CoinDesk reported that Monument’s plan to tokenize up to £250 million of retail deposits on Midnight had slipped by several months as the London bank sought a custody partner able to meet FCA standards while handling zero-knowledge privacy proofs. Monument’s founder said the bank had found an FCA-approved provider in Canada, though it had not identified the firm publicly. The deposits are intended to remain interest-bearing, fully backed by Monument and redeemable one-for-one for pounds sterling.
That is a useful interruption to the usual launch narrative. A bank can create a token, write a smart contract and make a ledger entry. But a retail deposit is not merely a ledger entry. It is a liability of a licensed bank to its customer. The token can represent that claim, but cannot replace the bank’s obligation to honour it.
The hard question, then, is not whether Midnight can keep data private. It is where the bank’s obligation ends, where the network’s privacy machinery begins, and who can act at the boundary between the two.
A token is not the deposit
A tokenized deposit is comparable to a stablecoin only at a very superficial level. Both can be transferred as digital units. The crucial difference is the liability behind them.
A stablecoin is ordinarily a claim on an issuer and its reserve structure. A tokenized bank deposit is a claim on the issuing bank itself, recorded within the banking system and potentially eligible for the protections attached to that deposit relationship. The customer does not need to own a wallet in the usual crypto sense to own the underlying bank claim.
CoinDesk’s March interview framed Monument and Midnight’s partnership as an effort to bring retail client assets on-chain while preserving an ordinary banking experience. The important phrase is not “on-chain.” It is “ordinary banking experience.” The design succeeds only if redemption remains as dependable as a normal withdrawal, even when the blockchain is congested, a wallet provider fails, or a privacy proof cannot be generated.
That means there must be two records that remain coherent with each other:
Monument’s core banking ledger, which records the deposit liability in sterling.
The token system, which records who is entitled to exercise or transfer the corresponding tokenized claim.
If those records disagree, the bank ledger must govern the legal obligation. But the token system needs rules that prevent the disagreement from arising in the first place.
The lifecycle begins in the bank, not on Midnight
Consider a customer depositing £10,000. Fiat enters Monument through the normal banking rails. Monument credits the customer’s account and records a £10,000 liability. Only then should a token issuance service mint an equivalent amount of tokenized deposit units.
The issuance instruction needs more than a signature. It needs policy. Is the account open and verified? Is the deposit available to transfer? Is the customer within relevant limits? Has a court, fraud team or sanctions process placed a restriction on the account? The token should be minted only when the answer to each relevant question is yes.
Midnight is designed for the part that conventional public chains handle badly: proving compliance without publishing the customer’s identity, balance or transaction history. The Block reported that Midnight maintains its own ledger, consensus and smart contract environment, using zero-knowledge proofs and a hybrid model that can combine public and private data within a transaction.
In practical terms, a customer should be able to prove statements such as: “I passed this bank’s customer checks,” “this transfer is within my permitted limit,” or “the recipient is eligible to receive this asset.” The verifier learns whether the rule was satisfied, not the identity documents, account balance or other witness data used to create the proof.
This is a privacy function. It is not proof that Monument still owes £10,000.
Compliance proof and solvency proof are different objects
The distinction matters because privacy systems can be technically sound while a bank’s token accounting remains weak.
A compliance proof answers whether a person or transaction satisfies a specified rule. A liability proof answers whether the token supply is matched by deposits that the bank owes and will redeem. The first is cryptographic. The second is accounting, legal and operational.
For a robust retail design, Monument would need to produce a frequent reconciliation across at least four quantities:
| Control | What it must establish |
|---|---|
| Bank deposit ledger | Sterling liabilities owed to participating customers |
| Token issuance ledger | Gross tokens minted and tokens burned |
| Shielded token state | Tokens that remain spendable and outstanding |
| Redemption queue | Valid claims awaiting conversion back to sterling |
The control objective is straightforward: outstanding tokens must not exceed the relevant redeemable deposit liabilities. But showing it without leaking customer information is more difficult. An external observer may be able to verify aggregate issuance and burns. A regulator may need a more detailed audit view. The bank itself needs enough information to resolve disputes, execute freezes and process redemption.
These are not identical audiences, and they should not receive identical data.
A public chain does not need the names of depositors. A regulator may need to obtain targeted records under legal process. Monument needs the ability to associate a customer’s banking relationship with a tokenized position when it is necessary to fulfil its obligations. The privacy promise is therefore selective disclosure, not permanent institutional blindness.
Custody is the authority map
This is why the reported search for a custodian is more than vendor procurement. Custody decides which party holds the keys that can change the system’s state.
At least four distinct authorities must be separated:
- Signing authority to mint, burn, pause or migrate deposit tokens.
- Customer spending authority to transfer a shielded token position.
- Viewing authority to inspect transaction or balance information when disclosure is justified.
- Recovery authority to handle lost access, death, fraud, court orders or a failed service provider.
Putting every authority with Monument creates a familiar bank-operated system with stronger privacy at the ledger layer, but limited user sovereignty. Giving every key to customers may preserve a purer crypto model, but it risks making retail redemption and regulated recovery unworkable. Delegating every control to a custodian substitutes one concentration of power for another.
The design needs explicit limits. A custodian holding an institutional signing key should not automatically gain visibility into every customer’s private history. A bank holding a viewing key should not be able to transfer customer tokens. A customer who loses a device should have a recovery route, but that route should require defined controls rather than an informal support request.
Jesica Davis is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and gpt-5.6-terra. Out on the live web: gpt-5.6-terra and gpt-5.6-luna. Pictures: gpt-image-1 and flux. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Jesica Davis's usual length and in Jesica Davis's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.