What is Herstatt risk? FX settlement risk, PvP, and what real-time settlement changes

Herstatt risk is the risk that you pay your side of a foreign exchange trade and never receive the other side. The two currencies settle at different times, so one party pays first and trusts the other to follow. The BIS counted more than $1.4 trillion a day of FX settlement still fully exposed to it in April 2025. Faster settlement shortens the window. BlindPay's payouts cut it from days to minutes on instant rails.

Key takeaways

• Herstatt risk is principal risk: the full amount you paid, not a price move. It comes from settling two currencies at different times.
• Payment versus payment (PvP) removes it by releasing both currencies together or not at all. CLS does this in 18 currencies.
• In April 2025, 36% of average daily FX settlement used PvP, 54% used methods that only reduce the risk, and 10% was fully exposed, according to the BIS.
• Instant rails and stablecoins shorten the exposure window from days to minutes. They don't make a stablecoin-to-bank payout atomic.
• In a stablecoin payout, ask what happens during the window: who holds the funds, how long holds last, and what gets refunded automatically.

What is Herstatt risk?

Herstatt risk is FX settlement risk: the chance that one party to a currency trade delivers the currency it owes and the counterparty doesn't deliver in return. The BIS defines FX settlement risk as "the risk that one party in a currency trade fails to deliver the currency owed."

It exists because an FX trade has two legs in two currencies. Each leg settles in its own country's payment system, on its own hours. If the dollar leg and the peso leg can't settle at the same instant, someone pays first.

The loss is the whole principal. If you sold $1 million for euros, paid the dollars, and the euros never came, you lost $1 million, not the 2% the rate moved that week. That is what makes it different from market risk.

What happened at Bankhaus Herstatt in 1974?

On June 26, 1974, German supervisors closed Bankhaus Herstatt in the middle of the German business day, after heavy losses on speculative currency positions. Its counterparties had already paid it Deutsche marks. The dollars it owed them, due in New York later that day, never arrived.

The European Central Bank's account of the case lays out the timing. Herstatt had already received, through the German payment system, the marks it bought. Because of the time zone gap, it had not yet delivered the dollars it sold. Several institutions took losses, and the US CHIPS system closed for 24 hours.

Before Herstatt, the ECB notes, banks thought their FX risk was limited to market moves. After it, they knew they faced principal risk. The failure was one of the disturbances that led G10 central bank governors to set up what became the Basel Committee on Banking Supervision at the end of 1974.

Why does an FX trade expose the full principal?

Because the two legs settle on different systems at different times, and nothing ties one payment to the other. Your payment becomes final in your currency's system whether or not the counterparty's payment ever happens.

The exposure window runs from the moment your payment can no longer be recalled until you confirm the other currency has arrived. Three things stretch it:

1. Time zones. Asian currencies settle before European ones, and European ones before the dollar. Whoever pays the earlier currency waits.
2. Cut-offs and banking hours. If the second leg misses its cut-off, it settles the next business day. A Friday trade can wait for Monday.
3. Reconciliation. Many firms don't know the other leg arrived until they match statements, often hours after the money actually landed.

Correspondent banking adds a further layer. The payment you sent passes through one or more intermediary banks before it reaches the counterparty, and each one is a point where it can be held. Why cross-border payments are slow walks through those hops.

How do PvP and CLS remove FX settlement risk?

Payment versus payment (PvP) links the two legs: the first currency is released only if the second is released too. If either side can't pay, neither leg settles, and nobody loses principal.

CLS is the main PvP system for FX. It launched in 2002, and the BIS describes it as providing PvP in 18 currencies. Members pay in to CLS through the central bank settlement systems of each currency, and CLS releases both legs of each trade together.

The limit is coverage. A trade settles through CLS only if both currencies are eligible and both parties have access. The BIS's June 2026 Quarterly Review article found that only 12% of trades in non-CLS-eligible currency pairs settled through other PvP systems, against 40% for CLS-eligible pairs. When firms settled gross instead, the top reasons were that the counterparty had no PvP access, the trade type wasn't eligible, or the currency pair wasn't eligible.

How much FX settlement is still exposed in 2026?

About a tenth of it, measured in the most recent data. The BIS used the 2025 Triennial Survey to break down how roughly $14 trillion of daily FX obligations settled in April 2025.

Source: BIS Quarterly Review, June 2026, "Uncovering FX settlement risk: new measures from the 2025 BIS Triennial Survey".

Who is most exposed? Not the big dealers trading with each other. The BIS found gross bilateral settlement made up 22% of obligations with non-financial customers, 19% with other financial institutions, and 11% between external dealers. An earlier BIS study of April 2022 data found the risk concentrated in emerging market currencies against the US dollar, many of which CLS doesn't cover.

That describes a business paying suppliers in Brazilian reais, Colombian pesos, or Argentine pesos. None of the three is among the 18 CLS currencies (the Mexican peso is), and a company paying a supplier rarely has PvP access anyway. The protection large banks rely on mostly isn't there.

How do real-time rails and stablecoins change the exposure window?

They shorten it. Herstatt risk is a timing problem, and a payment that settles in seconds leaves far less time for a counterparty to fail between the two legs.

Two separate things help:

• Instant local rails. Pix in Brazil and SPEI in Mexico run 24/7 and credit the recipient in seconds to minutes. The local currency leg no longer waits for a banking day.
• Stablecoin settlement. A stablecoin such as USDC or USDT moves on a blockchain and reaches finality in seconds to minutes on most payment networks, at any hour. The dollar leg no longer waits for New York to open.

The window shrinks; it doesn't close. When one leg is a token and the other is a bank deposit in reais, the two can't settle in the same instant. A smart contract can swap two tokens on the same chain atomically, which is PvP by construction. A Pix credit lives in Brazil's central bank system, outside any blockchain, so a stablecoin-to-bank payout still has an order: one leg first, the other after.

Where does Herstatt-style risk remain in a stablecoin payout?

In the gap between the stablecoin leaving your wallet and the local currency reaching the recipient. In that gap you've paid, and the provider is your counterparty until the fiat lands.

Here is how that gap looks in a BlindPay payout, from the payouts docs:

1. Quote. Rate and fees lock for five minutes. Nothing has moved, so nothing is at risk.
2. Stablecoins pulled. The quoted amount leaves the funding wallet and settles on-chain. From here your leg is done.
3. Review, on some rails. ACH, wire, and RTP payouts pass through on_hold for compliance review after the stablecoins are collected. SWIFT payouts start on_hold until documents are approved. Holds can last up to 30 days.
4. Fiat sent. Pix and SPEI land in minutes. ACH, TED, ACH Colombia, and SEPA take about one to two business days. SWIFT (POBO/COBO) can take up to five.
5. Completed, refunded, or failed. A refunded payout returns the stablecoins to the funding source. A failed payout isn't refunded automatically.

Automatic refunds have a scope worth knowing. When a payout can't be delivered after the stablecoins are collected, Pix and other non-USD local rail payouts are refunded automatically, while USD payouts, and payouts whose review times out, are refunded after an operator review. Read stablecoin payout statuses explained before you build your own retry logic.

Two habits keep the exposure small:

• Use instant rails where they exist. A Pix or SPEI payout keeps the window at minutes. A Friday SEPA payout can sit until Monday, and cut-off times by rail shows where that happens.
• Fund at send time. Don't park a balance with any provider ahead of time. Approve exactly the quoted amount, so the most you can have outstanding is the payout in flight.

How long is the exposure window on a $50,000 payment?

This example uses round, illustrative numbers. It isn't a quote.

A US company owes a supplier in São Paulo the reais equivalent of $50,000. It pays on a Friday afternoon, New York time.

By correspondent wire. The company's bank debits $50,000 on Friday. The wire misses the day's cut-off at an intermediary bank, waits for Monday, and the Brazilian bank converts and credits reais on Tuesday. For about four calendar days, $50,000 is somewhere in a chain of banks, and the company has no claim on any of them until something goes wrong.

By stablecoin payout over Pix. The company quotes the payout, approves the USDC amount, and creates the payout. The USDC settles on-chain in seconds, and the reais arrive over Pix in minutes, even on a Friday evening. The company's exposure is to one regulated provider for minutes, and it can track each step through webhooks.

Neither route is PvP. The difference is the size of the window: four days across several banks, or minutes with one counterparty you chose.

What should treasury and payments teams ask a provider?

Ask about the window, not only the price. Five questions cover it:

1. In what order do the two legs settle, and when does my payment become irrevocable?
2. Who holds the funds between the legs, and are they held in my name or the provider's?
3. Which payouts go to compliance review after my funds are collected, and for how long?
4. If the fiat leg fails, which cases are refunded automatically, and in what form?
5. Do you need me to pre-fund a balance, which turns a minutes-long window into a standing exposure?

Custodial vs non-custodial off-ramps covers question 2 in depth, and what real-time cross-border settlement means defines the speed claims you'll hear in the answers.

How does BlindPay handle settlement timing?

BlindPay sequences the legs so the window stays short: the stablecoin leg settles first, then the local currency goes out over the fastest rail available for the corridor. Payouts reach bank accounts over Pix, SPEI, ACH, RTP, SEPA, Transfers 3.0, ACH Colombia, and SWIFT (POBO/COBO), from one API.

What that means in practice:

• Funded at send time. Payouts pull the quoted stablecoin amount from a wallet at execution, so no destination-currency balance sits with BlindPay ahead of time.
• Non-custodial when you fund from your own wallet. Until you approve the quoted amount, BlindPay can't move it. Managed wallets, a beta product, are BlindPay-custodied.
• Instant rails first. Pix, SPEI, and Transfers 3.0 settle in minutes and RTP instantly, according to the payment methods guide.
• Status at every step. Each payout reports processing, on_hold, completed, failed, or refunded, with webhooks on every change.

What to do next

Map the exposure window for your top corridor: when your funds leave, which rail delivers, and what happens if it fails. Then run a test payout on a free development instance with the payout quickstart and watch each status change.