From Project Samara to Production: What the Pilot Proved, What it Did Not Build, and the Path to Live Multi-Bank Settlement

Executive summary

Project Samara, the Bank of Canada's tokenized bond pilot executed with Export Development Canada as the issuer and RBC Capital Markets and TD Securities as joint lead managers, used distributed ledger technology and wholesale central-bank digital money to test the full lifecycle of an institutional bond, including issuance, settlement, lifecycle management, and secondary-market functionality. The Bank of Canada described it as an important step in understanding tokenization, DLT, and how they can improve financial instruments for investors, businesses, and the financial community.

The pilot proved that the architecture works in a Canadian regulatory context. That settles the feasibility question. The remaining work is structurally different: it is the build of production institutional infrastructure that turns a successful pilot into a live, multi-bank, multi-issuer, scalable, regulated market. This report walks through what Samara proved, what it intentionally did not build, the missing layer between issuance and liquidity, why Canada needs a neutral institutional venue, what individual banks can build alone versus what requires shared rails, and the operational blueprint for the production phase.

1 What Project Samara actually tested

The pilot's design is worth being precise about, because the operational scope determines what conclusions can be drawn from it.

Issuer side. Export Development Canada, a Canadian Crown corporation with a well-established institutional bond issuance track record, served as the issuer. EDC's involvement is structurally meaningful because it signals that Canadian Crown issuance can be operationally compatible with tokenized issuance frameworks. Crown issuance is among the most institutionally credible asset categories in the Canadian market.

Bank side. RBC Capital Markets and TD Securities, two of the largest Canadian institutional bank capital markets desks, served as joint lead managers. Their participation indicates that Canadian Tier-1 bank capital markets operations can operationalize tokenized issuance under pilot conditions.

Cash side. Wholesale central-bank digital money, issued by the Bank of Canada inside the pilot perimeter, served as the cash leg for settlement. This is distinct from retail or private-sector stablecoin settlement; it is central-bank money. The pilot demonstrated that wholesale CBDC can operationally function as the institutional settlement asset for a tokenized bond.

Technology side. Distributed ledger technology served as the underlying record-keeping and transfer mechanism. The pilot did not require any single chain to be the production answer; it tested whether DLT in general can serve the institutional bond lifecycle.

Scope of lifecycle tested. The pilot tested issuance, settlement (asset leg and cash leg), lifecycle management (coupon and other lifecycle events), and secondary-market functionality. This is the full institutional bond lifecycle, not just an issuance proof of concept.

The pilot's design was conservative and comprehensive. The conclusions that can be drawn from it are correspondingly strong.

2 What Samara proved

Five specific conclusions follow from the pilot's design and execution.

DLT can support institutional bond issuance workflows in Canada. This was not obvious in advance. Bond issuance has well-established operational expectations around legal documentation, registration, transfer agency, and lifecycle automation. The pilot demonstrated that these expectations can be operationalized on DLT under Canadian regulatory conditions.

Wholesale digital money can support institutional settlement experiments. The pairing of a tokenized bond asset with wholesale CBDC as the cash leg proved that atomic delivery-versus-payment is operationally feasible inside a Canadian pilot perimeter. This is the gating primitive for institutional tokenization at scale.

Major Canadian institutions will participate when the regulatory perimeter is clear. EDC, RBC, and TD participated. Their participation signals that other Canadian Tier-1 institutions will participate in successor initiatives under similar conditions. Anchor institutional adoption is a prerequisite for the next phase.

Secondary trading can be modeled inside a pilot perimeter. The pilot did not produce a live continuous secondary market, but it did demonstrate that secondary-market functionality can be tested on the same architecture as primary issuance. The technical foundation for a regulated secondary market is in place.

Lifecycle events can be digitized end to end. Coupon payments, registration changes, and other bond lifecycle events were demonstrated as operationally compatible with the DLT-based architecture. This is operationally significant because the alternative (manual workflows wrapped around a DLT record) would have undermined the case for tokenization in the first place.

3 What Samara intentionally did not build

The pilot's design boundaries are equally important. Five categories of work were explicitly outside scope.

Production-grade multi-bank settlement. The pilot involved two banks (RBC and TD). A production institutional venue needs to support the full Canadian Tier-1 bank set plus regional banks, credit unions, and Crown institutions as peer counterparties. That multi-institution operating capability is the architectural problem that has to be solved next.

Commercialized tokenized deposit infrastructure. Wholesale CBDC inside a pilot perimeter is structurally different from production tokenized deposit infrastructure operating at commercial scale across institutional counterparties. The latter requires bank-side product launches (BMO's announcement with CME and Google Cloud is the first material example), regulatory clearance for production deployment, and integration with the venue layer.

Live regulated liquidity venues. Secondary-market functionality modeled inside a pilot perimeter is not the same as a continuously operating, regulated, multi-issuer, multi-counterparty secondary market. The latter requires venue-level licensing, market-making capability, regulatory reporting, and the operational scale that only a dedicated institutional venue produces.

Scaled custody, audit, and interoperability. Pilot-stage custody arrangements are operationally simpler than production-stage custody at scale. The CIRO Digital Asset Custody Framework, formalized in February 2026, defines what production-stage custody looks like. Aligning Samara-style activity with the production framework is its own work stream.

Scalable legal and compliance standards. Pilot transactions can rely on bespoke legal documentation. A scalable institutional market requires standardized legal frameworks, templated disclosure, automated compliance workflows, and the operational discipline that supports issuance velocity across many issuers and counterparties.

None of these omissions reflect weakness in the pilot. They reflect the correct scoping of a pilot's role. The pilot's job was to prove the architecture. The production build's job is to operationalize what comes next.

4 The missing layer between issuance and liquidity

The structural gap that Samara surfaces is the absence of a regulated multi-institution venue and settlement architecture that connects issuers (Canadian banks, Crown corporations, asset managers, RWA issuers) to institutional buyers (pension funds, insurance companies, asset managers, accredited and qualified individual buyers) on terms that meet Canadian institutional mandates.

The missing-layer functions:

Standardized listing and disclosure framework that scales across issuers
Continuous secondary-market liquidity with market-making support
Multi-custodian interoperability across qualified Canadian custodians
Atomic delivery-versus-payment across multiple CAD digital cash instruments (QCAD, regulated CADC, tokenized deposits, wholesale CBDC)
Regulatory reporting and supervisory access from inception
Cross-jurisdictional interoperability for international institutional buyers
Multi-bank governance and neutral system administration

No existing Canadian operator delivers all of these at production scale. The Bank of Canada explicitly does not operate production institutional venues; that is not a central bank's role. The major Canadian banks individually can build single-bank platforms (and BMO's CME and Google Cloud announcement is one such platform) but cannot, by definition, build a neutral multi-bank venue. The existing Canadian crypto exchanges (NDAX, Bitbuy, Wealthsimple Crypto, Newton, Shakepay) are retail-focused, not institutional-RWA-focused. The international RWA venues (Archax in the UK, ADDX in Singapore, Securitize in the US, SDX in Switzerland) are regulatorily constrained to their home jurisdictions and cannot serve Canadian regulated institutional counterparties on terms that meet Canadian mandates.

The missing layer is structurally an institutional opportunity. Closing it requires a deliberate, multi-stakeholder build with the right governance posture and regulatory pathway from inception.

5 Why Canada needs a neutral institutional venue

The neutrality requirement matters. A single-bank venue, regardless of which bank operates it, will not be used by other Tier-1 Canadian banks as a peer settlement layer on equal terms. The JPMorgan Kinexys experience in the US is the canonical example. Kinexys has cleared more than US$3 trillion in cumulative notional, but it has done so as JPMorgan's network. Other Tier-1 US banks have not used Kinexys as a neutral settlement venue on equal terms with JPMorgan; the venue, the rules, the system administration, and the data are all JPMorgan's.

For a Canadian national settlement layer, the single-bank governance model is the wrong choice from the start. The venue needs to be:

Operated by an entity independent of any single bank
Governed by a multi-institution board that includes representation from multiple Tier-1 banks, multiple custodians, multiple issuer categories, and independent expertise
Subject to supervisory oversight by CIRO and the CSA in their respective domains
Structured for cross-jurisdictional interoperability rather than for protection of any single domestic counterparty's market position

This is achievable. It requires deliberate design from inception. It is not retrofittable after the fact.

6 What banks can build alone vs what requires shared rails

The line between what an individual Canadian bank can build inside its own perimeter and what requires shared multi-bank infrastructure is sharp and consequential.

What an individual bank can build alone.

Tokenized deposits for its own institutional clients
A token-aware client treasury management product
Integration of its existing capital markets and lending products with tokenized issuance
Internal settlement and reconciliation automation using DLT
Pilot transactions with selected counterparties, including other banks under bilateral arrangements

These are all useful and several Canadian banks are already operating in this space. BMO's CME Group and Google Cloud tokenized cash platform is the most public example. Other Tier-1 banks are operating less-publicized variants.

What requires shared multi-bank rails.

Cross-bank tokenized deposit settlement (so a corporate client can hold tokenized deposits with one bank and transact against tokenized assets held with another bank's custodian)
Multi-bank tokenized repo and intraday liquidity facilities
Cross-bank tokenized securities settlement at production scale
A regulated continuous secondary market that interoperates across multiple bank-issuer relationships
Standardized regulatory reporting from a single venue rather than from each bank individually
Cross-jurisdictional interoperability that serves multiple Canadian banks rather than only one bank's international counterparties

None of these can be built by an individual bank, no matter how large or how well-resourced. They require a multi-bank, neutral, regulated venue. That is the architectural reason a single-bank model fails for the Canadian institutional layer.

7 The production blueprint

A working production blueprint for the post-Samara phase has six operational requirements.

One. A multi-bank governance model with anchor participation from at least three Tier-1 Canadian banks and one Crown institutional counterparty.

Two. A CIRO-compliant three-entity structure (HoldCo, OpCo, CustodyCo) with the CustodyCo interoperating with other Canadian qualified custodians, not competing with them.

Three. Native multi-instrument CAD digital cash settlement (QCAD, regulated CADC, bank tokenized deposits, eventually wholesale CBDC for inter-bank flows), with atomic delivery-versus-payment as the operational default.

Four. Supervisory access from inception for CIRO, the CSA, FINTRAC, and the Bank of Canada in their respective domains.

Five. Cross-jurisdictional interoperability with qualified international custodians and selected international venues, enabling cross-border institutional buyer access to Canadian-issued tokenized assets.

Six. Operational scaling capacity for a multi-issuer, multi-asset-class flow (real estate, mortgages, commodities, credit, fixed income, fund instruments) running on the same venue infrastructure.

Each is a serious build. Together they constitute the institutional infrastructure that converts Samara-style proof into a live market.

8 The constructive read

Project Samara settled the feasibility question. Canadian institutional tokenization can be operationalized on DLT with wholesale digital money under regulated conditions, with credible Tier-1 bank and Crown participation, across the full bond lifecycle. The architecture works.

The next phase is the production build. The structural gap is the absence of a regulated multi-institution venue and settlement architecture that converts pilot-stage feasibility into live, scalable, multi-bank, multi-issuer institutional market activity. The pieces around the gap are increasingly in place: CIRO custody, QCAD and the regulated CAD stablecoin layer, BMO's tokenized deposit platform, the CSA's active Project Tokenization workstream, and the Bank of Canada's continued wholesale CBDC research. The connective venue layer is what is missing.

That layer is what 4orm Finance is being designed to operate. Samara proved the architecture. The production phase is the build that follows.

Background and Sources

Bank of Canada, Project Samara announcement and pilot materials, March 2026.
Export Development Canada, public statements on Project Samara participation.
RBC Capital Markets and TD Securities public materials on Project Samara.
Canadian Securities Administrators, CSA Project Tokenization.
CIRO Digital Asset Custody Framework, February 2026.
BMO Tokenized Cash Platform announcement with CME Group and Google Cloud, April 2026.

This report is institutional research from KCS Capital. It is for informational purposes only and does not constitute an offer or solicitation to buy or sell securities. KCS Capital Inc. is an independent technology and research firm; 4orm Finance operates as a separate regulated entity.

From Project Samara to Production. The Infrastructure Path.