Utila's institutional custody platform and Bermuda's compliant privacy layer partner to give institutions the settlement infrastructure they need: Central bank operations on shared ledgers, with keys that never leave the bank's own vault and a footprint only the bank can read.

Central Banks Worldwide Are Moving On-Chain

In the euro area, the Eurosystem has committed to settling tokenized transactions in central bank money. Its short-term track, Pontes, pilots DLT settlement against TARGET services from the third quarter of 2026. Its long-term track, Appia, sets the architecture for a European tokenized financial ecosystem. 

In Singapore, the Monetary Authority leads the Global Layer One initiative and published a white paper on programmable compliance in June 2026, with contributions from Bermuda, Banque de France, the IMF, J.P. Morgan and Standard Chartered. Its core finding is that privacy and regulatory enforceability can coexist, because rules can be enforced with cryptographic precision inside private transactions.

Project Agorá brings together eight central banks and more than 40 private institutions. They showcased in May 2026 that tokenization improves wholesale cross-border payments, and the work now advances to real-value testing.

Switzerland has gone furthest. Under Project Helvetia, the Swiss National Bank has settled tokenized bond issuances in Swiss franc wholesale CBDC on SIX Digital Exchange since December 2023. In June 2024, it became the first central bank to run a monetary policy operation on DLT in live production, issuing CHF 64 million of digital SNB Bills with a one-week term. In 2025, the SNB extended the pilot until at least mid-2027 and expanded it to include a second settlement method: an RTGS link connecting tokenized platforms such as BX Digital to traditional central bank money.

Diverse Operations, Same Requirements on Privacy and Security

Around the world central bank operations vary widely. Some banks steer rates through repo operations. Some manage large reserves and move value across borders. Some rely on outright purchases and sales in open market operations. The SNB implements its policy rate by remunerating sight deposits, by conducting repos and SNB Bill auctions that keep SARON close to target.

The operating environment is also becoming multi-venue (and multi-chain) by design. Public networks such as Ethereum concentrate liquidity and host the majority of tokenized trades.  Each venue is another place where a central bank holds keys, moves assets, and leaves a footprint. 

Underneath that diversity sit two shared requirements. The keys must be secure. The footprint must stay private.

Implementation Strategy Must Stay Confidential

Central banks move markets by construction, and the publication schedule of their data is a policy instrument in its own right. The SNB publishes sight deposit statistics weekly, and analysts have long read those numbers for traces of interventions. Now shrink that lag from a week to block time. A transparent ledger would expose, in real time, auction allotments per counterparty, the timing of fine-tuning operations, collateral movements, and reserve flows.

Observers can reverse-engineer intervention thresholds and exact targets that the central bank deliberately keeps unpublished. Trades could be front-run. A strategy leak of this kind raises the cost of every subsequent operation. Most importantly, financial institutions demand privacy.

Central banks already agree. Agorá highlights that enabling privacy with regulatory compliance is mission-critical. The GL1 programmable compliance paper, which Bermuda contributed to, shows how rules can be enforced inside private transactions with cryptographic guarantees, on any public blockchain. The industry is on the same page. "Privacy and compliance are the two most requested features from our clients," says Kyle Jenke, COO of Optimism, which hosts 15% of all blockchain transactions.

"Every serious market participant keeps its order flow and positions confidential, and a central bank has more reason to do so than anyone," says Dr. Jan Philipp Fritsche, co-founder of Bermuda, who previously worked at the European Central Bank. "On shared ledgers, confidentiality has to be engineered. Bermuda exists so an institution can prove that every rule was followed while size, timing, and counterparties stay private."

The Keys Must Stay in the Bank's Own Hardware

Gold lives in central bank vaults, and Central banks run critical infrastructure under their own physical control e.g. RTGS systems live in central bank data centers. Wallet keys deserve the same treatment. 

With Utila's approach, Keys remain on premise and within hardware security modules (HSM) the bank owns. Supervisors already hold the market to this standard. Hong Kong's SFC requires that 98% of client assets be held in certified HSMs. The JFSA requires 95% and Singapore's MAS requires 90%, with locally controlled asset movement. In the EU, MiCA pushes CASPs toward FIPS 140-2- and 140-3-certified hardware. 

Central banks will hold themselves accountable to standards that they set for the institutions. A monetary operation needs strict policy validation, such that trades remain in within the scope of the institutions and operator errors cannot lead to disasters. Moreover, broad blockchain connectivity, wallet and address management, approval workflows, AML and compliance checks, transaction history, and reporting interfaces. 

Utila supplies that full stack: A platform with a granular policy engine, roles and approval quorums. Utila connects directly to leading HSMs, starting with Thales Luna Wallet keys are generated inside the bank's HSM. Utila never holds key material and the material never leaves the HSM. 

The trust model fits a central bank's threat model. This is why Utila has already processed more than $200 billion in transaction volume.

Security in the Bank's Hardware, Privacy on the Ledger

Within the partnership Utila supplies the security layer, anchored in hardware the bank physically controls, before the transaction is submitted, it is validated against the internal policies.  Bermuda adds privacy to any transaction that gets executed. Bermuda's shielded accounts keep balances and trades confidential, stealth addresses make DeFi interactions unlinkable. Transfers and DeFi interactions are screened against compliance policies, and settlement remains atomic.

This week, Utila and Bermuda showcase how confidential custody for central banks becomes real. A repo operation in which each counterparty sees its own allotment. The market doesn't see the central bank's strategy, and every step is verified within the bank's own HSM. Signing policies are enforced by Utila, and asset policies are enforced by Bermuda. Auditors can receive full visibility through selective disclosure. With Bermuda and Utila, issuers can issue assets directly to a shielded adress. Central banks can conduct monetary policy on chain, but the market only learns exactly what the central bank chooses to announce. 

"Central banks expect the same rigor from digital asset infrastructure that they demand from their RTGS systems, and that is what Utila was built for," says Bentzi Rabi, co-founder and CEO of Utila. "Combined with Bermuda, an operation on a shared ledger stays confidential until the institution decides otherwise."

Swiss Opportunity

Switzerland already leads. Switzerland was the first to launch a wholesale CBDC pilot and the first to conduct a tokenized monetary policy operation on chain. Switzerland runs an active multi-venue digital asset pilot running until mid-2027. The binding constraint on the next phase is operational confidentiality and central bank-grade security. Utila and Bermuda ship the tooling for both: confidentiality engineered into the ledger, and custody anchored in HSMs the bank runs on its own premises.

What Bermuda and Utila Make Possible

Shared ledgers create the possibility of a more open financial system, one in which a broader set of regulated institutions can access common settlement infrastructure directly, beyond the closed commercial bank networks. Bermuda makes that system compliant and confidential. Utila makes it operationally accessible, and with the HSM integration, accessible from the institution's own hardware. A central bank can run tenders and reserve operations on public infrastructure with the discretion it has today. The decision of what to publish when remains with the bank. Even central banks can settle with each other. The result is financial market infrastructure with the openness of a public network, the discretion of a private one, and keys that never leave hardware each institution controls.

Learn more at utila.io, bermudabay.xyz, and optimism.io.

Register for our joint seminar on Luma: https://luma.com/fy9ra0wu