Why Project Pigeon matters for every bank that wants to use a public blockchain

By Chia Hock Lai, Chairman, Responsible Fintech institute, Co-Chairman, Digital Assets Association

A carrier pigeon is an odd mascot for a financial-risk framework. But the more time I have spent on Project Pigeon, the more the name feels right.

For centuries, pigeons carried messages across open country that no one controlled. Nobody owned the sky. Nobody vetted the route. And yet the message arrived, because the people who used pigeons built a system around them: trained birds, secure lofts, coded messages, trusted handlers, and a way to know when something had gone wrong. The openness of the sky was never the problem. The absence of a system would have been.

That is exactly the situation banks face today with public, permissionless blockchains. The networks are open. Nobody controls them. And for most of the past few years, the regulatory answer to that openness has been a simple one: stay away.

Project Pigeon exists to build the system that makes the sky safe to use.

The problem we set out to solve

The story starts with a number: 1,250 per cent.

That is the risk weight the Basel Committee’s cryptoasset standard attached to any cryptoasset sitting on a permissionless blockchain. In plain terms, a bank had to hold a dollar of capital for every dollar of exposure. It did not matter whether the asset was a fully backed stablecoin or a tokenised government bond. If it lived on a public chain, it was treated as if it could vanish tomorrow.

When the Monetary Authority of Singapore first consulted on implementing this standard in March 2025, the industry pushed back hard, and not because anyone wanted a free pass. The objection was that the rule was not technology-neutral. It punished the choice of network rather than assessing the actual risk, and it ignored the real progress that had been made in monitoring, custody and settlement controls.

MAS listened. In April 2026, it published a second consultation paper, P009-2026, that changed the conversation. The proposal is principle-based: a cryptoasset on a permissionless blockchain is no longer automatically excluded from Group 1 treatment, the more favourable capital category, provided the bank can show that the risks arising from the permissionless network are adequately mitigated. MAS even made a version of this treatment available to Singapore banks during an interim period, subject to conditions, rather than waiting for the final rules.

This is a significant shift, and I want to give MAS credit for it. But it also moves the burden. The question is no longer “may a bank use a public blockchain?” It is “can a bank prove it has managed the risks of doing so?” And when the consultation closed in May, there was no shared, practical answer to that second question. Every institution would have to invent its own playbook, and every supervisor would have to assess each one from scratch.

That gap is where Project Pigeon comes in.

What Project Pigeon is

On 13 August 2026, four organisations formally launched Project Pigeon: A Working Group for Permissionless Blockchain Governance in APAC. The conveners are Elliptic, the Digital Assets Association, the Responsible Fintech Institute and Baker McKenzie Wong & Leow. Each brings a different discipline to the table, and that was by design. On-chain analytics, industry practice, governance research and law all have to sit in the same room for this to work.

Around that core sits a broader membership: banks, digital asset exchanges, crypto-native firms and established financial institutions from across the Asia-Pacific region. Regulatory bodies have been given observer and consulting roles, so that supervisors can see the work as it develops rather than being handed a finished document and asked to react.

The ambition is straightforward. We want a single, regional, industry-authored framework that a risk manager at a bank in Singapore, Hong Kong, Tokyo or Sydney can pick up and use to assess, control and evidence the risks of operating on a public blockchain. Not a manifesto. Not a white paper full of good intentions. A working document with a taxonomy, a catalogue of risk events, a set of controls and a way to test them.

Four pillars, four owners

We organised the work around the four risk areas that matter most to a prudential regulator, and we gave each one a named owner so that accountability is clear.

Governance risk, led by the Responsible Fintech Institute, deals with the question that unsettles most bank boards: who is actually in charge of a network that nobody owns? The workstream is looking at node and validator concentration, the transparency of protocol upgrade processes, and how an institution can hold itself accountable for decisions made by a community it does not control.

Technology risk, led by the Digital Assets Association. Public chains are extraordinarily resilient in some ways and surprisingly fragile in others. This workstream is cataloguing the concrete threats a bank must plan for: 51 per cent attacks, consensus failures, smart contract exploits, bridge compromises, client software bugs and the broader infrastructure risks that come with relying on nodes, RPC providers and key management systems the bank may not operate itself. For each, we are defining what “adequately mitigated” should look like in practice.

Settlement finality risk, led by Baker McKenzie, tackles a problem lawyers and technologists have been talking past each other on for years. Many public blockchains offer probabilistic finality, meaning a transaction becomes progressively harder to reverse rather than instantly final. Banking law and payment systems are built on deterministic finality. The workstream is mapping consensus mechanisms against legal requirements so that an institution can say, with confidence, at what point a transfer on a given network is legally done.

AML/CFT risk, led by Elliptic, addresses the concern that most often ends a conversation about public chains before it begins. Pseudonymous addresses, sanctions exposure, Travel Rule compliance and the interaction between financial crime controls and prudential capital are all in scope. The goal is to show that transparency on-chain, properly instrumented, can be a stronger control environment than the opaque correspondent banking chains it may replace.

How the work actually gets done

Industry working groups have a habit of producing a launch press release, a few enthusiastic meetings and then silence. We have tried to design against that.

Baker McKenzie serves as the secretariat, holding the pen on the documents, managing the governance process and coordinating engagement with regulators. The full group meets in plenary every two weeks. Each of the four workstreams holds its own focused sessions in between. A steering committee made up of the four conveners reviews progress monthly. And every quarter, we hold a formal checkpoint with the regulatory observers to test whether what we are building is the kind of thing a supervisor could actually rely on.

That last point matters more than any other. A framework that the industry loves but regulators cannot use is a wasted effort. A framework that regulators accept but banks find impractical will never leave the shelf. The only version worth writing is one both sides can stand behind.

What we will deliver

The output will be an industry guide, provisionally titled Pigeon Permissionless Blockchains, targeted for publication in the first quarter of 2027. It will set out an end-to-end risk management lifecycle: how to identify risks, how to assess them, what preventive and detective controls to put in place, how to test those controls, and how to manage and report issues when they arise. It will reference existing standards and regulatory guidance rather than reinventing them, so that a compliance team can slot it into frameworks they already operate.

Alongside the guide, we will publish a shorter regulatory briefing paper written specifically for supervisors across the region. Different audiences need different documents, and we would rather write two good ones than one compromise.

Why this is a regional project, not a Singapore one

Singapore happens to be where the catalyst appeared, and it is where the conveners are based. But the problem is not Singaporean. Every prudential regulator in Asia-Pacific is working through the same Basel standard and facing the same question from its banks. If each jurisdiction produces its own answer, we will end up with a patchwork that makes cross-border tokenised markets harder, not easier.

Project Pigeon is an attempt to get ahead of that fragmentation. By writing the framework with institutions and observers from across the region, we hope to give supervisors a common reference point, so that a control which satisfies one regulator has a reasonable chance of satisfying the next. That is good for banks, good for the technology providers who serve them, and ultimately good for the customers who will use these systems without ever knowing what chain they run on.

An invitation

The theme of this year’s Digital Assets Summit is programmable finance as the next layer of global markets. I believe that. But a layer only gets built if the institutions with balance sheets are allowed to stand on it, and they will only be allowed to if the risks are understood, controlled and evidenced to a standard supervisors trust.

That is unglamorous work. It involves taxonomies and control matrices and long arguments about what “finality” means. It will not trend on social media. It is also the work that decides whether the next decade of digital assets is built by regulated institutions or around them.

If you run risk, compliance, technology or legal at a financial institution in this region, we want you in the room. If you build infrastructure for those institutions, we want your expertise on what actually breaks. If you are a regulator, we want you watching, questioning and telling us where we have got it wrong. The working groups are open, and the public consultation phase will be your chance to shape the final guide before it is published.

The sky was never the problem. Let’s build the system.

Chia Hock Lai is Co-Chairman of the Digital Assets Association and Chairman of the Responsible Fintech Institute, two of the four convening organisations of Project Pigeon.