Every settlement system you operate makes a promise about timing: that the value you send and the value you receive arrive close enough together that the gap between them cannot sink you. Settlement risk is what lives in that gap. It is not credit risk in the usual sense and it is not market risk. It is the risk that you part with the full principal of a payment and get nothing back, because your counterparty failed in the window between your leg settling and theirs.
This module is about where that risk hides, why foreign exchange is its sharpest expression, and how the fixes we built shrink the exposure without making it disappear.
Settlement risk is principal risk
Start with the worst case, because it sets the scale. In a poorly designed settlement, you can lose the entire principal of a transaction, not a few basis points of mark-to-market on it.
Picture two obligations that are meant to net or to settle against each other. You owe currency A. Your counterparty owes currency B. If you pay your leg first and irrevocably, and your counterparty fails before paying theirs, you are out the full amount you sent. There is no haircut and no recovery on the trade itself. You are now an unsecured creditor in someone else's insolvency for 100 percent of the value.
That is principal risk. It is the reason settlement design obsesses over linkage: making the delivery of one leg conditional on the delivery of the other, so that neither side can be left holding the whole loss.
Herstatt: the afternoon that named the risk
The textbook case is real and worth keeping concrete.
Bankhaus Herstatt was a privately owned bank in Cologne. On 26 June 1974 it had taken large speculative foreign exchange positions, selling US dollars against Deutsche marks, and the market moved against it. German regulators withdrew its license and closed it at 15:30 Central European Time.
Here is the timing that made it infamous. By the time Herstatt was shut, its counterparties had already paid Deutsche marks to it earlier that day in Frankfurt, where the business day was ending. The corresponding US dollar payments were due to settle later in New York, where the day was still running. Herstatt was closed before those dollar legs went out. Counterparties had delivered one currency in full and would never receive the other.
The fallout was not contained to a few trades. Banks across the system stopped releasing outgoing payments until they could confirm the countervalue had arrived. Payment flows seized, lending rates spiked, and trust in cross-border settlement evaporated for a period. The episode pushed central bankers to create the Basel Committee on Banking Supervision later that year, and FX settlement risk has been called Herstatt risk ever since.
The lesson is not "banks fail." Banks fail. The lesson is that time-zone gaps turn an ordinary default into a guaranteed principal loss for whoever paid first.
CLS: solving FX with payment-versus-payment
The structural answer to Herstatt risk is to refuse to let the two legs settle at different times. That is what payment-versus-payment (PvP) means: neither currency leg settles unless both settle.
CLS (Continuous Linked Settlement) is the system built to do this at industry scale. It runs a multi-currency settlement service in which both sides of an eligible FX trade settle simultaneously across CLS accounts at the relevant central banks, linked to local RTGS systems. If the funding for one leg is not there, the matched pair does not settle. The first-mover cannot lose principal because there is no first mover. CLS settles in 18 currencies, which covers the large majority of global FX value but not all of it.
So the principal-risk problem in FX is largely solved for trades that go through PvP. Two things matter for a practitioner. First, the coverage is not total: currencies outside CLS, and counterparties or instruments that settle bilaterally, still carry the old Herstatt exposure. The BIS has repeatedly flagged that a material share of FX still settles without PvP protection. Second, PvP solves the timing problem. It does not remove the liquidity problem, which we come to below.
Netting reduces exposure and concentrates it
The other lever everyone reaches for is netting. Instead of settling every gross obligation, you net offsetting positions and settle the difference.
The headline benefit is real. Multilateral netting can collapse a huge volume of gross payments into a small net figure, cutting the principal at risk and the liquidity you need on hand to settle. CLS itself uses netting alongside PvP: members fund net positions, not gross.
But netting does not destroy risk. It relocates it. Two things happen when you net through a central node.
First, you move bilateral exposures into a single shared dependency. Everyone now depends on the netting calculation holding and on the central node performing. The exposure is smaller in aggregate but concentrated in one place.
Second, and this is the part that bites in a crisis, netting can carry unwind risk. If a member defaults before settlement and the system recomputes the net positions without that member's trades, the surviving members' obligations can shift, sometimes sharply. The comfortable net number you funded for can move against you exactly when funding markets are tightest. A netting arrangement that lacks robust default rules and pre-funded resources can amplify a shock rather than absorb it. This is why the relevant principal-risk standards insist that systemically important netting systems be able to withstand the default of their largest participant.
Netting shrinks the total exposure but concentrates what remains. You are trading many small bilateral risks for one large structural one.
Intraday liquidity and replacement-cost risk
Two more exposures live in the gap, and PvP does not erase either.
Intraday liquidity risk. PvP and netting both require you to have the right currency, in the right account, at the right moment of the settlement cycle. CLS settles within a defined window each day, and members must fund their positions on time. If your liquidity is stuck, a custodian is slow, or a nostro is short for an hour, you can fail to settle a trade that carried no credit problem at all. Liquidity is a timing resource, not just a balance.
Replacement-cost risk. Even when no principal is lost, a failed-to-settle trade still has to be replaced. If your counterparty defaults before settlement, you have not lost the principal under PvP, but you have lost the trade. You must go back to the market and re-execute at whatever price now prevails. The cost of that re-execution, the gap between the original rate and the new one, is replacement-cost risk. It is smaller than principal risk but it is real, and it grows precisely in volatile markets where defaults cluster.
Takeaway
Settlement risk is principal risk, and its purest form is the Herstatt gap: pay your leg, never see theirs. PvP through CLS closes that gap for most FX value by refusing to settle one leg without the other. Netting shrinks the exposure that remains but concentrates it into a central node and a recomputation that can move against you in a default. Ask three questions of any settlement you run: is the principal protected by linkage, where does netting move the risk I no longer see bilaterally, and do I have the intraday liquidity to honor my net position at the exact minute it is due.