The Wholesale Digital Euro

Wholesale settlement is the layer where dollar-clearing leverage becomes operational.

What BNP Paribas Paid For

On 30 June 2014, BNP Paribas pleaded guilty in United States federal court to two felony counts. The bank had processed dollar-denominated transactions for entities in Sudan, Iran, and Cuba, routing them through its New York branch to obscure the identities of the sanctioned parties.

The settlement was 8.9 billion dollars in penalties, a one-year suspension from dollar clearing in several business lines, and the discipline of thirteen employees up to the Chief Operating Officer.[2]

The conduct was legal under French law. France did not participate in the American sanctions regimes on Cuba or Iran. European Union sanctions on Sudan in the relevant period did not mirror the American programme. BNP was not breaking French law, European law, or the law of any counterparty.

It was breaking American law.

The mechanism is worth being specific about. When a French company sells equipment to a Sudanese buyer and receives payment in dollars, the dollars do not physically move from Sudan to France. What moves is an accounting entry between correspondent banks, and the chain of correspondents terminates at a United States financial institution.

That institution is subject to American sanctions authority. The transaction, legal under the law of every party involved, becomes a violation of American law at the moment it touches the correspondent account in New York.

The BNP penalty was the largest ever imposed on a non-American bank for sanctions violations. It was not the only one. HSBC paid 1.9 billion in 2012. Commerzbank paid 1.45 billion in 2015. Société Générale paid 1.34 billion in 2018.

The pattern across the decade was consistent: European banks, conducting business legal under European law, penalised by American authority because the business touched dollar rails.[3]

The penalties changed behaviour. European institutions began over-complying with American sanctions lists rather than risk secondary-sanction consequences.

An American sanctions listing would be implemented on European clients before any European legal review had authorised the implementation, because the cost of not implementing was dollar-clearing access, and dollar-clearing access was the commercial life of the institution.

Foreign executive action reached into European commercial decisions through the operational reality that non-compliance meant losing the infrastructure on which the institution depended.

This is the wholesale layer equivalent of what Paper 14 described at retail. The mechanism is the same. The infrastructure at retail is card networks, stablecoin issuers, and technology platforms. The infrastructure at wholesale is correspondent banking, dollar clearing, and the messaging layer that connects them. The digital euro in its retail form is the European response at the first layer.

The wholesale digital euro is the response at the second.

Whether the response succeeds depends on design choices being made now.

The Euro’s Missing Half

The euro is two different currencies.

At the level of monetary policy, balance sheets, and international debt markets, it is a reserve currency. The European Central Bank conducts independent policy, governments issue debt denominated in euros that the world buys, and central banks hold euros as part of their reserves. Roughly twenty per cent of global foreign exchange reserves are held in euros.

The euro is the second-largest reserve currency by most measures.[4]

At the level of operational settlement, where institutions actually move money between each other at scale, the euro is something less than sovereign. The wholesale rails were never fully built. They could not be, at the time the euro was introduced, because the global settlement infrastructure that existed was dollar-based, messaging-based, and organised around correspondent banking.

Building a euro system that operated independently of that infrastructure was technically possible only for the intra-euro-area slice. For everything else, European banks plugged into the existing American rails because those rails were what existed at institutional scale.

TARGET is the exception that proves the shape of the problem. TARGET2 was built in 1999 and the upgraded TARGET Services went live in 2023. It settles over a quadrillion euros annually in intra-euro-area wholesale transactions. It operates sovereignly, under European governance, accountable to European institutions. It is what euro wholesale settlement looks like when Europe builds it.[5]

TARGET does not reach beyond the euro area. A euro-denominated transaction between a German bank and a Japanese bank does not settle on TARGET. It settles through correspondent banking, which means through dollar-adjacent infrastructure.

A euro-denominated loan from a French bank to an Indonesian project finances the project in euros but requires the Indonesian counterparty to have euros to spend, and sourcing those euros typically happens through swap markets that touch dollar-euro liquidity in London, Tokyo, or New York. The euro travels internationally on rails Europe did not build.

This is the second layer of the euro. It exists. It works. And it requires American cooperation to function.

Cooperation has been available because the alliance structure that built the post-war order held. When the alliance structure holds, the dependency is tolerable. When it does not, the dependency becomes the instrument of whatever disagreement has emerged. BNP in 2014. The Russian central bank reserves frozen in 2022.

The ICC judges Paper 14 described, debanked in Amsterdam on an American executive order. These are the events that demonstrate what the dependency produces when it is tested.

The euro project stopped at the layer where building the alternative would have required technological capabilities that did not yet exist. Messaging-based wholesale settlement requires shared infrastructure between participants, and the shared infrastructure that existed belonged to someone else.

The United States had built it, the United States governed it, and building the European equivalent at global scale was not a choice anyone could have made in 1999.

Tokenisation is the first technological moment when that choice becomes available.

What Tokenisation Changes

A tokenised settlement system is not a faster version of the existing one. It is a different architecture.

In a messaging-based system, two institutions settle a transaction by exchanging instructions through a shared messaging network. SWIFT carries the instructions. Correspondent banks hold the accounts. Central banks operate the real-time gross settlement systems that reconcile the positions.

Each step requires the cooperation of a specific intermediary, and the cooperation is enforced through contractual and regulatory relationships. The infrastructure is a set of institutions.

In a tokenised system, the tokens themselves carry the value. A tokenised euro bond is not a claim recorded in a custodian’s database that settles through a chain of messages between intermediaries. It is a cryptographic record on a ledger, transferable directly between the parties to the transaction, settling atomically against tokenised cash.

The infrastructure is the protocol, and the protocol can be built on any governance model that the participants agree to use.

This is what makes the tokenisation transition consequential for sovereignty.

In the messaging-based world, wholesale settlement requires the existing intermediary infrastructure, and the existing infrastructure is dollar-adjacent by construction. In the tokenised world, the infrastructure is whatever the participants build. Europe can, for the first time, build wholesale settlement infrastructure that operates independently of dollar cooperation at the protocol level.

The claim has limits worth being specific about. A tokenised euro transaction between two European counterparties, settling on a European-governed ledger, does not require dollar cooperation. That case is now achievable.

A tokenised euro transaction between a European counterparty and a non-European counterparty who does not hold euros directly still requires the non-European side to source euros from somewhere, and sourcing typically involves some cooperation with dollar-based swap markets.

That case is harder, and the degree to which tokenisation resolves it depends on how the Eurosystem makes euros available to qualifying foreign institutions through the new infrastructure.

The ECB’s Appia consultation has this question explicitly on the table as one of its six building blocks. Cross-border interoperability is the area where the sovereignty claim is most contingent. If Appia settles cross-border transactions through interoperability arrangements that route liquidity through non-European infrastructure, the sovereignty is partial.

If it does so through direct euro issuance to qualifying foreign central banks and institutions on the new rails, the sovereignty is more complete. The design choice is live.

For the intra-European slice, which is the majority of the tokenised volume the system will handle in its first decade, tokenisation delivers full sovereignty if the underlying ledger is European-governed. This is the part of the argument that does not depend on resolving the cross-border question. It is already enough to justify building Appia.

Canton Is Already Being Built

Canton Network is the distributed ledger platform European wholesale is migrating to in the absence of a European alternative. Canton was created by Digital Asset Holdings (incorporated in Delaware), with protocol governance held by the Canton Foundation (registered in Zug).

Super Validator status, the effective governance authority over protocol changes, is held by an institutional set including Goldman Sachs, HSBC, BNY Mellon, BNP Paribas, Euroclear, Tradeweb, Circle, Broadridge, Nasdaq, and Visa. Nine of the ten largest investment banks participate.

Canton’s public metrics report nine trillion dollars of monthly transaction volume and six trillion dollars of tokenised real-world assets under management.

In December 2025, DTCC joined the Canton Foundation as co-chair alongside Euroclear, formalising governance parity between the American and European post-trade institutions on a platform whose operational governance remains Delaware-domiciled.[6]

Paper 13 of this series introduces the framework for assessing decentralisation claims: real decentralisation means no discretionary control point any authority can compel; pseudo-decentralisation is a non-Position-3 system marketed as decentralised.

Apply Paper 13’s subject-swap test to Canton: replace the freeze target with a sanctioned European institution and ask whether the operational logic still holds. The Super Validators most likely to enforce the freeze are the ones with the deepest dollar-clearing exposure.

The European banks named above have already demonstrated, in BNP Paribas in 2014 and across the decade that followed, that dollar-clearing exposure produces over-compliance with American sanctions. The subject-swap test on Canton’s roster delivers the same answer the framework predicts. Canton is Position 5.

This is the wholesale analogue of the dynamic Paper 11 documents at retail. The card duopoly captured European retail payments by providing scale no European alternative could match. Canton is in the process of capturing European wholesale tokenisation by the same mechanism.

The tokenisation transition is still early enough that the capture is not yet locked in: the majority of wholesale settlement still runs on TARGET, SWIFT, and correspondent banking. The window in which a sovereign alternative can be built closes when Canton’s share of tokenised wholesale passes the threshold where migrating away becomes operationally impractical.

That threshold is not precisely knowable in advance. The safe assumption given the rate of onboarding in 2025 and 2026 is that the window is measured in years.

Pontes, Appia, and the Sovereignty Framework

The ECB’s response has two components with different time horizons.

Pontes is the bridge. It takes the existing TARGET infrastructure and connects it to DLT settlement networks, allowing tokenised transactions on external platforms to settle in central bank money through TARGET. The first Pontes pilot is scheduled for the third quarter of 2026. Pontes is not itself a sovereign wholesale tokenisation layer.

It is the mechanism by which central bank money reaches tokenised platforms, including Canton if Canton becomes one of the networks Pontes bridges to.[7]

Appia is the longer-term project. The consultation on its design closed on 22 April 2026, and the blueprint is scheduled for publication in 2028. Appia is intended to be the European sovereign wholesale tokenisation layer itself, not a bridge to external layers.

If it is built to reach Position 2 or Position 3 of the sovereignty framework, it is the infrastructure Europe needs. If it is built to reach only Position 4, or worse allowed to operate as Position 5, it is a European-branded variant of the capture Canton represents.[8]

The framework positions, applied to tokenised wholesale settlement, work as follows.

Position 1 would be a national European settlement chain governed by a single member state’s central bank. A French chain governed by the Banque de France, a German chain governed by the Bundesbank. Position 1 is achievable but suboptimal for the euro area, because the currency itself is supranational and settlement infrastructure should match the currency’s scope.

Position 2 is EU sovereignty. A Eurosystem-governed settlement chain, operated by the ECB and the national central banks collectively, accountable to European democratic institutions and reachable by European legal process. Position 2 is the right level for wholesale settlement because wholesale settlement requires accountable governance.

When a transaction fails, when a counterparty defaults, when a protocol bug is discovered, someone must make a decision about what happens. Position 2 has accountable decision-makers. Position 3 does not.

Position 3 is distributed and mathematical. No single entity, jurisdiction, or consortium can compel protocol changes. The properties are enforced by cryptography and distributed consensus rather than by governance. Position 3 is the right level for components of the system where accountability is less important than resistance to capture.

Cross-border bridges, for example, may work better at Position 3 than Position 2 because the governance question for a cross-border bridge raises jurisdictional questions Position 2 cannot easily answer.

Position 4 is the condition Paper 1 described as shared sovereignty with a foreign state. European participation in a system whose governance sits outside European jurisdiction, with the participation legitimated by the presence of European institutions in the governance structure even though effective authority remains foreign.

Position 5 is decentralisation theatre. Position 4 with marketing. A system that claims distributed governance while operating under concentrated control. Canton is Position 5.

Appia’s design needs to deliver Position 2 for the core settlement layer and Position 3 for any component where Position 2 is not technically achievable. Position 4 is the failure case. Position 5 is the failure case with a worse diagnosis, because it means Europe has been sold a product that was not what it claimed to be.

What the Appia Blueprint Should Specify

The framework translates into three specific requirements for Appia.

Governance in Europe, answerable through European law. The corporate and institutional structure operating Appia must be European-domiciled and accountable to European institutions. Protocol changes must require decisions by a body whose members are reachable by European courts and regulators. Position 2 is what Canton does not have and what any European alternative must.

Cross-border interoperability that does not import jurisdictional exposure. Appia will need to connect to non-European settlement systems. The question is how. If interoperability operates through bridge infrastructure that itself sits under foreign jurisdiction, the interoperability re-imports the exposure Appia is designed to avoid.

If interoperability operates through direct issuance of euros to qualifying foreign institutions on the Eurosystem’s own infrastructure, the sovereignty of the core layer is preserved. This is the building-block question the ECB consultation has on the table, and the answer is not yet settled.

The Eurosystem as anchor customer. Appia will only achieve operational dominance if the Eurosystem itself uses it at scale. The central bank’s own wholesale operations, monetary policy interventions, reserve management, cross-border settlement with other central banks, are the volume that would make Appia viable as primary infrastructure rather than as an alternative experiment.

This is the wholesale equivalent of the retail argument in Paper 14: the digital euro functions as anchor procurement for the sovereign European stack. At wholesale, the anchor is the Eurosystem’s own activity.

None of these commitments is technically speculative. All of them are politically and operationally expensive. Building sovereign wholesale tokenisation infrastructure at scale within the Appia timeline requires procurement decisions, standard-setting, validator onboarding, and interoperability negotiations that will take most of the decade. The cost is real.

The cost of not paying it is the euro remaining what it has been since 1999: a currency that is sovereign on balance sheets and partial in the pipes.

Completing the Project

The euro was introduced as the most ambitious political project in European history. Twenty countries surrendered monetary sovereignty to a shared institution. Three hundred and fifty-seven million people now share a single currency. On paper, the euro is one of only two currencies in the world that can claim reserve status.[9]

The project stopped at the layer where building the alternative would have required infrastructure that did not yet exist. Wholesale settlement in euros was integrated within the euro area through TARGET. International wholesale settlement in euros continued to depend on dollar-adjacent rails because those were the rails that existed.

The euro inherited the second-largest reserve currency position in the world and also inherited the second place in a system whose first place was occupied by the currency whose infrastructure everyone else used.

For twenty-seven years the compromise held because the alliance held. The compromise is no longer holding.

The infrastructure dependency that was tolerable when the United States was the reliable partner Europe assumed is not tolerable when the United States sanctions European central banks’ counterparties, debanks European judges through private American compliance infrastructure, and advises European legislators against building the alternatives.

Tokenisation is the technological moment when the missing layers become buildable. It is the first moment in the euro’s history when European wholesale tokenisation can be built sovereignly, rather than left to consolidate around platforms governed elsewhere. Appia is the instrument. The wholesale digital euro is the project.

The choice this decade is whether Europe builds the missing layers or watches them be built around it.

This is the completion of the euro project. The monetary union that began in 1999 with policy sovereignty and partial operational sovereignty can, through Appia, achieve operational sovereignty at the layer where it matters most for international use. The euro can become a reserve currency in the pipes as well as on the balance sheet.

The cost of this completion is the commitment to build infrastructure that will compete with incumbents who have decades of scale and that will require sustained European procurement, standard-setting, and governance effort through 2030 and beyond.

The cost of not paying it is the arrival of a euro that remains a currency whose sovereignty can be tested by any American administration willing to use the existing infrastructure as a lever.

Paper 14 argues that the retail digital euro must preserve the properties of cash, with property one (public money held directly with no commercial intermediary) as the architectural foundation that makes the other four hold structurally rather than procedurally.

The parallel argument for wholesale follows: complete the operational sovereignty TARGET provides at intra-Eurozone scale, and extend it to the layers TARGET cannot reach. The retail and wholesale halves together complete the digital euro project.

The euro has been a partial reserve currency for twenty-seven years because nothing else was technologically possible. Something else is now possible. The choice about whether Europe builds it is the choice the Appia blueprint will determine.

[1] Mechanism explained in Federal Reserve Bank of New York operational documentation on US dollar correspondent banking and Clearing House Interbank Payments System (CHIPS); also discussed in Adam J. Levitin, ‘Safe Banking’, Yale Law Journal, 2014.

[2] BNP Paribas guilty plea, US Department of Justice press release, 30 June 2014. The bank pleaded guilty to two felony counts under the International Emergency Economic Powers Act and the Trading with the Enemy Act. Total settlement: 8.97 billion US dollars including criminal forfeiture and civil penalties; one-year suspension from US dollar clearing in specific business lines; thirteen employees disciplined up to the Chief Operating Officer.

[3] Société Générale S.A., settlement with US Department of Justice, OFAC, Federal Reserve and Manhattan District Attorney, 19 November 2018. Total: 1.34 billion US dollars for sanctions violations concerning Iran, Cuba, Sudan and other sanctioned countries; second largest US economic-sanctions penalty against a financial institution at the time.

[4] International Monetary Fund, Currency Composition of Official Foreign Exchange Reserves (COFER) database, 2025. Euro share of allocated reserves approximately 20 per cent versus US dollar at approximately 58 per cent.

[5] European Central Bank, TARGET Annual Report, 2024. TARGET Services settled approximately 1.05 quadrillion euros in 2024 across TARGET2 and the upgraded TARGET Services platform launched 20 March 2023.

[6] DTCC and Digital Asset Holdings, joint press release, 17 December 2025. DTCC assumed co-chair role at the Canton Foundation alongside Euroclear and announced tokenisation of DTC-custodied US Treasury securities on the Canton Network.

[7] European Central Bank press release on the next phase of distributed-ledger settlement work, 2 October 2025. Pontes pilot bridging TARGET to DLT settlement networks scheduled for third quarter 2026.

[8] European Central Bank, Appia consultation on long-term wholesale settlement architecture, opened February 2026, closed 22 April 2026; blueprint publication scheduled for 2028. Six building blocks include settlement model, governance, cross-border interoperability, asset coverage, central bank money issuance, and operational risk.

[9] European Central Bank and Eurostat, euro area statistics, 2026. With Bulgaria’s accession on 1 January 2026, the euro area covers 21 member states and approximately 357 million people.