The Street Tokenized the Mirror

In July 2025, BNY and Goldman Sachs announced that shares in money market funds run by BlackRock, Fidelity, Federated Hermes and others would be represented on Goldman's ledger as mirror tokens. The release said in the same breath that BNY would go on keeping the official books, records and settlements for the funds. The use of the word mirror was deliberate. 

A mirror shows something that exists somewhere else. It can be faster to look at, easier to carry, and open around the clock. But a mirror can't change what it reflects. Fourteen months on, the largest pieces of U.S. market infrastructure have adopted the same design, and anyone who wants to know which ledger is authoritative for a customer position can now find the answer written down.

DTC put the answer in writing

The SEC staff gave the Depository Trust Company a no-action letter on December 11 allowing it to run a tokenization service for three years. DTCC ran limited production trades in July and plans to launch the service in October. The letter is more than thirty pages, and the mechanics it describes settle the authority question with precision.

A participant can elect to have its entitlement to a security recorded as a token in a wallet registered with DTC rather than as a book entry. The token can then move to another registered wallet at any hour, without any instruction to DTC. DTC learns this by running a program called LedgerScan, described in the letter as an off-chain software system in a public cloud that scans the underlying chains in near real time and records who holds what. For tokenized entitlements, the letter says, LedgerScan's record constitutes DTC's official books and records.

The token is on-chain. The token's official record is a cloud program that reads the chain afterward and records what it saw. Registered ownership never leaves Cede & Co., and the tokens carry no collateral or settlement value inside DTC's risk system. DTC also keeps a root wallet on every supported chain with keys that can mint, burn, transfer, or convert any token without the holder's private key. The chain displays the entitlement. DTC keeps the power to overwrite the display.

For a pilot, this is the right design

DTC designed it that way for good reasons. A systemically important depository has duties under Article 8 that a public chain can't discharge, and the letter says plainly that no one, including DTC, controls a public blockchain. Override keys are how a central securities depository honors its obligation to hold one security for every entitlement while letting the entitlement move somewhere it doesn't run. The design is sound, and it's the design a regulator could approve.

The point is narrower than a critique. Tokenization as the Street is building it moves a copy onto a faster surface and leaves the question of which copy governs where it was. The chain is now the most visible ledger in the stack and, by the depository's own filing, not the authoritative one. Moving the token on-chain did not move authority with it, and the filing is where to check that, not the marketing.

Your customer's position was never on any of those ledgers

The letter is equally direct about the layer beneath the participant, which is the layer a broker-dealer or custodian answers for. DTC recognizes only the participant as the entitlement holder. A customer's position sits on the participant's own books and records. A participant may register a wallet for a customer and hand over the keys, and DTC would still see the participant, with the relationship between the two treated as a bilateral matter.

A customer position therefore sits behind four ledgers: registered ownership at Cede & Co., DTC's book or LedgerScan's reading of the chain in its place, the participant's own customer ledger and the chain itself, which the customer may be watching directly. The customer's screen reflects the last of those. The firm answers for the third.

When two of them disagree, the tie goes where it always has: to contract, then to court. Celsius customers learned that in January 2023, when roughly 600,000 accounts showed balances worth about $4.2 billion and a bankruptcy judge found that title had passed to the company under the terms of use. Every screen showed a position, and the governing ledger showed an unsecured claim. That case usually gets filed under crypto excess. It belongs under a plainer heading, because the display and the authoritative book were different systems and the customer only ever saw the display.

A copy is only as fresh as its last sync

The cost of the design shows up in timing. A mirror that updates nightly suited holders who instructed transfers during business hours and checked positions the next morning. The DTC service lets tokens move at any hour, and the letter itself lists extended-hours trading and smart-contract allocation of collateral among the things participants and their customers can now do.

Increasingly, software is instructing those moves. A collateral optimizer or a treasury agent will shift a tokenized entitlement between wallets many times in a session and never ask a desk. Each move lands on the chain in seconds, reaches DTC's official book when LedgerScan next reads it, and reaches the participant's customer ledger whenever that firm's own process runs. One position now updates on three separate clocks.

At human volume, the drift between them was a rounding error absorbed by a reconciliation team. At agent volume, the drift is the operating state, and the ledger the firm is accountable for is the one furthest from the movement.

The authoritative ledger should be the one the movement writes

The fix is a change in where authority attaches, and it doesn't require dismantling anything the Street just built. Authority should sit with the entry produced by the transfer itself, with permission tested ahead of the transfer and proof generated by it, so there's nothing left to sync and no later reading to defend. W3.io builds agent-powered capital workflows on that principle, and it's the definition of autonomous finance that a custodian's compliance team can sign. The entry written at the moment of movement is the one every party reads, including the firm that answers for the customer, and it's composed into a workflow a firm already runs rather than installed in place of one.

Tokenization has already moved the copy, and the Street has said as much in its own filings. A customer position is authoritative on one ledger and only one. The useful work for a broker-dealer or custodian this year is deciding whether that ledger will be the one its own process writes after the fact or the one the movement writes as it happens.