A private tokenized deposit network is a closed, blockchain-based system where a bank converts its own commercial deposits into digital tokens. In this environment, banks maintain absolute control over a proprietary distributed ledger technology (DLT) network. Only the bank’s vetted corporate and institutional clients can transact on it.
Several of the world’s largest financial institutions are the pioneers of this single-bank ledger model. For example, JPMorgan runs Kinexys, and Citi operates Citi Token Services for Cash. HSBC runs its tokenized deposit service out of its Orion digital asset platform. DBS in Singapore offers DBS Token Services. In every case, the bank is the sole issuer and the sole operator. Tokens are minted internally, moved between the bank’s own clients as real-time book transfers, and burned when a client wants standard fiat back.
This model makes immense commercial sense when a single bank already moves massive value internally between its own global clients every day.
This snippet from BCG and Anchorage Digital, June 2026 Report gives us a glimpse of what a rightly implemented private tokenized deposit initiative could do for a bank:
The Use Cases and Benefits for Every Stakeholder
The business case for a private tokenized deposit network comes down to maximizing the velocity and value of internal liquidity.
Because the network is closed and completely controlled by the bank, these use cases focus on delivering high-margin, automated services to global corporate and institutional clients.
Here are the core use cases that describe what the platform actually does:
- 24/7 Cross-Border Cash Pooling: Shifting multi-currency corporate cash balances instantly across global branches outside of standard central bank operating hours.
- Automated Conditional Escrow: Using conditional logic to automatically release funds to a vendor only when specific digital business milestones are verified.
- Intraday Repurchase Agreements (Repos): Lending or borrowing cash on an hourly basis to meet short-term liquidity or collateral mandates.
- Atomic Asset Settlement (DvP): Simultaneously exchanging bank-issued digital assets (like tokenized commercial paper) and tokenized deposits on the same ledger to ensure the trade executes flawlessly.
Now, how will these benefit different stakeholders?
| Stakeholder | Financial & Operational Value Created |
| Corporate Treasurers | * Elimination of Trapped Cash: Achieves 24/7/365 liquidity management, ensuring capital is not locked up over weekends due to legacy settlement cut-offs.* Optimized Capital Expenses: Intraday operations and continuous automated sweeping help lower corporate borrowing needs and dependence on overnight lines of credit. |
| Bank Executives | * Ecosystem Lock-In: Because transactions are restricted to the bank’s internal network, a client’s suppliers and global subsidiaries are highly incentivized to establish operating accounts with the same bank, accelerating customer acquisition.* Bypassing External Costs: The bank avoids third-party clearing houses and external messaging networks, eliminating variable transactional overhead. |
| Risk & Compliance | * Zero Settlement Risk: Atomic processing guarantees that a transaction either executes fully across both cash and asset sides or reverts completely.* Absolute Confidentiality: All transaction metadata, corporate balances, and proprietary pricing are kept entirely behind the bank’s firewall, safe from public view. |
How a Private Tokenized Deposit Network Use Case Works
The clearest way to see how a private tokenized deposit network works is to watch it do a real job. We will use the flagship use case J.P. Morgan built Kinexys around, the intraday repo, a collateralized loan that starts and ends the same day, timed to the minute, something legacy settlement rails cannot execute.
Credit: Source: JP Morgan and BCG, “The Future of Distributed Ledger Technology in Capital Markets”; GFMA member inputs; BCG analysis.
Step 1. The Account Structure
Before any tokens are created, the bank sets up a dual-ledger system for each participant.
- The Core Banking Ledger. The bank’s traditional database, where the cash lender holds a standard Demand Deposit Account, a DDA, with actual fiat balances.
- The Tokenized Ledger. The bank’s private, permissioned blockchain. Each participant is mapped to a Blockchain Deposit Account, a BDA, which works exactly like a traditional deposit account except that the recordkeeping is done on blockchain rather than on legacy ledger systems. A client must hold a DDA with the bank in order to fund a BDA
Step 2. Pre-Positioning, Minting Both Legs
A repo has two legs, and both must exist on the ledger before the trade can settle atomically.
- Cash leg. The lender moves $50 million from their DDA into their BDA. The core system locks the fiat, and the blockchain simultaneously mints $50 million of deposit-token balance. No separate asset is created, and the bank’s balance sheet does not change. The liability is simply reclassified from a standard deposit to a tokenized deposit.
- Collateral leg. The borrower’s Treasuries are transferred to an account in the name of a collateral token agent at a traditional triparty agent, BNY, in the early trades. Once the collateral and its value are confirmed, a collateral token is minted on the same ledger. The bonds never leave custody. The token represents the security entitlement.
Step 3. Execution and Atomic Settlement
The repo seller submits a quote request, and the buyer accepts. The terms, covering collateral type, amount, interest, and an intraday maturity time specific to the minute, are recorded in a smart contract.
- At the agreed start time, the contract settles both legs at once. The lender receives the collateral token and the borrower receives the cash balances, settling the repo within minutes. Either both sides settle or nothing does, so leg risk disappears.
- Once confirmed on the ledger, a transaction is irreversible and final within seconds, with no concept of probabilistic settlement, and payments on the system run 24/7/365.
Step 4. Maturity and Off-Ramping, Burning
The repo unwinds automatically at the pre-set maturity, often just a few hours later. The contract returns the collateral to the borrower and the cash, with interest calculated to the minute, back to the lender. In January 2025, Santander executed two programmable intraday repos on Kinexys, one for $50 million and one for €50 million, each scheduled to redeem three hours after execution.
To exit the tokenized environment, a client requests a payout. The ledger burns the BDA balance and the core system credits standard commercial cash to the client’s DDA, a redemption into traditional deposits. Those funds can then move anywhere in the world on legacy rails.
The repo demonstrates every core mechanic of the network, lock and mint, atomic transfer, programmatic execution, burn and release, applied to a real problem, freeing intraday liquidity that overnight funding traps.
The Architecture of Single Bank Ledgers for Tokenized Deposits
In a private tokenized deposit network, the infrastructure runs inside the bank’s approved operating environment, either on-premise, in a private cloud, or through managed infrastructure under the bank’s control. Across live implementations, the architecture usually follows five layers.
The first is the core banking layer. This is the bank’s traditional system where deposit accounts, customer records, general ledger entries, statements, and reporting stay. The tokenized ledger does not replace this layer. It depends on it. Every tokenized deposit in the system is still a deposit liability that the bank already accounts for.
The second is the integration layer. This is the bridge between the traditional ledger and the blockchain ledger, and for most banks it is the hardest part of the build. Its job is simple. Whatever happens on the tokenized ledger must reconcile with the core system, and whatever the core system locks or releases must be reflected on the tokenized ledger. This is usually handled through secure APIs, event triggers, and reconciliation workflows.
The third is the private ledger layer. This is the private blockchain environment where approved clients, accounts, and applications transact. Banks can build this on EVM-compatible stacks such as Hyperledger Besu, enterprise platforms such as Hyperledger Fabric, Cosmos SDK-based chains, or dedicated EVM L2s. The bank controls the validators, sets the operating rules, and approves every participant.
The fourth is the compliance and policy layer. The advantage of a private ledger is that compliance does not need to be rebuilt at the blockchain level. The bank already knows every participant, so KYC status, limits, approvals, whitelisted accounts, and rules can plug directly into the transaction flow.
The fifth is the client access layer. Corporate clients never touch the blockchain. They keep using the same interface they already use. The ledger works behind that interface as a settlement and workflow engine. If the bank builds it well, the only thing a client notices is that approved payments, liquidity movements, or settlement workflows can now run outside normal banking hours.
This is the main architectural idea behind the single-bank ledger model.
Examples of Full Commercial Production Implementations of Private Tokenized Deposits Network
JPMorgan Kinexys
They are the largest operator of a private, single-bank tokenized ledger that has processed around $3 trillion in cumulative volume since its inception.
Source: BCG and Anchorage Digital, June 2026 Report
The platform runs on a private permissioned version of the Ethereum Virtual Machine (EVM) framework. Kinexys utilizes an Asynchronous Dual-Ledger Bridge Architecture. The blockchain environment sits completely parallel to JPMorgan’s core banking databases, and communicates via high-speed, event-driven APIs.
When a corporate client opens a specialized Blockchain Deposit Account (BDA), the traditional core banking system registers this and routes instructions through an API bus to lock the fiat funds. A banking smart contract then mints ERC-20-compliant digital deposit tokens directly into the client’s wallet. Corporate clients interact with the system through their standard corporate banking portal, using the blockchain purely as an automated background execution layer.
The platform supports eight major fiat currencies, including USD, EUR, GBP, AUD, HKD, JPY, CNY, and SGD, enabling global multi-currency intra-bank settlement 24/7.
Citi Token Services:
Citigroup’s architecture for Citi Token Services for Cash is a unique approach to user interaction. Rather than creating a new account type like BDA, Citi integrates tokenization directly into existing global client accounts within its Treasury and Trade Solutions business.
The technical platform is built using Hyperledger Besu, an enterprise-grade private client of the Ethereum network. A core architectural feature of Citi’s model is the complete abstraction of the blockchain layer away from the end user. Corporate treasurers do not manage cryptographic private keys, interact with Web3 wallet interfaces, or track token balances. Instead, the tokens exist strictly as a short-lived backend messaging wrapper.
When a corporate treasurer initiates a real-time payout from a branch in London to an entity in Singapore, Citi’s internal Hyperledger Besu nodes mint, transfer, and burn the token instantly in the background. The ledger acts as an ultra-high-speed processing engine and updates the traditional fiat accounts on both ends seamlessly while providing the benefits of a programmable ledger.
HSBC Tokenized Deposit Service:
JPMorgan and Citi built their tokenized deposit networks as independent cash engines. HSBC architected its tokenized deposit system as a sub-module of its broader digital asset issuance platform (HSBC Orion).
In HSBC’s design, the tokenized deposit ledger shares the exact same cryptographic environment as tokenized bonds and commercial paper. This allows for native Delivery-versus-Payment (DvP) atomic swaps. The asset token and the cash token sit side-by-side, executing on a single shared state ledger, ensuring that security transfers and cash clearances happen as a single, indivisible cryptographic event.
HSBC Tokenized Deposit Service is commercially operational and facilitates real-time transactions specifically in Hong Kong Dollars (HKD) and US Dollars (USD).
The Limitations of Private Tokenized Deposit Networks
Credit: Deutsche Bank
A private ledger is, by definition, a walled garden, and that creates several linked problems.
- If a corporate client needs to pay a vendor who banks with a competitor, the tokenized money cannot follow. The bank has to burn the token, release traditional cash, and send it out through the same slow rails the network was built to avoid.
This limitation caps the network’s usefulness. A tokenized deposit is only as valuable as the number of counterparties who can receive it, and on a single-bank ledger, that number is capped at the bank’s own client base. Smaller mid-market businesses are largely excluded. - Corporate treasurers also tend to dislike concentration risk. A single-bank network effectively asks a client to hold oversized balances at one institution to make full use of its automated features, which works against normal treasury diversification practices.
- Finally, the bank bears the full cost of building and running the system alone. There is no consortium to share infrastructure, cybersecurity, or audit costs with, unlike a shared multi-bank network.
So when do private ledgers still make sense?
- When the bank already controls a massive intra-bank ecosystem.
- When trades are so sensitive that total confidentiality behind the bank’s own firewall is worth the tradeoff.
- And when time to market matters, since a bank can launch privately now and join shared networks later.
The winning institutions will likely run both. A private ledger for internal processing power, plus shared or universal connectivity for external reach, much as banks today pair internal core systems with SWIFT-like coordination networks.
Zeeve for Privacy Enabled Blockchain Infrastructure for Tokenized Deposits
Zeeve is a managed blockchain infrastructure and privacy middleware layer that lets a bank deploy tokenized deposit networks without replacing legacy core systems or building a chain from scratch.
Zeeve addresses the three limitations above directly.
- First, multi-stack orchestration. From one dashboard, a bank can manage intra-bank, inter-bank, and universal ledgers built using Besu, Fabric, Cosmos CTS, or custom EVM L2 stacks.
- Second, system-wide privacy through Zeeve Tegaris. This modular privacy layer brings workflow privacy along with network-level privacy offered by permissioned networks. ZK proofs and role-based selective disclosure keep balances and counterparties confidential on shared networks, while giving regulators dedicated audit visibility.
- Third, legacy protection. Zeeve provides APIs to connect core banking systems with digital asset infrastructure. So the book of record continues to function while digital asset infrastructure handles real-time settlement.
Zeeve infrastructure is used by enterprises including Vodafone, Deutsche Telekom, and Siemens Energy. Zeeve has multi-stack expertise. It is a certified Besu partner and enterprise implementation partner of Cosmos Labs, for CTS and other products. It holds SOC 2 Type II and ISO 27001 certifications, complies with GDPR, and backs its 24/7 operations center with 99.9 percent uptime SLAs.
For a bank weighing the single ledger opportunity against its walled garden limits, Zeeve offers a way to capture the first without being trapped by the second.
Schedule a call with Zeeve today!
