Hook
On 10 September 2024, a coalition of market infrastructure operators — Nasdaq and Börse Stuttgart among the named parties — asked European policymakers to lift or raise the size ceilings on the EU's tokenised securities pilot. The headline was predictable. What was not predictable, and what almost nobody highlighted, is a single operational claim buried inside the coalition's position: tokenised securities projects have already exceeded the pilot's capacity limits.
Read that again. Not "will exceed." Already.
A regulatory ceiling is not a soft target. It is a hard parameter enforced through supervisory reporting. If a live project has breached it, the operators are not experimenting freely. They are either splitting transactions to fit under the threshold, throttling issuance, or running in a state that exists only because supervisors have chosen, for now, not to enforce. Each of those is a data artifact. And an experiment conducted in split-trade mode does not produce valid measurements of liquidity aggregation, settlement latency, or cost per transaction.
The ledger remembers what the narrative forgets. The narrative is "the EU embraces tokenisation." The supervisory record says the pilot has already hit its wall. Everything below is an attempt to reconstruct, from first principles, what this lobbying actually requests — and why the loudest demand is probably not the most important one.
Context: A Regime Built to Be Temporary
The EU's DLT Pilot Regime — Regulation (EU) 2022/858 — entered into force in June 2022 and became applicable in March 2023. Its purpose is narrow and explicit: create a limited, time-bound exemption so that distributed ledger-based market infrastructure can operate inside EU financial law without having to satisfy rules written for a world of central securities depositories and sequential, batch-based settlement.
Three licence classes exist. A DLT multilateral trading facility (DLT MTF) is a trading venue for DLT financial instruments. A DLT settlement system (DLT SS) handles settlement. A DLT trading and settlement system (DLT TSS) combines both — trading and settlement on the same ledger, outside the CSD requirement that otherwise governs EU securities.
The regime attaches ceilings to each. For a DLT SS, the aggregate market value of DLT financial instruments admitted is capped at roughly €500 million. For DLT MTF and DLT TSS, the ceiling sits at roughly €6 billion. Those numbers were never justified by a technical throughput model. They were calibrated as risk containment: limit the size of the blast radius, and you limit the systemic consequence of a design that has never been stress-tested at scale.
That is the first thing to understand, and it is the thing that gets lost when this story is reported as a technology story. The cap is not a performance parameter. It is a loss limit.
Which is why the coalition's framing is clever. By arguing that the ceiling prevents technical validation, the letter converts a prudential instrument into an engineering obstacle. The moment that conversion succeeds, the debate stops being "how much risk are we willing to tolerate" and becomes "why is Brussels blocking innovation." Those are not the same question, and they are not answered by the same evidence.
I have a habit that dates to 2017, when I spent two months cross-referencing the Ethereum whitepaper's gas cost model against actual transaction data pulled from Parity clients. The theoretical model and the implementation disagreed in ways that only showed up under load. Since then I begin every analysis by mapping the stated protocol to its earliest implementation artifact, because the artifact is where the assumptions become visible. So: what is the implementation artifact here? It is the pilot's reporting obligation. And it is telling us that participants are already operating at the boundary.
Core: Reconstructing the Pilot From First Principles
Strip away the lobbying and there are exactly three mechanical problems in the EU's tokenised securities pilot. Only one of them is the cap.
1. The two-sided liquidity problem is real, and the cap does make it worse
A trading venue needs both sides. Depth on the buy side and depth on the sell side, from participants who are not all the same participant. A capped universe cannot produce that, for a simple reason: if the aggregate instrument value available on the venue is bounded at a few billion euros, then the number of issuers who find it worth listing there is small, and the number of institutional investors who find it worth connecting is smaller. You end up with a venue where the same handful of counterparties face each other.
That configuration cannot generate the data the pilot needs. Liquidity aggregation benefits — one of the core hypotheses of tokenised market infrastructure — only appear when order flow from multiple venues and multiple jurisdictions lands on a shared ledger. With five participants, you measure nothing. You observe a private bilateral market with extra steps.
The coalition is therefore correct on the mechanism. Where it is imprecise is the causally decisive variable. The cap limits notional size, but what actually throttles liquidity formation is the number of eligible counterparties and asset classes, which is a scoping decision, not a numeric one. Raising €6 billion to €60 billion while keeping the participant whitelist closed would change the arithmetic of the pilot without changing its informational content. More notional, same structure, same uninformative sample.
2. The cash leg is the harder constraint, and nobody is lobbying about it
Here is where the technical analysis has to go deeper than the press release, because the press release does not mention settlement at all.
Tokenised securities settle on a delivery-versus-payment basis. Securities move one way; cash moves the other; and in a properly designed system the two legs are atomic — one cannot complete without the other. The securities leg on a permissioned DLT ledger is a solved problem in the limited sense that the ledger is the source of truth and the operator controls finality.
The cash leg is not solved.
Under the EU framework, the cash leg of a securities transaction is expected to settle in central bank money or commercial bank money, and central bank money lives on TARGET Services, not on a DLT ledger. That produces a bridging problem: you have an atomic operation on one side and a traditional settlement rail on the other, and you must reconcile them. Either you introduce a conditional mechanism so that the DLT leg executes only after the cash leg is irrevocably confirmed, or you accept a window in which the two legs are not truly simultaneous — in which case "atomic" becomes a marketing word rather than an architectural property.
I spent part of 2020 inside a small security team auditing Curve Finance's stableswap invariant. The finding we documented privately was a rounding error in the virtual price calculation — a tiny arithmetic drift that leaked value to arbitrageurs and away from liquidity providers during high volatility. The lesson generalised far beyond Curve. In financial infrastructure, the failure mode is almost never the headline mechanism. It is the arithmetic at the seam where two systems meet, and the seam is where the incentives to notice are weakest.
In the tokenised securities pilot, the seam is the securities ledger to cash rail boundary. That is where reconciliation breaks, where settlement finality definitions diverge, and where a coupon payment split across ledgers with different decimal precision quietly produces dust that someone has to account for. No amount of ceiling relief fixes any of it.
3. Interoperability with existing infrastructure is the binding technical cost
A pilot that runs in isolation proves nothing about production. Production means tokenised instruments must interact with existing CSDs, with the T2S settlement platform, with custodians, and with corporate action processing that has been hardened over four decades.
Every one of those interfaces is a build. Each requires message mapping, timing harmonisation, and a legal determination of which system holds the authoritative record at each moment. The cost of these interfaces is fixed and largely independent of the pilot's size ceiling. This is the awkward part of the coalition's argument: raising the ceiling does not reduce the interoperability cost. It increases the volume flowing through a bridge that has not been proven under load.
Reconstructing the protocol from first principles, the ceiling was never the thing stopping integration work. Integration work is stopped by the absence of a stable legal endpoint — a rule for when a DLT ledger record becomes the definitive legal record. Until that exists, every interface is built twice.
4. Permissioned DLT shifts the security surface to the operator
A permissioned ledger with whitelisted, regulated nodes is the right architecture for securities. It is also a fundamentally different security model from a public chain, and it deserves to be stated plainly rather than assumed.
In this model, the operator controls admission, can freeze assets, and can intervene in state. That is not a bug; it is the compliance feature that makes the pilot legally coherent. But it relocates the entire security burden onto operator key management and administrative authority.
When I worked on the review of EIP-7702 for the Pectra upgrade, the central insight was that delegation of authority — allowing an account to hand execution rights to another party — creates an entirely new validation surface. The vulnerability we identified in signature validation logic during testnet work was not exotic. It was a gap between what the specification assumed about gas pricing and what the execution environment actually did. The same structural hazard applies here. In a permissioned DLT settlement system, an administrator key that can force settlement or freeze instruments is functionally equivalent to a privileged transaction path. If its authorisation logic is not exhaustively specified and tested, the perimeter is only as strong as the least-documented administrative function.
Stability is not a feature; it is a discipline. A whitelisted node set is stable only as long as the operational discipline behind those keys holds.
Contrarian: The Risk That Was Not in the Letter
The coalition asked for a higher ceiling, broader scope, and more testing of blockchain-based issuance, trading, and settlement. Reasonable as a request. But the framing conceals two things the reader should notice.
First, the material risk is not the cap. It is the sunset.
Exemptions under the DLT Pilot Regime are time-limited, on the order of a few years depending on licence class, with review and possible extension. That means every project currently operating inside the regime is running toward a date on which its legal basis may simply cease. If the exemption is not renewed and the ceiling is not addressed, the outcome is not a smaller pilot. It is a compliance cliff: live instruments must migrate back to CSD-based settlement infrastructure, or wind down. Migration cost and market disruption at that moment would be far larger than anything the cap is currently causing.
And here is the uncomfortable part. The coalition's public letter does not lead with that. It leads with capacity. Which is rational — a sunset argument is a governance argument that supervisors can defer for years, while a capacity argument sounds like an economic competitiveness argument that politicians must answer now. But for anyone building on this infrastructure, the sunset clause is the parameter that determines whether the architecture is worth committing to. A pilot designed to expire is not a foundation. It is a lease.
Second, the value capture is entirely infrastructural, and the token-economics analogy does not transfer.
Tokenised securities are not tokens in the crypto-native sense. There is no supply schedule, no allocation, no unlock cliff, no emission-funded incentive, and no mechanism by which later buyers pay earlier holders. The instrument's cash flows come from the underlying — coupons, dividends, principal repayment. That removes the reflexive failure mode I spent six weeks dismantling after the Terra collapse in 2022, tracing how the algorithmic stabilisation depended on a liquidity assumption that could never hold under negative equity conditions. There is no equivalent recursive loop here, which is precisely why no one should model this story as an RWA token trade.
The fees flow to whoever performs issuance, custody, settlement, and market-making. Those are regulated entities, mostly listed, mostly already profitable. The economic question this news actually raises is which of those entities captures the rebuild. That is a question about operating margins, not about token price.
Protecting the user, in this instance, means correcting a category error early: readers who map an EU prudential-parameter debate onto the price of an RWA concept coin are not making a stretched analogy. They are making an invalid one. And if the pilot eventually includes tokenised money market instruments and fund units as collateral inside a permissioned environment, the indirect transmission to public DeFi stays blocked by design. The wall is intentional.
Takeaway
The lobbying letter is not a signal. It is a request to a decision-maker who has not yet responded, from parties with a direct commercial interest in the answer. Nothing has been decided, and no supervisory body has committed to anything.
What to watch, in order: a formal Commission proposal to amend the regime, ESMA's technical advice on any revised thresholds, and — the one that matters most and gets covered least — the review timeline attached to the exemption itself. The ceiling may rise. The clock is the real variable.
So the question is not whether Brussels raises a number. It is whether a settlement model architecturally dependent on a bridge between two ledgers, and legally dependent on a waiver with an expiry date, can ever be described as stable — or whether it is simply a longer experiment wearing the same word.
