5.4 Liquidity Risk in Secondary Markets
Why transferability is not liquidity, how every redemption channel carries a documented capacity, where a token promises a faster exit than its underlying can deliver, how runs change on a public ledger, why whitelists, chains and DeFi pools thin the buyer side further, and what Hong Kong's SFC now expects of tokenized fund secondary markets.
Tokenization makes an asset easier to move. It does not make it easier to sell. A token can settle in seconds, at any hour, to any eligible wallet on several chains, and none of that supplies a buyer. The exits that actually exist are an issuer's redemption channel, a thin peer-to-peer market, a decentralized exchange pool, or a lending protocol's liquidator, and each of them is capped, queued, permissioned, or priced by whoever is left on the other side. On an ordinary day the difference does not show. It shows when many holders want out at once.
Section 5.3 asked whether the parties behind a token can pay, and found that tokenization adds to the list of parties who must pay before the holder does. This section asks what can go wrong even when all of them are solvent: whether a holder can get out, how fast, and at what price. Section 3.3 found the liquidity benefit "real where an underlying market already exists and largely absent where it does not", promised a return to thin secondary markets "as a risk rather than an unfulfilled benefit", and left Chapter 5 to treat as a risk the asymmetry that continuous redemption does not create a two-sided market. Section 3.1 set out IOSCO's finding that secondary markets have not delivered the promised liquidity. Section 4.1 noted that "secondary liquidity outside these venues remains thin", and its checklist for reading any protocol asks what happens on redemption stress. Section 4.4 documented the caps on instant redemption as cash-leg facts, and Section 4.5 recorded $0.98 billion of net outflows from tokenized Treasury funds in the 30 days to 23 September 2026. This section reads those facts as risk, without redoing Section 3.3's turnover arithmetic.
Transferable Is Not the Same as Sellable
Regulators reading their own data agree. IOSCO notes that native tokenized securities "have thus far exhibited low levels of secondary market liquidity", and that for BUIDL, the largest tokenized fund, "a substantial part of the order / trading flows from existing conventional infrastructure remains"1. ESMA's review of the EU's DLT Pilot Regime found trading "extremely limited to date", and reported for CSD Prague's first seven months that "there have not been any secondary market transactions"2. The ECB finds "limited evidence of secondary market trading taking place"3.
Issuer documents are blunter. Franklin Templeton's prospectus for the government money fund behind BENJI states that a whitelisted investor "must be aware of other whitelisted investors who are available to enter into peer-to-peer transfers and neither the Fund nor its transfer agent will play any role in connecting transferors and transferees"4. It adds that "Peer-to-peer transfers do not constitute a public trading market" and that "the Fund does not require that peer-to-peer transfers occur at NAV"4. Transferability is a permission. A market is a set of people willing to buy, and the prospectus says in terms that the fund will not supply them.
On-chain activity shows the same shape. On 28 September 2026 rwa.xyz counted 107 holders of BUIDL and 24 addresses that sent or received it in the trailing 30 days5. Apollo's tokenized credit fund ACRED had 70 holders and 14 transfers worth $804,670 in the month, under 1% of its $95.4 million value6. Tokenized real estate, the category most often sold on liquidity, showed 142 monthly active addresses across 2,861 holders7. Even these counts flatter the market. rwa.xyz counts every transfer between holders except mints and burns8, so a move into a vault or a collateral contract counts the same as a sale. By that measure Janus Henderson's JTRSY, a Treasury fund with 32 holders, moved about 4.8 times its own value in a month9. Most of that is plumbing, not trading.
With no second investor reliably waiting, a holder's exit falls back on the issuer, and the issuer's exit has limits.
Every Exit Has a Capacity
The ECB states the dependency directly: investors redeem tokenized money market fund units "directly with the asset manager for fiat currency or stablecoins, given the limited role of secondary markets. This means that if redemptions exceed available liquidity, the asset manager may need to sell assets at a loss"10. The exit is real. It is also finite, and product documents say where the limit sits.
Table 1 sets out one documented exit limit for each of six products1112131441516. OUSG's cap and Maple's 30-day maximum repeat Section 4.4; the right-hand column is new.
| Product and exit | Documented limit | Read as run capacity |
|---|---|---|
| OUSG, instant redemption in USDC | $50 million per 24 hours across all investors | About 16% of the $319.82 million Ondo reported on 25 September 2026; the rest waits for the non-instant channel |
| Maple syrupUSDC, withdrawal | "first-in, first-out basis as liquidity becomes available", up to 30 days | The queue clears as cash reaches the pool, at a pace no holder controls |
| ERC-7540 asynchronous vaults | No fulfilment deadline; pending requests "MAY NOT have a fixed exchange rate" | The exit price is set when the request is paid, not when it is made |
| Midas mWIN, atomic redemption | $10 million of Midas's $30 million atomic liquidity; "Midas may pause instant redemptions" in market disruption | The instant route can close in the conditions it exists for |
| Franklin BENJI, redemption with the fund | "we may temporarily suspend redemptions or postpone the payment of proceeds" in unusual circumstances | A discretion, not a number |
| Apollo Diversified Credit Fund, behind ACRED | Quarterly repurchase offers "for no less than 5%" of shares | 5% of the fund per quarter in the 2026 offers, shared across every holder who tenders |
Two readings follow. First, instant liquidity is a facility that someone funds from a balance sheet and sizes for ordinary days. OUSG held 1.33% of its portfolio directly in USDC on Ondo's page11, and at the full $50 million a day, redeeming the whole fund instantly would take about six and a half days, by this paper's calculation. The BIS notes that instant facilities built with stablecoin issuers can relieve pressure on the fund while opening the channel between tokenized funds and stablecoins that Section 5.3 traced as a wrong-way risk17. Section 4.4 asked whose liquidity backs the instant leg. In a run the answer is whoever it is, in an amount they chose in advance.
Second, a redemption request is a place in a queue. ERC-7540, the standard behind the asynchronous vaults in Section 4.1's Centrifuge profile, was written for systems with "asynchronous actions or delays", naming "real-world asset protocols" first, and it warns that "the price can change between Pending and Claimed"13. The holder carries the price risk while waiting.
The Token Is More Liquid Than What It Holds
The FSB names the core risk plainly: "Tokenisation may introduce the potential for liquidity and maturity mismatch between the tokens and underlying assets"18. Its illustration: "a token representing a share of an asset could give a false impression of ample market liquidity through marketing efforts, even though the reference asset is not liquid. A significant spike in redemption demands on the token in times of stress could force the issuer to sell the reference assets in less liquid markets, which could, in turn, trigger a downward price spiral on the tokens"18. The BIS places the same mismatch "At the heart of" the risks of tokenized money market funds17.
None of this is new to fund regulators. The FSB defines structural liquidity mismatch as "the difference between the redemption terms that an OEF offers to investors and the amount of time it may take the OEF's manager to liquidate fund holdings in an orderly manner", and says funds with a significant share of illiquid assets, indicatively more than 30%, should deal less often than daily or require long notice or settlement periods19. IOSCO's revised recommendations state that redemption terms "should be based on the liquidity of its asset holdings in normal and stressed market conditions"20. What neither settles is which layer's terms count when a token wraps a fund: the fund's, or the token's as advertised.
ACRED shows the gap. Apollo and Securitize launched it on 30 January 2025 as a feeder into Apollo Diversified Credit Fund, with "native redemptions at a daily net asset value"21. The master fund's prospectus states that "No secondary market is expected to develop for the Fund's shares. Thus, liquidity for the Fund's shares will be provided only through quarterly repurchase offers for no less than 5% of Fund's shares at net asset value", and warns that feeder tenders "could contribute to an over-subscription of a particular repurchase offer"15. In 2026 the master fund honoured its February offer in full, then repurchased about 35% of the 10,814,698 shares tendered by 5 May and about 27% of the 13,720,453 tendered by 4 August16. rwa.xyz now lists ACRED's redemption window as quarterly6. No source available to this paper shows how the feeder allocated those prorated offers among its token holders, and nothing here suggests ACRED holders were refused. The point is structural: unless a buyer or a sponsor supplies cash, a feeder's holders cannot, in aggregate, get out faster than the fund beneath them lets the feeder out.
Prorating is not in itself a failure. Blue Owl's OCIC, a private credit fund that is not tokenized and serves here as the conventional analogue, received estimated repurchase requests of 21.9% of its shares in the first quarter of 2026 and 18.8% in the second2223. It said it would fill only its 5% tender offer, pro rata, about 27% of the shares tendered in the second quarter, while holding $11.6 billion of liquidity and stating that it "does not need to sell a single private loan to satisfy the tender offer"23. The gate protects the holders who stay. Apollo's prospectus names the feedback it creates: "Some shareholders, in anticipation of proration, may tender more Common Shares than they wish to have repurchased"15. A token that redeems at any hour sits on top of that loop, not outside it.
Runs Move at Block Speed
A run is a coordination problem, and the FSB traces it to a "first-mover advantage at the fund level when redeeming investors do not bear the full cost of redemptions"19. Public ledgers speed up the coordination. The BIS finds that blockchain transparency "further compounds liquidity risk by acting as a coordination device among investors. As redemptions are immediately visible to all market participants, the risk of runs may be exacerbated"17. IOSCO adds that automated execution "might trigger highly correlated movement of funds, creating correlated liquidity risks"1.
The clock adds a second channel. Section 5.1 quoted the FSB's warning that token runs intensify when the reference market is closed while the token still trades, and read it for what it does to the price. The ECB describes where the same sequence ends for the holder: in "forced fire sales to meet redemption pressures once the traditional markets reopen"10. Section 3.4 treated the weekend as a price basis; here it is a queue that builds while the underlying market is shut. A secondary price, where one exists, becomes a signal of its own: it "may diverge from the fund's net asset value per share, signalling distress and prompting withdrawals"10. That discount to NAV is a risk regulators anticipate rather than one yet observed. This paper found no regulator, issuer, or data source that has measured a tokenized fund trading at a sustained discount to its NAV.
Holder concentration makes ordinary flows look like runs. JTRSY lost 60.83% of its value in the 30 days to 28 September 2026 with 32 holders, and BUIDL 18.84% with 10795; Section 4.5 already recorded the net outflows behind those falls. With Treasury bills underneath, flows of that size are benign, and they are benign because of the asset, not the token. The ECB expects that if these funds' secondary markets scale, "their run dynamics may start to resemble those of stablecoins"10, and the same flow against an underlying that cannot be sold in a day is the FSB's scenario above. The conventional defence, in the ECB's words, is that "gating or suspending redemptions can help manage large outflows and protect remaining investors"10. On a public ledger, the queue a gate creates is visible to everyone standing in it.
Whitelists and Chains Split the Buyer Pool
Section 3.3 already established that a whitelist reduces market depth. What matters in stress is the mechanics. The BIS finds that allow-listing "restricts TMMF liquidity, limiting their wider use for margining. It also fragments the blockchain environment into controlled and uncontrolled compartments"17. The FSB adds that permissioned platforms "may limit the development of deep and liquid secondary markets"18.
The live exits show who decides who may buy. BUIDL's decentralized exchange route is a quote service on UniswapX, where prices come from "whitelisted subscribers (including Flowdesk, Tokka Labs, and Wintermute)" and every investor using it is "pre-qualified and whitelisted through Securitize"24. On Aave Horizon, supplying RWA collateral "is exclusively for users who have been qualified and allowlisted by the specific relevant RWA's issuer"25. Midas's proposal to list its mWIN token there is explicit about the other side of a liquidation: "Liquidators must be allowlisted at the token level to receive mWIN collateral. Horizon does not select or whitelist liquidators; eligibility is controlled by the issuer"14. On Horizon, when collateral has to be sold, the issuer of the collateral chooses who is allowed to buy it.
Chains divide the pool again. The FSB warns that a lack of fungibility between tokens and their reference assets "could create fragmentation of liquidity and divergence in pricing"18. The ECB describes assets that "circulate within siloed networks, requiring users to hold the settlement asset native to the same DLT network to purchase tokens"3. Section 4.2 counted ten network entries for BUIDL alone. Each deployment is its own buyer pool, and a holder on one chain cannot sell to a buyer on another without a bridge or the issuer. These are the structural obstacles IOSCO named in Section 3.1, interoperability and settlement assets, read as liquidity risk. Geofencing by jurisdiction splits the pool a third time, and Section 5.6 takes that up.
Pool Depth Is Not Market Depth
Decentralized finance offers another answer to the missing buyer: a pool that is always there. IOSCO records the claim that automated market makers "can ensure liquidity is always available to traders", while noting that their use "has yet to be widely observed in current tokenization initiatives"1. Bank of Canada and Ontario Securities Commission staff research treats total value locked as "a key measure of liquidity for AMMs", and warns that "Fragmented and low liquidity in certain AMM pools can cause mispricing issues to persist or worsen"26.
The pools that exist are small against the tokens they would have to absorb. DefiLlama's pool data for 28 September 2026 lists no automated market maker pool holding BlackRock's BUIDL at all27. USDY, at $2.28 billion outstanding28, sat in three exchange pools worth $4.36 million together, about 0.2% of its value27. Maple's syrupUSDC had about $277 million supplied to lending markets against about $17 million across every exchange pool DefiLlama lists for it, $14.5 million of that in the two largest, by this paper's sum of DefiLlama's data27. Pool value counts both sides of each pair, so the stablecoin side available to absorb a sale is roughly half.
So when a lending market has to liquidate RWA collateral, the pool is not where the collateral goes. Midas's proposal states that "The expected liquidation route is for liquidators to use standard redemptions, as indicated by liquidators themselves", backed by issuer capacity of "$10M per day" cycled through T+1 redemptions14. The DeFi exit collapses back onto the issuer's redemption channel and inherits its capacity. The FSB warns that automatic liquidation of under-collateralised tokenized collateral "could have an impact on the underlying reference assets, possibly causing runs on reference asset markets"18. Borrowing against that collateral, and looping it, is Section 5.3's subject.
The nearest measured case of a Treasury-backed token repricing sharply in secondary markets because of its exit terms is a DeFi wrapper, a crypto-native analogue rather than a fund. USD0++ represents USD0 "locked until maturity (June 30, 2028)"29, and USD0 is a stablecoin whose listed collateral includes Hashnote's USYC, which Usual describes as "a tokenized fund investing in reverse repos and US Government securities"30. In January 2025 Usual introduced an early-exit path with a 0.87 USD0 floor price. USD0++ fell from $1 to $0.915 on decentralized exchanges and its largest Curve pool swung to a 92% imbalance31; Usual itself reported residual pool liquidity "below 20 million USD0" amid "significant sell-offs and liquidity withdrawals"29. The collateral did not change. The exit terms and the pool did, and the price followed them.
Who Is Responsible for the Exit?
Fund liquidity rules bind the fund. Nothing in them, by default, makes anyone responsible for the token's secondary market, and Franklin's prospectus disclaims the role outright4. ESMA attributes thin order books on its pilot infrastructures partly to "the limited onboarding of professional liquidity providers"2. The ECB concludes that "Market-makers would still be needed to ensure liquidity"3.
Hong Kong's Securities and Futures Commission has written the first framework aimed at this risk. Its circular of 20 April 2026 asks product providers to "use their best endeavours to arrange that each Tokenised Product has at least one market maker", with at least one giving "not less than three months' notice" before withdrawing32. Licensed trading platforms should alert investors when a price "would deviate significantly from the product's real-time or near real-time indicative net asset value", and tell them that "they may choose to subscribe or redeem at NAV"32. Offering documents should disclose "potentially very thin trading and large premium/discount to NAV, particularly outside normal operating hours of the Hong Kong financial market and during weekends"32. The circular's examples of contingency planning include "whether trading halt in secondary market for Tokenised Products is needed when primary dealing is suspended", and providers should alert the SFC on "receipt of any resignation notice of the last market maker"32. As of the SFC's quarterly report for April to June 2026, the initial batch of products was still "expected to focus on tokenised money market funds"33, so the framework has not yet been tested in stress.
The regulatory questions this leaves are the ones Chapter 6 inherits. Must a token's advertised liquidity match the redemption terms of what it holds? Whose liquidity-management rules govern a token that wraps a fund, the fund regulator's or the trading venue's? And who, if anyone, must stand behind a secondary market that tokenization makes technically possible but does not populate? Before that, Section 5.5 turns from the market around the token to the code inside it. The redemption contracts, pause functions, and allowlists described here are all smart contracts, and smart contracts fail in their own ways.
- Tokenized assets move easily and trade rarely. ESMA reported no secondary transactions in the first seven months of CSD Prague's DLT settlement system, and Franklin Templeton's prospectus states that peer-to-peer transfers "do not constitute a public trading market". BUIDL had 24 active addresses among 107 holders in the 30 days to 28 September 2026.
- Every exit has a capacity. OUSG's instant redemption is capped at $50 million a day across all investors, about 16% of its value; Maple's withdrawals queue for up to 30 days; the ERC-7540 standard for asynchronous vaults sets no fulfilment deadline; issuers reserve the right to suspend or pause.
- The FSB and BIS name the core risk as a token more liquid than what it holds, and FSB and IOSCO fund rules already say redemption terms should follow asset liquidity. Apollo Diversified Credit Fund, the master behind the ACRED token launched with daily-NAV redemptions, prorated its May and August 2026 repurchase offers at about 35% and 27% of shares tendered.
- Public ledgers speed runs up. The BIS finds that visible redemptions act as "a coordination device among investors", the FSB and ECB warn of weekend token runs ending in fire sales when markets reopen, and JTRSY's 60.83% fall in 30 days with 32 holders shows how few holders it takes to produce a run-sized flow. Discounts to NAV remain anticipated rather than measured.
- DeFi depth is thinner than it looks. DefiLlama lists no AMM pool for BUIDL, syrupUSDC had about $277 million in lending markets against about $17 million in exchange pools, and RWA collateral liquidations route back to issuer redemption through issuer-allowlisted liquidators. Hong Kong's SFC now expects market makers, price-deviation alerts, and disclosure of "potentially very thin trading and large premium/discount to NAV".