chain issuance, from a single gateway connection with custody kept to the bank's mandate.
A first workflow can target MVP deployment by 2027.
Euroclear can extend the role it already holds into cross-chain settlement
For Euroclear
This is a project worth Euroclear exploring, taking the settlement and custody role it already holds for international securities across chains.
Commercially, Euroclear settles the securities it serves against tokenised cash across chains, a new stream of settlement and custody fees on flows that today take several days through correspondents.
Strategically, holding the cross-chain notary role for its securities keeps Euroclear central as settlement moves on chain, rather than ceding that ground to a new entrant.
A first workflow can target MVP deployment by 2027.
27
The infrastructure that settles across chains will define regional capital markets for the next decade. Whoever builds it first, and on neutral terms, turns fragmentation back into liquidity, and Singapore can be where that happens.
1Cross-chain bridge exploit: April 2026 incident in which wrapped assets were stranded across roughly twenty chains, losses near USD 292 million. Reported by CoinDesk and cited in the BCG and Anchorage Digital digital-assets playbook, June 2026.
2Bridge exploit losses: Chainalysis, cumulative cross-chain bridge exploit losses estimated at approximately USD 2.8 billion; Ronin bridge incident, March 2022, USD 625 million.
3Tokenised market size, upper case: BCG, “Relevance of on-chain asset tokenization”, 2022: approximately USD 16.1 trillion of tokenised assets projected by 2030.
4Tokenised market size, conservative case: McKinsey, “From ripples to waves: the transformational power of tokenizing assets”, 2024: base case of approximately USD 2 trillion of tokenised market capitalisation by 2030, excluding stablecoins and CBDC.
5MAS policy and settlement assets: MAS addresses at the Singapore FinTech Festival 2025, including the warning against “sub-scale walled gardens”; the Global Layer One initiative and its Market Infrastructure Toolkit of 108 controls; the BLOOM initiative for tokenised deposits and regulated stablecoins, with more than sixteen participating institutions; and the SGD Testnet for wholesale settlement.
6Multi-chain issuance, deposit tokens and tokenised collateral: BlackRock BUIDL multi-chain expansion across seven networks and its acceptance as posted collateral on major derivatives venues; JPMorgan JPMD deposit token (Kinexys). Issuer and venue disclosures, 2024 to 2026.
7DTCC, multi-chain collateral: DTCC multi-chain collateral initiatives, with broad launch of its tokenisation service targeted for October 2026. DTCC announcements, 2026.
8Les Gardiennes: joint initiative of Banque de France and MAS exploring repurchase agreements involving tokenised financial assets and tokenised money, with UBS and Société Générale-FORGE. MAS, Singapore FinTech Festival 2025.
