Governance Above the Rail
When systemic tokenisation infrastructure enters production trading in mid-2026, the institution inherits an L5 governance obligation that no rail operator can discharge on its behalf.
8 min read · Cabier Intelligence
Executive summary
In mid-2026, systemic tokenisation infrastructure for securities settlement moves into production trading. The rail itself is competent, well-supervised, and operates a clean set of asset-level controls — mint, burn, freeze, unfreeze, force transfer, clawback, pause. Those controls govern how a tokenised security behaves inside the rail.
They do not, and cannot, discharge the obligations the participating institution carries above the rail. Basel III capital sits on the institution's balance sheet. DORA ICT mapping is the institution's register. MiCA, MAS, FCA, JFSA, SR 11-7, and FATF Recommendation 16 apply in every jurisdiction the institution operates — irrespective of the rail's home authorisation.
That is the L5 obligation. It is structurally Cabier's. This brief states the category map for Cohort A, the six obligations the rail cannot discharge, and the capabilities that operate above the rail. The companion brief at tokenised-deposits-2027-governance-vacancy covers Cohort B — bank-issued deposit tokens on shared 24/7 rails, a structurally different problem on a parallel timeline.
What the rail actually does
The rail performs three things: it tokenises a security, it settles transfers atomically against a cash leg, and it exposes a finite set of asset-level operational controls to its participants. Mint and burn create or extinguish a token. Freeze and unfreeze suspend transferability on a per-token or per-account basis. Force transfer and clawback move a token under an authorised instruction. Pause halts the asset network-wide.
These are essential. They are also bounded. A rail operator authorised in one jurisdiction cannot discharge the capital, model, ICT, AML, conduct, or sovereignty obligations the institution carries in the other twenty jurisdictions it operates. The control set is technically complete inside the rail and structurally incomplete outside it.
The L5 vacancy
Layers 1 through 4 are operated by the rail itself — settlement finality and cash leg (L1), CSD, custody and transfer agency (L2), smart-contract runtime (L3), and the participant network or consortium (L4). Layer 5 — governance, control, and assurance — sits above all of them and is the institution's own.
L5 is not optional. It is where the institution's regulators look first. It is where Basel capital is computed, DORA mapping is filed, MiCA obligations are evidenced, SR 11-7 model validation is recorded, and FATF Recommendation 16 data is carried. The rail does not see L5. The institution cannot avoid it.
The vacancy is not that institutions lack will. It is that the L5 substrate has not previously existed as instrumented infrastructure — only as documentation, spreadsheets, and a quarterly committee. Cabier exists to close that gap as a single evidence vault, a calculation engine, and a regulator-traceable score.
Six obligations the rail cannot discharge
These are the questions a regulator will put to the participating institution, not to the rail operator. Each one resolves to evidence the institution must produce, in the jurisdiction asking.
Capital treatment for tokenised securities on the institution's balance sheet — risk-weighting, large-exposure, concentration limits. The rail does not hold the capital; the institution does.
Article 28 third-party register entry, exit strategy, and concentration testing where the rail is a critical ICT provider to an EU-supervised entity.
EU asset-referenced and e-money token obligations for non-US participants, irrespective of the rail's US authorisation.
Singapore Notice 824/626, UK SYSC + MiFIR, and Japan JFSA participation conditions remain the institution's own.
US model governance for any AI model used in tokenised asset workflows — pricing, surveillance, liquidity, screening.
Originator/beneficiary data the moment a tokenised asset moves across chains or to an unhosted wallet — IVMS101 envelope.
Cabier capabilities — Cohort A mapping
The substrate above the rail. Each capability is pre-existing infrastructure, instrumented against the obligations above and reusable across Cohort B.
Three-lines-of-defence evidence engine sitting above the rail's mint, burn, freeze, unfreeze, force transfer, clawback, and pause controls. Per-asset-class control library, effectiveness-graded rather than pass/fail.
Open standards binding the rail's asset-level primitives to a uniform CDS data model, CEF cryptographic evidence, COM ORS methodology, and CTRE cross-chain Travel Rule envelope.
Model risk management over any AI embedded in the tokenised workflow — pricing, surveillance, screening, liquidity. EU AI Act and SR 11-7 mapping with continuous drift and bias telemetry.
Nine-dimension regulator-traceable composite. Each tokenised intake produces a marginal ORS contribution sealed in evidence, with the calculation tree available to supervisors on request.
One immutable substrate behind every report, attestation, regulator question, and audit walkthrough. Tokenised activity, cyber posture, third-party concentration, and AI model events resolve to a single anchor.
Restricted-beta data product produced by the Protocol. Not a tradeable index. Distribution under the Cabier Foundation.
Why Cohort B is a different problem
Tokenised deposits — bank-issued money settled on shared 24/7 rails across competing institutions — are emerging on a parallel timeline targeting H1 2027. The L5 obligation has the same shape. The regulatory anchors do not. BSA/AML, OFAC, FDIC characterisation, Reg HH and the PFMI principles for financial market infrastructures apply where securities law does not.
The settlement cadence does not. A rail that runs 24/7 with continuous mint and burn cannot be reconciled against a deposit ledger on a T+1 batch. The governance topology does not. A consortium utility cannot govern over itself; participant banks cannot mark each other's homework on a shared rail.
That cohort is addressed in the companion brief: The deposit-rail governance vacancy.
What this is not
- Not custody. Cabier does not hold tokenised assets.
- Not settlement. Cabier does not move value; the rail does.
- Not issuance. Cabier does not mint, burn, or characterise instruments at the rail layer.
- Not a competitor to the rail. The rail and the L5 substrate are complementary by design.
- Not a public price. Every engagement is custom-quoted under signed terms.
- Not a model vendor. Cabier does not train foundation models; the AI Assurance OS wraps any model in scope.
Frequently asked questions
What is 'the rail'?
Systemic tokenisation infrastructure entering production trading in mid-2026 for securities settlement — operated by market infrastructure providers under a single home regulator. Mint, burn, freeze, unfreeze, force transfer, clawback and pause are asset-level controls inside that rail. Everything above sits with the institution.
Why can't the rail operator govern this for the institution?
Because the rail is licensed in one jurisdiction, against one set of asset-level operational controls. The participating institution carries Basel III capital, DORA ICT, MiCA, MAS, FCA, JFSA, SR 11-7, and Travel Rule obligations in every jurisdiction it operates. None of those are dischargeable by a rail operator's home authorisation.
Is Cabier a competitor to the rail?
No. Cabier sits above the rail. The rail performs settlement; Cabier performs governance, evidence, and cross-framework assurance. The two are complementary by design.
Does Cabier hold tokenised assets?
No custody. No settlement. No issuance. Cabier is a metadata, evidence, and assurance plane. The rail holds, settles, and issues; the institution governs, with Cabier as the operating substrate.
How is this different from a GRC tool?
GRC tools document controls. Cabier instruments them — each control is wired to live evidence, an effectiveness grade, a calculation tree, and an ORS contribution that regulators can trace end-to-end.
What about Cohort B — the deposit rail?
Cohort B is a structurally different problem, addressed in the companion brief at /insights/tokenised-deposits-2027-governance-vacancy. The L5 obligation is the same shape; the regulatory anchors, settlement cadence, and consortium governance are different.
Does this work outside the US?
Yes. The framework is jurisdiction-aware by design — Basel III, MiCA, DORA, MAS, FCA, JFSA, OSFI, SR 11-7, NIS2, SMCR, FATF, APPI. Sovereign deployments and on-shore residency are supported.
Is there a public price list?
No. Every engagement is custom-quoted under signed terms. Public price cards distort institutional procurement and we refuse to publish them.
How quickly can an institutional sponsor adopt this?
A baseline above the rail runs in weeks, not quarters, because the control library, evidence vault, and ORS engine are pre-existing infrastructure. Bespoke jurisdictional overlays and sovereign deployment vary by scope.
Does Cabier replace internal compliance?
No. Cabier instruments internal compliance — three-lines-of-defence functions remain accountable. The platform is human-led; senior consultants operate it alongside the institution.
What does 'regulator-traceable' mean in practice?
Every ORS figure, control effectiveness grade, and evidence artefact resolves to an immutable calculation tree with a stable identifier. A supervisor can request the lineage of any number and receive a reproducible answer.
Are you a model vendor?
No. Cabier does not train foundation models. The AI Assurance OS wraps third-party and institutional models with the same governance contract regulators expect of any high-risk system.
How does this map to DORA?
Where the rail is a critical ICT third party to an EU-supervised institution, Cabier produces the Article 28 register entry, exit strategy artefacts, and concentration testing evidence — and keeps them current as the rail's perimeter changes.
What about FATF Recommendation 16?
The CTRE envelope carries IVMS101 originator/beneficiary data across chains and into unhosted-wallet flows. The institution remains the regulated entity; Cabier carries the data structure.
Is Cabier endorsed by the rail?
Endorsement and reference-implementation models are addressed privately with rail operators and named institutional sponsors. The companion private brief at /platform/governance-above-the-rail covers the three partnership models.
What happens at the SR 11-7 layer?
Any AI model embedded in pricing, surveillance, liquidity, or screening workflows over tokenised assets must be validated under SR 11-7. The AI Assurance OS provides the model registry, validation workflow, drift and bias monitoring, and effectiveness evidence.
Can a regulator log in directly?
A regulator-facing interface exists. It is provisioned per supervisor on request and exposes ORS lineage, evidence walkthroughs, and incident reporting at the supervisor's preferred depth.
Where is the named competitor comparison?
Under non-disclosure at /insights/tokenization-named-comparison. The public articles publish the category map; the named comparison and full operating disclosure are released only under signed terms.
Glossary
- The rail
- Systemic tokenisation infrastructure for securities settlement entering production in mid-2026; operated by market infrastructure providers under a single home regulator.
- Cohort A
- Tokenised securities track — governed by securities law, anchored to the mid-2026 rail launch. The subject of this brief.
- Cohort B
- Tokenised deposits track — bank-issued money on shared 24/7 rails, governed by banking-supervisory and payment-system law, targeting H1 2027. Addressed separately.
- L5 — Governance, Control & Assurance
- The institutional governance layer above the tokenisation stack. Cannot be discharged by the rail operator's home authorisation.
- Above the rail
- Cabier's positioning. The rail settles; Cabier governs. The two are complementary by design.
- TCOS
- Tokenization Control OS — the three-lines-of-defence evidence engine over the institution's tokenised activity.
- Cabier Protocol
- Open standards: CDS data model, CEF cryptographic evidence, COM ORS methodology, CTRE cross-chain Travel Rule envelope.
- ORS
- Operational Resilience Score — nine-dimension composite, regulator-traceable, recalculated continuously.
- AI Assurance OS
- Model risk governance over any AI embedded in tokenised workflows; EU AI Act and SR 11-7 mapped.
- Evidence vault
- Single immutable substrate behind every report, attestation, regulator question, and audit walkthrough.
- Calculation tree
- The reproducible lineage of any score, grade, or attestation produced by the platform.
- Basel III
- Capital, liquidity, and large-exposure framework applied at the institutional balance-sheet level.
- DORA
- EU Digital Operational Resilience Act — ICT third-party register, exit strategy, and concentration testing.
- MiCA
- EU Markets in Crypto-Assets Regulation — Title III/IV obligations for asset-referenced and e-money tokens.
- MAS Notice 824/626
- Monetary Authority of Singapore custody, AML, and operational risk notices for participating institutions.
- FCA SYSC
- UK Financial Conduct Authority Senior Management Arrangements, Systems and Controls sourcebook.
- JFSA
- Japan Financial Services Agency — supervisor for Japanese participating institutions.
- SR 11-7
- US Federal Reserve model risk management guidance — applied to any AI in the tokenised workflow.
- FATF Recommendation 16
- Travel Rule — originator/beneficiary data for value transfers; carried via IVMS101.
- IVMS101
- The InterVASP messaging standard for originator/beneficiary data; carried in Cabier's CTRE envelope.
- CTRE
- Cross-chain Travel Rule Envelope — Cabier Protocol component carrying FATF R.16 data structurally.
- CEF
- Cryptographically anchored Evidence Format — the substrate behind every attestation Cabier produces.
- CDS
- Cabier Data Schema — the canonical data model under the Protocol.
- COM
- Cabier ORS Methodology — the published basis of the Operational Resilience Score.
- Custom quote
- Cabier's standing policy: no engagement is publicly priced; every scope is sized and quoted under signed terms.
Continue reading
The companion flagship covers Cohort B — the deposit-rail governance vacancy.