In a tokenized issuance, custody and registration are different things: whoever controls the keys controls the asset, and whoever keeps the register decides who the holder is. In Spain, the register with legal effects corresponds to the ERIR under Ley 6/2023, while custody of the keys can fall to the investor or a third party.
You are about to issue a security token, and the awkward question comes up: where are those tokens stored, and who is responsible if something fails? It is not a minor doubt. Whoever controls the keys controls the asset, and whoever keeps the register decides who is the holder. They are two different things, and confusing them can cost you dearly with an investor or with the supervisor.
This guide is for you, issuer. We are going to separate three concepts that get mixed up daily: ownership registration, custody of the instrument and investor self-custody. And we are going to make clear why custodying a security token is not the same as custodying any cryptoasset.
Registration and custody: what each one is responsible for
Registration says who owns the security; custody keeps the keys or the instrument. They are separate functions, provided by different parties and they are responsible for different things.
Ownership of a security token is maintained by an ERIR, the Entity Responsible for Registration and Registry. Think of it as the digital notary of the registry: it records who owns each security, with full legal effect (art. 8 Ley 6/2023, LMVSI; RD 814/2023). If the ERIR says the token is yours, it is. As of June 2026, Ursus-3 Capital is the first entity authorized by the CNMV for this function.
Custody is something else. Custodying means keeping the financial instrument or the cryptographic keys that give access to it. The ERIR does not custody: it registers. The fact that your name appears in the register does not mean the ERIR has your private keys.
What this means for you: do not hire the ERIR expecting it to also custody. They are two services, two responsibilities and, usually, two providers. If you assume that the registrar keeps the keys, you are in for a surprise.
Self-custody: the investor controls their own wallet
In self-custody, the investor keeps their own private keys in their wallet. There is no third-party custodian. Control is total, and so is responsibility.
Self-custody is the native model of blockchain. The investor receives the token in a wallet they control, with their private key. No one else has access. If they lose the key, they lose access to the asset, and there is no custodian to claim against.
What it means for the issuer
When your investor self-custodies, you do not hold anything of theirs. That reduces your operational exposure, but it shifts the risk of key loss to the investor. Ownership remains recorded with the ERIR, so a wallet error does not erase the registered right; it makes recovering access to the token itself more difficult.
What it means for you: self-custody does not make you a custodian. You issue, the ERIR registers and the investor holds. Document well who assumes each risk in your terms and conditions.
Qualified custodian: custody of financial instruments under MiFID II
If the investor does not want to self-custody, the alternative is a qualified custodian. Custodying financial instruments is an investment service regulated by MiFID II, and it is provided by an authorized entity.
A security token is a financial instrument. Therefore, custodying it on behalf of a third party is an investment service subject to MiFID II (Directive 2014/65/EU). It is provided by an investment services company (ESI) or a credit institution with the corresponding authorization, not by just any technology provider.
Why the word “qualified” matters
The qualified custodian is liable for the safekeeping of the instrument. It is supervised, segregates client assets, and complies with specific protection obligations. It is not the same as leaving the keys in the hands of an unlicensed intermediary. The “qualified” label indicates that there is a regulatory regime behind it and an identifiable responsible party.
What it means for you: if your offering includes custody for investors who do not want to manage keys, make sure it is provided by an entity authorized under MiFID II. Offering custody without that authorization is providing a regulated service without a license.
MiFID II and MiCA: two different regimes for custody
Custodying a tokenized security follows MiFID II. Custodying a MiCA crypto-asset follows the CASP regime. They are separate frameworks, and a tokenized security falls outside MiCA.
Here is the most common mistake. MiCA (EU Regulation 2023/1114) regulates crypto-assets and creates the crypto-asset service provider, the CASP. Think of CASPs as the banks of the crypto world: their services include the custody and administration of crypto-assets on behalf of clients (Art. 3 MiCA).
But MiCA expressly excludes crypto-assets that are financial instruments (Art. 2(4) MiCA). A tokenized security is a financial instrument. It therefore falls outside MiCA. Its custody, when provided, follows the MiFID II regime, not the CASP regime.
Why a bank with a MiCA license is not enough
Spanish banks that have notified CASP services under MiCA custody crypto-assets. That does not mean they are authorized to provide custody for MiFID tokenized securities. They are different authorizations. The fact that an entity provides custody for bitcoin does not mean it can provide custody for a tokenized transferable security.
What it means for you: when choosing a custodian, ask about the specific authorization. For a tokenized security you need custody under MiFID II. A MiCA license, on its own, does not cover your financial instrument.
Comparison table
| Concept | What it does | Regime | Who provides it |
|---|---|---|---|
| Registry (ERIR) | Records ownership with legal effect | LMVSI Ley 6/2023, RD 814/2023 | Entity authorized by CNMV (Ursus-3 Capital as of 2026) |
| Tokenized security custody | Safekeeps the instrument or a third party's keys | MiFID II (Directive 2014/65/EU) | ESI or authorized credit institution |
| Crypto-asset custody | Safekeeps crypto-assets on behalf of clients | MiCA (Art. 3), CASP service | Crypto-asset service provider (CASP) |
| Self-custody | The investor holds their own keys | No third-party custodian | The investor themselves (self-custody) |
Read the table along two axes. Vertical: registry versus custody, two functions that are not substitutes for each other. Horizontal in custody: MiFID II for the tokenized security, MiCA for the crypto-asset. And self-custody, outside any third-party custodian scheme.
Where HokenFi fits
HokenFi is a software and infrastructure provider. It does not custody financial instruments or hold third-party keys. It is not a custodial service.
Let's be clear so there is no misunderstanding. HokenFi gives you the technology to issue and manage tokenization. It does not act as a MiFID II qualified custodian or as a MiCA CASP, nor does it replace the ERIR. The registry is maintained by the ERIR; custody, when it exists, is provided by an authorized entity; and self-custody is assumed by the investor in their wallet.
What to do now
Before you finalize your custody model, settle these decisions:
- Confirm who registers ownership. Review how the ERIR and the security token registry work before signing anything.
- Decide the custody model: investor self-custody or MiFID II qualified custodian. Do not confuse them with the MiCA license.
- If you are considering MiCA entities, check what each one covers in the guide to banks with a MiCA license in Spain. Remember: they provide custody for crypto-assets, not necessarily your security token.
- Fit everything into the issuance process. Review how to issue a security token in Spain from start to finish.
- Unsure about the terminology? Check the glossary to pin down the concepts.
Frequently asked questions
Does the ERIR hold my security tokens in custody?
No. The ERIR registers ownership with legal effect (art. 8 LMVSI; RD 814/2023). Registering is not providing custody. Custody of the instrument or of the keys is a different function that the ERIR does not provide.
What is self-custody of a security token?
It is when the investor stores their own private keys in their wallet, without a third-party custodian (self-custody). The investor controls access and assumes the risk of losing the key.
Who can provide custody for a security token in Spain?
A security token is a financial instrument, so its custody is an investment service under MiFID II. It is provided by an investment services company or an authorized credit institution, not by just any technology provider.
Can a bank with a MiCA license provide custody for my security token?
Not automatically. The MiCA license authorizes custody of crypto-assets (CASP service, art. 3 MiCA). A security token falls outside MiCA (art. 2(4)), and its custody follows MiFID II. Ask about the specific authorization.
What is the difference between MiCA custody and MiFID II custody?
MiCA custody covers crypto-assets and is provided by a CASP. MiFID II custody covers financial instruments, such as a security token, and is provided by an authorised investment firm. They are different regimes and authorisations.
Does HokenFi custody the tokens or the keys?
No. HokenFi is a software and infrastructure provider, not a custodian. It does not hold financial instruments or third-party keys, nor does it act as a qualified custodian or CASP.
Notice
Informational content. It does not constitute legal, tax or investment advice. HokenFi is a software and infrastructure provider; it does not provide regulated services. Check the current version of the rules cited in the BOE and EUR-Lex.
Cited regulations
- Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión (LMVSI), Art. 8.
- Real Decreto 814/2023, de 8 de noviembre.
- Directive 2014/65/EU (MiFID II).
- Regulation (EU) 2023/1114 (MiCA), Art. 2(4) and Art. 3.
