Real-world asset (RWA) tokenization – the process of representing ownership rights in a physical or financial asset as a digital token on a blockchain – is moving rapidly from pilot projects to production. Established operators in real estate, private credit, commodities and fund management are evaluating tokenization not as an experiment but as an infrastructure decision. The legal question is no longer whether to tokenize but how to do it without mis-classifying the token, triggering securities regulation, or exposing the issuer to cross-border enforcement action.
Mis-classifying a token can convert a product launch into an unregistered securities offering. That is the central risk, and it arises from a gap between marketing intent and legal substance. A label on a whitepaper does not settle the classification question. What matters is the bundle of rights the token actually confers – economic participation, voting, redemption, profit share – and how those rights interact with the regulatory regime of each jurisdiction where the token is offered or traded. Regulators under MiCA (the EU's Markets in Crypto-Assets Regulation), the VARA regime in Dubai, and the MAS Payment Services Act framework in Singapore each apply their own substance-over-form analysis. Getting this wrong at launch is structurally expensive to fix.
This page sets out the regulated basis for RWA tokenization, the process an established operator should expect, the most common structural mistakes, and a decision matrix by asset class and operator profile.
What is real-world asset tokenization and why does the legal regime matter?
RWA tokenization produces a digital instrument whose value and rights derive from an off-chain asset. The token is not the asset; it is a legal claim against an entity that holds or controls the asset. That distinction is foundational. Every tokenization structure must answer three questions before a token goes near a blockchain: who holds the underlying asset, what rights does a token confer, and what mechanism enforces those rights.
The legal regime matters because the answers to those questions determine regulatory classification. A token that confers a pro-rata share of rental income from a property portfolio looks, under the substantive tests applied by the SFC in Hong Kong and the FCA in the United Kingdom, very much like a collective investment scheme unit. A token that confers a fixed redemption right against a stablecoin reserve may qualify as an e-money token (EMT) under MiCA. A token that confers access rights only – no economic participation, no redemption – has the strongest case for a utility classification, though even that case requires documented analysis, not assertion.
In our practice, the most expensive errors arise when operators assume that a token's label controls its classification. Regulators apply a substance-over-form test. The rights embedded in the smart contract, the marketing materials distributed, and the investor profile targeted all contribute to the analysis. An operator that launches without completing that analysis in writing, before token generation, is carrying unquantifiable regulatory risk.
For a scoped classification assessment before your token generation event, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the asset, the token rights, the investor base, the distribution channels – change the analysis materially.
What does the legal structure stack for an RWA token look like?
An RWA tokenization structure typically involves at least three legal layers: the asset-holding layer, the issuance layer, and the distribution layer. Each layer has its own regulatory surface, and the interaction between them determines the overall compliance posture.
The asset-holding layer is the entity that legally owns or controls the underlying asset. For real estate, this is typically a special-purpose vehicle (SPV). For a loan portfolio, it may be a trust or a securitization structure. The SPV must be constituted in a jurisdiction whose law recognizes both the asset class and the intended transfer mechanism. The Cayman Islands, the BVI and Delaware are common choices for this layer, each offering established frameworks for asset segregation and bankruptcy remoteness.
The issuance layer is the entity that issues the tokens. It must be authorized, registered or exempted as appropriate in the jurisdictions where the tokens will be offered. Under MiCA, an issuer of asset-referenced tokens (ARTs) requires authorization from a national competent authority. Under VARA in Dubai, a token issuance of this kind falls within the exchange or brokerage activity categories depending on the secondary market mechanism. The FSRA within ADGM in Abu Dhabi takes a similar activity-based approach.
The distribution layer governs how tokens reach investors. Secondary market trading, custody, and any advisory or management services relating to the tokens are each separately regulated activities in most flagship jurisdictions. A structure that places the SPV in the Cayman Islands, the issuer in a MiCA-compliant EU member state, and distribution through a VARA-licensed exchange in Dubai is common in practice – but it requires legal sign-off in each layer, and the interaction between the regimes must be mapped explicitly.
How is an RWA token classified, and what turns the analysis?
Token classification is the critical threshold question for every RWA structure. Classification determines which regulatory regime applies, which licences are required, and whether the offering can proceed in a given jurisdiction at all.
The primary axes of classification are: (1) economic rights – does the token confer a return tied to the performance of an underlying asset or enterprise; (2) redemption rights – can the holder redeem the token against the issuer for a defined value; and (3) governance rights – does the token carry voting or decision-making rights over the issuer or the underlying asset. A token carrying all three is almost certainly a security in every major common-law jurisdiction. A token carrying only economic rights requires further analysis against local securities law. A token carrying only access rights – no economic participation, no redemption, no governance – has the strongest utility argument, but that argument must survive regulatory scrutiny, not just internal sign-off.
Under the MiCA taxonomy, the relevant categories for RWA tokens are ARTs (backed by a basket of assets or currencies) and "other crypto-assets" (the residual category that includes most utility tokens). EMTs apply where the backing is a single fiat currency. In practice, most RWA tokens involving real property or private credit fall either within the ART category or, if they confer investor-type rights, outside MiCA entirely and into the existing financial-instruments regime via the relevant MiFID provisions.
In Singapore, MAS applies the Capital Markets Products test. In Hong Kong, the SFC applies a collective investment scheme analysis. In the United States, the SEC applies the Howey test to determine whether the token is an investment contract. None of these tests look to the marketing label. All of them look to the substance of rights. We assess classification against that substance, not the label – and we document the analysis in writing before the token generation event.
What is the tokenization process, and how long does it take?
A disciplined RWA tokenization process for an established operator has six identifiable stages. Each stage has a legal output. Skipping a stage does not accelerate the project; it defers risk that typically crystallizes at a far higher cost.
Stage 1 – Asset and rights mapping (typically two to four weeks). The legal team maps the underlying asset, the rights intended to be tokenized, and the investor profile. The output is a classification memorandum that determines the applicable regime in each target jurisdiction.
Stage 2 – Structure selection and entity setup (four to twelve weeks depending on jurisdiction). The SPV is incorporated, the issuer entity is established or identified, and the distribution arrangement is documented. Offshore SPV formation in the Cayman Islands or BVI can be completed relatively quickly; a MiCA CASP authorization or a VARA licence takes considerably longer and runs in parallel.
Stage 3 – Regulatory filing and whitepaper preparation (variable; typically eight to twenty-four weeks for a licence or authorization). The applicable whitepaper or offering document is prepared. Under MiCA, ART and EMT issuers file a whitepaper with the relevant national competent authority and must comply with defined content and liability standards. Non-securities utility tokens under MiCA are subject to whitepaper notification requirements. Securities-classified tokens require a prospectus or private placement documentation in most jurisdictions.
Stage 4 – Smart-contract audit and legal mapping (two to six weeks). The smart-contract code is audited by a technical firm, and legal counsel maps the contract logic to the representations made in the offering document. Discrepancies between code behavior and documentation are a primary source of investor claims and regulatory concern.
Stage 5 – Token generation and primary distribution. The token is minted and distributed to initial holders. KYC/AML (know-your-customer / anti-money-laundering) procedures apply at this stage in every regulated jurisdiction. The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary data with a virtual asset transfer – applies to transfers above the applicable threshold in most flagship regimes.
Stage 6 – Secondary market and ongoing compliance. Ongoing reporting, investor communications, reserve management (for ARTs) and periodic re-classification review are standing obligations. The legal environment continues to evolve; an operator that completes a tokenization in one regulatory window must monitor for changes that affect the structure's ongoing classification.
What are the most common structural mistakes in RWA tokenization?
Operators we advise regularly arrive after having made one or more of the following errors. Each is correctable, but correction is substantially more expensive than avoidance.
The first and most frequent mistake is self-classifying the token as a utility instrument without documented legal analysis. A utility label on a whitepaper is not a legal opinion. Regulators in every major hub have made clear that the substance of rights controls. An operator that relies on the label alone carries the risk of a retroactive securities finding, which typically requires registration, investor rescission rights, or both.
The second mistake is structuring the SPV without regard to investor rights under local law. If the SPV is constituted in a jurisdiction whose law does not recognize the transfer mechanism, or whose insolvency regime does not segregate SPV assets from the issuer's general estate, the bankruptcy-remoteness of the structure fails. The token holder's claim against the underlying asset is then contingent rather than proprietary, which changes the classification analysis and the investor value proposition.
The third mistake is ignoring the distribution layer. An issuer that has obtained the correct authorization in one jurisdiction may still be offering an unregistered product in jurisdictions where the token is accessible online. Most major regulators apply a jurisdictional nexus test that captures online offers directed at their residents. A geo-block is necessary but not always sufficient; the applicable nexus test must be analyzed per jurisdiction.
The fourth mistake is failing to map the smart contract to the offering documents. If the contract permits functions – minting, burning, pausing, upgrading – that are not disclosed in the whitepaper, that gap is a disclosure failure. Regulators and courts in leading common-law forums have increasingly looked to on-chain evidence when assessing investor claims.
How does the cross-border reality affect an RWA tokenization?
For an established operator, the cross-border dimension of RWA tokenization is not a secondary consideration. It is the primary design constraint.
The entity that holds the asset, the entity that issues the token, the platform that facilitates trading, and the investors who hold the token will typically sit in different jurisdictions. Each jurisdictional contact point engages a local regulatory regime. An RWA token issued by a Cayman SPV, authorized under MiCA via a Lithuanian CASP, traded on a VARA-licensed exchange in Dubai, and held by investors in Singapore and Hong Kong is simultaneously subject to at least five distinct supervisory regimes. Compliance with one does not imply compliance with any other.
Banking is a parallel constraint. Banks in regulated jurisdictions increasingly require comfort on the regulatory status of a tokenization structure before they will provide custody, payment services or corporate banking to the issuer. An issuer that cannot produce a clear classification memorandum and a jurisdiction-by-jurisdiction compliance map will find its banking options restricted. We have seen structures where the regulatory analysis was completed but the banking relationship was lost because the operator could not articulate the classification clearly to a correspondent bank's compliance team.
Tax is the third cross-border dimension. The transfer of an asset into an SPV, the issuance of tokens, the payment of distributions to token holders, and the eventual redemption or secondary transfer of tokens may each trigger tax events in multiple jurisdictions. The applicable treatment – income versus capital, VAT or GST, withholding tax on distributions – varies materially by jurisdiction and by the legal characterization of the token. Tax structuring must be integrated into the legal structure from Stage 1, not retrofitted after the token launches.
In our cross-border practice, we coordinate the legal structure across the relevant jurisdictions, working alongside allied counsel in the relevant local jurisdictions where specialist local input is required. The integration of the licensing, banking, and tax stack is a core part of the mandate, not an add-on.
To map the licence, banking and tax stack for your tokenization build, write to OBOLUS at info@oboluslaw.com. If a prior structure stalled at the banking or regulatory stage, a second read can surface the structural reason and the route forward.
Which structure suits which operator profile?
There is no universal RWA tokenization structure. The right architecture depends on the asset class, the intended investor base, the operator's existing regulatory footprint, and the jurisdictions where the token will be offered. The following decision matrix sets out the principal profiles we encounter in practice.
Profile A – Established real estate fund manager tokenizing a single property or portfolio. The typical structure involves a Cayman or BVI SPV holding the asset, with token issuance under a MiCA ART or securities-law exemption framework in the EU. The investor base is institutional or sophisticated retail. The key risk is the collective investment scheme / securities classification in any jurisdiction where the token is marketed. Timeline from instruction to token generation is typically six to eighteen months, depending on whether a new authorization is required. The operative legal question is whether the token rights constitute a regulated investment under the applicable securities law of each distribution jurisdiction.
Profile B – Private credit fund digitizing loan participation interests. Loan participation tokens carry a fixed-income economic profile. They are high-risk for securities classification in most jurisdictions. The most common compliant structure uses a private placement exemption in each distribution jurisdiction, with transfer restrictions hard-coded into the smart contract. VARA in Dubai and the FSRA within ADGM in Abu Dhabi have developed specific guidance for tokenized securities that permits compliant distribution within their perimeters. Timeline is comparable to Profile A; the primary constraint is the private placement documentation and investor eligibility verification.
Profile C – Commodities operator tokenizing physical inventory or commodity contracts. Commodity tokenization is the category with the most variation in regulatory treatment across jurisdictions. In the United States, a commodity token may fall under CFTC jurisdiction. In the EU, the classification depends on whether the token constitutes a financial instrument under the applicable EU financial-markets regime or falls within the residual MiCA category. The AIFC/AFSA regime in Kazakhstan has developed specific provisions for commodity-linked digital assets. Legal analysis must be completed jurisdiction by jurisdiction; there is no universal commodity-token classification.
Profile D – Fintech operator building a secondary market or custody layer for existing RWA tokens. This operator does not issue tokens but provides infrastructure. The regulatory question is whether the services provided – trading facilitation, custody, clearing – constitute regulated activities under the applicable regime. Under MiCA, custody of crypto-assets and operating a trading platform are both CASP activities requiring authorization. Under VARA, exchange and custody services are separately licensed activities. The risk of operating without the correct authorization is enforcement action, not just reputational damage.
A matter from our practice
In a recent tokenization mandate, a fund manager sought to tokenize a portfolio of income-producing commercial real estate across two jurisdictions. The initial structure had been designed by the operator's internal team and classified the token as a utility instrument on the basis that it conferred "access to the platform." On legal review, the token rights – pro-rata income distributions, a redemption mechanism tied to appraised asset value, and a governance vote on asset disposals – clearly constituted a collective investment scheme interest in one jurisdiction and a regulated investment instrument in the other. We restructured the issuance layer to operate under a private placement exemption with transfer restrictions embedded in the smart contract and prepared the classification memorandum that supported the operator's banking application. The structure launched in the following quarter with the appropriate regulatory basis documented in writing before the token generation event.
A common assumption: the utility label settles the classification
A common assumption among operators new to tokenization is that attaching a utility label to the token – in the whitepaper, in the terms of service, or in the smart-contract metadata – is sufficient to avoid securities regulation. It is not. Every major regulator applies a substance-over-form test. The label is one data point. The rights conferred, the marketing materials distributed, and the investor expectation created by those materials are the determinative inputs.
This assumption is particularly dangerous in the context of secondary market trading. A token that was genuinely utility-classified at issuance can acquire investment-contract characteristics if a secondary market develops and the issuer's statements shift toward return-expectation framing. Classification is not a one-time exercise; it is an ongoing obligation.
Regulators under MiCA, VARA, and the SFC regime have each published guidance making this position explicit. The guidance does not provide a safe harbor for label-only utility classification. A documented legal opinion – updated as the structure evolves – is the only credible defense against a retroactive reclassification finding.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – the full practice overview covering DeFi legal structuring, smart-contract counsel and tokenization across jurisdictions.
- RWA tokenization in the Cayman Islands – jurisdiction-specific analysis of the Cayman SPV and CIMA VASP framework for tokenization structures.
- Smart-contract dispute resolution in El Salvador – how El Salvador's legal regime addresses on-chain contract disputes and what that means for operators structuring there.
FAQ
Can a DeFi protocol be regulated?
A decentralized finance (DeFi) protocol can be subject to regulation even where no central operator is identifiable. Regulators in the EU under MiCA, the FCA in the UK, and the SEC in the United States assess whether a protocol involves regulated activities – trading, lending, custody – regardless of the degree of decentralization. Where a developer team, a DAO treasury, or a governance token structure retains meaningful control, regulatory attribution is possible. Genuine decentralization reduces but does not eliminate regulatory risk; the analysis is fact-specific and jurisdiction-specific.
What legal wrapper suits a DAO?
A decentralized autonomous organization (DAO) without a legal wrapper is an unincorporated association in most jurisdictions, exposing members to unlimited joint liability. Common legal wrappers include the Cayman Islands foundation company, the BVI restricted purpose company, the Wyoming DAO LLC, and the Marshall Islands DAO LLC. The right choice depends on the DAO's purpose, governance structure, and the jurisdictions where its members and counterparties are located. Tax treatment and regulatory classification both turn on the wrapper selected; legal advice is required before a wrapper is adopted.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the failure mode, the applicable law, and the contractual documentation. A coding error that causes loss may expose the developer under general tort or contract principles. An issuer that represented a specific contract behavior in offering documents may face investor claims if the contract performs differently. Courts in England and Wales, Singapore, and Hong Kong have each addressed on-chain asset disputes and applied property and contract law principles to digital assets. The governing law of the contract and the forum selection clause in any associated legal agreement are material to any recovery analysis.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. Our classification work is grounded in the substantive rights analysis that regulators apply – not in the label an operator places on a whitepaper. To discuss your tokenization structure, contact info@oboluslaw.com.
By Roman Levitt, Technology and DeFi Counsel – advising established operators on RWA tokenization structures, smart-contract legal mapping and cross-border DeFi regulatory positioning.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.