Choosing between tokenization platforms looks like a software purchase. Most of its consequences are legal. The platform you select determines who keeps the register of your investors, which law your security lives under and what happens to holders if the vendor disappears. Those questions outlast any feature list. This guide describes what a platform actually does, the questions that separate serious providers from token factories, and a criteria table to score candidates. It also states where HokenFi sits, so you can judge us by the same standard.
What a tokenization platform actually does
At its core, a platform is issuance software. It creates the tokens, connects them to a register of holders, runs investor onboarding with KYC and AML checks, collects subscriptions and executes the life cycle of the security: payments, votes, amortisations and transfers. Good platforms also produce the reporting trail that a supervised issuance generates over the years.
Just as relevant is what a platform does not do. Software does not make an offer legal. It does not replace the prospectus or the exemption analysis. It cannot turn a security into an unregulated asset, and no disclaimer changes that classification. In Spain it is not even the legal register: that function belongs to the ERIR, the authorised entity that Law 6/2023 requires for financial instruments represented on distributed ledgers, working as the digital notary of the issuance (art. 8, Law 6/2023; RD 814/2023).
A provider that presents its software as a way around regulation is describing a structure that will not survive contact with a supervisor. The useful comparison between platforms starts after that filter, among providers that describe their legal perimeter honestly.
Price comparisons mislead for the same reason. The software fee is one line of the issuance budget; the register, the legal documentation and distribution carry their own costs whichever platform you pick. Compare the total cost of a completed issuance, not licence fees.
Five questions to ask before you sign
Put these questions in writing and require written answers. What a provider will not put in writing tells you as much as what it will.
1. Who keeps the legal register of holders?
If the answer is «the blockchain», ask which law gives that ledger legal effect. A distributed ledger is evidence; a register is a legal function someone answers for. In Spain the register of tokenized securities is kept by an ERIR supervised by CNMV, and the first one, URSUS-3 Capital A.V., was authorised in November 2024. A serious platform names the registrar and its authorisation.
2. Which law governs the security?
The token inherits the law of the instrument, not the law of the server. Ask under which jurisdiction the security is issued, where disputes would be resolved and whether that framework recognises DLT registration. For an issuer that wants European investors, a framework connected to the EU prospectus passport is worth more than a faster offshore wrapper. A provider that cannot name the governing law without consulting anyone has not designed the structure yet (arts. 24-25, Regulation (EU) 2017/1129).
3. What happens if the platform disappears?
The security must outlive the software. Ask for the continuity plan: who holds the register independently of the vendor, how holders prove ownership without the platform’s interface, whether contracts and technical records are escrowed, and how another provider could take over the life cycle. When the register sits with an authorised ERIR, the answer does not depend on the vendor’s balance sheet.
4. How are KYC and AML obligations handled?
Someone is legally responsible for onboarding checks, and it is rarely the software. Ask which entity acts as the obliged subject under anti-money-laundering law, which verification standard applies and how records are kept available for the supervisor. «We have a KYC module» is a feature description, not an answer.
5. How are corporate actions executed?
Coupon payments, dividends, votes, amortisations and forced transfers happen for years after issuance day. Ask who triggers each action, who reconciles it against the register and which parts are automated. A platform that only demonstrates the subscription flow has shown you the first month of a ten-year instrument.
Criteria table
| Criterion | What to look for | Warning sign |
|---|---|---|
| Legal register | A named, authorised registrar; in Spain, an ERIR | «The blockchain is the register» |
| Regulatory perimeter | A clear split between software and regulated functions, with entities named | «Fully licensed» claims with no supervisor named |
| Governing law | An instrument issued under a framework with EU market access | An offshore wrapper marketed to EU investors |
| Investor onboarding | An identified obliged entity and a documented KYC/AML standard | Onboarding described only as a user-experience feature |
| Continuity | Register independence, escrow of records and an exit plan in the contract | No answer beyond «the code is open source» |
| Corporate actions | Payments, votes and transfers with named responsibilities | Only the subscription flow is demonstrated |
Score candidates against the table in writing. The exercise takes an afternoon and tends to reduce a crowded market to two or three real options. Disqualify on the first row before weighing the rest: a platform without a supervised register does not become acceptable by having better dashboards.
Where HokenFi sits
HokenFi is a technology platform for security token issuances on the Spanish framework. HokenFi is not an entity authorised by CNMV. The regulated functions of each issuance are performed by authorised partners: an ERIR keeps the legal register, specialised law firms prepare the documentation, and, where the offer requires it, authorised investment firms participate in distribution. We state this because it is the same disclosure we suggest you demand from any provider. In practice it means one contract for the technology and identified regulated counterparties for each supervised function, visible from the first proposal.
The route this model builds on is the one described above: instruments under Law 6/2023, registration with an ERIR, CNMV supervision, and access to the EU through the prospectus passport or the exemption thresholds, set at 12 million euros over 12 months since 5 June 2026 (Regulation (EU) 2024/2809). The full context is in our guides to RWA tokenization in Europe and security token regulation in Spain, and the model is summarised at hokenfi.com/en.
The right platform is the one whose answers survive review by your lawyers. Run the 2-minute issuance assessment or request a proposal.
This content is educational. It is not legal, tax or investment advice. Always check the current version of each rule on BOE and EUR-Lex.
HokenFi is a software and infrastructure provider; it does not provide regulated services (CASP, investment firm, financial advisor or ERIR). This article is for information only and is not financial or legal advice.
Frequently asked questions
Do tokenization platforms need a financial licence?
It depends on the functions performed. Issuance software as such is not a regulated activity, but keeping the legal register, placing securities, custody and advice are. In Spain the register of tokenized securities must be kept by an ERIR authorised by CNMV. A platform should state which functions it performs itself and which sit with authorised entities.
Who keeps the register of a tokenized security in Spain?
An ERIR, the entity responsible for the registration and recording of securities on distributed ledgers, required by article 8 of Law 6/2023 and developed by Royal Decree 814/2023. The ERIR is authorised and supervised by CNMV. The first ERIR, URSUS-3 Capital A.V., was authorised in November 2024, and the register it keeps determines legal ownership of the tokens.
What happens to a security token if the platform shuts down?
If the issuance is structured correctly, the security survives. Ownership derives from the legal register, in Spain kept by an authorised ERIR, and from the instrument's documentation, not from the vendor's software. Before signing, ask for the continuity plan: how holders prove ownership without the platform, which records are escrowed and how another provider would take over.
