Executive Summary

Tokenized money market fund shares are the first tokenized traditional asset with a genuine institutional use case: collateral that earns yield while pledged and moves in minutes instead of T+1. BlackRock’s BUIDL and Franklin Templeton’s on-chain fund proved the wrapper works^[1][2]; the CFTC’s Global Markets Advisory Committee has already recommended a framework for tokenized non-cash collateral, and clearinghouses and prime brokers are now deciding whether to accept it for margin^[3]. Three findings drive this assessment.

Risk Analysis

Five risks decide whether a tokenized MMF pledge survives contact with a default, and the weighting is lopsided: title and liquidity drive most of the loss-given-default scenarios we can construct, while the token rail — last on the list — is where all the audit budget goes.

The architecture, briefly

Every live tokenized MMF today is a mirror structure: the fund and its transfer agent remain the legal machinery, and a permissioned token contract reflects the register on-chain — Franklin’s prospectus says it plainly: the transfer agent “maintains the official record of share ownership,” blockchain integration notwithstanding^[2]. Collateral mobility happens entirely in the token layer. The risk sits in the seams between layers.

Tier 1 — risks that produce losses

1. Title and perfection ambiguity. Possession of the token is not registration on the shareholder register, and in a default you need the register. The failure scenario is concrete: pledgor defaults, secured party forecloses on tokens, fund’s transfer agent declines to re-register because its rulebook recognizes court orders and registered transfers, not on-chain events. Now the secured party owns a token the issuer will not redeem while the estate’s administrator claims the underlying shares. Under MiCA, tokenized fund shares are out of scope entirely — they remain MiFID financial instruments^[8] — so the crypto-native rulebook does not save you, and the DLT Pilot Regime’s ledger-as-register answer^[4] only covers instruments admitted to a DLT market infrastructure. Having sat on collateral committees at a Tier 1 bank, I can say plainly: a pledge the operations team cannot perfect in the registrar’s books would never have been approved off-chain, and the token wrapper does not change that test.

2. Liquidity asymmetry under stress. The token settles in minutes, 24/7. The fund redeems at the next NAV strike, business days only, under a Rule 2a-7 toolkit that regulators have rebuilt after every stress episode since 2008 — the SEC’s 2023 reform removed redemption gates but made liquidity fees mandatory for institutional prime funds precisely because redemption pressure keeps breaking the structure^[9]. The asymmetry compounds in a falling market: weekend margin calls are met in tokens, tokens accumulate with collateral takers who need cash, Monday brings a redemption queue at a single NAV print. March 2020 is the calibration point: institutional prime MMFs lost roughly 16% of assets in under three weeks, with peak outflows near 35% at some funds, before the Fed intervened^[10]. Redemption-at-NAV is exactly the mechanism that seizes. Pricing tokenized MMF collateral as cash-equivalent assumes the one market condition — calm — in which you do not need collateral.

Tier 2 — risks that produce disputes and capital surprises

3. Valuation staleness. The on-chain price is an oracle echo of yesterday’s NAV. Intraday, the token’s economic value drifts from its displayed value — trivially in normal times, materially when rates move or the portfolio takes a credit hit. Margin systems consuming the on-chain figure will systematically over-credit collateral on bad days.

4. Regulatory classification divergence. The same token is a MiFID instrument in the EU, a security in the US, and potentially something else in each Asian booking center — with Basel Group 1a capital treatment available only where enforceability and finality are evidenced, and 1250% risk weight where they are not^[6]. A collateral schedule that works in one booking entity can blow up the capital calculation in another. The gray zone here is genuine: as of mid-2026, no Basel-implementing jurisdiction has published supervisory criteria for when a tokenized fund clears the Group 1a bar.

Tier 3 — the risk everyone audits anyway

5. Token rail failure. Contract bugs, key compromise, allowlist misconfiguration, chain outages. Real, but bounded: permissioned contracts with issuer freeze-and-reissue powers make most rail failures recoverable in a way title defects are not. This is the only risk on this list with a mature control market — which is exactly why it absorbs a disproportionate share of diligence effort. Key custody for the pledged tokens raises the same architecture questions covered in our custody key management assessment (2026-002).

Mitigation and Controls

The control set follows the risk tiers. Most of it is collateral management discipline that banks already know, applied to a wrapper that tempts everyone to skip it.

Perfect the pledge where title actually lives. The clean structure is one where the token transfer and the register update are the same event — either because the instrument sits inside a regime that makes the ledger the register^[4], or because the fund’s transfer agent contractually recognizes on-chain pledge events in its rulebook. If neither holds, fall back to what works: a tri-party-style account-control agreement with the transfer agent alongside the token pledge. Slower, uglier, enforceable. We have seen institutions accept the token-only pledge “because the issuer is reputable” — that is credit analysis substituting for perfection, and it fails exactly when the issuer’s reputation does.

Haircut the lag, not the asset class. The underlying is a government MMF; the wrapper adds a redemption lag and a dual-record risk the underlying does not have. Price both: start from the untokenized fund’s haircut, then add increments for worst-case NAV-to-cash time (measured across weekends, not averaged) and for any jurisdiction where the perfection opinion is qualified. If the resulting haircut makes the product uneconomic, that is the analysis working, not failing.

Reconcile the two records daily and treat breaks as incidents. Token supply versus registered shares, every day, with a named owner and an escalation path. Every mirror-structure failure mode — duplicated credit, phantom collateral, a frozen register behind a live token — shows up first as a reconciliation break. This is the cheapest Tier 1 control available and the one most programs skip because the rail “has never broken.”

Cap concentration while the legal questions are open. Issuer caps, chain caps, and a ceiling on tokenized collateral as a share of total margin received. The Basel framework’s own infrastructure-risk add-on logic^[6] points the same direction: novel rails earn capacity gradually.

The counter-argument deserves a hearing. Proponents argue the asymmetry critique is transitional — intraday NAV, atomic delivery-versus-payment, and ledger-native registers will close the gaps, and the BIS’s unified-ledger work sketches exactly that end state^[7]. We agree on direction and disagree on timing: collateral programs are being approved in 2026, and controls must price the structure that exists, not the one on the roadmap. Relax the haircuts when the transfer agent honors a 02:00 Sunday redemption, not before.