Atomic settlement and conditional release are the two features every programmable money deck leads with. They are also the two most likely to mislead a team that has not built with them. The mechanics are real and several are in production. The guarantees they offer are narrower than the slide implies, and the gap between them is where projects fail.
This lesson separates what the technology actually delivers from the marketing. We assume you already know money is a ledger and how a stablecoin settles from the earlier modules. Here we look at the settlement primitive itself.
What atomic settlement actually guarantees
Atomic settlement means two or more linked legs execute as a single all-or-nothing operation. The standard case is delivery versus payment (DvP): the asset moves only if the cash moves, and neither moves if either fails. The same logic covers payment versus payment (PvP) in FX, where two currency legs settle together or not at all.
The guarantee is real but bounded. Atomicity removes principal risk inside one settlement boundary. It does not remove credit risk, liquidity risk, or the risk that one leg is not actually final money. The promise is "both legs or neither," not "this trade is now economically clean."
Atomicity is a property of a transaction boundary, not a property of the assets inside it.
That distinction is the whole lesson. A perfectly atomic swap of a tokenized bond against a low-quality cash token has simply made a bad settlement asset settle faster.
The cash leg decides everything
An atomic DvP is only as strong as the asset on the payment leg. Many projects tokenize the security side cleanly, then quietly fall back to an off-chain transfer or a credit IOU on the cash side. When the cash leg is not final money, the atomic promise weakens because settlement is not actually final.
This is why the serious infrastructure work has concentrated on the payment leg. Fnality runs the Sterling Fnality Payment System, which went live with controlled payments in December 2023 as the first regulated DLT-based wholesale payment system, settling against a digital representation of central bank money. BIS Project Agorá, convened with the Institute of International Finance, moved through a prototype during 2025 that combined tokenized commercial bank deposits with tokenized central bank reserves, and announced in May 2026 that the work advances to real-value testing across seven central banks and more than 40 financial institutions.
Both efforts spend most of their engineering on making the cash leg a credible settlement asset. That is the tell. If a programmability pitch glosses over what the cash token actually is, the atomicity it promises is doing less than it appears.
Conditional release: powerful inside a boundary, fragile across one
Conditional release means funds are locked and only move when a stated condition is met. On a single ledger this is mature. An escrow that releases on a signed delivery confirmation, a payment that fires when an oracle reports a threshold, a coupon that pays on a date: these run today and the logic is deterministic.
The fragility appears the moment the condition spans two systems that do not share a ledger.
The cross-chain case and the time-lock tax
The classic cross-chain mechanism is the hash time-locked contract (HTLC). Both parties lock assets on their respective chains under the same hash. Revealing the secret claims the funds; if no one reveals it in time, the time lock refunds everyone. It is genuinely trustless and it is genuinely atomic for the pair.
It is also slow and exposed to griefing. Each side waits for block confirmations on both chains before the locks are safe, which adds real latency. Worse, the party who holds the secret can wait and watch the price. If the trade turns against them they simply let the time lock expire, leaving the counterparty's capital locked and idle for the full window with nothing to show for it. The swap stayed atomic. The counterparty still lost optionality and time.
Most production systems avoid HTLCs for exactly this reason. They settle conditional logic inside one permissioned ledger and use a coordinator or a messaging layer to span boundaries, which reintroduces a trusted component. That is a defensible choice, but it means the "trustless atomic cross-chain settlement" on the slide has quietly become "atomic within our ledger, coordinated across the gap." Know which one you are buying.
A worked example
Consider a tokenized US Treasury fund trading against a cash token across two ledgers. In May 2025 Chainlink, JPMorgan's Kinexys and Ondo Finance executed exactly this shape: a cross-chain DvP of a tokenized Treasury fund between a public and a permissioned chain.
Walk the legs honestly. The asset leg is final when the fund token transfers on its ledger. The cash leg is final only when the cash token is itself a settlement asset with a clear redemption path, not a wrapped claim that still needs an off-chain bank transfer to become money. The cross-chain coordination is atomic for the pair but depends on the messaging layer behaving and on both ledgers confirming.
The transaction is a real demonstration. It is not yet evidence that the same flow clears at production volume with default-remote cash and no trusted coordinator. Treat a single executed transaction as proof the plumbing connects, not proof the model scales.
How to read a programmability claim
Three questions cut through most decks.
First, what is on the cash leg? If the answer is a stablecoin with issuer default risk or an off-chain transfer, the atomic guarantee is thin. Tokenized deposits and tokenized central bank money are the credible settlement assets, and we cover their mechanics in later modules.
Second, where is the settlement boundary? Conditional release inside one ledger is solved. Across two ledgers, ask what spans the gap and whether it is trusted. There is usually a coordinator hiding behind the word "atomic."
Third, what fails when a leg fails? A good answer names the refund path, the time-lock window, and who carries liquidity risk while capital is locked. A bad answer is "it cannot fail," which means the failure modes have not been mapped.
Takeaway
Atomic settlement and conditional release are production-grade primitives, not vaporware. What is still theatre is the framing that they remove settlement risk on their own. They remove principal risk inside a boundary, and only when the cash leg is real money and the boundary is honest. Buy the primitive for what it does: tighten a settlement boundary you control. Do not buy it as a guarantee that the assets crossing that boundary are clean, because that is the one thing it was never built to provide.