What Are Digital Securities?

Digital securities are ordinary financial instruments, such as shares, bonds and fund units, issued and recorded in electronic form, usually on distributed ledger technology (DLT). The rights they carry come from securities law, not from the software. A tokenized bond is still a bond, with the same obligations for the issuer and the same protections for the investor (Directive 2014/65/EU, MiFID II, Annex I).

The definition is the easy part. The decisions that follow are not: which electronic register replaces the central depository, which national law recognises that register, and which regulated entity must run it. This guide answers those three questions for the EU, with Spain as the worked example.

What counts as a digital security

An instrument is a digital security when two conditions meet. First, it is a financial instrument under EU law: a transferable security such as a share or a bond, a money-market instrument, a unit in a collective investment undertaking, or one of the derivatives listed in Annex I of MiFID II. Second, it is represented and transferred through electronic records rather than paper certificates or traditional book entries (Directive 2014/65/EU, Annex I, Section C).

The test looks at substance, not labels. ESMA’s guidelines on the qualification of crypto-assets confirm that the rights attached to the token decide its legal nature, whatever the issuer calls it. A “utility token” that pays dividends is a security with a misleading name (ESMA75-453128700-1323, final report December 2024, guidelines of 19 March 2025).

Digital securities and security tokens: one instrument, two names

“Digital security” and “security token” describe the same object with a different emphasis. “Security token” grew out of the crypto market and points at the rail: a token recorded on a blockchain. “Digital security” is the institutional term and points at the instrument: a share or a bond that happens to live on new plumbing. Regulators often use a third formula, “crypto-assets that qualify as financial instruments”. All three names lead to the same legal analysis.

If you want the token-side view in depth, start with our guide on what a security token is.

The law that applies, and the law that does not

Three EU rules frame the field. MiFID II decides whether the token is a financial instrument at all. The Prospectus Regulation governs public offers: a prospectus approved by one national supervisor can be passported across the whole EU, and offers below 12 million euros over 12 months can run without one, with a Member State option to lower that threshold to 5 million, applicable since 5 June 2026 (Regulation (EU) 2017/1129, arts. 24-25, as amended by Regulation (EU) 2024/2809).

MiCA, the EU crypto-asset regulation, does not apply here. Its scope expressly excludes crypto-assets that qualify as financial instruments, which is exactly what a digital security is. Calling a tokenized bond “MiCA-compliant” is a category error, and supervisors read it as one (Regulation (EU) 2023/1114, art. 2.4).

The EU registration rails: who keeps the legal record

Traditional securities live in accounts at a central securities depository. When a DLT register replaces that depository, each Member State must say who keeps the legally valid record of ownership. Two national answers show the pattern.

Spain: the ERIR. Spanish law admits securities represented on DLT and assigns the legal register to an ERIR (in Spanish, “entidad responsable de la inscripción y del registro”), a regulated entity that works as the digital notary of the ledger. The figure comes from art. 8 of Law 6/2023 and is developed in Royal Decree 814/2023. The first ERIR, URSUS-3 Capital, A.V., was authorised in November 2024 (Ley 6/2023; RD 814/2023).

Germany: the eWpG registrar. Germany’s Electronic Securities Act (eWpG, 2021) allows securities issued through electronic registers, including crypto securities registers, run by entities under BaFin supervision.

For secondary trading, the EU added the DLT Pilot Regime. It lets authorised venues operate DLT-based trading and settlement systems under temporary exemptions from standard market rules (Regulation (EU) 2022/858).

For the full Spanish circuit, roles and timelines, see our page on security token regulation in Spain.

Honest limits

Digital securities cut friction in registration and transfer. They do not repeal securities law, and they do not create demand. Four limits are worth pricing in before you commit.

• Liquidity is not automatic. Secondary markets for digital securities remain thin. A transferable token without buyers is still an illiquid position.
• Investors still onboard the slow way. KYC, AML and, where applicable, suitability checks apply exactly as they do for any other security.
• Public offers still need documentation. A prospectus, or a documented exemption, remains the gate to the retail public (Regulation (EU) 2017/1129).
• The register is an operational dependency. Your contracts must cover what happens to the legal record if the registrar fails or exits the business.

Three checks before you commit

1. Qualification. Map the rights the token will carry against Annex I of MiFID II. If they match, plan for securities law and set MiCA aside.
2. Register. Choose the Member State whose registration figure fits your issuance: the ERIR in Spain, the eWpG registrar in Germany. If you are still comparing wrappers and steps, our guide on how to tokenize an asset covers the process end to end.
3. Roles. Decide who runs each regulated role before you sign anything. HokenFi is the technology platform, not a CNMV-authorised entity: the regulated circuit is covered with partner entities, starting with the ERIR.

This content is educational. It is not legal, tax or investment advice. Always check the current version of each rule on BOE and EUR-Lex.