Eight use cases, different points of failure. Who carries the risk, what happens when something goes wrong, and how banks and card institutions could lose their place in the payment chain.
A CHF token may shorten the payment chain, but it replaces some bank and card dependencies with issuer, wallet, ledger and liquidity-provider dependencies. A stable price target does not guarantee safe custody, enforceable ownership or immediate redemption.
These are qualitative scenario assessments, not measured loss probabilities or new scores for the business-model spider charts. The common risks below apply to all eight models; each use-case section adds its distinct exposures. Controls reduce risk but do not eliminate it.
Research, not legal, investment or supervisory advice. Illustrative structures, not assessments of named companies. Actual exposure depends on the issuer, reserve design, contracts, jurisdictions and operating controls.
Shared exposures
The issuer or a reserve bank fails, or reserve assets lose value. A token's legal claim may differ from a bank deposit.
Consequence: Holders recover less than CHF 1, or wait through insolvency proceedings.
Controls: Verify the claim, asset eligibility, segregation, insolvency treatment and reserve-bank concentration; obtain independent assurance.
Responsible: Issuer board, treasury and legal team
Many holders request CHF at once, while reserves, banking rails or redemption staff are unavailable. A 24/7 token is not automatically redeemable 24/7.
Consequence: Redemption queues and discounts can turn a confidence shock into a run.
Controls: Stress-test outflows, maintain readily available liquidity and publish realistic redemption terms and contingency arrangements.
Responsible: Issuer treasury and settlement bank
A stolen signing key, contract flaw, upgrade error, chain outage or bridge exploit disrupts ownership or supply.
Consequence: Tokens are stolen, duplicated, frozen or inaccessible; settlement may stop.
Controls: Use independently reviewed contracts, split key authority, supply limits, recovery procedures and minimal bridge exposure.
Responsible: Issuer technology team and custody provider
Wallet credentials are stolen, a custodian fails, or a user approves a fraudulent transfer. On-chain payments usually lack card-style dispute reversal.
Consequence: Users may lose funds permanently or discover that recovery rights are limited.
Controls: Set wallet limits, verify recipients, segregate client holdings and define fraud liability, recovery and complaint procedures.
Responsible: Wallet or custodian, distributor and user
Licence coverage, transfer finality, holder rights or cross-border permissions are misunderstood; intermediaries fail screening or reporting obligations.
Consequence: Transfers are blocked, operations restricted and participants face enforcement or disputes.
Controls: Obtain structure-specific legal advice; assign onboarding, monitoring, sanctions and reporting duties to named participants.
Responsible: Issuer and each regulated intermediary
Banking APIs, cloud services, nodes or vendors fail; records of reserves, supply and client holdings diverge.
Consequence: Incorrect minting, delayed payouts, reconciliation losses or prolonged outages.
Controls: Reconcile reserves and supply, require dual approval, test fallback rails and define vendor exit and incident-response plans.
Responsible: Operations, risk and outsourced providers
Acceptance stays narrow, liquidity is fragmented, or fees and reserve income cannot cover controls and distribution costs.
Consequence: Users cannot spend or exit efficiently; the issuer cuts service or withdraws the product.
Controls: Test demand and unit economics under low or negative CHF rates, validate partners and fund an orderly wind-down.
Responsible: Issuer management and distribution partners
Public transaction histories expose commercial or personal activity, while opaque reserve disclosures hide financial weaknesses.
Consequence: Sensitive information leaks or holders cannot assess the issuer's solvency and liquidity.
Controls: Minimise personal data on-chain, control access to off-chain records and publish meaningful reserve and redemption disclosures.
Responsible: Data protection, compliance and issuer finance
A controlled group network reduces exposure to unknown counterparties, but concentrates operational dependence and makes legal entity accounting critical. It does not remove issuer or redemption risk.
A token sweep is booked as cash when it actually creates a loan or claim between subsidiaries, subject to local restrictions.
Incorrect accounts, transfer-pricing disputes or unlawful upstream funding.
Document each legal entity's claim, loan terms, tax treatment and local transfer restrictions before automating sweeps.
Responsible: Group treasury, tax and subsidiary finance
An ERP error or compromised treasury instruction sweeps funds from several subsidiaries at once.
Operating companies cannot meet payroll or supplier payments.
Use entity-level balances, sweep ceilings, dual approval and an emergency stop independent of the TMS.
Responsible: Group treasury and TMS operator
The group relies on one token issuer, ledger and redemption channel across time zones.
One outage or redemption suspension immobilises group cash.
Retain conventional bank balances, multiple funding channels and tested local cash fallback arrangements.
Responsible: Group treasury and issuing bank
Token finality is not reflected in the ERP, or ledger access reveals subsidiary cash flows.
Duplicate payments, reconciliation breaks or exposure of commercial information.
Use unique payment identifiers, entity-level reconciliation and permissioned access to sensitive transaction data.
Responsible: Finance systems and data protection teams
Large corporate payments amplify FX, settlement and counterparty exposures. Removing correspondent steps can reduce delay, but the CHF token transfer alone does not complete the foreign-currency payout.
A CHF token is exchanged for foreign currency through a dealer with limited weekend liquidity or an expiring quote.
Unexpected spreads, slippage or insufficient beneficiary currency.
Lock executable quotes, cap dealer exposure and prearrange corridor liquidity and hedging.
Responsible: FX provider and payer treasury
The CHF token is delivered before the beneficiary currency is paid; the second counterparty defaults.
The payer loses principal despite a final on-chain transfer.
Use legally effective payment-versus-payment where available, or collateral, exposure limits and conditional release.
Responsible: Participating banks and FX provider
The receiving bank cannot accept the token or freezes the payout; jurisdictions recognise transfer finality differently.
The invoice remains unpaid and funds are trapped between rails.
Confirm recipient eligibility, beneficiary account details and the full payout chain; specify when the obligation is discharged.
Responsible: Sending and receiving banks, corporate legal teams
Wallet data does not adequately identify the business, invoice or underlying sanctioned trade.
Rejected transfers, investigations and compliance penalties.
Link KYB, invoice and payment data securely and agree screening responsibilities across the corridor.
Responsible: Bank compliance and corporate payer
The main vulnerability is the last mile: a consumer needs usable local money, not merely a successful token transfer. Fraud and consumer redress remain central even when transfer fees fall.
A payout agent runs short of cash, rejects identification or cannot reach the recipient's local bank or mobile wallet.
A family cannot access an otherwise delivered remittance.
Verify payout coverage, agent liquidity and identity requirements; provide alternative payout partners and escalation.
Responsible: Remittance provider and local payout partner
A consumer follows a fake support request or sends to an incorrect or unsupported address.
Irrecoverable loss with limited dispute rights.
Use recipient checks, clear payment confirmation, fraud limits and an explicit support and recovery policy.
Responsible: Wallet provider and remittance operator
A cheap token transfer is combined with an unfavourable FX rate, gas costs and payout fees.
The recipient receives less than the sender expected.
Show the total CHF cost and guaranteed or estimated recipient amount before authorisation, with quote expiry.
Responsible: Remittance provider and FX partner
Rules on remittances, capital controls, personal data and sanctions differ between sending and receiving countries.
Blocked transfers, unlawful data sharing or missing consumer remedies.
Review each corridor, minimise shared personal data and assign local licensing and complaint responsibilities.
Responsible: Remittance compliance and payout partner
Institutional onboarding lowers some consumer risks, but large positions and tightly coupled venues create concentrated settlement and intraday liquidity exposure. Technical atomicity must match legal finality.
The cash token and security run on different systems or their legal transfers are not synchronised.
One party delivers without receiving enforceable ownership of the other leg.
Validate both technical and legal DvP, including failed-leg recovery and insolvency treatment.
Responsible: Venue, CSD, settlement banks and legal teams
Margin calls rise while token redemption or minting is unavailable outside bank hours.
Forced sales, missed settlement or default despite adequate total assets.
Stress-test simultaneous margin and redemption demands and preposition eligible cash and collateral.
Responsible: Trading firms and issuer treasury
An exchange, CSD or omnibus custodian holds most balances and suffers an outage or insolvency.
Multiple institutions lose access to the same settlement asset.
Segregate holdings, reconcile beneficial ownership and diversify custody and settlement access where feasible.
Responsible: Venue, custodian and institutional clients
Tokenised securities are misclassified, an ineligible asset enters settlement, or trading is manipulated.
Unenforceable trades, conduct losses or regulatory restrictions.
Apply instrument admission, participant permissions, surveillance and relevant securities and venue authorisations.
Responsible: Venue compliance and trading firms
Retail trading combines stablecoin issuer risk with exchange failure, speculation and user mistakes. A stable CHF token does not make the assets purchased with it safe.
A platform lends, pledges or mixes customer tokens with its own assets.
Customers become unsecured creditors or cannot withdraw.
Check legal custody terms, segregation, withdrawal rights and independent reconciliation; do not treat proof of assets as proof of liabilities.
Responsible: Exchange, custodian and retail investor
A CHF token funds volatile assets or leveraged positions, or is accepted as collateral at a discount.
Liquidation and investment losses even if the token retains its peg.
Separate cash-token risk from investment risk; impose suitable leverage limits and clear collateral haircuts.
Responsible: Broker or exchange and investor
An investor buys a look-alike token or deposits genuine tokens on a chain the venue does not support.
Lost deposits or exposure to worthless counterfeit assets.
Verify canonical contract addresses and supported networks; use allowlists and small test transfers where appropriate.
Responsible: Wallet, platform and investor
The retail user can sell on an exchange but lacks direct issuer redemption access, or tokens are frozen during an investigation.
The apparent CHF balance cannot be converted at par when needed.
Explain redemption eligibility, minimums, fees and freeze powers; maintain alternative compliant exit channels.
Responsible: Issuer, distributor and exchange
Shared infrastructure offers broad reach but increases the blast radius of outages and concentrates governance power. Individual issuer backing must remain distinguishable even on a common ledger.
A common ledger, gateway or shared service fails across banks and payment providers.
Many merchants and users simultaneously lose payment access.
Test independent failover and fallback rails, define incident escalation and prevent a single operator from disabling the whole network.
Responsible: Network operator and participating PSPs
Members disagree over upgrades, losses, access or exit, and contracts do not assign accountability.
Delayed fixes, disputed compensation and stranded integrations.
Specify voting, service levels, liability, resolution and member exit rules before launch.
Responsible: Consortium board and member legal teams
Tokens from different issuers appear interchangeable despite different credit quality or redemption claims.
Users unknowingly assume weaker backing and one issuer's problem spreads to others.
Identify each issuer and claim, segregate reserve accounting and define conversion and loss allocation rules.
Responsible: Issuers and network risk management
Bridges, standards and multiple token pools split liquidity or introduce insecure wrapped claims.
Higher fees, unusable balances and bridge losses.
Prefer a clearly identified canonical token, reviewed connectors and explicit bridge and conversion exposure limits.
Responsible: Protocol operator, PSPs and liquidity providers
Fast token payment is not a complete replacement for a card service. Refunds, fraud protection, merchant settlement and optional credit must be designed separately.
The checkout treats a pending transaction as final, prices in the wrong currency or mishandles variable network fees.
Goods are delivered without assured payment or the customer is overcharged.
Define confirmation policy, invoice expiry, supported networks and the exact CHF amount before releasing goods.
Responsible: Merchant, acquirer and wallet provider
An irreversible payment lacks a contractual refund process or equivalent buyer protection.
Customers cannot resolve non-delivery and merchants face reputational or legal claims.
Provide authenticated refunds, complaint handling and clear liability terms; offer protection services where needed.
Responsible: Merchant and payment service provider
Sales settle in tokens while payroll and suppliers require CHF bank deposits; off-ramp liquidity is unavailable.
A profitable merchant cannot pay expenses on time.
Offer scheduled CHF conversion, bank-hour buffers, settlement guarantees where contracted and backup acceptance rails.
Responsible: Acquirer, issuer and merchant treasury
Instalments, rewards or token-funded lending add credit, conduct and programme obligations beyond payment settlement.
Loan losses, unfunded rewards or inappropriate consumer credit.
Separate payment and lending contracts, assess affordability where required and fund rewards transparently.
Responsible: Credit provider, programme operator and merchant
A defensive reserve design can reduce investment risk, not eliminate it. The holder still depends on the legal claim, access to redemption and custody; CHF price stability is not purchasing-power stability.
A holder assumes a token has deposit insurance, a direct SNB claim or a state guarantee solely because reserves are high quality.
Unexpected loss allocation if the issuer or custodian fails.
Explain the exact holder claim and protection regime; central-bank reserves do not automatically give token holders a claim on the SNB.
Responsible: Issuer, legal team and distributor
The issuer lacks direct central-bank access or cannot convert reserves rapidly during stress.
Delayed redemption despite apparently strong backing.
Verify actual account eligibility and reserve access arrangements, including dependence on intermediary banks and stress liquidity.
Responsible: Issuer treasury and reserve bank
A non-yielding CHF token loses real purchasing power or CHF weakens relative to the holder's spending currency.
Savings decline in real or foreign-currency terms despite a stable CHF peg.
Disclose the difference between nominal CHF stability and investment returns; assess currency and inflation exposure separately.
Responsible: Holder and distributor
Keys are lost, inheritance access is unclear, or low reserve income makes long-term service unprofitable.
Savings become inaccessible, fees rise or the issuer winds down.
Plan recovery and inheritance, disclose recurring fees and maintain funded migration and wind-down arrangements.
Responsible: Custodian, issuer management and holder
Strategic risk · banks
Disintermediation means customers bypass services the bank used to provide. Treasury and cross-border B2B threaten transaction-banking relationships and FX fees; trading threatens settlement and custody revenues; retail payments threaten the customer interface; store of value can compete for savings balances.
Customers move operating or savings balances to tokens whose reserves are held elsewhere, with a few reserve banks or in securities.
The originating bank loses stable funding, may pay more for deposits and may reduce lending or margins.
Monitor customer-level migration and stressed liquidity; offer competitive tokenised deposits or regulated issuance, custody and reserve services.
Responsible: Bank treasury, asset–liability management and product teams
Corporate and consumer transfers route through wallets and liquidity providers rather than the bank's payment chain.
Reduced transaction fees, FX spreads and revenues from cross-border treasury services.
Compete on corridor liquidity, FX execution, compliance and reliable off-ramps rather than relying on settlement friction.
Responsible: Payments, transaction banking and FX desks
A wallet or platform becomes the main financial interface, leaving the bank as an invisible reserve or settlement provider.
Less cross-selling, weaker pricing power and less insight into client needs.
Provide integrated wallets and treasury interfaces, contractual data access with consent and differentiated advisory services.
Responsible: Retail and corporate banking, digital channels
The bank's own token services replace profitable legacy products before new volumes cover technology and compliance costs.
Margin compression and duplicate operating stacks.
Measure total relationship profitability, phase migration and retire legacy cost only when service continuity is proven.
Responsible: Bank strategy, finance and operations
A bank becomes the key reserve, guarantee or redemption partner for several issuers and faces correlated withdrawals.
Liquidity stress, contingent liabilities and reputational losses even without issuing the tokens itself.
Set issuer and guarantee limits, price liquidity commitments and stress simultaneous issuer runs.
Responsible: Bank treasury, credit risk and legal teams
Indicators to monitor: operating-deposit retention, reserve-bank concentration, stressed outflows, cross-border fee and FX income, wallet-led customer activity and contribution margin after token-service costs. Banks can remain essential as issuers, reserve holders, FX providers, custodians and credit providers; displacement is a scenario, not an inevitable outcome.
Strategic risk · card institutions
The strongest direct exposure comes from POS B2C, cross-border B2C and shared payment infrastructure. Here, “card institution” includes the card-issuing bank, the card network and the merchant acquirer: they earn different fees and take different risks. Institutional treasury and B2B trading are mainly bank-disintermediation stories, not direct substitutes for everyday card spending.
Consumers pay merchants directly from token wallets, avoiding some card authorisation and clearing services.
Issuing banks may lose interchange income, networks scheme fees and acquirers processing revenue; savings depend on total wallet, FX and off-ramp costs.
Offer token acceptance, wallet services and useful fraud or dispute protection with transparent pricing.
Responsible: Card issuers, networks and acquirers
Wallets and software platforms control payment choice and merchant onboarding.
Card brands and acquirers become less visible and more easily replaceable.
Integrate into merchant software and compete on acceptance reach, reconciliation and settlement reliability.
Responsible: Networks, acquirers and merchant-service teams
Token wallets supply spending insights, rewards or separate credit, reducing usage of the traditional card product.
Lower revolving-credit income, weaker loyalty and fewer cross-selling opportunities.
Separate valuable credit and protection services from the settlement rail; offer responsible credit and relevant rewards across payment methods.
Responsible: Card-issuing institutions and programme operators
A hybrid card-to-token or token-to-card service adds irreversible token settlement to an existing reversible card transaction.
Chargebacks on the funding leg can leave the provider exposed after tokens have already been released.
Use risk-based release, funding limits, reserves and clear liability allocation; never assume token finality cancels card dispute rights.
Responsible: Card issuer, acquirer and wallet funding provider
A card institution builds parallel token rails while merchants and consumers still need cards, offline payments and buyer protection.
Duplicated costs without sufficient displaced volume or replacement revenue.
Pilot segments with real demand, track contribution after all costs and retain card fallback and protection services.
Responsible: Card institution strategy, finance and operations
Indicators to monitor: share of checkout volume paid directly from wallets, issuer interchange and network-fee income, acquiring margins, fraud and chargeback losses, loyalty engagement and the full cost of token acceptance. Protection, credit, funding and acceptance services can remain valuable even if the settlement rail changes.
Official background for issuer, financial-stability and payment-system risks. The use-case controls and strategic scenarios above are analytical synthesis, not official FINMA or SNB ratings.
