India’s 18-month window: take leadership of tokenization while the rails are still being laid

India’s underrated advantage is its digital public infrastructure, the open-protocol stack based on its Aadhaar identity system; built on it, UPI records about 750 million daily transactions, more than Mastercard’s global swipes and enough to rival Visa’s. BlackRock chief Larry Fink has said the binding constraint on tokenization at scale is not technology but identity verification. India has solved this problem.

What we need is to bolt the digital rupee onto this DPI stack as the settlement leg of tokenized assets—what central bankers call atomic delivery-versus-payment. Hong Kong is doing this in Project Ensemble; Singapore in Project Guardian.

This is not just a capital-markets story. If Indian regulators coordinate efforts, an ordinary saver in Pune could hold a fraction of a tokenized government security (G-Sec) on her phone, settled in seconds against the digital rupee, with the same legal status as the dematerialized securities she already holds.

A small business owner in Surat could tokenize a future receivable, raise working capital from individual investors anywhere in India, and clear it through a regulated platform supervised by either Sebi or IFSCA.

Fink’s line about identity verification matters here too: an Aadhaar-anchored stack would let tokenized assets be acquired safely and traded at scale.

There is a second clock that almost no one outside cryptography labs is talking about. On 13 August 2024, the US National Institute of Standards and Technology (NIST) finalized the world’s first three post-quantum cryptographic standards (FIPS 203, 204 and 205), algorithms that are expected to replace elliptic-curve cryptography on banking, blockchain and government systems.

Four months later, Google’s Willow chip demonstrated quantum error correction at an engineering threshold that compresses the timeline from ‘decades away’ to ‘this decade’.

Today, intelligence services are already storing encrypted financial traffic on a ‘harvest now, decrypt later’ bet. Every tokenized-bond ledger, wholesale-CBDC signature and identity certificate has a cryptographic expiry date. The cheapest form of strategic insurance available to the Indian banking, financial services and insurance sector would be a joint RBI-Sebi-IFSCA post-quantum cryptography inventory and migration roadmap.

What to do in the next 18 months: Coordination looks like this. Three deliverables, each shipped before end-2027. First, RBI publishes a wholesale digital-rupee interoperability specification that Sebi’s tokenized-fund pilots and IFSCA’s tokenized-bond and bullion offerings can settle into without breaking the on-chain audit trail.

Second, Sebi and IFSCA publish a joint identity-and-disclosure framework for tokenized securities, anchored by the Aadhaar-DigiLocker stack.

Third, all three regulators publish a joint post-quantum cryptography migration roadmap by March 2027. Senior tech executives in Mumbai, Singapore or Bengaluru would have six to 12 months to make the same three commitments within their firms— before the rails harden under someone else’s standards.

The author is a senior banking technology executive based in Singapore.