The Permission Layer
The hidden price inside the risk-free asset just came off zero, and the first signal is hiding in custody.
Ownership and usability separated between 2022 and 2026. The scarce reserve service is no longer safety alone. It is the right to use what you own when the system turns hostile, and almost no one is pricing it correctly.
By Shanaka Anslem Perera
June 23, 2026
On February 28, 2022, several hundred billion dollars stopped being usable in the only sense that matters to a reserve manager. No issuer defaulted. No payment was missed. No broad market closed. The United States Treasury published a directive, and in the time it took to read a single paragraph, a large portion of the foreign reserves of a Group of Twenty central bank became unusable to the people who owned them. The claims still existed. The records still pointed to the owner. But the legal and settlement perimeter through which those claims could be managed, transferred, pledged, or converted had turned against the holder. The Treasury’s own language was precise about the mechanism. It did not block the assets. It required United States persons to reject transactions involving them, unless exempt or authorized, which impaired practical usability while leaving formal title intact.
The markets have spent the years since filing that morning under familiar labels. The financial press called it sanctions. The reserve-management literature called it a diversification signal. The gold bugs called it the death of the dollar. Each label catches part of the event and misses the structure. Ownership and usability, fused inside a single sovereign claim for decades, came apart that day. And once two things thought to be one come apart, they can be priced separately.
For most of the postwar era a reserve asset carried at least seven services inside one instrument. It was liquid. It cleared as regulatory collateral. It stored duration. It was legally enforceable. It settled without friction. Every other reserve manager on earth accepted it. And it was politically neutral, which is to say the issuer would not switch it off because of who held it. Investors paid one price for the whole bundle and assumed the bundle could not be taken apart.
The bundle was always separable. It looked indivisible only because the same power supplied both the deepest safe asset in history and the settlement system those assets ran on. Neutrality looked like a property of the bond. Neutrality was a discretionary grant from the legal and settlement perimeter through which the claim had to move. The risk-free rate, the number from which every other asset on the planet is priced, carried a hidden term no model ever isolated, because for seventy years that term never moved. Call it the neutrality premium: the compensation an investor should demand for the risk that the administrator turns adversarial. From 1945 to 2022 the market treated it, by collective assumption, as zero.
It is not zero now. Working out what it actually is may be the most consequential problem in global macro for the next decade, and the institutions that solve it first will still be standing when the rest learn, one freeze at a time, that they owned a great deal and could use far less of it than they believed.
What Risk-Free Always Smuggled In
Ask a portfolio manager to name the risk in a Treasury bill and you will hear two answers. Default risk, negligible, because the issuer prints the currency the bill is denominated in. Duration risk, trivial on a three-month instrument. The bill is therefore risk-free. This is taught in every business school and wired into every pricing engine on every desk in the world.
The definition was always incomplete, and the missing piece was the most valuable hidden assumption in finance. Risk-free never meant only default-free. In practice, for a reserve manager, it also meant administrator-neutral. It meant that the parties standing between a holder and the use of an asset, the custodian, the clearer, the settlement system, the sanctions authority, would stay neutral toward that holder regardless of who the holder was. Default-free is a statement about the issuer’s solvency. Administrator-neutral is a statement about the issuer’s intentions. The first is a number. The second is a relationship, and a relationship can change.
The reason this is more than wordplay is structural. The issuer of the world’s safe asset is also the chief enforcement officer of the world’s payment system, and those two roles draw from the same well. The privilege of issuing the asset every central bank wants to hold, and the power to deny any particular holder the use of it, are expressions of one underlying trust. Each use of the enforcement power spends a little of the issuance privilege. Weaponizing the settlement layer is not free. It depletes the neutrality that made the asset worth holding, a slow self-cannibalizing trade that the issuer cannot stop making, because the same conflicts that make sanctions necessary are the ones that make the franchise valuable. This is a contradiction built into holding both roles at once, not a policy error better management could avoid.
The contradiction stayed dormant for decades because the enforcement power was used only against small economies whose reserves were a rounding error. Freezing the reserves of a smaller sanctioned state teaches the system less, because large reserve managers can treat the case as outside their reference class. Then the power was turned on the central bank of a Group of Twenty economy holding several hundred billion in the core reserve currencies, and every serious reserve committee now had reason to run the same calculation for the first time. If it can happen to them, under what conditions could it happen to me, and what is that risk worth.
That calculation is the neutrality premium waking up. A price dormant for seventy years had started to move, and prices that move after that long do not settle quietly back to zero.
The Legibility Event
February 2022 did not create the risk. It revealed it. The legal authority to immobilize a foreign central bank’s reserves existed long before anyone used it at scale. So did the custodial chokepoints through which the world’s reserves flow, and the dependency of every dollar reserve on a clearing relationship a sanctions order could sever. What did not exist before that month was common knowledge that the risk was real. After that month it became unavoidable in reserve-management discussions.
Economists have a word for this. It was a legibility event. The underlying state of the world held steady. The observability of that state changed, and observability is what gets priced. A risk everyone privately suspected but no one could point to becomes, the moment it is demonstrated, a risk that must appear in every committee memo and every allocation review. The freeze turned a tail scenario into a dated precedent, and a dated precedent cannot be un-known.
The anatomy matters more than the headline. The figure that circulated, roughly three hundred billion dollars, was always an order-of-magnitude estimate of Russian reserves held in Group of Seven currencies and jurisdictions. The official immobilized total was never cleanly disclosed, and its geography is the revealing part. The overwhelming majority sat not in the United States but in Europe, with somewhere between one hundred ninety and two hundred ten billion euros immobilized at a single securities depository in Belgium. The amount frozen directly inside the United States was on the order of five billion dollars. The lesson a watching reserve manager drew was not about America. It was structural. An asset does not have to sit inside the sanctioning country to be reachable. It has to sit inside the sanctioning country’s settlement perimeter, and that perimeter is wider than the border.
That distinction is the seed of everything that follows. If usability depends not on where an asset sits but on whose plumbing it cannot avoid, the entire global stock of reserves can be sorted along an axis no pricing model has a column for. Not credit quality. Not liquidity. Reachability. The degree to which a claim, owned outright, can be impaired by an authority whose plumbing it depends on. Sort assets along that axis and you have a spread. Build a spread and you can ask whether the market pays for it.
Proof, Permission, Throughput
The usability of an asset under adversarial conditions is not one property. It is the product of three, and the three are in tension. This is the frame that holds the rest together, and it survives long after the specific events fade.
The first is proof: the ability to demonstrate, without relying on anyone’s discretionary goodwill, that the asset exists and is yours. An allocated bar with a serial number in a vault you control has high proof. An unallocated paper claim on a pool of metal, which is really an unsecured promise from a bullion bank, has low proof, because under stress what you own is a line in someone else’s ledger.
The second is permission: the inverse of an administrator’s capacity to freeze, censor, burn, or revoke. Permission approaches its maximum when no single party holds the legal or technical authority to deny you the asset, and it falls to zero the moment a freeze order, a blacklist function, or an export licence stands between you and your own property.
The third is throughput: the velocity, depth, and operational bandwidth with which a claim can be moved, settled, pledged, or converted at scale when you need it. An asset can be perfectly provable and perfectly unfreezable and still be useless in a crisis if you cannot mobilize it fast enough or large enough to matter.
Nearly every public discussion of safe havens assumes an asset can maximize all three. It cannot. The three form a constrained boundary, and every asset class on earth sacrifices at least one to optimize the other two. This is the usable-control trilemma, and once it is visible it cannot be unseen in any reserve portfolio.
Run the three canonical assets through it. United States Treasuries maximize throughput and proof. They are the most liquid, most verifiable financial instrument ever built, settling in size through a system the whole world recognizes. What they sacrifice is permission. Their usability is wholly contingent on the issuer’s legal architecture, so for a sanctioned holder it collapses overnight, as it did in February 2022. Onshore physical gold, vaulted at home under sovereign control, inverts the trade. It maximizes proof and permission, since no foreign administrator can freeze a bar sitting in your own capital. What it sacrifices is throughput, because gold in a domestic vault is slow and costly to mobilize, and under acute stress that slowness becomes a binding constraint rather than a footnote. Regulated stablecoins, the supposed cryptographic escape, maximize throughput and a form of proof while surrendering permission so completely that the surrender is written into the source code, because the issuer holds a key that can render any holder’s balance inert on a lawful order.
Three assets. Three different sacrificed vectors. No asset on the boundary escapes the trade. The reserve manager who believes she is choosing between safe and risky is choosing which of the three usability dimensions to give up, and most have never named the choice they are making.
A fuller model would add two more dimensions. Convertibility, whether the asset can be turned into the currency, collateral, fuel, chips, insurance, or legal recognition actually needed in the crisis. And recourse, because once a claim is frozen its value depends on recovery time, not only on legal title. The first-order trilemma is enough for the argument that follows. Proof, permission, and throughput cannot all be maximized at once.
The whole repricing now underway, across reserves, custody, payments, and physical supply chains, is the market discovering that these three dimensions have come apart and must be priced one at a time. The bundle is unbundling. And the scarce thing in the new regime is not safety, which is still abundant, but neutrality, which has become rare.
The free preview ends here.
What follows is the full mechanism. Why the gold story is a statistical mirage, and where the real signal lives. The throughput trap that turns the safest asset into a liability at the worst possible moment. The rival explanation this entire thesis has to defeat before it can be called alpha, and the single test that would kill it. The timeline the market is mispricing right now. And the allocator’s playbook for a world where every asset carries a hidden tag of who can switch it off.
If you manage reserves, run a macro book, sit on an investment committee, or advise anyone who does, this is the framework to read before the next allocation review, not after.
The Gold Mirage
The cleanest test of whether anyone understands this regime is what they believe about gold.
