Most bank blockchain pilots prove something nobody seriously doubted: that a transaction settles. The people who approve production ask a different question. They want evidence they can defend. In my experience, that means a reconciled month of books and compliance records in the regulator's own format. It also means a counterparty that was not coached through the process, and a number the CFO can take to the board. A pilot that cannot produce that evidence tends to keep running, because nothing it generates moves the decision.

A hypothetical example shows the gap. A tokenized deposit transfer settles onchain in seconds, and the counterparty confirms receipt. The next morning, someone in finance matches it to the general ledger by hand. The screening results sit in a vendor dashboard that the bank's regulatory reporting never touches. The demonstration went well, and the approval case has not moved.

Why do blockchain pilots stall after the technology works?

A blockchain pilot usually stalls because it was designed to test the technology, while production approval depends on whether the bank can operate the product. Settlement on public networks is now established for patterns such as deposit tokens. J.P. Morgan piloted its JPMD deposit token on Base in June 2025 and made it available to institutional clients that November. Martin Quensel, co-founder of Centrifuge, summed up the state of the rails: "The technology has matured."

What remains open sits inside the bank. In my work with banks that build products on top of these networks, the decision rule is fairly consistent. Whoever owns the risk decides, based on evidence they can defend. Each piece of that evidence belongs to a different function, so approval depends on teams the project does not control. Brian Butler of Polygon Labs said the partners he works with always get stuck on compliance, sanctions screening above all.

Why do banks keep running pilots that only test the technology?

A pilot can suit several interests while it remains a pilot. The proposing team may retain its budget, while vendors, firms like ours included, gain a reference. If production approval is never requested, risk owners do not have to make that decision. That can leave a project running without anyone taking responsibility for bringing the product to market.

That points to two kinds of stalled pilot. In the first, a business line wants the product but lacks the evidence to launch it. That pilot can be fixed by building the evidence. In the second, nobody wants to own the product at all. Quensel traced many failed pilots to "the business use case": whether the product has, or will have, product market fit. A pilot of the second kind will not move however much evidence it produces.

What does a blockchain pilot leave untested?

Usually, the work around the blockchain. The rails provide the settlement and the tokens. A production product also needs:

  • a connection between the core ledger, the treasury system and the chain;
  • daily reconciliation, including failed transactions and reorganized ones, which drop out or change order when the network replaces its most recent blocks;
  • a signing policy covering who can move what, when and in what amounts, and what happens when that person leaves;
  • compliance evidence in the format the bank already sends its supervisor;
  • operating cover for a network that runs around the clock while bank systems close at 5 pm.

If a network upgrade lands at 3 am, someone has to decide what the bank's systems do before the morning.

Building these parts properly makes a pilot slower and more expensive, so teams often run them by hand. That is reasonable for a technology test. It becomes a problem when the same pilot is presented as the basis for production, because the manual steps are exactly what approvers will ask about.

Some questions concern the network itself. Gagan Mac, who leads product and engineering for Circle's Arc network, described three that enterprises raised. The first was how to account for network fees paid in a gas token, a token whose price moves. The second was how to know that nodes, the computers that validate transactions, are not in a sanctioned country. The third was when a transaction is final in the legal sense, as well as technically. A pilot can answer these before any meaningful volume flows.

Why does the settlement asset matter?

The settlement asset decides how much reconciliation work survives into production. A pilot settled in one form of money says little about a product that will settle in another.

J.P. Morgan built JPMD as commercial bank money. Emma Landriault, Global Head of Kinexys Labs at J.P. Morgan Payments, explained that clients wanted onchain cash that “would just aggregate as a total deposit position.” Some of those clients were concerned about assessing and managing the reserves behind different stablecoins. She described how some reserves resemble money market funds, while others look “a lot more like a hedge fund’s balance sheet.” Those concerns helped explain the demand for a deposit-based product.

If the cash leg stays offchain, the bank keeps two systems to reconcile. As Quensel put it, you "still reconcile what's on the blockchain with what's not on the blockchain."

The risk I watch for is a pilot run on whichever settlement asset was easiest to obtain, with a launch planned on a different one. The treasury and risk questions change with the asset, so much of the approval case has to be rebuilt.

Can a third party use the token without calling the issuer?

For products meant for outside users, a token needs to be accepted by a third party without calling the issuer. Internal uses, such as moving cash between entities of the same group, may not need that independence.

Quensel described what that independence takes when a tokenized fund is used as collateral. A lender has to be able to liquidate it entirely onchain, through smart contracts, until an offchain asset must be sold. His question for any token is "what can actually happen in the worst case?"

A pilot can explore that worst case through a simulated liquidation or redemption. A live test still has to follow the product's terms. For a fund, that may rule out redemptions outside its dealing hours.

What can one approved flow show?

Many banks assume everything must be approved before anything goes live, and that approval never comes. On the panel, I reminded the other guests that each of them had started with one flow, one counterparty, one approval and one product. A narrow live flow lets risk owners see the product under real controls. Its reconciliation rules, reporting formats and runbooks can often be reused.

It does not prove readiness for the next flow. A different asset, counterparty type or jurisdiction raises its own questions. My colleague Luis Medeiros, Protofire's Field CTO, has argued for going first where existing rules already leave room, such as stablecoin payments. Which flows qualify depends on the bank's jurisdiction, its authorizations, and its counsel's view.

One question I rarely see in requests for proposals is the exit. Can the provider show its reconciliation, and what would the bank keep or lose if the provider disappeared, or if the bank left the chain in five years? In the EU, Article 28(8) of DORA (Regulation (EU) 2022/2554) requires financial entities to put in place exit strategies for ICT services supporting critical or important functions. Whether a blockchain service falls into that category is the bank's own assessment.

At Protofire, we build these parts for banks issuing deposit tokens: core banking connections, reconciliation, key management and compliance records.

Quotations are from The Protocol Roundtable, Episode 4 (18 September 2026) and Episode 5 (1 October 2026). Guests spoke in their own capacity; their comments do not imply endorsement of Protofire.