Permissioned vs Permissionless Blockchains for Banks

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Neither is more secure by default. A permissioned ledger limits who validates and reads, but concentrates trust in its operators' keys. A public chain removes the operator but exposes data and code, and Basel still flags permissionless chains.

Watch: Permissioned vs Permissionless Blockchains for Banks 1:36

Video transcript

Is a permissioned or public blockchain more secure for a bank? Neither, by default. Each design moves trust somewhere different.

A permissioned ledger is only as safe as its operators and their keys. A public chain swaps the operator for many validators and economic penalties, but exposes your data and code.

On Ethereum, reverting a finalized block would cost an attacker at least one-third of all staked ETH. Other public chains may settle only probabilistically.

Permissioned risk sits with operator insiders and a few critical keys. On a public chain, whoever holds the token's mint, freeze and upgrade keys holds most of the risk.

Trust moves rather than disappears. On Canton, synchronizer operators cannot read your transactions. Your own validator is another matter.

Regulators test the network too. In December 2023, Basel flagged permissionless chains. A review is under way, with an update expected by year end.

Many projects now mix the two, like JPMorgan's JPMD token on Base, or DTCC on Canton and a private Besu network. Every bridge between ledgers needs its own threat model.

Start from the asset and its counterparties. If the answers point public, permission the token itself. If they point permissioned, treat operators as critical third parties.

Read the full article for the threat questions, or talk to Guardian about choosing your chain.

Banks putting assets onchain face one choice early: a permissioned ledger, or a public, permissionless chain.

Large institutions now use both. On October 28, 2026, DTCC said its Tokenization Service had gone live, integrated with the Canton Network and DTCC's private Besu network.

JPMorgan's Kinexys offers deposit accounts on its private blockchain and has worked in blockchain since 2015. In 2025 it launched a permissioned deposit token on Base, a public network, as a proof of concept.

This is a threat model, not a glossary: who you trust, what can go wrong, and how regulators treat each.

The Two Models

The difference is who may run a node, validate transactions and read the ledger.

	Permissioned	Permissionless
Who validates	Known, approved operators	Anyone who meets the protocol's rules, such as staking
Who reads	Approved participants, sometimes only the parties to a trade	Anyone
Who transacts	Onboarded participants	Anyone with a key, unless the token adds limits
Finality	Often immediate, by validator vote	Varies by chain; can be probabilistic
Example	Citi Token Services; DTCC's private Besu network	Ethereum

The line blurs in practice. Canton's docs call it "a public layer 1 blockchain designed for privacy-preserving transactions," where parties see only the data they are entitled to see.

And a permissioned token can live on a public chain. JPMorgan calls JPMD a "permissioned deposit token," and runs it on Base, an Ethereum layer 2.

Trust Assumptions

Permissioned: you trust the operators

A permissioned network is as safe as its operators and their keys. The validator set is small and known.

Hyperledger Besu's proof of authority protocols, QBFT and IBFT 2.0, have "immediate finality," per its docs. They need at least two-thirds of validators running to create blocks.

A network of four validators tolerates one unresponsive node. A small set means few keys to protect, and few to steal.

Permissionless: you trust the economics

A public chain replaces the operator with a large validator set and economic penalties.

On Ethereum, checkpoints are finalized through votes backed by two-thirds of staked ETH. Reverting a finalized block would cost an attacker at least one-third of all staked ETH, ethereum.org says.

Not every public chain works that way. The US banking agencies' 2025 safekeeping statement notes that settlement on permissionless chains "can be probabilistic."

Our finality comparison by chain shows what final means on each.

Threats Unique to Each

Threat	Permissioned	Permissionless
Validator compromise	Few keys; operator insiders	Needs a large share of stake
Governance	The operator can change rules or exclude you	Upgrades and forks outside your control
Privacy	Leaks through nodes and operators	Every transaction is public
Keys	Node, admin and permissioning keys	Wallet and token admin keys
Availability	Two-thirds of a few nodes must run	Outages and stalls you cannot fix
Counterparties	Known and onboarded	Anyone can send to your address
Interoperability	Links to other ledgers	Bridges and wrapped assets

Canton shows how trust moves rather than disappears. Its docs say synchronizer operators cannot read or forge your transactions, though they could delay them.

Your own validator is another matter: it "sees all your data and could block you." See our Canton Network security guide.

On a public chain, the token contract becomes the control point. Whoever holds its mint, pause, freeze and upgrade keys holds most of the risk.

Regulatory Treatment

Basel's cryptoasset standard, SCO60, tests the network as well as the asset. For Group 1 status:

All transactions and participants must be traceable (SCO60.17).
Key network elements include the degree of access, restricted or unrestricted.
Node validators may meet "appropriate risk management standards" instead of being regulated (SCO60.19).

In December 2023, the Committee said cryptoassets on permissionless blockchains "create risks that cannot be sufficiently mitigated at present." It kept the existing treatment.

On October 1, 2026, it said it is reviewing targeted elements of the standard and expects an update by the end of the year. Our Basel explainer tracks the review.

In the US, the agencies' 2025 statement says customer agreements may address "probabilistic settlement that may be characteristic of permissionless blockchains."

It also says banks should oversee the smart contracts that custodied assets depend on "throughout their life cycle."

Hybrid Designs

Many bank projects now mix the two. Three patterns stand out:

Permissioned token, public chain: JPMD on Base, eventually for JPMorgan institutional clients only.
Several networks at once: DTCC's service on Canton and its private Besu network, with more networks planned for 2027.
A public network with private data: Canton, where parties see only the data they are entitled to see.

Hybrids add a seam: the link between ledgers. Every bridge, interoperability service and mirrored record needs its own threat model.

For how the choice plays out for bank money, see tokenized deposits vs stablecoins.

Decision Guide

Start from the asset and the counterparties, not the technology. Guardian's working questions:

Must counterparties outside your network hold or move the asset?
Can transaction details be public, or only seen by the parties?
Do you need final settlement in seconds?
Who may change the rules, and can they exclude you?
How many keys would an attacker need, and who holds them?
Which Basel group must the asset qualify for?
What happens to holders if the chain or operator stops?

Our recommendation: if the answers point public, put the permissioning in the token, with allowlists, scoped freeze powers and a timelocked upgrade path.

If they point permissioned, treat the operator and its validators as critical third parties, with diligence, monitoring and an exit plan.

How Guardian Helps

Guardian's institutional practice advises on target architecture: what goes onchain and what stays off it, which chain and why, and the custody and signing model.

Its counterparty review assesses the bridges, custodians, oracles and protocols you would depend on as concentrations of risk.

The Digital Asset Assurance Pilot offers five self-contained modules, from an architecture assessment to offchain pentests.

Frequently Asked Questions

What is the difference between a permissioned and a permissionless blockchain?

Who may validate, read and transact. A permissioned ledger admits only approved operators and participants. A permissionless chain lets anyone who meets the protocol's rules validate, and anyone with a key transact.

Can a bank use a public blockchain under Basel rules?

For Group 1 status, SCO60 requires a network where all transactions and participants are traceable. In December 2023 the Committee said cryptoassets on permissionless blockchains create risks that cannot be sufficiently mitigated at present. A review is under way.

Is Canton Network permissioned or public?

Canton's documentation calls it a public layer 1 blockchain designed for privacy-preserving transactions. Parties see only the data they are entitled to, and synchronizer operators cannot read transaction content.

Do permissioned blockchains settle faster?

Often. Hyperledger Besu's QBFT and IBFT 2.0 protocols have immediate finality. Ethereum finalizes checkpoints through votes from two-thirds of staked ETH, and US agencies note that settlement on permissionless chains can be probabilistic.

Sources

Choose your chain with a threat model

Guardian maps who you would trust on each network, which keys an attacker would need, and the controls to put in place before you commit.

Talk to Guardian Explore institutional security