One firm clearing and recording the same trade undoes a deliberate split
The Bank of England has let a clearing house also run the ownership record for tokenised securities. Those two jobs were separated on purpose, and the sandbox should say how they are being kept apart.
When shares or bonds change hands, two institutions sit in the middle: one guarantees the trade completes if a party fails, and another keeps the definitive record of who owns what. The Bank of England runs a Digital Securities Sandbox, a temporary regime letting firms do those jobs using new technology under modified rules. It has now approved ClearToken, a London clearing firm, to run the record-keeping side.
Letting one firm both guarantee trades and keep the ownership record undoes a separation that exists for good reason. The Bank should say plainly how the two halves are walled off, and when the permanent rules arrive.
Two jobs that were pulled apart for a reason
A clearing house has just been given permission to keep the ownership record too. Those are not the same job, and they were separated on purpose.
When a security changes hands, two very different institutions sit in the middle. A clearing house steps between buyer and seller and guarantees the trade completes even if one side collapses. To do that it must take on risk: it collects margin, holds a default fund, and is engineered so that a large member can fail without the whole chain failing. A depository does the opposite. It keeps the definitive register of who owns what and moves entries between accounts. It is supposed to take on almost no risk at all, because a clearing house can in principle be resolved and replaced, while a corrupted or contested ownership record has no substitute.
ClearToken, a London clearing house for digital assets, has been approved by the Bank of England to operate a Digital Securities Depository inside the Digital Securities Sandbox. That is the whole of what the announcement establishes, and it is enough to ask the question that matters: under what terms are the two halves kept apart?
What a sandbox approval is and is not
A sandbox is a temporary permission to do something the permanent rulebook does not yet allow, under conditions the regulator sets. It is not a licence, not an endorsement of a business model, and not a judgement that the firm is safe at scale. The usual controls are activity limits — caps on the value of securities recorded, on the types of instrument, on who may participate — and the power to pull the permission.
Those controls are the substance of the decision. The headline is the permission; the caps and conditions are the policy. At the moment the market has the headline. Anyone trying to work out whether this is a contained experiment or a structural change to who holds the register of British securities cannot tell from what has been published.
The settlement asset question nobody has answered in public
There is a second gap. A securities trade has two legs: the security moves and the cash moves. The point of putting both on one ledger is to make them move together, so neither side is ever exposed to the other. But cash on a ledger is cash issued by somebody. Central bank money cannot fail. Commercial bank money can. A token issued by a private firm and backed by assets it manages can fail in a different way again, and the difference only shows up on a bad day.
If the settlement asset in a sandbox depository is not central bank money, then the efficiency gain has been bought by moving credit risk from the settlement lag into the settlement asset. That may well be an acceptable trade at sandbox scale. It is not an acceptable trade to leave unstated.
The strongest case against me
The best argument for combining the two roles is that tokenisation makes one of them smaller. The historic reason for a clearing house standing between counterparties is that settlement takes days, and days of exposure need collateral and a guarantor. If delivery and payment happen in the same instant on the same ledger, the exposure the clearing house exists to absorb largely disappears. On that view the unbundling of clearing from settlement is an artefact of slow plumbing, and rebundling them is the reform, not the risk.
There is force in that, and the Bank is right to test it rather than assume it. But two things survive the argument. First, instant settlement removes counterparty exposure between trade and settlement; it does not remove the depository’s status as a single point of failure for the record itself. Nobody has yet built a securities market where the register can be lost. Second, if the clearing function really is shrinking towards nothing, the firm should say so and be regulated as a depository with a residual guarantee function — not carry the word clearing on the door while the risk model quietly changes underneath it.
The deadline that is not in the announcement
Sandboxes end. That is the definition. The firms inside one are building on a permission that expires, and the value of the whole exercise depends on whether a permanent regime exists by the time it does. If it does not, the sandbox becomes a series of rolling extensions, which is the worst of both worlds: real market infrastructure operating on temporary terms, with the regulator increasingly reluctant to withdraw a permission that customers now depend on.
That is the failure mode to guard against, and it is a policy failure rather than a firm’s failure. The Bank has been busy this month with rate decisions, gilt sales and letters to the Chancellor. This approval will get a fraction of that attention and will outlast most of it, because market plumbing, once laid, is almost never dug up.
The Bank of England should publish, for each Digital Securities Sandbox approval, the activity limits attached to it, the settlement asset used for the cash leg, and whether the clearing and depository functions sit in separately capitalised entities with separate default rules. It should also publish, for every approved depository, the arrangement for transferring the securities record to another operator if the firm fails.
HM Treasury and the Bank should then name a date for the permanent rulebook that follows the sandbox. Firms cannot build durable infrastructure on a permission with an expiry date and no successor, and regulators should not be manoeuvred into extending one because too much now depends on it.
What would change this view
I am wrong if the Bank of England publishes, for this approval, the activity limits applied to the depository, confirmation that the clearing and depository functions sit in separately capitalised entities with distinct default waterfalls and rulebooks, and a documented plan for transferring the securities record to another operator if the firm fails. Those four disclosures would answer the concentration objection outright.
I am also wrong on the exit point if HM Treasury or the Bank publishes a permanent rulebook for digital securities depositories, with a commencement date, before the sandbox's own end date. In that case firms are building towards a known destination rather than a cliff, and the sandbox is doing exactly what a sandbox should.
Worked from
- ClearToken wins Bank of England approval to clear tokenised assets
Finextra · 2026-09-22