Three Central Banks Settled FX Across Separate Ledgers, and One Had to Hold the Money

The Bank of England published the results of a three-central-bank settlement experiment on 13 November, and the detail that matters sits below the headline finding. Atomic payment-versus-payment worked across an RTGS system, a tokenised wholesale ledger and a wholesale CBDC testnet. In one of the three, it only worked because the operator held the cash.

The Bank of England’s summary of Project Meridian FX APAC, run with the Monetary Authority of Singapore and the Bank of Thailand, sets out the trade-off in plain language. Where a settlement system could not reserve funds for a third party, the synchronisation operator had to fall back on an arrangement that put participant money inside a wallet it controlled. Partior built the operator prototype.

The experiment is exploratory, ran on simulated environments, and did not reproduce a live FX trade lifecycle. Read that way, it still answers a question that has blocked cross-border settlement design for years: whether banks have to converge on one shared platform to settle atomically. The answer is no. The cost of not converging shows up somewhere else.

What the operator actually did

Meridian FX APAC is the third round of a model the Bank of England has been building out. Project Meridian coordinated a cash leg against an asset leg. Meridian FX extended that to foreign exchange and added liquidity-saving features. The APAC round pushed the model across three central bank money environments built on different technology, then asked whether one coordination process could drive all three at once.

The operator is deliberately thin. The technical report describes four stages that every transaction passes through. A participant submits a settlement instruction carrying the sell side of the trade, the currency, amount, counterparty, value date and a priority flag. The operator matches the two legs of the trade. It then asks each settlement system to earmark the required funds, so the money is reserved and cannot be reused unless the operator cancels it. Only when every leg is secured does it instruct settlement, and only then does the all-or-nothing condition bind.

The reversible window is the useful part of the design. Until the first settlement instruction executes, the operator can cancel earmarks and unwind the whole transaction. After the first leg executes, it cannot. The technical report calls that fork the point of commitment, and separates it from legal settlement finality, which is a different question handled in the policy report.

Four exception scenarios tested that fork: insufficient funds, an invalid account identifier, a batch containing both faults at once, and an infrastructure outage. In each case the operator either completed every leg or unwound every leg. Nothing was left half-settled. The report attributes that to three system capabilities: idempotency, queryable transaction status and reliable event delivery.

Three systems, three different answers to the same question

The environments were not variations on one build. The Bank of England’s Synchronisation Lab paired a simulated RTGS system with a prototype earmarking and coordinated-settlement capability. Thailand’s Project SAN used a token-based wholesale settlement model with a centrally managed token ledger and an interoperability layer routing instructions between participants. Singapore’s SGD Testnet, run in a non-production configuration, used a shared ledger in which commercial bank wallets hold wholesale CBDC, with no central intermediary and no third-party orchestrator.

The Bank of England’s reading is that the differences did not stop settlement. The summary states that “synchronisation worked across systems with materially different technologies and operating models,” and adds that cross-border interoperability does not necessarily require central banks to converge on a single infrastructure design.

What the differences did change was how much work the operator had to do. Project SAN authorised the operator as an instructing party at the interface level. The Synchronisation Lab did the same. SGD Testnet did not. It requires a cryptographic signature from the account holder for every asset movement, so the operator’s adapter composes the unsigned instruction, routes it to the participant’s external key custodian for signing, and submits the signed transaction. The operator ends up holding only its own key, which the report describes as acting in a purpose-limited capacity.

The escrow wallet, and why it is the real finding

Funds reservation is where the architectures diverged in a way that matters. The baseline model in the accompanying policy report assumes a non-custodial operator: one that coordinates settlement, matches instructions, monitors readiness and applies unwind logic, but never holds participant money or maintains settlement accounts.

Singapore’s environment could not earmark funds for a third party. So the operator replicated reservation the only way left. “in MAS’ test environment, the SO managed a dedicated escrow account to replicate funds reservation,” the summary notes, adding that the arrangement “reflected the design and capabilities of the experimental system and is not an inherent feature of synchronisation.”

That single sentence carries a lot. An operator that parks participant funds in a wallet it controls is no longer only a coordinator. It sits inside the payment flow with custody exposure, operational risk and a legal relationship to the money that a non-custodial model avoids. The policy report treats this carefully, saying the analysis uses a non-custodial operator as its baseline and then identifies how the considerations change if the operator holds funds, calculates positions or performs additional functions.

The arithmetic is simple and uncomfortable. One of the three environments, a third of the test bed, needed a custody workaround to reach the same outcome the other two reached natively. The technical fix was small, an adapter plus a bank-authorised wallet. The governance consequence is not small, because the regulatory treatment of a settlement coordinator and the treatment of an entity holding client money in escrow are different exercises.

Netting quietly pushes the operator toward a clearing house

The second use case was multilateral net FX PvP across all three systems, and it worked. The mechanics are more interesting than the result. The operator deferred non-urgent transactions into cycles, matched them, then calculated each participant’s net position for the candidate batch and built instructions to reserve liquidity and execute the resulting movements. Because it could not know in advance which transactions each system would accept, it negotiated iteratively, removing rejected items and resubmitting until all three systems earmarked the same set.

When the batch finally settled, each participant ended with a single debit or credit per system regardless of how many counterparties it faced. On Project SAN the netted batch went in as one instruction with one movement record per participant. On SGD Testnet the operator executed the same net positions as a sequence of individual movements, which is the kind of asymmetry that makes cross-system coordination expensive.

The report is candid about where this leads. “Where an SO is responsible for calculating offsetting positions and generating settlement instructions, it may begin to assume functions traditionally associated with a clearing house, rather than acting solely as a settlement co-ordinator,” it states. One remedy it floats is for central bank systems to accept multilateral net settlement messages and perform the netting themselves, which would keep the operator thin.

Scale explains why that matters. Take ten participants who all trade with each other: the gross mesh produces 90 payment legs, while netting collapses the same set to 10 movements, an 89% reduction in instructions. That figure is arithmetic, not a project result. It shows why netting is worth the coordination cost, and why the entity doing the netting attracts clearing-house obligations.

The $9 trillion the experiment is aiming at

Meridian FX APAC exists because a large slice of the foreign exchange market still settles without payment-versus-payment protection, and the Bank of England cites the BIS’s 2025 Triennial Survey analysis for the scale. Of the roughly $14 trillion settled daily in April 2025, just over $5 trillion, or 36%, went through PvP and carried no settlement risk. Another $7.6 trillion, 54%, used methods such as pre-settlement netting that reduce risk without eliminating it. More than $1.4 trillion, 10%, settled gross and bilateral, fully exposed.

That last number annualises to about $511 trillion of average daily exposure if you simply multiply by 365, which is an illustration of scale rather than a measured flow. It also frames what synchronisation is for. The experiment targets the 64% of daily settlement that does not clear through existing PvP arrangements, and it does so without asking each jurisdiction to replace its domestic infrastructure.

The Hong Kong Monetary Authority has taken a different route, moving its EnsembleTX tokenised settlement platform to round-the-clock operation with 32 participants, as BlockchainReporter reported. Where Hong Kong builds a single tokenised venue, Meridian links venues that already exist. The parallel push around cross-border stablecoin settlement adds a third model, one the Financial Stability Board has flagged for cross-border risk.

Atomicity is a technical event. Finality is a legal one.

The policy report draws a distinction that engineers regularly blur. Coordinating payment legs so they settle atomically does not, on its own, create a legally recognised settlement outcome across separate domestic systems and jurisdictions. The technical point of commitment is a software state. Settlement finality is a rulebook question, and it is what protects participants in a resolution.

The report tests the operator against five lenses: access and assurance, regulatory perimeter and oversight, settlement finality, governance and accountability, and data and information sharing. It maps each onto an existing framework rather than inventing one. Settlement finality leans on Principle 8 of the PFMI, which requires an infrastructure’s rules to define the moment settlement becomes final, and on the CLS model. Access and assurance draws on the Reserve Bank of Australia’s batch administrator framework. Data sharing draws on ISO 20022.

No single framework covers the whole arrangement. Access questions and perimeter questions sit mostly inside domestic law. Finality, accountability and cooperation between authorities arise precisely because the service crosses borders. The report argues that internationally developed principles or expectations could give authorities a more consistent basis for assessing operators, while avoiding the assumption that every synchronisation service looks the same.

What the Bank of England still has to show before 2028

The Bank of England says the findings will inform its work toward a live synchronisation service, “in line with its commitment to launch synchronisation in 2028.” From the 13 November publication date, that is a little over 414 days to the start of 2028, which leaves the gap between a controlled experiment and a production service as the thing to watch.

The report lists what was not tested. Operating hours did not overlap in the way real jurisdictions do, so the coordination of a settlement window spanning Asia and London remains unproven. Earmark expiry was not modelled. Outages were introduced and recovered from, but not prolonged ones. Commercial bank money was represented by stylised participants, and the submission and settlement of FX trades in commercial bank money was outside scope.

The Bank of Thailand and MAS stopped short of matching the Bank of England’s commitment. The summary states plainly that participation does not imply an equivalent implementation commitment or a particular policy direction for either. The Bangko Sentral ng Pilipinas and the Reserve Bank of Australia contributed to the policy workstream as observers, which is where the next round of jurisdictions is likely to come from.

For builders, capability alignment beats platform consensus

The transferable lesson is not that atomic settlement works. It is that the capabilities a settlement system exposes decide how much of the coordination burden lands on the operator. Authorised third-party access, native funds reservation and settlement initiation each removed an adapter and a workaround. Where they were missing, the operator absorbed responsibility it was not designed to carry.

That is the same design pressure onchain builders already know. A protocol that cannot reserve, revoke or atomically execute on behalf of an authorised party forces every integrator to build a custodial bridge, and each bridge becomes a new place where funds can sit and rules can be tested. Meridian FX APAC put three central bank systems through that test and found the payments held. What it did not show, and cannot show inside a controlled environment, is whether the legal and oversight machinery will hold around an operator that ends up holding funds it never intended to touch.