The Institutional Tokenization Ceiling: Why Every Pilot Succeeds and Every Scale-Up Stalls

TL;DR

Global financial institutions’ tokenization initiatives succeed almost without exception at the pilot stage. BlackRock BUIDL has reached $18B AUM, JP Morgan Kinexys has processed over $1.5T in transactions, and HSBC Orion has facilitated more than $3.5B in digital bond issuance. Yet these successes are uniformly products of controlled environments. This research analyzes five institutions’ initiatives in depth to derive three structural bottlenecks preventing the pilot-to-production transition: the rational trap of walled garden strategies, the gap between Canton’s promise and reality, and the illusion of readiness created by pilot success. These bottlenecks are not failures of technology but of industry structure, and each translates into concrete technical requirements that RWA 2.0 infrastructure must satisfy.

---

The Paradox of Pilots

Between 2024 and 2026, the numbers emerging from institutional tokenization look as if a tipping point has already been crossed.

The tokenized US Treasury market surpassed $10B as of January 2026 [1]. BlackRock’s BUIDL fund reached $18B AUM across nine blockchains by February 2026, having launched in March 2024 [2]. JP Morgan’s blockchain unit Kinexys has processed over $1.5T in cumulative transactions, with payment volumes growing 10x year-over-year [3]. HSBC Orion has facilitated more than $3.5B in digital bond issuance and was selected as the platform for the UK government’s Digital Gilt Instrument (DIGIT) pilot in February 2026 [4]. Goldman Sachs’ GS DAP issued the EIB’s €100M digital bond and launched the first US tokenized money market fund solution with BNY Mellon [5]. Canton Network counts over 400 institutional participants, including DTCC, Goldman Sachs, and BNP Paribas [6].

These numbers are impressive. But one question remains.

With the global financial system exceeding $600T in total assets, the aggregate scale of tokenized assets remains a rounding error. The $10B in tokenized US Treasuries represents just 0.037% of the $27T US Treasury market. Every pilot succeeds, so why does the scale remain negligible?

The technical deficiencies of RWA tokenization analyzed in our previous research, including unidirectional oracles, the “dead token” problem, and manual process dependence, remain valid. But this article examines a different dimension: why even the most advanced institutions have failed to reach RWA 2.0. Answering this question requires reading each institution’s strategy not in isolation but as a pattern.

The Strategic Landscape of Five Institutions

Figure 1: Institutional Tokenization Landscape

BlackRock BUIDL: Success of Scale, Limits of Scope

BlackRock’s BUIDL is the most frequently cited success story in the tokenization market. After launching in March 2024, it gathered $375M within six weeks, crossed $1B in early 2025, and reached $18B AUM by February 2026 [2]. It is natively issued on nine blockchains, tradable on Uniswap, and accepted as derivatives collateral on Binance and Deribit.

However, it is essential to distinguish what BUIDL proves from what it does not.

What BUIDL has demonstrated is that institutional demand for tokenized money market funds is real. The value proposition of delivering US Treasury-based yield while serving as on-chain collateral has proven effective.

What BUIDL has not demonstrated is the tokenization of complex financial instruments. Money market funds rank among the lowest in state complexity across financial products: a single asset type (US Treasuries), a fixed value (NAV pegged to $1), and a simple yield structure (daily dividends). Under the State Synchronization Dependency (S_i) metric from our TVO framework, money market funds sit at the bottom of the dependency spectrum.

In January 2026, Circle’s USYC overtook BUIDL to claim the top position in the tokenized Treasury market [1]. The reason was revealing: it was not technological superiority but a mechanical difference in yield structure. USYC’s “accumulating” model (interest auto-compounds into token balance) integrates more frictionlessly with collateral systems than BUIDL’s “distributing” model (interest paid separately). This is not a complex state synchronization challenge; it is a mechanical token design choice. In other words, BUIDL’s competitive landscape remains at the level of design optimization among products with low state complexity.

JP Morgan Kinexys: Success of Depth, Absence of Breadth

JP Morgan’s blockchain strategy is the longest-running and deepest in the industry. Starting with Onyx in 2020 and rebranded to Kinexys in 2024, this division has established several meaningful milestones.

Kinexys Digital Payments (formerly JPM Coin) has processed over $1.5T in cumulative transactions, averaging more than $2B daily, with institutional clients across five continents using it for cross-border payments and intraday repo trades [3]. In October 2025, JP Morgan launched Kinexys Fund Flow to automate alternative investment fund distribution and servicing on blockchain. In January 2026, the bank announced plans to natively issue JPM Coin (JPMD) on the Canton Network.

The critical observation is that Kinexys’s success has occurred within the JP Morgan ecosystem. Kinexys Digital Payments processes settlements between JP Morgan’s institutional clients. The first Kinexys Fund Flow transaction involved JP Morgan Private Bank, JP Morgan Asset Management, and fund administrator Citco. The Tokenized Collateral Network (TCN) utilizes JP Morgan’s own money market fund shares as collateral.

This does not mean JP Morgan made the wrong choice. Validating within a single institution before expanding is a rational strategy. But this approach structurally defers the problem of inter-institutional interoperability. The $1.5T in transaction volume, however impressive, was achieved within the confines of a single institution.

In early 2025, Kinexys executed a cross-chain Delivery versus Payment (DvP) test transaction with Chainlink and Ondo Finance, exchanging tokenized US Treasuries on Ondo Chain’s testnet against USD deposits via Kinexys Digital Payments, with Chainlink’s CCIP orchestrating across chains. But this remains a testnet-level proof of concept, a bespoke pipeline possible only through three-party collaboration, far from standardized industry-wide interoperability.

HSBC Orion: Geographic Expansion, Asset Scope Constraints

HSBC Orion has achieved the widest geographic reach among institutional tokenization platforms. It has facilitated over $3.5B in digital bond issuance, with a notable list of firsts: the EIB’s first digital sterling bond (2023), Hong Kong’s world-first multi-currency digital green bond (2024), Luxembourg’s first digital treasury certificates (2025), the Middle East’s first digital bond (2025), and the UK government’s DIGIT pilot platform selection (2026) [4]. Its retail HSBC Gold Token, the first SFC-approved product of its kind in Hong Kong, has recorded over 100,000 transactions and more than $1B in trading volume since launch.

Yet Orion’s success is largely concentrated in bond issuance as a single use case. Bond issuance represents the earliest stage of tokenization: creating an asset in digital form. Post-issuance lifecycle management (coupon payments, rate resets, maturity processing, regulatory action reflection) still relies on traditional infrastructure. Orion’s achievement of “reducing settlement time from five days to one” is meaningful but reflects efficiency at the point of issuance, not automation across the full asset lifecycle.

Goldman Sachs GS DAP: Technological Depth, Strategic Inflection

Goldman Sachs’ GS DAP made the most technologically interesting choice among institutional tokenization platforms. Built on Digital Asset’s DAML smart contract language and the Canton protocol, it is designed to capture the full lifecycle of assets’ rights, obligations, and cash flows [5].

Since launching in 2022, GS DAP issued the EIB’s €100M digital bond (Project Venus) and in July 2025 launched the first US tokenized money market fund solution with BNY Mellon, with participation from BlackRock, Fidelity, and Federated Hermes in “mirrored record tokenization” of MMF shares.

In November 2024, Goldman Sachs announced plans to spin out GS DAP as an independent industry platform. Mathew McDermott, Global Head of Goldman Sachs Digital Assets, stated the rationale directly: keeping the platform on the bank’s balance sheet makes broad institutional adoption and scaling very difficult. Tradeweb joined as the first strategic partner, with a mid-2026 spin-out target.

This strategic pivot reflects an important recognition: a platform owned by a single institution cannot achieve industry-wide interoperability. But the spin-out itself does not guarantee interoperability. How the independent GS DAP will actually connect with other institutions’ platforms remains an unresolved challenge.

Canton Network: The Promise of Synchronization, The Challenge of Realization

Canton Network intersects all of the above initiatives as an infrastructure layer. Developed by Digital Asset and involving over 400 institutions including Goldman Sachs, BNP Paribas, Deutsche Börse, and DTCC, it bills itself as the first public blockchain built for institutional finance [6].

Canton’s most important technical promise is cross-domain synchronization. Its “network of networks” architecture lets each participating institution maintain its own ledger while connecting through a shared synchronization layer, enabling atomic transactions while preserving privacy. Theoretically, this addresses the walled garden problem analyzed above.

In July 2025, a significant milestone was achieved on Canton Network: a broad industry group executed live 24/7 intraday and after-hours financing trades using tokenized US Treasuries. In December 2025, DTCC partnered with Canton Network to begin tokenizing DTC-custodied US Treasuries on Canton in the first half of 2026, and assumed the co-chair position of the Canton Foundation [7].

This represents meaningful progress. However, Canton’s current successes are primarily within Canton domains: interoperability among Canton-based applications such as GS DAP, Deutsche Börse’s D7, and Broadridge’s DLR. Bidirectional state synchronization between Canton domains and external public chains (Ethereum, Arbitrum, Solana, etc.) remains in early stages. JP Morgan’s January 2026 announcement to natively issue JPMD on Canton is an attempt to bridge this gap, but as the phrase “phased approach throughout 2026” suggests, realization is still in progress.

Three Structural Bottlenecks

Figure 2: Three Structural Bottlenecks

A recurring pattern emerges across the individual analyses. It can be abstracted into three structural bottlenecks.

Bottleneck 1: The Rational Trap of Walled Gardens

Each institution building its own platform is individually rational. JP Morgan optimizes its clients’ payments and fund flows through Kinexys. Goldman Sachs manages its digital asset products through GS DAP. HSBC digitizes its bond issuance pipeline through Orion. Each platform is designed to fit its institution’s regulatory environment, technology stack, and client requirements. This is rational.

The problem is the composite effect of these rational choices. If N institutions each build their own platform, N(N-1)/2 bilateral connections are theoretically required. Five institutions need 10 connections; 20 need 190; 100 need 4,950. Each connection involves not just technical integration but legal agreements, regulatory approvals, and operational process alignment.

Goldman Sachs’ decision to spin out GS DAP reflects recognition of this problem. But becoming an independent entity does not automatically achieve interoperability. Interoperability requires not just technical connectivity but a shared state model and regulatory vocabulary.

Bottleneck 2: Canton’s Inter-Domain Gap

Canton Network represents the most ambitious answer to the walled garden problem. Its “network of networks” architecture is designed to let institutions maintain privacy while performing atomic transactions through a shared synchronization layer.

What Canton has already achieved is noteworthy: DTCC’s participation, live 24/7 trading, over 400 ecosystem participants. However, Canton’s current synchronization scope is concentrated within Canton domains, covering interoperability among DAML-based applications.

The reality of institutional tokenization does not consist solely of Canton domains. BlackRock’s BUIDL operates on nine public blockchains. It trades on Uniswap. It serves as collateral in DeFi protocols. All of this activity occurs outside Canton domains.

Synchronization within Canton domains and bidirectional state synchronization between Canton and public chains are fundamentally different problems. The former operates in a controlled environment guaranteed by DAML’s shared semantics and Canton’s privacy protocol. The latter involves consistency challenges across systems with heterogeneous consensus mechanisms, different finality guarantees, and divergent state models.

JP Morgan’s simultaneous pursuit of natively issuing JPMD on Canton while piloting on Base (an Ethereum L2) reflects this dual reality. Institutional payments need Canton’s privacy; DeFi integration needs public chain accessibility. The bidirectional state synchronization infrastructure connecting both worlds has not yet been established at an industry level.

Bottleneck 3: The Pilot Success Fallacy

The third bottleneck is cognitive rather than technical. Pilot success creates the illusion of production readiness.

Examining the structural differences between pilot and production environments reveals the pattern. Pilots operate in single jurisdictions: BUIDL’s initial success occurred within the US regulatory environment, and each HSBC Orion digital bond was issued under a single jurisdiction. With a single jurisdiction, regulatory action conflicts do not arise.

Pilots involve few known participants. The first Kinexys Fund Flow transaction involved four parties: three JP Morgan divisions and Citco. With few participants and established mutual trust, state inconsistencies can be resolved manually.

Pilots handle single asset types. BUIDL deals in US Treasury-based money market funds; the GS DAP-BNY collaboration covers MMF shares; HSBC Orion focuses on bonds. With a single asset type, the state model is simple and cross-asset-class regulatory differences need not be considered.

Scaling to production removes all three simplifications simultaneously. Multi-jurisdictional environments, numerous participants, and diverse asset types must be handled at once. The resulting complexity is not linear but combinatorial. Three jurisdictions multiplied by 10 participants multiplied by 5 asset types is not merely tens of times more complex than one jurisdiction times four participants times one asset type; it is hundreds of times more complex.

From Bottlenecks to Requirements

Figure 3: The Pilot-to-Production Gap

In our previous research, we articulated three RWA 2.0 principles (Legacy-First, State Completeness, Regulation-Native) and argued that their common technical requirement is continuous bidirectional state synchronization. The analysis above supports this claim not as theory but as empirical observation.

Each bottleneck translates into a specific technical requirement that RWA 2.0 infrastructure must satisfy.

The rational trap of walled gardens shows that inter-institutional interoperability cannot be achieved through individual institutions’ goodwill alone. Solving the N(N-1)/2 connection problem requires protocol-level interoperability where each institution maintains its own infrastructure while connecting through a shared state vocabulary and regulatory action taxonomy. This is also what the Legacy-First principle demands: not replacing existing infrastructure but connecting between existing systems.

Canton’s inter-domain gap demonstrates that synchronization within a single blockchain ecosystem is insufficient. Given the reality that institutional assets simultaneously exist across Canton domains, public chains, and DeFi protocols, bidirectional state consistency across heterogeneous systems is required. This is the realization condition for the State Completeness principle: for a token to reflect an asset’s full lifecycle, state must be synchronized across every environment where that asset exists.

The pilot success fallacy reveals that the combinatorial complexity of production environments demands a new class of infrastructure. When a regulatory action occurs in a multi-jurisdictional environment, that action must propagate atomically across every chain and system where the affected asset exists. This is what the Regulation-Native principle requires: compliance guaranteed at the protocol level rather than dependent on individual systems’ runtime checks.

These three requirements ultimately converge on a single problem: continuous bidirectional state synchronization spanning on-chain, off-chain, and cross-chain environments. If existing oracle architectures were designed for unidirectional data feeds, this requirement calls for a fundamentally different kind of primitive.

Open Questions for Institutional Tokenization

The trajectory of institutional tokenization is clear: every major institution is moving in this direction, and investment volumes and staffing decisions confirm it. But several unresolved questions remain along the path from pilot to production.

The desire to escape walled gardens vs. the instinct to protect competitive advantage. Goldman Sachs’ decision to spin out GS DAP reflects the judgment that platform openness creates more value than closure. But will other institutions reach the same conclusion? If an institution’s own platform achieves sufficient network effects, incentives for interoperability may weaken.

The pace of Canton’s scope expansion. DTCC’s participation means a core pillar of traditional financial infrastructure has joined Canton. But how long until bidirectional synchronization between Canton domains and public chains is established at an industry level? When will infrastructure emerge that simultaneously satisfies both the reality of BUIDL operating on nine public chains and the reality that institutional transactions require Canton’s privacy?

Atomicity of multi-jurisdictional regulatory enforcement. This is simultaneously a technology problem and a policy problem. Even if cross-chain atomic enforcement is technically achievable, will regulatory authorities in each jurisdiction recognize the automatic propagation of regulatory actions originating in other jurisdictions? This question will be explored more deeply in our next research on cross-border securities trading and regulatory conflicts.

Conclusion: Breaking the Institutional Tokenization Ceiling

---

The numbers in institutional tokenization are impressive. But examining the structure behind the numbers makes clear that current successes are products of controlled environments: within a single institution, under a single jurisdiction, covering a single asset type, among a small number of participants.

The transition to production removes these conditions simultaneously. The three bottlenecks revealed in this process (the rational trap of walled gardens, Canton’s inter-domain gap, and the cognitive trap of pilot success) cannot be resolved by individual institutions’ technical capabilities alone. This is an industry-level infrastructure challenge.

The technical requirements of this challenge are clear: a shared state vocabulary, bidirectional state consistency across heterogeneous systems, and atomic propagation of regulatory actions across domains. When these three requirements are met, pilot success will finally become production reality.

---

References

[1] CryptoSlate. (2026, January). “How BlackRock lost control of the $10B tokenized Treasury market to Circle.” https://cryptoslate.com

[2] BlockEden.xyz. (2026, February). “Wall Street Meets DeFi: BlackRock’s $18B Treasury Fund Goes Live on Uniswap.” https://blockeden.xyz

[3] J.P. Morgan. (2024). “Introducing Kinexys.” https://www.jpmorgan.com

[4] HSBC. (2026, February). “HSBC Orion awarded DIGIT platform mandate.” https://www.hsbc.com

[5] Goldman Sachs. (2025, July). “BNY and Goldman Sachs Launch Tokenized Money Market Funds Solution.” https://www.goldmansachs.com

[6] Digital Asset. (2025, June). “Digital Asset Raises $135 Million to Accelerate Adoption of Canton Network.” https://www.canton.network

[7] DTCC/Canton Network. (2025, December). “DTCC and Digital Asset Partner to Tokenize DTC-Custodied U.S. Treasury Securities on the Canton Network.” https://www.canton.network

Learn More

• The RWA 2.0 Declaration: Blockchain Innovation That Embraces Legacy — RWA 2.0’s three principles and the continuous bidirectional state synchronization requirement

• From Isabelle/HOL to Compliance-Aware Infrastructure: Why RWA Needs Provable Compliance — The compliance assurance spectrum for RWA infrastructure and the case for provable compliance

• Why Oraclizer Chose DAML/CANTON — An institutional liquidity perspective on the DAML/Canton selection