Real-world asset tokenization – the process of representing ownership or economic rights in a physical or financial asset as a digital token on a blockchain – is moving from pilot projects to live capital-markets infrastructure. The legal question it raises is not whether the technology works. It is whether the token, the platform issuing it, and the protocol settling transfers are operating within the regulated perimeter in every jurisdiction where investors or counterparties sit.
Token classification is the threshold question, and it is answered by the substance of the rights the token confers, not by the label printed on the whitepaper. A token representing fractional ownership of a commercial real-estate portfolio is almost certainly a security in the United States under the SEC's long-standing analytical approach, a financial instrument under MiCA (the EU's Markets in Crypto-Assets Regulation) in one or more of its asset-referenced or other-crypto-asset categories, and a capital-markets product under the Singapore Payment Services Act regime administered by the Monetary Authority of Singapore (MAS). Each classification triggers a different licensing path, disclosure obligation, and – critically – a different set of secondary liabilities for the platform facilitating the transfer.
This guide maps the legal terrain: how regulators classify RWA tokens, which licensing and disclosure obligations attach, how the cross-border reality compounds the analysis, and where the common structural mistakes occur. It is written for the operator who already understands tokenization mechanics and needs the legal answer before committing to a product architecture.
What Is Real-world Asset Tokenization, and Why Does It Attract Regulatory Attention?
Real-world asset tokenization creates a digital representation – the token – of rights in an underlying asset. That asset can be a debt instrument, equity, real estate, a commodity, a revenue stream, a private fund interest, or infrastructure. The token may represent full ownership, a fractional interest, a secured claim, or a contractual right to income. The blockchain records title transfers; a smart contract (self-executing code that automates performance of defined conditions) handles settlement logic.
Regulators pay attention for a direct reason. When a token represents a financial interest in something of value and is sold to investors, every element of the classic investor-protection problem is present: information asymmetry, valuation difficulty, platform dependence, and cross-border mobility. The last factor is what distinguishes the RWA environment from traditional securities markets. A tokenized bond can be originated in Switzerland, distributed through a protocol running on nodes across the EU, purchased by a fund domiciled in Singapore, and settled against a stablecoin issued in the United States – in a single afternoon. No single regulator has visibility across the full chain. That regulatory gap is precisely where enforcement risk accumulates.
In our cross-border practice, the most persistent structural error we observe is an issuer that classifies the token correctly for its home jurisdiction and then assumes that classification travels. It does not. The securities laws of the investor's jurisdiction govern the offer to that investor, regardless of where the issuer is incorporated or where the smart contract is deployed.
How Do Regulators Classify RWA Tokens Across Key Regimes?
Token classification is a functional exercise: regulators ask what economic rights the token holder actually has, not what the issuer calls the token. The major regimes apply this substance-over-label principle consistently, though the specific outcomes and thresholds differ.
Under MiCA, tokens are placed into one of three primary categories: asset-referenced tokens (ARTs), e-money tokens (EMTs), and a residual "other crypto-assets" category. A tokenized real-estate fund share that references a basket of property values and offers holders a redemption right could be analyzed as an ART, but it could equally fall outside MiCA's scope entirely if it qualifies as a financial instrument under MiFID II – in which case MiCA explicitly does not apply, and the issuer must instead comply with prospectus, MiFID II, and AIFMD obligations as relevant. The boundary between MiCA and MiFID II is the most consequential classification question in the EU right now, and ESMA (the European Securities and Markets Authority) has published guidance acknowledging the ambiguity.
In the United States, the SEC applies the Howey test: an instrument is a security if it involves an investment of money in a common enterprise with an expectation of profits primarily from the efforts of others. Most RWA tokens – where holders depend on a manager, issuer, or protocol team to generate value – satisfy this test. The consequence is not merely registration: it is that every secondary transfer on a VASP (virtual asset service provider) platform may be an unregistered broker-dealer or exchange transaction unless the platform itself is registered or relies on an exemption.
Under Singapore's Payment Services Act and the Securities and Futures Act, MAS distinguishes between digital payment tokens (outside the securities perimeter) and capital-markets products (inside it). A tokenized bond or collective investment scheme unit is a capital-markets product. Distribution to Singapore investors without the relevant regulatory approval exposes both the issuer and the distributor to liability under Singapore law.
VARA in Dubai applies activity-based licensing. If a platform facilitates the trading, custody, or transfer of tokenized assets that VARA considers virtual assets, the full suite of applicable VARA rulebooks – advisory, broker-dealer, exchange, custody – attach. ADGM's FSRA within Abu Dhabi applies a parallel framework with a "recognised virtual assets" list concept that affects which tokens can be offered through FSRA-regulated firms.
When Does RWA Tokenization Trigger a Licensing Obligation?
Licensing is triggered the moment a platform performs a regulated activity in connection with an RWA token – and the scope of "regulated activity" is wider than most issuers anticipate. The question is not only whether the issuer itself needs a licence. It extends to every intermediary in the distribution and settlement chain.
Consider a straightforward architecture: an issuer creates a tokenized private-credit fund; a protocol routes secondary liquidity; a custodian holds the underlying notes; a stablecoin handles settlement; investors connect via a wallet app. At minimum, the following licensing questions arise simultaneously:
- Does the issuer's public or private offer require prospectus registration, an AIF manager authorisation, or a CASP authorisation under MiCA (or equivalent)?
- Does the protocol providing secondary liquidity constitute an exchange or multilateral trading facility in any jurisdiction where its users are located?
- Does the custodian holding the digital tokens need a digital-asset custody licence separate from any licence it holds for the underlying traditional asset?
- Does the stablecoin used for settlement trigger EMT or ART obligations under MiCA, or a money-transmission licence in the US?
- Does the wallet app, if it facilitates orders, need a broker-dealer registration?
Each of these questions has a different answer in each jurisdiction, and the answers are not always consistent. We regularly advise operators who assumed a single EU CASP authorisation resolved their licensing position across the entire product stack – only to discover that the token itself, as a MiFID II financial instrument, requires a separate authorisation path that the CASP licence does not cover.
CTA #1
The licensing analysis above describes the standard path. Your facts – the asset class, the investor base, the settlement architecture – change the outcome materially. For a scoped assessment of your RWA product structure, contact OBOLUS at info@oboluslaw.com.
What Is the Cross-border Reality of RWA Tokenization?
The cross-border dimension of RWA tokenization is not a complication that sophisticated operators can engineer away – it is the defining characteristic of the product class. A token is mobile by design. The legal analysis must treat each jurisdiction where investors hold, trade, or receive income from the token as a potential point of regulatory exposure.
Three vectors generate the most cross-border friction in practice.
The first is the offer perimeter. Securities laws in most jurisdictions apply to any offer made to persons in that jurisdiction, regardless of where the offeror is based or where the token was issued. Geo-blocking is a partial mitigation, but regulators in England and Wales, the EU, Singapore, and the United States have each taken the position that a public blockchain protocol that is technically accessible is "making an offer" to persons in their territory absent affirmative steps to exclude those persons.
The second is the Travel Rule (the obligation, derived from FATF Recommendation 15, to pass originator and beneficiary data with a virtual asset transfer). As RWA tokens trade on secondary markets, each transfer between wallets triggers Travel Rule data obligations in any jurisdiction where either the sending or receiving VASP is licensed. For a globally distributed token, this means the compliance architecture must handle Travel Rule data flows across a large number of national implementations simultaneously.
The third is enforcement jurisdiction. When something goes wrong – an issuer misappropriates reserve assets, a protocol has a smart-contract exploit, a custodian becomes insolvent – investors will look for assets wherever they can be found, and they will bring claims in forums that are willing to assert jurisdiction over digital assets. England and Wales, the DIFC Courts in Dubai, Singapore, and Hong Kong each have well-developed jurisprudence recognising crypto assets as property capable of being frozen and traced. A cross-border RWA token dispute can and does draw on several of these forums simultaneously.
In a matter handled in recent months, a fund issuing tokenized credit instruments found its distribution restricted in a key target market not because of any deficiency in the token structure itself but because the intermediary facilitating secondary trades lacked the applicable licence in that market. Re-routing distribution through allied counsel and a properly licensed entity in the relevant jurisdiction resolved the issue – but the delay cost was significant.
Smart Contracts, DAO Structures, and Legal Enforceability
Smart contracts are the operational infrastructure of most RWA tokenization platforms, but their legal status as binding instruments varies by jurisdiction. In England and Wales, the Law Commission has concluded that smart contracts can constitute legally binding contracts under existing law. Singapore has reached a similar position. The United States does not have a uniform federal rule; enforceability depends on applicable state contract law and, for financial instruments, the overlay of securities or UCC frameworks.
The more consequential legal question is not whether the smart contract is enforceable but who is liable when it fails. Code audits reduce the probability of exploit, but they do not eliminate it, and they do not resolve the legal question of where loss falls when the code behaves as written but not as intended. In most legal systems, the answer depends on the relationship between the token holder and the issuing entity: if there is a prospectus, a subscription agreement, or a trust deed, the liability analysis starts there. If the token is "governance-only" with no contractual wrapper, the path to recovery for a token holder is considerably harder.
DAOs (decentralised autonomous organisations) present a related structural problem. A DAO that issues RWA tokens to investors may, depending on its governance structure and the rights attached to the tokens, constitute an unincorporated association, a general partnership, or a de facto investment fund in the jurisdictions where its token holders reside. In most jurisdictions, that creates joint and several liability exposure for token holders who participate in governance votes that direct protocol operations. Formal legal wrappers – a Marshall Islands DAO LLC, a Cayman foundation, a Swiss association – are used to address this, but the wrapper must be designed around the actual governance mechanics of the DAO, not applied as a cosmetic layer.
The common myth in this area is that a "governance token" label, or a DAO structure, eliminates the regulatory classification question. In our practice, we have assessed governance tokens that, when the full set of rights was analyzed, conferred a direct economic interest in protocol revenues. That is a securities analysis in virtually every major regime, regardless of what the token is called.
What Disclosure Obligations Apply to RWA Token Issuances?
Disclosure obligations for RWA token issuances follow the classification of the token. A security-equivalent token triggers the issuer's home jurisdiction's prospectus or offering-document regime – and, in parallel, the prospectus or private-placement exemption requirements of each jurisdiction where the offering is made.
Under MiCA, issuers of "other crypto-assets" (those that are not ARTs or EMTs and do not qualify as financial instruments) must publish a crypto-asset whitepaper that meets the content requirements set out in the regime and file it with the relevant national competent authority before the offer. The whitepaper is not a prospectus; it carries different liability standards and does not require prior regulatory approval for the residual "other" category. But it must be accurate, and it must contain specified information about the underlying asset, the rights conferred, the technology, and the risks.
Where the token is a financial instrument under MiFID II – as many RWA tokens will be – full prospectus or private-placement exemption discipline applies, ESMA's regulatory perimeter is engaged, and the MiCA whitepaper is not a substitute. Operators who file a MiCA whitepaper for a token that should have been subject to a prospectus have not reduced their regulatory exposure; they have created evidence that they were aware of the token's characteristics and chose the wrong disclosure path.
In Singapore, a prospectus is required for any public offer of capital-markets products unless an exemption applies (typically the private-placement exemption, which limits the offer to specified categories of accredited or institutional investors). MAS has been clear that the form of the instrument – a token – does not affect the applicability of these rules.
AML, KYC, and Travel Rule Compliance for RWA Platforms
AML and KYC obligations attach to RWA platforms as a function of their licensing position, not solely their choice to perform them. A VASP-licensed custodian holding tokenized-asset tokens must conduct customer due diligence on its depositors under the applicable AML framework in its home jurisdiction and under FATF Recommendation 15 principles. A platform that facilitates secondary trading of RWA tokens is, in most leading regimes, in the same position as a traditional securities exchange for AML purposes.
The Travel Rule – the FATF requirement that originator and beneficiary information accompany virtual asset transfers above a defined threshold – is particularly complex for RWA tokens. The threshold and specific data fields required vary by jurisdiction: the EU's TFR (Transfer of Funds Regulation) applies under MiCA; Singapore, Hong Kong, the United Kingdom, and the United States each have their own implementations. A transfer of tokenized fund units between two VASPs operating in different jurisdictions must satisfy the Travel Rule requirements of both.
Sunrise-period mismatches – where one jurisdiction has implemented the Travel Rule and the other has not – create practical compliance problems that operators are currently managing through technical solutions and contractual frameworks with counterpart VASPs. The most common mistake is assuming that Travel Rule compliance in the issuing jurisdiction exhausts the obligation. It does not. The obligation follows the transfer, not the issuer.
CTA #2
If a prior application for a VASP or platform licence stalled, or if a banking partner raised AML concerns about your RWA product structure, a structural review can identify the underlying issue and the route back. Write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.
What Are the Most Common Structural Mistakes in RWA Tokenization?
The most consequential mistakes in RWA tokenization are architectural – they are built into the product before the first token is issued, and they are expensive to unwind.
The first is token classification made by marketing, not by legal analysis. Naming a token a "utility token" or a "governance token" does not settle its regulatory classification. The classification follows from the rights the token confers. In our practice, we assess classification against the substance of those rights, the economic structure of the underlying asset, and the specific tests applied by each relevant regulator.
The second is designing the distribution architecture around a single jurisdiction's licence. An EU CASP authorisation is valuable and provides meaningful passporting across EU member states. It does not address the US, Singapore, Hong Kong, or the UAE. Operators who raise capital from investors across these markets without separate analysis of each market's offer rules create enforcement exposure that accumulates silently until it does not.
The third is treating the smart contract as the legal instrument. Smart contracts execute the mechanics of a transaction. They are not, in most legal systems, a substitute for a subscription agreement, a trust deed, or a prospectus. When a smart contract is the only instrument in the chain, token holders typically have no contractual path to recovery against the issuer in the event of loss. That is not a feature of the product design; it is a structural deficiency.
The fourth is ignoring the custody layer. Tokenized assets require custody of both the digital token and the underlying asset. These are separate regulated activities in most leading regimes. A custodian that holds the tokenized representation without a regulated link to the underlying asset custodian creates a settlement and insolvency risk that sophisticated institutional investors will not accept.
In a recent structuring matter, a fund manager preparing to launch a tokenized private-credit product brought us in during the technology build phase. The initial structure had a Cayman-incorporated issuer, a BVI-domiciled trustee holding the underlying notes, tokens issued directly to retail-facing wallets, and settlement in a major stablecoin. No VASP licence existed in any jurisdiction. We restructured the distribution to route through a properly licensed intermediary, added a subscription agreement with governing-law and dispute-resolution clauses, and advised on the prospectus exemption conditions applicable in each target market. The platform launched on a revised timeline – delayed by a matter of weeks – but on a legally sound architecture.
Which Operator Profile Needs Which Legal Structure?
The appropriate legal structure for an RWA tokenization project depends on the asset class, the investor profile, the distribution geography, and the secondary-market ambitions of the platform. There is no single architecture that fits all profiles.
Profile A – Institutional private placement, no secondary market. An asset manager tokenizing a private-credit fund for distribution to fewer than a defined number of professional investors in each target jurisdiction. The tool is a private-placement exemption in each target market, a subscription agreement incorporating the token mechanics, a licensed custodian for both token and underlying asset, and Travel Rule-compliant KYC at the point of subscription. Regulatory authorisation for the issuer may not be required in every jurisdiction, but the analysis must be done market by market. Timeline depends on the number of jurisdictions and the custodian onboarding process; in our experience, the AML and custodian due diligence is the pacing item, typically measured in weeks to months.
Profile B – Retail-accessible tokenized securities platform, EU-primary. A platform seeking to offer tokenized equity or debt to retail investors across the EU. The token is a MiFID II financial instrument; MiCA's whitepaper route is not available. The issuer needs a prospectus (or a prospectus-equivalent document under an applicable exemption) and the platform needs a MiFID II authorisation or, if it fits within the MiCA CASP perimeter for secondary trading of crypto-assets that are not financial instruments, a CASP authorisation. If the token is a financial instrument, a CASP licence alone is insufficient. Timeline for a MiFID II authorisation varies by member state and by the NCA's processing queue; applicants should not assume a rapid outcome. A CASP authorisation in a member state with a more streamlined MiCA implementation is the more realistic near-term path for platforms where the financial-instrument classification can be avoided by design.
Profile C – Global DeFi protocol with RWA collateral. A protocol that accepts RWA tokens as collateral for lending or liquidity purposes, with token holders in multiple jurisdictions. This is the most legally complex profile. The protocol may be operating as an unregulated exchange, broker-dealer, or investment fund simultaneously in multiple jurisdictions. The DAO governance structure may expose token holders to joint liability. A formal legal wrapper – a foundation, an operating company, a limited partnership – must be interposed between the protocol and its users. The choice of wrapper depends on where governance participants and investors are located, and allied counsel in the relevant jurisdiction will need to validate the structure locally.
A Common Assumption That Creates Legal Risk
A common assumption among token issuers is that attaching a utility label to a whitepaper settles the legal classification of the token. It does not. Regulators – and courts – look at the substance of the rights the token confers, the economic structure of the underlying arrangement, and the reasonable expectations of purchasers at the time of sale.
In the EU, ESMA has been explicit that the label in a whitepaper does not determine whether a crypto-asset qualifies as a financial instrument under MiFID II. In the US, the SEC has consistently taken the position that economic substance governs, not nomenclature. In Singapore, MAS applies the same substance-over-form analysis. A token that pays holders a share of protocol revenues, that provides governance rights over a treasury, or that represents a fractional interest in a real-estate portfolio will be classified according to those economic characteristics in every major regime.
The practical implication is that token classification must be performed before the whitepaper is drafted, not derived from it. The whitepaper documents the structure; it does not create it. We assess token classification against the applicable tests in each jurisdiction relevant to the planned distribution, with particular attention to the investor-protection rationale that underlies the securities laws – which is the same rationale that regulators apply when they re-examine a classification made by an issuer at launch.
Related Practices at OBOLUS
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – full-practice overview covering DeFi legal structuring, smart-contract review, and token issuance across jurisdictions.
- Smart Contract Legal Review in Singapore – how Singapore law treats smart contracts, enforceability analysis, and MAS-regulated platform implications.
- Tax Treatment of Tokens in Liechtenstein – token tax analysis under Liechtenstein's TVTG regime, a frequently used jurisdiction for RWA issuers seeking a predictable tax position.
FAQ
Can a DeFi protocol be regulated?
Yes. A DeFi protocol that performs regulated activities – facilitating exchange, providing custody, managing assets, or distributing securities – is subject to the regulatory regime of any jurisdiction where its users are located, regardless of whether the protocol is formally incorporated. Regulators in the EU, the US, Singapore, and the UAE have each taken enforcement action or issued guidance applying existing financial-services rules to DeFi protocols where the functional activity matches a regulated category. The absence of a central operator does not, by itself, remove the regulatory perimeter – it complicates the question of who bears the regulatory obligation.
What legal wrapper suits a DAO?
The appropriate legal wrapper for a DAO depends on its governance mechanics, the rights attached to its tokens, and where its participants are located. Commonly used structures include a Marshall Islands DAO LLC, a Cayman Islands foundation company, a Swiss association, and a BVI limited company. Each offers a different balance of liability insulation, governance flexibility, and tax treatment. A wrapper that is designed without reference to the actual on-chain governance structure – voting rights, treasury control, protocol upgrade authority – will not achieve the intended legal separation. The choice of wrapper must be validated against the specific jurisdictions where token holders and governance participants reside.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the legal relationship between the affected party and the deployer or issuer. Where a subscription agreement, prospectus, or other contractual instrument exists, the liability analysis starts with that document and the governing law it specifies. Where no off-chain instrument exists, liability may rest on tort principles, product liability frameworks, or – in the case of a DAO – on the governance participants who authorised the relevant deployment or upgrade. Code audits reduce the probability of failure but do not create a liability shield. Jurisdiction matters: English, Singapore, and Hong Kong courts have each demonstrated willingness to identify an identifiable defendant in blockchain disputes.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around every digital-asset structure. We assess token classification against the substance of the rights conferred, not the marketing label – a discipline that has become the baseline expectation of regulators in every major hub. Digital assets are the whole of our practice. To discuss your RWA project or token structure, contact info@oboluslaw.com.
By Roman Levitt, Technology and DeFi Counsel – advising on smart-contract architecture, token classification, and DeFi legal structuring across multiple regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.