Cross-chain bridges – protocols that lock assets on one distributed ledger and mint representative tokens on another – sit at the intersection of smart contract law, securities regulation, and cross-border prudential oversight. For institutional clients, the legal exposure is not theoretical: a bridge transaction can trigger licensing obligations in multiple jurisdictions simultaneously, expose counterparties to unregistered-offering liability, and create custodial responsibility gaps that no single legal regime has yet fully resolved. This page maps the regulated perimeter, identifies the pressure points that matter most to treasury teams and general counsel, and explains how OBOLUS approaches the analysis.
The central legal question for any institution using or operating a cross-chain bridge is whether the bridge constitutes a regulated activity – and if so, under which regime, in which seat. The answer is almost never singular. A bridge wrapping tokenized securities for an EU-regulated fund interacts with MiCA (the EU Markets in Crypto-Assets Regulation, administered by ESMA and national competent authorities), the fund's home-jurisdiction financial-instruments rules, and the rules of every chain-layer through which assets move. Getting the perimeter wrong converts a settlement efficiency tool into an unlicensed financial service.
The sections below work through the regulated basis, the risk typology, practical process, cross-border conflict points, a decision matrix for common institutional profiles, and the common mistakes we see in practice.
What is the regulated perimeter for cross-chain bridges?
A cross-chain bridge is regulated – or not – based on the economic substance of what it does, not on what the protocol documentation calls it. Under most leading regimes, the key question is whether the bridge performs a regulated activity: custody, transfer, exchange, or issuance of a regulated instrument.
Under MiCA, a bridge that mints a representative token may constitute the issuance of a crypto-asset. If the underlying asset is a security or a fund unit, the representative token may itself be classified as a security, pulling the bridge into the scope of financial-instruments regulation rather than the crypto-specific regime. ESMA and national competent authorities have signaled that substance governs: a token granting economic rights equivalent to a share does not escape securities law because it is labeled a "bridge receipt."
In Singapore, the Monetary Authority of Singapore (MAS) applies the Payment Services Act to digital-payment-token services. A bridge that facilitates the transfer of a DPT between addresses – even if the locking and minting mechanics are automated – may constitute a DPT service requiring a licence under the major payment institution track. The MAS has consistently applied a functional test: if the economic effect is that a user transfers value, the regulatory perimeter is engaged.
In Hong Kong, the Securities and Futures Commission (SFC) takes a similar functional approach under the VASP licensing regime for virtual-asset trading platforms. A bridge that routes tokenized securities activates SFC oversight. Institutions using bridges for settlement of tokenized real-world assets in Hong Kong must confirm that neither the bridge operator nor the institution's own treasury function is performing a regulated activity without authorization.
The common thread across MiCA, MAS, and the SFC regime is that automation does not create a regulatory gap. A smart contract executing a bridge transaction is not exempt from regulation because no human pressed a button.
For institutional clients, mapping the perimeter before a bridge goes live – not after – is the only workable posture. We regularly advise treasury and legal teams at the pre-build stage specifically to avoid the cost of retroactive restructuring.
What are the primary legal risks for institutional users of cross-chain bridges?
Institutional bridge risk clusters into five categories: securities classification, custodial responsibility gaps, counterparty and operational liability, sanctions exposure, and smart-contract governance risk.
Securities classification is the most acute risk for token issuers and funds. Mis-classifying a bridge token as a utility instrument when it confers economic rights equivalent to a security can convert a product launch into an unregistered offering. The AUDIENCE_PAIN point here is real: the regulatory consequence is not a fine calibrated to the size of the breach – it is the potential unwinding of all distributions and significant civil liability to recipients. Under both the US federal securities regime (administered by the SEC and CFTC at the federal level, alongside state money-transmitter licensing) and MiCA's ART and EMT provisions, the classification analysis turns on the rights the token confers, not the label attached to it.
A common assumption in early institutional structuring is that a utility label on a whitepaper settles the legal classification. It does not. In our cross-border practice, we assess classification against the substance of rights – redemption, governance, economic participation – against the applicable test in each seat where the instrument will be held or traded.
Custodial responsibility gaps arise because bridge mechanics typically involve an intermediate state: assets are locked on the source chain but the representative token has not yet been minted, or has been minted but the lock transaction has not achieved finality. During this window, who holds the asset for regulatory purposes? Under most prudential regimes, including the FSRA regime in Abu Dhabi's ADGM and the VARA regime in Dubai, custody is a regulated activity requiring authorization and mandatory segregation obligations. An institution that holds bridge-transit assets for clients – even transiently – may be performing unauthorized custody.
Counterparty and operational liability attaches where a bridge exploit or failure causes loss. Cross-chain bridge exploits represent a significant category of digital-asset loss events. The legal question is not simply "who built the code" but whether the bridge operator, the institution sourcing the bridge, or an intermediary protocol owes a duty to the institution and its clients. Where bridge operations are governed by a DAO (decentralized autonomous organization) – a governance structure using on-chain voting rather than a traditional board – identifying the liable person is complex. OBOLUS addresses DAO liability in depth in our related practice on DAO structuring.
Sanctions exposure is material. Bridges that interact with privacy-enhanced protocols or that have been used by sanctioned persons create OFAC and equivalent-regime compliance exposure for any institution touching the same liquidity pool. The OFAC designation of Tornado Cash – a smart-contract-based mixer – established that US sanctions can attach to a smart contract address, not merely to a legal person. Institutions bridging through protocols with contaminated transaction histories face secondary-sanctions risk.
Smart-contract governance risk affects institutions that hold tokens giving them governance rights over a bridge protocol. Voting to approve an upgrade that subsequently causes a loss may create fiduciary-like exposure depending on the jurisdiction of the institution and the structure of the governance instrument.
How does the cross-border reality multiply bridge legal risk?
Cross-chain bridges are, by definition, multi-jurisdictional instruments. The source chain, the destination chain, the bridge operator's place of incorporation, the institution's home jurisdiction, and the jurisdiction of the end-user can all differ. Each layer activates a potential regulatory claim.
Consider a typical institutional setup: a fund regulated in the Cayman Islands under the CIMA regime uses a bridge to move tokenized Treasury bills from an Ethereum-based custody provider to a Solana-based DeFi settlement layer. The fund's manager is licensed by the FSRA in ADGM. The bridge operator is incorporated in the BVI under the VASP Act 2022. The bridge's governance token is traded on an exchange licensed by the SFC in Hong Kong.
In this structure, five regulatory regimes are simultaneously engaged. CIMA's rules govern the fund's own activities. The FSRA's requirements apply to the manager's use of unregulated counterparties. The BVI FSC's VASP Act applies to the bridge operator. The SFC's VATP licensing regime may be engaged by the trading of the governance token. And if any participant is a US person, SEC and FinCEN rules layer on top.
In our practice, the most common cross-border failure mode is not that an institution ignores any one regime – it is that the institution's legal function treats each regime in isolation. The regimes interact: a MiCA whitepaper that does not address the BVI operator's status creates a disclosure gap that national competent authorities are now actively reviewing. A VARA application that does not address the cross-chain nature of the product risks a return of the file for supplementary information, adding material time to the licensing timeline.
Banking is a second cross-border pressure point. Institutions bridging between chains frequently need to convert bridge output into fiat for treasury purposes. Banks in Singapore, the UAE, and Switzerland are increasingly requiring institutions to demonstrate that the source chain, the bridge protocol, and the destination chain have each been assessed for sanctions and AML compliance. An institution that cannot produce that documentation faces account closure or delayed settlement – outcomes with direct P&L consequences.
For a scoped cross-border bridge risk assessment, contact OBOLUS at info@oboluslaw.com. The process above describes the standard framework. Your entity type, the chains involved, and the jurisdictions of your users will change the analysis materially.
Does the Travel Rule apply to bridge transactions?
The Travel Rule – the obligation, derived from FATF Recommendation 15, to pass originator and beneficiary information alongside a virtual-asset transfer – applies to bridge transactions wherever the applicable national implementation covers the transaction type. The analysis is not straightforward.
A bridge transaction involves at minimum two on-chain events: the lock on the source chain and the mint on the destination chain. Whether each event independently triggers Travel Rule obligations depends on how the local regime defines a "transfer." Under MiCA, the EU Transfer of Funds Regulation as extended to crypto-assets applies. Under the MAS Payment Services Act regime, MAS guidance on DPT Travel Rule compliance is the reference point. Under the FCA's Money Laundering Regulations in the UK, the same principle applies.
The structural complication is the intermediate custodial state described above. If neither the bridge operator nor any participant classifies itself as a VASP (virtual asset service provider) – a common position taken by purely on-chain, non-custodial protocols – no one in the transaction chain is performing the Travel Rule data collection. This creates a compliance gap that regulators in the EU, Singapore, and Hong Kong are actively working to close.
Institutions that use bridges in a B2B context – moving assets on behalf of clients – cannot rely on a protocol's self-description as "non-custodial" to discharge their own Travel Rule obligations. If the institution itself qualifies as a VASP under the applicable regime, it must collect and transmit the required data for the whole transaction, including the bridge leg. We regularly advise compliance functions at custodians and fund administrators on Travel Rule architecture that covers multi-chain flows.
Who is liable when a smart contract bridge fails?
When a cross-chain bridge fails – through an exploit, a governance attack, or a code-level vulnerability – liability attaches based on legal relationships, not technical mechanics. The smart contract did not enter a contract; the parties to legal relationships around it did.
Liability analysis for institutional bridge failures typically runs across four potential defendants: the bridge protocol operator (if one exists), the auditors who certified the code, the institution that selected and deployed the bridge, and, in DAO-governed structures, the governance-token holders who approved the relevant code version. The weight assigned to each depends on the governing law of the relationship, the terms of any service agreement, and the forum where the claim is brought.
English courts – which have developed the most sophisticated body of crypto-asset law – treat digital assets as property and have recognized that loss caused by a smart contract exploit can ground a proprietary claim. The DIFC Courts in Dubai, building on their 2025 decisions in commercial crypto matters, have shown willingness to grant worldwide freezing orders in support of digital-asset claims. Singapore's High Court, in its 2022 decision recognizing a proprietary injunction over crypto, confirmed that the courts will intervene to protect institutional positions pending full trial.
For institutional clients, the practical implication is that liability is not an academic question to be addressed post-loss. It is a structuring question. The institution should, before using a bridge at scale, confirm: (1) that the bridge operator is an identified legal person capable of being sued; (2) that the governing law of any service agreement is a jurisdiction with a developed crypto-asset law body; and (3) that the institution's own use of the bridge does not expose it to claims from its clients that it failed to exercise due diligence in counterparty selection.
In a recent matter, a regulated asset manager deployed tokenized fund units across a cross-chain bridge and suffered a significant loss when a governance exploit drained the bridge's liquidity pool. OBOLUS was instructed to assess recovery options and to advise on the institution's duty to its own investors. Working with allied counsel in the relevant common-law forum, we identified the bridge operator's legal entity, assessed the viability of a disclosure order against the exchange where the attacker's proceeds appeared, and advised on the duty-to-notify timeline under the manager's own regulatory permissions. The matter is ongoing, but the early intervention preserved multiple recovery lines that would have closed within days.
Which institutional profile faces which bridge risk profile?
Not every institutional participant in a cross-chain bridge faces the same risk. The profile of the institution, the use case, and the chain environment together determine which risks are primary.
Profile A: Regulated fund using a bridge for cross-chain settlement of tokenized real-world assets. The primary risks are securities classification (is the wrapped token still a regulated instrument?), custodial-gap liability during the bridge transit, and Travel Rule compliance for the transfer leg. The applicable regimes are likely MiCA (if EU-domiciled or EU-distributed), the FSRA or VARA regime (if ADGM or Dubai-domiciled), and the SFC regime (if Hong Kong-distributed). Timeline for a full pre-deployment risk assessment: typically a matter of weeks, depending on the number of chains and jurisdictions involved. Key risk: the bridge operator has no identifiable legal entity, creating an unenforceable counterparty relationship if the bridge fails.
Profile B: Crypto exchange seeking to add cross-chain swap functionality for institutional clients. The primary risks are licensing scope (does cross-chain swap constitute a new regulated activity not covered by the existing VASP authorisation?), AML/Travel Rule architecture for the expanded transaction type, and governance-token exposure if the exchange holds bridge governance rights. The applicable regimes are those under which the exchange is already licensed – MiCA CASP authorisation, MAS Payment Services Act, BVI VASP Act – plus any new regimes engaged by the destination chains. Timeline and process depend on whether the home regulator requires a variation of permission or accepts a notification. Key risk: deploying first and notifying later – a sequence that regulators in Singapore and the EU consistently treat as a material breach.
Profile C: Treasury function at a Web3 company using bridges for operational liquidity management across chains. The primary risks are sanctions screening (does the bridge interact with flagged addresses or blacklisted contracts?), internal governance (does the treasury have board-level authority to use experimental bridge protocols?), and banking relationship risk (will the institution's banking partner treat bridge-sourced inflows as requiring enhanced due diligence?). The regulatory exposure here is often lower than for Profiles A and B, but the operational and banking risks are equally material. Key risk: the banking relationship is disrupted by an inability to produce source-of-funds documentation for bridge-output proceeds.
If your profile does not map cleanly to one of the above, the analysis requires bespoke assessment. To map the bridge, banking, and compliance stack for your build, write to us at info@oboluslaw.com.
What are the most common legal mistakes institutional clients make with cross-chain bridges?
Treating the bridge as a technical rather than a legal decision is the most consistent mistake we see. Bridge selection is a counterparty decision. It is a custody decision. In some configurations, it is a licensing decision. Institutions that route it solely through engineering or product management, without legal sign-off, regularly create regulatory exposure that could have been avoided at the design stage.
A second recurring error is relying on the bridge operator's own compliance documentation without independent assessment. A bridge operator may represent that its protocol is non-custodial and therefore outside VASP regulation. That representation, even if accurate for the operator's own classification, does not determine how the institution's use of the bridge is classified by the institution's own regulator. The FCA, MAS, and VARA each apply an activities-based test to the regulated entity, not to the tools it uses.
Third, institutions frequently fail to address the bridge governance token held as part of a liquidity or treasury position. If the institution holds enough governance tokens to materially influence protocol upgrades, it may have acquired a form of control over a financial infrastructure that triggers additional regulatory notification or approval obligations in some jurisdictions. This is an emerging area; the applicable thresholds and tests vary by regime and are not yet fully settled.
Fourth, institutions that build cross-chain products without a clear DeFi legal opinion expose themselves to the risk identified in the audience premise: a token that looks like a utility instrument in the institution's own analysis may look like a security in the analysis of the regulator in the user's jurisdiction. We assess classification against the substance of rights – redemption features, economic participation, governance rights – against the applicable test in every seat where the instrument will be distributed, held, or traded.
Fifth, and most operationally dangerous: not having a pre-prepared incident response protocol for a bridge exploit. When a bridge exploit occurs, the recovery window is measured in hours. Institutions that have not pre-identified their legal team, their forensics partner, and their target forum for emergency relief will lose days on basic coordination while the attacker moves proceeds across further chains. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums; having that relationship in place before an incident is the relevant precaution.
Self-assessment: is your institutional bridge position legally sound?
Before deploying or expanding bridge usage at institutional scale, a legal function should be able to answer yes to each of the following questions. A no – or an "I don't know" – identifies a gap that should be addressed before the position is taken.
Has the bridge operator been identified as a legal entity with a known jurisdiction of incorporation? Has an assessment been made of whether that entity holds the relevant VASP or equivalent authorization in the jurisdictions where the institution and its clients are located? Has the institution's own use of the bridge been assessed against the activity-based definitions in every relevant regulatory regime? Does the institution's AML/Travel Rule architecture cover the bridge transaction leg as a distinct transfer event? Has a sanctions screen been conducted on the bridge's smart-contract address, associated wallet addresses, and known governance-token holders? Does the institution hold governance tokens, and if so, has their regulatory status been assessed? Is there a board-level approved incident response protocol for a bridge exploit, including pre-identified legal and forensics support?
If a prior assessment has been done but circumstances have changed – new chains, new users, new jurisdiction of distribution – the analysis should be refreshed. Regulatory regimes in this area are actively evolving. MiCA's full application continues to develop through ESMA technical standards. MAS and the SFC are refining their DeFi guidance. A prior clean opinion does not cover a materially changed product.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law practice overview – the full regulated perimeter for DeFi and tokenization at institutional scale.
- DAO legal wrapper in Hong Kong – structuring a DAO with legal certainty in a leading Asia-Pacific hub.
- Cross-chain bridge legal risk for early-stage founders – the same bridge risks mapped to the early-stage build environment.
FAQ
Can a DeFi protocol be regulated?
Yes. Regulators in the EU (under MiCA), Singapore (under the Payment Services Act), and Hong Kong (under the SFC's VASP regime) apply a functional test: if a protocol performs a regulated activity – custody, exchange, transfer, or issuance of a regulated instrument – the activity is regulated regardless of whether it is executed by a smart contract or a human. A protocol's autonomous or decentralized character does not, in most leading regimes, constitute a regulatory exemption. The question is whether an identifiable legal person controls, operates, or benefits from the protocol in a way that attracts regulatory responsibility.
What legal wrapper suits a DAO?
The right legal wrapper depends on the DAO's function, its member base, and the jurisdictions where it operates or distributes tokens. Common options include a limited liability company (Delaware, Wyoming, Marshall Islands), a foundation (Cayman, Switzerland, Panama), or a protected-cell or segregated-portfolio structure. The wrapper choice affects liability isolation, tax treatment, and regulatory classification of the governance token. In our practice, we assess the DAO's actual governance mechanics – who controls the multisig, who can propose and execute upgrades – to determine which structure genuinely limits member liability rather than merely creating a paper separation.
Who is liable when a smart contract fails?
Liability attaches to legal relationships, not to code. When a smart contract fails, potential defendants include the protocol operator, auditors who certified the code, the institution that selected and deployed the protocol, and – in DAO-governed structures – governance-token holders who approved the relevant code version. English courts, the DIFC Courts, and Singapore's High Court have each confirmed that digital assets are property and that courts will grant emergency relief to protect institutional positions following a smart-contract exploit. Liability is best addressed at the structuring stage, not after a loss event.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers, funds, and institutional treasury functions on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance architecture that surrounds them. Digital assets are the whole of our practice. We assess token classification against the substance of rights – not the marketing label – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your cross-chain bridge position, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – advises institutional clients on smart-contract governance, DeFi legal risk, and the regulatory classification of tokenized instruments across multi-chain environments.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.