Tokenizing a real-world asset in Europe means, in most cases, issuing a security. That classification decides which law governs the token, which supervisor reviews the offer and which investors you can approach. Much of what is published about RWA tokenization skips this point, because it is written for the US market or for offshore structures. This guide takes the European issuer’s view: what the tokenization of real world assets means under securities law, how the regulated route through Spain compares with the offshore alternative, which assets fit, and who supervises each stage.
What RWA tokenization means under securities law
RWA tokenization is the representation of rights over a real-world asset as transferable tokens recorded on distributed ledger technology (DLT). The underlying asset can be a building, a loan portfolio, a fund or a stream of royalties. The token is not the asset. It is an instrument that carries defined rights over the asset, or over the vehicle that holds it.
The decisive question in the EU is which rights the token carries. If they match a financial instrument listed in Annex I of MiFID II, such as a share, a bond or a fund unit, the token is a security token. Securities law then applies in full: MiFID II conduct and licensing rules, the Prospectus Regulation for public offers, and the national regime of the issuing state (Directive 2014/65/EU; Regulation (EU) 2017/1129).
MiCA does not govern these tokens. The regulation excludes crypto-assets that qualify as financial instruments from its scope, so a security token never sits under MiCA rules (art. 2.4, Regulation (EU) 2023/1114). ESMA has published guidelines on when a crypto-asset qualifies as a financial instrument, in application since March 2025 (ESMA75-453128700-1323).
Spain turned this framework into a working route. Law 6/2023 recognises financial instruments represented on DLT and requires an authorised entity, the ERIR, to keep the legal register of holders. The ERIR works as the digital notary of the issuance: it certifies who owns what. The register regime is developed by Royal Decree 814/2023, and the first ERIR, URSUS-3 Capital A.V., was authorised in November 2024 (art. 8, Law 6/2023; RD 814/2023). The Spanish framework is covered in detail in our guide to security token regulation in Spain.
The regulated EU route vs the offshore route
Issuers usually weigh speed and upfront cost against legal certainty and market access. The comparison below states the trade-off plainly, including where the offshore route wins.
| Criterion | Regulated EU route (Spain) | Offshore route |
|---|---|---|
| Legal nature of the token | A registered security with the same rights as a traditional share or bond | A contractual claim whose strength depends on the offshore documents and courts |
| Register of holders | Kept by an authorised ERIR under CNMV supervision | Kept by the platform or the issuer, with no supervised registrar |
| Access to EU investors | Direct; a CNMV-approved prospectus passports across the EU | Restricted; marketing into the EU triggers EU securities law |
| Investor protection | Prospectus liability, conduct rules and supervised intermediaries | Depends on the offshore jurisdiction; disclosure duties are often thin |
| Upfront cost and speed | Higher; structuring, ERIR onboarding and, where required, prospectus approval | Lower and faster at the point of issuance |
| Risk carried forward | Concentrated at the start, then largely resolved | Requalification and enforcement risk for as long as EU investors hold the token |
The offshore route is not illegal in itself. It becomes a problem when the tokens reach EU investors, because securities law follows the offer, not the server. Reverse solicitation is a narrow exception, not a distribution strategy. An issuer that plans to raise capital in Europe saves little by starting outside it. The offshore route wins the first three months; the regulated route wins the years that follow.
Which assets fit
Any asset that can sit inside a company, a fund or a debt instrument can support a security token issuance. Four categories dominate current practice.
- Real estate debt and equity. A vehicle holds the property or the development loan. Investors subscribe tokenized shares or bonds of that vehicle. The structures are explained in our guide to tokenizing real estate in Spain.
- Funds and managed vehicles. Units or shares of an investment vehicle are represented on DLT, which simplifies subscription and the register of holders.
- Bonds and notes. Debt from companies or energy projects is tokenized directly, with payment terms executed against the register.
- Intellectual property royalties. Music, audiovisual and patent income is packaged into instruments whose payments track what a vehicle collects.
What tokenization never does is turn a financial claim into an unregulated product. If the instrument grants economic or governance rights, it is a security, whatever the marketing calls it.
Not every asset is ready. If ownership of the underlying cannot be concentrated in a vehicle, or the income it produces cannot be verified and assigned, there is no instrument to issue. A practical screening test: describe in one sentence what the token pays, from which source and in what order of priority. If that sentence cannot be written, the problem is the structure, not the technology.
The process, stage by stage
- Structuring. Define the asset, the vehicle and the instrument. This stage fixes the legal nature of the token and everything that follows.
- Disclosure. Establish whether the offer needs a CNMV-approved prospectus or fits an exemption. Since 5 June 2026 the EU exemption threshold is 12 million euros over 12 months, with a member state option to lower it to 5 million; the Spanish adaptation is in progress (Regulation (EU) 2024/2809).
- Registration. Appoint the ERIR. It records the issuance and keeps the legal register that determines who owns each token.
- Distribution. Investors pass KYC and AML checks, subscribe and settle through the issuance platform.
- Life cycle. Payments, voting, amortisation and transfers execute against the ERIR register. Supervised secondary venues are appearing under the DLT Pilot Regime; the first Spanish DLT trading and settlement system was authorised by CNMV in November 2025 (Regulation (EU) 2022/858).
Who supervises
In Spain, CNMV authorises the ERIR, approves prospectuses and supervises the regulated entities in the chain. ESMA sets the criteria for classifying crypto-assets as financial instruments and coordinates supervisors across the Union. A prospectus approved by CNMV can be passported to any other member state with a notification, without a second review (arts. 24-25, Regulation (EU) 2017/1129).
Supervision does not end at issuance. The ERIR answers for the register it keeps, and offers made under a prospectus carry ongoing disclosure duties. For the issuer this is a cost; for the investor it is the reason a regulated token is easier to distribute than an offshore claim.
HokenFi operates on this route as the technology layer. HokenFi is not an entity authorised by CNMV; the regulated functions of each issuance are covered by authorised partners, including the ERIR and specialised counsel. How the model works is described at hokenfi.com/en.
If your asset fits a security wrapper, the regulated European route already exists. Run the 2-minute issuance assessment or request a proposal.
This content is educational. It is not legal, tax or investment advice. Always check the current version of each rule on BOE and EUR-Lex.
