On October 6, the Solana Foundation published an open-source settlement standard that does one thing with real rigor and refuses, by explicit design, to do the thing most institutions actually pay for. The standard enables delivery-versus-payment on Solana. It escrows both legs of a trade, verifies that both are funded to the agreed amount, and then fires an atomic swap. Neither party can release its leg while the other's leg sits still. That is the entire promise, and it is a serious one: principal settlement risk โ the Herstatt risk that has shadowed wholesale payments since a German bank failed mid-settlement in 1974 โ is eliminated. Then the standard stops. Every trade settles gross. Every trade requires 100% upfront cash. There is no netting, no partial fill, no financing facility, no cross-channel payment. The ledger remembers what the mind forgets: a settlement standard is defined less by what it enables than by what it forbids. This one forbids the balance-sheet relief that every treasury desk is quietly asking for. That single refusal is the most important fact in the announcement, and it is the fact most likely to be lost in the coverage.
Two problems get conflated constantly in crypto marketing, and the confusion is not innocent. The first is counterparty settlement risk: the danger that one leg of a trade moves and the other does not. The second is liquidity cost: the capital that must be parked, idle, while a settlement is pending or while a gross obligation waits to be funded. Delivery-versus-payment was invented to solve the first. Netting was invented to solve the second. They are different engineering problems, they demand different mechanisms, and โ this is the crux โ a solution to one can make the other worse. Solana's new standard picks one and, with unusual candor, tells you it has abandoned the other.
The historical anchor matters here. In June 1974, the German bank Bankhaus Herstatt had accepted Deutsche mark deliveries but had not yet made the corresponding dollar payments when it was closed by regulators mid-day. Counterparties who had already delivered were left exposed. The episode became the canonical illustration of settlement risk and the reason the G10 central banks built the machinery โ real-time gross settlement systems, the Lamfalussy standards, eventually the DvP principle โ that governs wholesale payments today. Every serious settlement design since has been an argument with Herstatt's ghost.
Solana's entry is a standard, not a product. The Foundation published it as open source, with source commits visible, framed as a settlement primitive for institutions rather than a consumer application. Two legs โ a cash token and an asset token โ are each placed in escrow. A designated third party, the "settlement authority," signs to trigger simultaneous transfer. The transaction record covers a single exchange between two parties. Both legs must be Solana token accounts; bank-account payments and other channels fall outside the atomic swap entirely.
The standard also cites the BIS/CPMI report of October 2024, an alignment that reads less like an academic footnote and more like a deliberate signal to regulators and institutional counterparties. And it exists alongside a parallel track reported on October 2 โ a service built on token transfer-and-burn with daily net settlement against bank accounts. Two settlement philosophies now coexist inside the same ecosystem: one nets off-chain, one refuses to net on-chain. The tension between them is the most interesting structural story here, and I will return to it.
The mechanics: an escrow agent, standardized
Strip the institutional packaging away and the mechanism is not new. Atomic swaps between escrowed legs have existed since hash time-locked contracts matured around 2017. What Solana's standard adds is not a new cryptographic primitive but a standardized interface for a specific class of counterparty: a licensed institution that needs deterministic, auditable, two-party settlement.
The flow is deliberately minimal. Both legs are escrowed. Both are checked against the agreed amounts. The settlement authority signs. The transfer executes atomically. That is the loop. The designers have drawn the boundary to create what I would call a minimal trusted unit โ a settlement primitive that sacrifices flexibility for certainty and auditability.
The reasoning is sound if you accept the premise. For a regulated institution, ambiguity is the enemy. Conditional states, partial states, and re-entrant states are all places where audit trails fray and where disputes breed. By refusing partial fills, by refusing cross-trade netting, by refusing cross-channel legs, the standard collapses settlement into a binary: it either happened, fully and atomically, or it did not happen at all. Under condition X, where both legs are escrowed and the authority signs, then outcome Y follows with no intermediate state. That determinism is genuinely valuable, and it is why the standard's design reads as conservative rather than careless.
But note the composability trade-off it accepts. High determinism, low efficiency. The design points, unmistakably, at licensed institutions โ banks, custodians, asset managers โ and away from DeFi-native users, who value composability and permissionless access over binary finality. This is not a flaw; it is a target-customer statement written in architecture.
The risk controls deserve a closer look, because they reveal the design's careful limits. The standard provides unwind, recovery, and settlement-authority cancellation instructions โ a layered response to the ways a two-party escrow can stall. Unwind reverses an initiated exchange; recovery addresses deposits that arrive after a channel has closed; cancellation lets the authority abort a trade before it completes. Together they are a reasonably complete failure-handling toolkit. What they cannot do is override an issuer. A fully funded, fully escrowed, fully signed trade can still be stopped by an issuer's freeze, and its refund can still depend on issuer cooperation. The controls govern the parts of the system the designers own. They do not govern the parts they depend on.
The economics: gross settlement is a balance-sheet tax
Here the design choice becomes expensive, and the cost is the whole story.
Netting is not a convenience feature. It is the mechanism by which wholesale finance functions at all. If party A owes party B 100 and party B owes party A 90, net settlement moves 10. Gross settlement moves 190. The difference โ 180 units of funding โ is liquidity that must be sourced, parked, and idled for the duration of the settlement window. Multiply that across a book of trades and the arithmetic stops being a rounding error and becomes a capital strategy.
The Solana standard requires 100% upfront funding for every trade and provides no financing whatsoever. If a participant needs funding, it is arranged outside the scheme, through ordinary inspected token transfers. Read that carefully, because it is the quiet center of the announcement: the liquidity cost is not eliminated. It is relocated โ off the settlement system and onto the participant's balance sheet. The standard solves the counterparty problem by externalizing the funding problem. It is, in effect, a rule that every trade must be pre-funded to the hilt, with the funding sourced somewhere else.
For banks, this is not a neutral outcome. Under Basel's liquidity framework, a bank must hold a buffer of high-quality liquid assets against stressed outflows. Cash idled to pre-fund gross settlement is cash that is not earning, not lent, not deployed. In calm markets the cost is a drag; in stressed markets, when everyone settles at once, it becomes a scramble. I have spent enough time inside liquidation models to be wary of this pattern. When I built a Python simulation of MakerDAO's liquidation cascades in 2020 โ six weeks of modeling how stability fees and collateral ratios interact under ETH volatility โ the lesson was not that safety mechanisms are bad. It was that safety mechanisms requiring full collateralization convert tail risk into a permanent carrying cost. You do not get the safety for free. You pay for it every single day, in capital you cannot use. Gross settlement is that logic applied to institutional cash: the safest settlement is also the most capital-hungry, and the bill arrives continuously.
The absence of any disclosed quantification sharpens the point. The standard offers no measured cost comparison, no modeled funding requirement, no worked example of a settlement cycle. It asserts the benefit โ eliminated principal risk โ and leaves the price unstated. For a product whose entire value proposition trades certainty against cost, that is a conspicuous silence.
One structural consequence deserves separate attention. If the standard requires 100% upfront funding and provides none, it creates demand for exactly one thing: short-term funding. Institutions that want to use Solana DvP will need a source of intraday cash โ a lender, a repo facility, a liquidity provider willing to bridge the settlement window. That demand does not currently have an obvious supply. The likely outcome is an intraday funding market that grows up parasitically around the standard, priced to the cost of idle capital at settlement peaks. The standard does not build this market. It implies it. And if settlement volumes ever concentrate at particular times of day, the resulting funding scramble is a liquidity-stress scenario the designers have not modeled publicly.
The competitive frame
Solana's standard is not entering empty space. Partior, backed by major banks, offers centralized multi-currency settlement with netting. Fnality settles against central-bank reserves in a wholesale-CBDC model, also with netting. Ethereum's ecosystem hosts a range of DvP designs, each with its own composability profile. Against all of them, Solana's differentiator is high-performance L1 throughput plus an open-source standard โ real advantages โ and its handicap is the explicit absence of netting, which competitors can market directly against. "Our design cuts your funding requirement by most of it; theirs requires all of it" is a pitch that writes itself. The standard's Solana-native performance and its network effects are genuine, but in a market where the buyer is a treasury desk measuring basis points of funding cost, the netting gap is not a detail. It is the negotiating table.
The power structure: two silent vetoes
The escrow removes risk between the two trading parties. It does not remove the issuer's control, and this is where the standard's architecture reveals its true dependency structure.
The cash token and the asset token retain their issuance-level authorities: freeze, pause, and in some designs permanent-delegate. If an issuer freezes the escrow account, a fully funded trade cannot complete. If an issuer blocks the transfer, the same. Refunds, in the worst case, may depend on issuer cooperation. The standard's own risk controls โ unwind, recovery, and cancellation by the settlement authority โ cannot override these issuer powers. They operate underneath them. A trade can be perfectly escrowed, perfectly funded, perfectly signed, and still fail because a third party outside the trade decided it should.
Then there is the settlement authority itself. Every trade depends on a designated third-party address signing to release. That is a centralized trust point introduced into an otherwise atomic design. If the authority is unavailable, the trade does not complete. No redundancy, no failover, and no disaster-recovery mechanism is disclosed. Architecturally, the standard has three trust anchors โ Solana L1 consensus, the token issuers, and the settlement authority โ and the atomic swap removes only the fourth: the counterparty. The counterparty was never the hardest problem to solve.
This is not a reason to dismiss the standard. It is a reason to read its security assumptions honestly. "Trustless atomic settlement" is accurate about the counterparty and silent about the issuer and the authority. The honest description is: atomic settlement conditional on two external parties continuing to behave.
The dependency chain: a pipe, not a well
Step back to the ecosystem and the standard's position becomes clear. It produces no assets. It is a pipe, not a well. Its value depends entirely on whether cash tokens and regulated asset tokens are actually issued on Solana. If tokenized deposits and regulated securities predominantly live on Ethereum or elsewhere, Solana's DvP is an empty pipe โ technically elegant, economically idle.
The direction of dependency is unfavorable. The standard is constrained by the token issuers, who hold veto power over settlement through their freeze and pause authorities. In the power structure of the arrangement, the settlement standard sits downstream of the entities that supply its inputs. It cannot route around their cooperation. This is the classic position of infrastructure that standardizes a function without owning the underlying asset โ powerful if adoption comes, hostage if it does not. The ledger remembers what the mind forgets: the standard will be judged not by the elegance of its escrow but by the willingness of issuers to let it settle.
There is also the lock-in. Both legs must be Solana token accounts. That strengthens Solana's network effect โ settlement volume, if it materializes, accrues to Solana โ while simultaneously capping the addressable market by excluding cross-chain settlement. The design optimizes for ecosystem capture over reach. Whether that is a strength or a ceiling depends entirely on whether the tokenized assets come to Solana, and that is not something the standard can decide for itself.
The transparency gap
Consider what the announcement does not contain. No audit is disclosed. No quantified cost savings. No production volume, no settlement counts, no TVL. No named institution has connected. For institutional infrastructure, this is not a minor omission. It is an anomaly.
When I audited early NFT platforms' energy claims in 2021 โ a three-month exercise comparing proof-of-work network consumption against traditional art auctions, which drew backlash precisely because it insisted on numbers โ the tell was always the same. A claim without a denominator is a claim that has not been tested. "The Carbon Cost of Digital Scarcity" was unpopular because it replaced sentiment with measurement. The Solana standard's claim is structural rather than environmental, but the tell is identical. A settlement standard that expects banks to rearchitect their operations should be able to show a number: a modeled funding requirement, a settlement-cycle comparison, a single production example. Its absence is the most important unstated fact in the release.
The governance vacuum compounds this. The standard is described as open source, but the mechanism by which it evolves โ who controls parameter changes, version upgrades, and the standard's maintenance โ is not disclosed. If no defined decentralized governance exists, control concentrates in the Foundation. That is a tension with the "open standard" framing, and it is the kind of tension institutional adopters notice, because they are being asked to build on a primitive whose steward they cannot vote on and cannot exit cheaply.
The regulatory layer
The BIS/CPMI citation is the most revealing choice in the announcement. It signals, deliberately, that the standard's design intends to align with international clearing norms โ that this is not a crypto-native experiment but an attempt to speak the language of the Committee on Payments and Market Infrastructures. The fixed refund paths, returning funds to a designated party's token account, reinforce this: they are favorable for audit and traceability. Regulators are likely to find the design legible, even welcome.
The permissioned posture is unmistakable. A settlement authority signature, a designated recipient, a fixed refund path โ all of it points to permissioned participants. This is where my long-standing view of compliance architecture becomes relevant. Most project KYC is theater; buying a few wallet holdings bypasses it, and the compliance cost lands entirely on honest users. But that critique does not apply cleanly here, because this standard does not pretend to be permissionless. It is honestly permissioned. The cost is real, and it is borne by the licensed, regulated participants who can afford it. The unregulated never enter this pipe at all; they use the permissionless rails next door. So the standard does not reduce compliance cost. It concentrates it โ cleanly, on the parties already paying for compliance anyway. That is a more defensible design than most, and it deserves to be described as such.
The security-property question attaches to the underlying asset tokens, not to the standard. Whether a tokenized asset is a security under Howey depends on the asset โ the money, the common enterprise, the expectation of profit, the reliance on others' efforts โ not on the settlement mechanism that moves it. The standard is a neutral tool; its participants are not.
The narrative and the expectation gap
Strip away the engineering and the announcement is a narrative event. It strengthens the story that Solana is being institutionalized โ that the chain once known for consumer speculation is becoming a venue for regulated finance. That story is real and it has momentum. What it does not have is delivery.
The gap between expectation and realization runs in one direction: over-optimism. The most natural misreading of this standard is that it lowers institutional settlement costs. It does not. Its own text says it excludes netting and provides no financing. Any expectation that Solana's DvP will "cut settlement costs" contradicts the facts of the release. The standard reduces a specific risk โ principal settlement risk โ and leaves the cost structure intact, or worse, transfers funding obligations onto participants. The verification point is precise: the first institution to disclose cost data under gross settlement. Until that disclosure exists, the narrative and the fundamentals are running on separate tracks, and the narrative is faster.
Social-to-fundamental ratios in institutional crypto narratives typically run hot for months before reality catches up. That is the environment this standard lands in. The article that accompanied it is, in effect, a de-hyping exercise โ a technical breakdown that quietly tells you what the standard does not do. The market would be wise to read it that way.
The contrarian angle: the flaw is the feature, and the silence is the risk
Now the counterintuitive part, and it runs against the obvious reading. The reflexive critique of this standard is that the missing netting is a weakness โ that Solana shipped a settlement system without the one feature that saves institutions money. I think that critique is half-wrong, and the more uncomfortable truth is elsewhere.
Netting is efficient in calm markets and dangerous in stressed ones, because it creates multilateral interdependence: every participant's exposure depends on every other participant's behavior. That is exactly the fragility that the Terra/Luna collapse exposed in 2022, when I retreated from public commentary for two months to study algorithmic stablecoin failure modes and the circular liquidity trap of dual-token systems. The lesson was not that interconnection is inherently bad; it was that systems optimized for efficiency in normal times can transmit failure catastrophically in abnormal times. Gross, fully funded settlement is expensive precisely because it refuses to build those linkages. It is a crisis-mode insurance policy that the market will price as a defect. The standard's real problem is not that it lacks netting. It is that it has not told anyone what the insurance costs.
The forward question is not whether Solana's DvP works. It is whether anyone will pay to use it. Watch for two signals: the first institution to disclose its funding cost under gross settlement, and the first settlement-authority outage that halts a fully funded trade. Either would convert this from narrative into evidence. Until then, treat the standard as what it is โ a precisely bounded primitive with an unstated price. The ledger remembers what the mind forgets, and it will remember the first time a fully escrowed trade failed to settle for a reason that had nothing to do with the counterparty.