Custody and Settlement Frameworks for Tokenized RWAs

1. Global Landscape -- Custody Models for Tokenized Securities

The custody of tokenized real-world assets (RWAs) is the single most consequential post-trade question facing regulators and market participants. Unlike traditional securities, where the custody chain is well-established through central securities depositories (CSDs) and intermediary holding patterns, tokenized assets introduce fundamental questions: Who holds the private key? Does possession of a private key constitute legal custody? What happens to on-chain assets when a custodian fails?

Across the 21 jurisdictions surveyed, five distinct custody models have emerged. No jurisdiction relies on a single model exclusively; most employ a hybrid approach adapted to their existing financial market infrastructure. A sixth pattern -- the offshore structuring venue that channels tokenized instruments into existing funds/securities regimes while deferring market-infrastructure and settlement to onshore venues -- has crystallised with the addition of the Cayman Islands and the British Virgin Islands (BVI).

Model A: Traditional CSD Custody Adapted for DLT

Under this model, the existing CSD infrastructure is extended to accommodate DLT-based instruments. The CSD remains the authoritative record-keeper, but may use distributed ledger technology as an internal operating layer or as a parallel record alongside traditional book-entry systems.

Jurisdictions:

EU (CSDR framework),

France (Euroclear D-FMI),

Luxembourg (Clearstream D7, Control Agent),

Ireland (EU CSDR / T2S fund-domicile),

Hong Kong (CMU integration)

The

EU Central Securities Depositories Regulation (CSDR, Regulation EU 909/2014) requires that transferable securities admitted to trading on regulated markets be recorded in book-entry form in a CSD. The DLT Pilot Regime (Regulation EU 2022/858) grants targeted exemptions from CSDR book-entry requirements where these are incompatible with DLT, but the CSD remains the anchor institution. As of early 2026, CSD Prague holds the first DLT Settlement System (DLT SS) authorization under the Pilot Regime, issued 11 October 2024.

In

Luxembourg, Clearstream launched its D7 DLT platform in late 2025 following successful ECB 2024 trials. D7 DLT is fully CSDR-compliant and built on distributed ledger technology with Google Cloud as infrastructure partner, initially focusing on commercial paper and medium-term notes for international market clients. Clearstream aims to extend D7 to electronic shares by H2 2026. Luxembourg's Blockchain Law IV (19 December 2024) added a flexible Control Agent role as an alternative to the traditional Central Account Keeper (CAK), permitting direct crediting to investor accounts; Investre became the first authorised Control Agent on 21 July 2025.

Ireland participates in this model not through a domestic equities CSD -- it has none following the Euronext Dublin migration -- but as the EU's dominant money-market-fund and ETF domicile. Tokenised financial instruments settle within the EU CSDR / TARGET2-Securities (T2S) / DLT Pilot framework, and Irish-domiciled MMFs underlie external tokenisation platforms (e.g. J.P. Morgan Kinexys, Archax) rather than a CBI-authorised on-chain CSD.

Source: ESMA DLT Pilot Regime; Clearstream D7 DLT Launch

Model B: Dedicated Crypto/DLT Custodian License

Under this model, a jurisdiction creates a bespoke licensing category for entities that custody digital assets, distinct from traditional CSD or bank custody licenses.

Jurisdictions:

Switzerland (FINMA-supervised),

Singapore (CMS license for custodial services),

Germany (BaFin crypto custody license),

Liechtenstein (TVTG Token Depositary/Key Custodian),

Brazil (BCB SPSAV custody modality),

Bahrain (CBB CRA Category 2),

UAE (VARA / DFSA custody), Abu Dhabi (ADGM) (FSRA DSF),

Cayman Islands (VASP custody licence), BVI (VASP safekeeping)

Germany introduced a standalone crypto custody license (Kryptoverwahrgeschaft) under KWG Section 1(1a) sentence 2 no. 6, requiring BaFin authorization and a minimum capital of EUR 150,000. This covers the custody, administration, and safeguarding of crypto assets or private cryptographic keys. Firms such as Cashlink Technologies GmbH and Finoa GmbH hold this license.

In

Singapore, the Monetary Authority of Singapore (MAS) requires a Capital Markets Services (CMS) license for custodial services relating to tokenized capital markets products. MAS takes a notably broad view: an entity may be regarded as providing custodial services where it has the ability to control access to a token, including through holding one of several private keys or key shards, even without sole or exclusive control. This captures multi-signature wallet arrangements and threshold key management schemes.

Liechtenstein's Token and Trustworthy Technologies Act (TVTG) originally defined two custodial roles -- TT Key Custodian (storing private cryptographic keys) and TT Token Depositary (safekeeping tokens). These were merged into a single custodian role in the 2024 TVTG Refit to harmonize with MiCAR's custody requirements; Celsion Bank AG (Vaduz) now provides segregated-account digital-asset custody under MiCAR Art. 60(1) (authorized 13 March 2026).

The model has spread across the Gulf and the offshore centres.

Bahrain's Central Bank of Bahrain (CBB) Crypto-Asset Module licenses custody under Category 2 (BHD 100,000), requiring segregation of client assets, independent custody, regular reconciliation, and insurance/compensation arrangements. In the

UAE, custody is licensed per zone -- VARA's custody-services category in Dubai, the DFSA's investment-token custodian in DIFC, and CBUAE payment-token custodian licenses federally. Abu Dhabi (ADGM) requires a separately licensed legal entity (a Digital Securities Facility, "DSF", holding an FSP for Providing Custody, or a Recognised Clearing House) -- a stricter posture than its virtual-asset regime. The

Cayman Islands introduced a VASP custody licence (Phase 2, effective 1 April 2025) mandating segregation of client virtual assets from proprietary assets, custody contracts, and cybersecurity controls; notably, its March 2026 tokenised-funds framework imposes no additional custodian mandate solely for tokenisation. The BVI VASP Act (Section 27) requires written safekeeping arrangements with client assets identified, segregated, and accounted for, while expressly recognising that ownership follows private-key control (unhosted wallets excepted).

Source: BaFin Crypto Custody Guidance; MAS Guide on Tokenisation of CMPs

Model C: Self-Custody with Legal Recognition

Under this model, the legal framework recognizes that a holder who controls the private key to a tokenized asset has a direct, legally enforceable property right -- without requiring an intermediary custodian.

Jurisdictions:

Switzerland (Art. 242a DEBA + uncertificated register securities),

Liechtenstein (TVTG right of disposal), BVI (ownership follows private-key control under SIBA/VASP property analysis),

UK (Property (Digital Assets etc) Act 2025 -- third category of personal property)

Switzerland represents the global gold standard for this model. The DLT Act created "DLT securities" (DLT-Registerwertrechte) under Article 973d et seq. of the Swiss Code of Obligations -- a new category of securities that exist natively on a DLT register and can be transferred by the holder directly without an intermediary. Combined with Art. 242a of the Debt Enforcement and Bankruptcy Act (DEBA), which provides bankruptcy segregation for crypto-based assets, Swiss law enables a direct holding model with statutory property protection. An individual holding the private key to a DLT security has a legally enforceable ownership claim that cannot be overridden by the insolvency of any intermediary, provided the asset was properly segregated.

Two newly surveyed jurisdictions reinforce the legal-recognition dimension of self-custody. The BVI VASP framework treats ownership of an unhosted virtual asset as following control of the private key, and excepts genuinely self-custodied (unhosted-wallet) holdings from the licensed-safekeeping regime. The

UK Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025) establishes digital assets as a distinct third category of personal property, supplying the property-law foundation on which direct-holding rights and insolvency claims over tokenized assets can rest.

Source: FINMA Guidance 01/2026 on Custody of Crypto-Based Assets; Chambers Blockchain 2025 -- Switzerland

Model D: Bank Custody Extension

Under this model, existing bank or broker-dealer licenses are extended to encompass digital asset custody without requiring a separate license category.

Jurisdictions:

US (OCC interpretive letters, SEC Rule 15c3-3),

Germany (banks as crypto securities registrars),

Canada (CIRO Digital Asset Custody Framework for member dealers)

The

US has moved aggressively toward this model since 2020. The Office of the Comptroller of the Currency (OCC) issued a series of interpretive letters establishing that national banks may custody digital assets:

In December 2025, the SEC Division of Trading and Markets issued a statement confirming that any broker-dealer that establishes control of a digital asset security via Paragraph (c) of Rule 15c3-3 (the Customer Protection Rule) can custody digital asset securities. The SEC simultaneously withdrew a July 2019 statement that had been widely viewed as prohibiting broker-dealers from offering custodial services for crypto assets, and the Special Purpose Broker-Dealer (SPBD) framework became optional in May 2025. This opened the door for traditional full-service broker-dealers to custody tokenized securities without the restrictive limitations of the SPBD framework.

Canada extends this model through its self-regulatory organisation: the Canadian Investment Regulatory Organization (CIRO) publishes a Digital Asset Custody Framework for crypto-trading-platform (CTP) dealer members, addressing technological, operational, and legal custody risks. CTPs are migrating from interim restricted-dealer registration to full investment-dealer (CIRO member) status through 2025-2026, bringing tokenized-asset custody under established member-dealer supervision rather than a bespoke license category.

Source: OCC IL 1183; OCC Clarifies Bank Authority (May 2025); SEC Statement on Custody of Crypto Asset Securities (Dec 2025)

Model E: Hybrid Traditional + Crypto Custody

Under this model, jurisdictions require or permit a combination of traditional custodial infrastructure with DLT-based custody layers, typically where the tokenized asset is "wrapped" or mirrored -- one record exists on a traditional system and a parallel tokenized representation exists on-chain.

Jurisdictions:

US (DTC tokenization pilot),

UK (DSS framework),

Japan (custody-type security tokens),

Australia (DAP/TCP framework, commences 2027)

The most significant example is the DTC Tokenization Pilot. On 11 December 2025, the SEC Division of Trading and Markets issued a no-action letter to The Depository Trust Company (DTC) permitting a three-year pilot to tokenize DTC-custodied assets on supported blockchains. DTC participants may elect to have their security entitlements recorded as tokens on distributed ledgers rather than exclusively on DTC's centralized ledger. Eligible securities include Russell 1000 constituents, US Treasuries, and major-index ETFs. The pilot launch is targeted for H2 2026, with the investor choosing traditional or tokenized form per trade. Crucially, DTC remains the "golden record" -- tokenized entitlements do not receive settlement or collateral value for DTC risk management purposes during the pilot.

In

Japan, the security token market has been dominated by "custody-type" products where a licensed Type I Financial Instruments Business Operator (FIBO) maintains custody on behalf of retail investors, with the on-chain token serving as a parallel record. Type I FIBOs must segregate client assets. Major institutions including Nomura, SBI, Daiwa, and MUFG have initiated pilots for "native" security tokens that exist entirely on-chain (the existence of these native pilots is not independently verified in the source matrix).

In

Australia, the Corporations Amendment (Digital Assets Framework) Act 2026 (Act No. 38 of 2026, Royal Assent 8 April 2026) creates two new product categories -- Digital Asset Platforms (DAPs) that hold digital tokens on trust, and Tokenised Custody Platforms (TCPs) that issue a single token conferring a right to redeem the underlying asset at a strict one-to-one ratio. The Act commences 9 April 2027 (followed by a six-month transition); the asset-holding, client-segregation, and withdrawal-right standards for DAPs/TCPs are to be set by ASIC consultation and are not yet verified.

Source: SEC No-Action Letter to DTC (Dec 2025); DTCC Tokenization Initiative; Australia Digital Assets Framework Act -- Ashurst

Model F (Emerging): Offshore Structuring / Fund-Domicile Venue

A distinct sixth pattern has surfaced with the addition of the offshore centres. Here the jurisdiction supplies a tax-neutral issuer/SPV/fund domicile and a proportionate VASP custody regime, but deliberately leaves securities-market infrastructure, on-chain settlement, and retail distribution to onshore venues.

Jurisdictions:

Cayman Islands (tokenised-funds framework, Mar 2026), BVI (SIBA/VASP structuring venue)

The

Cayman Islands enacted a purpose-built tokenised-funds framework (Mutual Funds, Private Funds, and VASP Amendment Acts 2026, in force 24 March 2026) that channels "digital equity tokens" and "digital investment tokens" into the existing funds and securities-investment-business (SIBA) regimes and excludes tokenised-fund issuance from the VASP "issuance of virtual assets" perimeter, removing dual-licensing risk. Nine tokenised investment funds were conditionally registered with CIMA by 29 April 2026. The BVI runs a SIBA/VASP dual framework with a flexible BVI Business Company vehicle, English common law (UK Privy Council final appeal), and tax neutrality; 14 VASPs were registered with the FSC as at 30 July 2025. Neither jurisdiction operates a DLT market-infrastructure pilot regime, a domestic securities exchange for tokenized RWA secondary trading, or a mandated on-chain settlement regime.

Source: Cayman Islands Monetary Authority (CIMA) -- VASP / Funds; BVI Financial Services Commission -- VASP Act

2. Settlement Finality

Settlement finality -- the moment at which a transfer of a financial instrument becomes irrevocable and unconditional -- is a foundational concept in financial market infrastructure. For traditional securities, finality is well-defined through statutory frameworks such as the EU Settlement Finality Directive (98/26/EC) and the UK Settlement Finality Regulations. For DLT-based instruments, the question of when a blockchain transaction is "final" introduces novel legal and technical challenges.

2.1 When Is a Blockchain Transaction Legally Final?

On a public proof-of-stake blockchain (such as Ethereum post-Merge), a transaction achieves "probabilistic finality" after a certain number of block confirmations, and "economic finality" when reversal would require an attacker to forfeit economically prohibitive amounts of staked capital. On permissioned ledgers (such as R3 Corda or Hyperledger Fabric), transaction finality can be deterministic -- once the consensus protocol commits a transaction, it cannot be reversed. (Canada's Project Samara, for instance, ran bond and cash legs on separate Hyperledger Fabric ledgers to achieve near-instant atomic settlement.)

No jurisdiction has yet enacted legislation that defines finality by reference to a specific number of block confirmations or consensus mechanism. Instead, regulators have adopted one of four approaches:

1. Definitional approach: Define finality by reference to the rules of the designated settlement system, requiring the system operator to specify when finality occurs (EU proposed Settlement Finality Regulation).
2. Sandbox approach: Suspend or modify existing finality requirements during a testing period and allow the sandbox operator to define finality rules (UK DSS, EU DLT Pilot Regime, Ireland DLT Pilot).
3. Existing-law approach: Apply existing settlement finality rules without modification, requiring tokenized settlement to conform to traditional definitions (US, Singapore, Japan, Bahrain).
4. Register-effect approach: Define transfer/finality by the moment of debit/credit in a statutory electronic securities register (South Korea amended AERSB; ADGM RCH/DSF irrevocable-transfer standard).

A large group of jurisdictions has no DLT-specific settlement-finality regime at all as of 4 June 2026 -- either because the question is not addressed (Cayman Islands, BVI, Liechtenstein, Bahrain, Brazil, Japan, South Korea for DvP) or because settlement defers to onshore/EU rails (Luxembourg, Ireland for live infrastructure).

2.2 EU Settlement Finality Framework

The existing Settlement Finality Directive (SFD, 98/26/EC) provides legal certainty as to when transfer orders entered into designated securities settlement systems become irrevocable and when settlement is final. This protection insulates participants from insolvency proceedings affecting other participants. It governs the EU member states surveyed here -- including

Germany,

France,

Luxembourg and

Ireland -- and reaches

Liechtenstein via the EEA Agreement.

The DLT Pilot Regime provides targeted exemptions from the SFD where DLT-based settlement mechanisms cannot readily be designated as systems under the traditional framework. DLT settlement system operators must still ensure equivalent levels of settlement protection.

In December 2025, the European Commission adopted the Market Integration and Supervision Package (4 December 2025), which includes converting the Settlement Finality Directive into a directly applicable Settlement Finality Regulation (SFR). The proposed SFR establishes clear, harmonized rules for three critical moments:

1. When a transfer order enters the system
2. When it becomes irrevocable
3. When settlement is final -- defined as the moment when the discharge of the respective obligations of the parties to a transaction is completed in an unconditional and irrevocable manner

The proposed Regulation maintains a technology-neutral approach. For DLT systems specifically, the SFR requires that a DLT system "shall implement mechanisms guaranteeing deterministic and legally enforceable finality moments." Trilogue negotiations are expected throughout 2026, with adoption likely in late 2026 or 2027.

Source: EU Market Integration Package -- Ashurst; Bird & Bird -- Market Integration Package; European Commission -- Market Integration Package

2.3 UK Digital Securities Sandbox (DSS) Approach

The

UK Digital Securities Sandbox, established under Sections 13-17 of FSMA 2023 and operational since 8 January 2024, adopts a pragmatic approach to settlement finality. Digital Securities Depositories (DSDs) operating within the DSS are not required to obtain designation under the UK Settlement Finality Regulations (the UK's retained version of the EU SFD). Instead, they must disclose the rules governing settlement finality that apply to their securities settlement system, ensuring users understand the level of investor protection available. Notably, the FCA intends to disapply the commercial-settlement-system exemption for cryptoasset DvP, and money in a DvP transaction involving cryptoassets is treated as client money even where settled DvP.

The Bank of England has stated it will continue to engage with industry to develop solutions to mitigate the risks that public permissionless ledgers pose to settlement finality and operational resilience. The Bank's Project Meridian explored atomic transactions between central bank money and tokenised securities, and the Bank/FCA joint Call for Input (18 May 2026) targets a live synchronisation service by 2028.

HM Treasury has signalled willingness to make broader permanent changes to the Financial Collateral Arrangement Regulations and Settlement Finality Regulations if the DSS demonstrates the need. As of latest dashboard data, 16 firms hold Gate 1 Sandbox Approval Notices, including HSBC, J.P. Morgan, Euroclear, Tradeweb, and LSEG B3, but no firm has yet progressed to Gate 2; the DSS is operational until December 2028.

Source: Bank of England -- DSS Guidance; Bank of England -- DSS Dashboard

2.4 Swiss SDX Settlement

Switzerland operates the most advanced production-grade DLT settlement infrastructure globally. SIX Digital Exchange (SDX), licensed by FINMA as both a stock exchange and CSD, provides atomic settlement -- simultaneous delivery-versus-payment (DvP) where both the asset leg and cash leg of a transaction occur on-ledger in a single atomic operation.

Under Project Helvetia III (live since 1 December 2023, extended to at least mid-2027), the Swiss National Bank (SNB) issues tokenized Swiss franc wholesale CBDC on the SDX platform for settlement of digital bond transactions.

In June 2025, the SNB announced two expansions: (1) a second settlement approach via an RTGS link connecting to the existing SIC payment system, providing an alternative to the wCBDC approach; and (2) connection of BX Digital AG to the Helvetia III infrastructure. BX Digital -- the sole (small) DLT trading facility licensed by FINMA (12 March 2025, effective 14 May 2025) -- itself performs DvP via smart contracts on Ethereum.

Source: SNB -- Project Helvetia; BIS -- Project Helvetia; SDX -- wCBDC Pilot

2.5 Atomic Settlement and On-Chain DvP

Atomic settlement represents the most significant structural innovation that tokenization offers to post-trade infrastructure. In an atomic settlement, the transfer of the security and the transfer of payment occur simultaneously in a single indivisible operation. If either leg fails, neither is executed. This eliminates settlement risk, counterparty credit risk during the settlement window, and the need for central counterparty clearing in many scenarios.

Jurisdictions and platforms implementing or piloting atomic settlement:

The ECB's dual-track strategy (announced 1 July 2025) is particularly significant. Pontes will offer Eurosystem DLT-based settlement in central bank money from end Q3 2026 by linking DLT platforms to the TARGET Services infrastructure. Appia, the long-term track, aims to design the next generation of Europe's financial infrastructure with an early 2028 target launch. On 12 March 2026, the ECB published its Appia roadmap describing Appia as "a highway for the future of Europe's digital finance."

Three of the four newly integrated jurisdictions sit at distinct points on this spectrum. Abu Dhabi (ADGM) supplies a production-ready regulatory capability for atomic/instantaneous DvP through its DSF and Remote-Clearing-House framework (see Section 2.6).

Ireland's atomic-DvP work is prospective only: the Central Bank of Ireland's Discussion Paper 12 (5 March 2026) envisages atomic DvP settlement of tokenised ETFs against wholesale CBDC, but no live Irish DLT settlement system existed as of 4 June 2026. The

Cayman Islands and BVI have no on-chain settlement, CSD, or atomic-DvP framework; settlement of tokens issued through Cayman/BVI vehicles occurs on the underlying blockchain under general contract/property law and operator-approved transfers, not under any domestic finality statute.

Source: ECB -- Dual-Track DLT Settlement (July 2025); ECB Appia Roadmap (March 2026); ECB -- Pontes Launch Q3 2026

2.6 ADGM Settlement: DvP via Separated Clearing and Trading

Abu Dhabi (ADGM) codifies settlement finality through structural separation rather than a sandbox. Under the Financial Services and Markets Regulations 2015 (FSMR) and FSRA Rulebooks, delivery-versus-payment -- an irrevocable, unconditional transfer -- is the settlement standard, and it must be effected through a Recognised Clearing House (RCH) or a Digital Securities Facility (DSF). A trading venue may not self-settle within the same legal entity, and Remote Clearing Houses are not permitted. The DSF supports instantaneous/atomic DvP; for atomic DvP, the FSRA may deem certain default-management requirements inapplicable, while end-of-day or T+n delayed DvP scales MIR Chapter 4 obligations to the settlement horizon. CSD-type functions are performed under COBS Chapter 10, with independent third-party reconciliation that custody holdings match records at least annually.

Source: ADGM FSRA Rulebooks (FSMR, MIR, COBS); FSRA Digital Securities Guidance

3. CSD Requirements

3.1 CSDR Applicability to Tokenized Securities

Under the

EU CSDR (Regulation EU 909/2014), transferable securities admitted to trading on regulated markets must be recorded in book-entry form in a CSD. This requirement applies regardless of whether the security is issued on a blockchain, and binds every EU member state surveyed --

Germany,

France,

Luxembourg and

Ireland -- plus

Liechtenstein via the EEA. Consequently, a tokenized bond admitted to trading on a regulated market must, in principle, be entered into a CSD's records.

This creates a fundamental tension: DLT-based securities may not fit neatly into the CSDR's account-based book-entry model. The DLT Pilot Regime resolves this by permitting DLT settlement systems to use distributed ledger records instead of traditional securities accounts where book-entry use is incompatible with DLT.

The Market Integration Package (adopted 4 December 2025) proposes explicitly authorizing CSDs to use distributed ledger technology and permitting settlement using MiCA-authorized e-money tokens, reducing the need for exemptions under the Pilot Regime.

3.2 DLT Pilot Regime CSD Exemptions

The DLT Pilot Regime creates three categories of DLT market infrastructure with varying CSD requirements:

Key CSD-related exemptions available under the Pilot Regime:

• Book-entry requirements: DLT records may substitute for traditional securities accounts
• Participant requirements: Broader range of entities may participate directly in DLT settlement (not limited to traditional CSD participants)
• Intermediary layers: Reduced need for multi-tier intermediary chains

As of January 2026, six entities hold DLT Pilot Regime authorizations per the ESMA register: CSD Prague (DLT SS, October 2024), 21X AG (DLT TSS, December 2024, Germany), 360X AG (DLT MTF, April 2025, Germany), Axiology (Lithuania), LISE SA (DLT TSS, France, 13 October 2025), and Securitize (DLT TSS, Spain/CNMV, November 2025).

France's LISE SA holds and settles tokens itself under the integrated TSS model (CSD exemption);

Ireland is the competent authority for any Irish DLT-MTF/SS but has no live authorised infrastructure. In June 2025, ESMA recommended making the regime permanent, and the Market Integration Package proposes raising the maximum aggregated market-value threshold from EUR 6 billion to EUR 100 billion.

Source: ESMA Report on DLT Pilot Regime (June 2025); AMF -- DLT Pilot Regime

3.3 National CSD Approaches

SDX (Switzerland)

SIX Digital Exchange AG holds a CSD license under FMIA Art. 61 ff., making it the world's first fully regulated CSD operating on distributed ledger technology. SDX provides an integrated value chain from issuance and trading through to settlement and custody of tokenized assets. The SDX CSD license is a traditional financial market infrastructure license, not a DLT trading facility license -- reflecting Switzerland's decision to regulate SDX under existing FMI law rather than the newer DLT trading facility category.

Clearstream D7 (Luxembourg / Germany)

Deutsche Borse's Clearstream launched D7 DLT in late 2025, a CSDR-compliant tokenized securities platform using DLT. D7 DLT enables issuance of tokenized securities directly onto the DLT while maintaining full CSDR compliance. The platform integrates with Deutsche Borse Group's 360X DLT MTF for trading of natively DLT-issued securities. Initial focus: commercial paper and medium-term notes, with electronic shares planned for H2 2026.

Hong Kong CMU

The

Hong Kong Monetary Authority's Central Moneymarkets Unit (CMU) serves as the government bond settlement system. Under the Digital Green Bond Grant Scheme (DBGS) -- the third HKSAR digital green bond reaching HKD 10 billion (multi-currency) in November 2025 -- the CMU integrates with DLT-based issuance platforms.

KSD / KDX (South Korea)

South Korea's Korea Securities Depository (KSD) remains the traditional depository, and the amended Electronic Securities Act (AERSB, passed 15 January 2026, effective January 2027) makes KSD registration mandatory for security-token issuers, with transfer effective on debit/credit in the electronic register. A dedicated KRX security-token market and the KDX consortium (KRX-led, preliminary designation 13 February 2026) are being prepared -- a notably more centralized CSD model than Singapore's or the UAE's.

Offshore: no domestic CSD (Cayman Islands, BVI, Ireland for equities)

The

Cayman Islands and BVI operate no DLT CSD and no recognised securities exchange for tokenized RWA secondary trading; tokenised fund interests are transferred via operator-approved transfers reconciled to book-entry registers.

Ireland likewise has no domestic equities CSD following the Euronext Dublin migration, relying entirely on EU CSDR / T2S rails.

Source: Clearstream D7 DLT Launch; FINMA -- SDX Approval (Sep 2021)

4. Comparative Analysis Table

The following table summarizes custody, settlement, and CSD requirements across all 21 surveyed jurisdictions.

5. Bankruptcy Protection and Asset Segregation

5.1 Swiss Art. 242a DEBA -- The Gold Standard

Switzerland's Art. 242a DEBA, introduced by the DLT Act (Phase 2, effective 1 August 2021), establishes the most robust statutory framework for bankruptcy protection of tokenized assets held with custodians.

Under Art. 242a DEBA, crypto-based assets are segregated from the bankruptcy estate of a custodian when:

1. The custodian has undertaken to keep the assets available for the client at all times; and
2. The assets can be attributed to the individual client or to a community of co-owners with known individual shares.

Key features:

• Applies to both individual and pooled (omnibus) accounts, provided the above conditions are met
• Properly segregated assets are off-balance-sheet and exempt from capital requirements
• Payment tokens held in omnibus accounts require the custodian to hold a FinTech or banking license
• Protection extends to assets held by sub-custodians, provided the sub-custodian is prudentially supervised and foreign law guarantees equivalent bankruptcy protection

On 12 January 2026, FINMA published Guidance 01/2026 on custody of crypto-based assets, which reinforced these requirements and imposed additional obligations on financial institutions, including per-client segregation expectations. For foreign custodian delegation, FINMA requires that the foreign custodian be subject to prudential supervision and that foreign law guarantees bankruptcy protection. Where no foreign custodian meets these standards, delegation is permitted only with comprehensive client risk disclosures and documented written consent.

Source: FINMA Guidance 01/2026; MLL -- FINMA Guidance 01/2026; Mondaq -- FINMA Guidance 01/2026

5.2 EU CSDR and MiCA Segregation

Under CSDR, CSDs must offer both omnibus and individual client segregation at the level of the CSD. Participants must offer at least omnibus client segregation and must inform clients of the costs and risks associated with each level. This binds the EU member states surveyed --

Germany,

France,

Luxembourg,

Ireland -- and reaches

Liechtenstein via the EEA.

For tokenized securities under MiCA, CASPs providing custody must:

• Maintain a custody policy with documented segregation arrangements
• Ensure client crypto-assets are segregated from own assets on-chain and off-chain
• Not use client crypto-assets for the CASP's own account without prior written consent
• Record client entitlements in a register, with positions reconciled regularly

The MiFID II framework for custody of financial instruments (including tokenized securities classified as such) imposes additional requirements through the Delegated Directive, including the use of registered custodians/sub-custodians, due diligence on third-party custodians, and client asset reconciliation. In

Ireland, the Central Bank applies MiFID Client Asset Requirements (CAR) and MiCAR Art. 75 with daily reconciliation, and -- because Ireland is principally a fund domicile -- depositary and valuation safeguards are central for tokenised funds. In

Luxembourg, the central administration agent must reconcile the DLT register with transfer-agent records under depositary oversight.

Liechtenstein's Celsion Bank AG provides MiCAR Art. 60(1) segregated-account digital-asset custody.

5.3 US SEC Rule 15c3-3 for Security Tokens

SEC Rule 15c3-3 (the Customer Protection Rule) requires broker-dealers to maintain possession or control of customer securities. The December 2025 guidance from the SEC Division of Trading and Markets confirmed that broker-dealers may deem themselves to have "physical possession" of crypto asset securities carried for customers, provided they:

• Maintain access to the crypto asset security and the capability to transfer it on the associated DLT
• Maintain policies, procedures, and controls reasonably designed to protect private keys, consistent with industry best practices
• Ensure the crypto asset security is not subject to any lien, charge, or claim of any third party

For registered investment advisers, the SEC Custody Rule (Rule 206(4)-2) requires that client assets be held with a qualified custodian. On 30 September 2025, the SEC Division of Investment Management issued a no-action letter confirming that RIAs may treat certain state-chartered trust companies as "banks" for custody of crypto-assets, subject to conditions including state regulatory examination and adequate capital.

The rescission of SAB 121 (replaced by SAB 122 in January 2025) was equally consequential. SAB 121 had required entities safeguarding crypto assets to recognize the full value of client crypto assets as both an asset and a liability on their balance sheets, making crypto custody operationally infeasible for SEC-reporting banks. SAB 122 eliminated this requirement, aligning crypto custody accounting with traditional custody practices.

Source: SEC Statement on Custody (Dec 2025); Sidley Austin -- SEC Crypto Custody Guidance; SEC No-Action Letter -- State-Chartered Trust Companies (Sep 2025)

5.4 Offshore and Gulf Segregation Regimes

The newly integrated jurisdictions rely on regulatory rather than statutory-insolvency segregation. The

Cayman Islands VASP custody licence (Phase 2) and the BVI VASP Act (Section 27) both require client virtual assets to be identified, segregated from proprietary assets, and accounted for separately; the BVI also prohibits encumbering client deposits absent agreement and recognises that ownership follows private-key control, though it provides no general statutory investor-compensation scheme. Cayman's 2026 tokenised-funds framework adds a parity rule (tokenised rights equal traditional rights) and operator-approved-transfer controls, with CIMA inspection rights. In the Gulf,

Bahrain's CRA mandates segregation, independent custody, reconciliation, and insurance/compensation arrangements; Abu Dhabi (ADGM) requires legal-entity segregation between trading and custody/settlement, with independent third-party verification at least annually that custody holdings match records; and the broader

UAE mandates per-zone segregation (ADGM legal-entity custody, VARA AML/risk rulebook, ARVA reserve management).

5.5 How Omnibus vs. Individual Segregation Works On-Chain

The traditional distinction between omnibus and individual segregation takes on new characteristics in a DLT context:

Individual segregation on-chain: Each client's assets are held in a separate blockchain address (wallet) controlled by the custodian. The on-chain record provides a transparent, immutable audit trail of client-specific holdings. This approach provides the strongest protection but increases operational complexity and gas costs on public blockchains.

Omnibus segregation on-chain: Multiple clients' assets are held in a single blockchain address, with the custodian maintaining an off-chain record of each client's entitlement. The on-chain record shows total holdings; individual attribution requires the custodian's internal records. This is operationally simpler but creates trust dependencies: if the custodian's internal records are lost or corrupted, proving individual client entitlements may be difficult.

Hybrid approaches: Several custodians employ smart-contract-based segregation, where a single smart contract maintains a mapping of client addresses to entitlements. This provides on-chain attribution (addressing the auditability concern of pure omnibus) while reducing operational overhead compared to fully separate wallets.

The Swiss Art. 242a DEBA framework explicitly accommodates both individual and omnibus approaches, requiring only that the assets be "attributable" to the individual client or to a community of co-owners; FINMA Guidance 01/2026 now overlays per-client segregation expectations.

Singapore's PS Regulations go further, requiring distinct blockchain addresses for customer versus proprietary assets (and a trust account for digital payment tokens).

6. What Works and What Does Not

What Works

Statutory bankruptcy segregation (Switzerland). Art. 242a DEBA provides the clearest, most enforceable framework for protecting tokenized asset holders in custodian insolvency. Its explicit coverage of both individual and omnibus accounts, combined with off-balance-sheet treatment, creates strong incentives for proper segregation. Other jurisdictions should consider similar statutory approaches rather than relying solely on regulatory guidance.

Property-law foundation for direct holding (UK). The UK Property (Digital Assets etc) Act 2025 establishing digital assets as a third category of personal property supplies the doctrinal base -- absent in most common-law systems -- on which self-custody rights and insolvency claims can rest, complementing the BVI's private-key-control recognition.

Atomic settlement with central bank money (SDX/Project Helvetia III). The Swiss production pilot demonstrates that atomic DvP settlement of tokenized bonds using wholesale CBDC is technically and legally feasible at institutional scale. The SNB's extension to mid-2027 and addition of an RTGS link reflect institutional confidence.

Structurally separated DvP clearing (ADGM). ADGM's requirement that settlement run through an RCH or DSF distinct from the trading venue -- with Remote Clearing Houses prohibited and atomic DvP expressly supported -- shows a clean way to import settlement-finality discipline into a DLT venue without a sandbox.

DLT-native CSD licensing (SDX, Clearstream D7). Both SDX (licensed 2021) and Clearstream D7 (launched 2025) demonstrate that existing CSD regulatory frameworks can accommodate DLT without requiring entirely new legal categories. This preserves investor familiarity and regulatory oversight while enabling technological innovation.

Broad custodial scope definition (Singapore). MAS's definition of custodial services to include any entity that can control access to a token -- including multi-sig key holders -- prevents regulatory arbitrage through technical structuring. This approach correctly focuses on economic substance over form.

Bank custody extension (US OCC letters + SEC Rule 15c3-3 guidance). Removing barriers for traditional banks and broker-dealers to custody tokenized assets brings institutional infrastructure, balance sheet strength, and operational expertise to the market. The coordinated 2025 actions (OCC IL 1183/1184, SEC custody statement, SAB 122) represent the most significant deregulatory step for institutional tokenized asset adoption.

Dual-licensing relief for fund tokenisation (Cayman Islands). Cayman's March 2026 tokenised-funds framework channels tokenised fund interests into the existing funds/SIBA regimes and excludes them from the VASP issuance perimeter, eliminating the dual-licensing trap -- a clean template for offshore fund domiciles.

What Does Not Work

Settlement finality ambiguity for public blockchains. No jurisdiction has satisfactorily resolved the legal status of probabilistic finality on public proof-of-stake blockchains. The EU's proposed Settlement Finality Regulation requires "deterministic and legally enforceable finality moments," which may effectively exclude public blockchains that cannot guarantee deterministic finality -- an unresolved tension given that high-profile issuances (Siemens EUR 300M bond, KfW, NRW.BANK EUR 100M on Polygon) use public chains. Hong Kong's response -- requiring offering documents to disclose on/off-chain finality and to avoid public permissionless ledgers absent additional controls -- illustrates the same caution.

Settlement-finality silence in offshore and emerging regimes. A large bloc --

Cayman Islands, BVI,

Liechtenstein,

Bahrain,

Brazil,

Japan -- has no DLT-specific settlement-finality rule at all, leaving on-chain settlement of tokens issued through these venues to general contract/property law. This is workable for a structuring layer but offers no systemic-finality protection of the kind the SFD provides.

CSD bottleneck for listed tokenized securities (EU CSDR). The CSDR requirement for CSD intermediation creates friction for tokenized securities that could otherwise be settled peer-to-peer or through DLT-native mechanisms. While the DLT Pilot Regime provides exemptions, only six entities obtained authorization after three years, suggesting that the exemption process itself remains a barrier.

Fragmented custody licensing across EU member states. Despite MiCA's harmonization of CASP custody licensing, custody of tokenized financial instruments remains governed by MiFID II (at the member-state level), creating divergent requirements for the same economic activity depending on whether the asset is classified as a crypto-asset or a financial instrument. The Market Integration Package partially addresses this.

Accounting treatment barriers (historical). The now-rescinded SAB 121 in the

US demonstrated how accounting rules -- not securities law -- can be the binding constraint on custody services. For over two years, SAB 121 effectively prevented US banks from offering crypto custody despite having legal authority to do so. This illustrates the need for regulators to coordinate across prudential, conduct, and accounting frameworks.

Failed DLT infrastructure projects (Australia ASX CHESS). The Australian Securities Exchange's abandonment of its DLT-based CHESS replacement in November 2022 (after a ~AUD 250 million write-down) remains the most prominent failure of DLT integration into core securities infrastructure; the non-DLT replacement (Release 1 go-live H1 2026, settlement Release 2 targeted 2029) has diminished near-term expectations for DLT adoption in Australia's post-trade environment.

Brazil Drex blockchain abandonment. In late 2025, the Banco Central do Brasil concluded after extended testing that blockchain technology "did not prove viable" for Drex, citing technical maturity and privacy readiness; Drex Phase 1 (2026) proceeds with a centralized settlement model, illustrating the gap between blockchain hype and production readiness for central bank infrastructure.

7. Recommended Framework

Based on the comparative analysis of all 21 jurisdictions, the following tiered custody framework is recommended for regulators designing or updating their approach to tokenized RWA custody and settlement.

Tier 1: Statutory Foundation

Every jurisdiction should enact legislation that:

1. Defines custodial control broadly to include any entity that can unilaterally or jointly control access to a tokenized asset, including through private key management, multi-signature arrangements, or threshold key schemes. (Precedent: Singapore MAS Guide on Tokenisation of CMPs.)

2. Establishes bankruptcy segregation by statute -- not merely by regulatory guidance -- ensuring that properly segregated tokenized assets held by a custodian are excluded from the custodian's insolvency estate. (Precedent: Switzerland Art. 242a DEBA.)

3. Recognizes DLT records as legally valid evidence of ownership for both direct and indirect holding patterns, and supplies a property-law category for digital assets. (Precedent: Germany eWpG legal fiction of movable property; Switzerland DLT securities under CO Art. 973d; UK Property (Digital Assets etc) Act 2025; BVI private-key-control recognition.)

4. Defines settlement finality in technology-neutral terms that accommodate DLT-based systems, specifying the moments of entry, irrevocability, and finality. (Precedent: EU proposed Settlement Finality Regulation; South Korea register-effect finality under amended AERSB.)

Tier 2: Licensing and Supervision

1. License crypto/DLT custodians under a dedicated or extended licensing regime with capital requirements proportionate to custody volume. (Precedent: Germany BaFin crypto custody license, EUR 150,000 minimum; EU MiCA CASP Class 2, EUR 125,000 minimum; Bahrain CRA Category 2; Cayman/BVI VASP custody.)

2. Permit qualified banks and broker-dealers to extend existing custody services to tokenized assets without requiring a separate license, subject to demonstrating adequate operational and cybersecurity controls. (Precedent: US OCC interpretive letters and SEC Rule 15c3-3 guidance; Canada CIRO Digital Asset Custody Framework.)

3. Require prudential supervision of custodians holding tokenized assets above specified thresholds, with escalating requirements (capital, governance, IT security, disaster recovery) proportional to custody volume. (Precedent: Switzerland FMIA tiered capital requirements for DLT trading facilities; ADGM DSF prudential standards.)

Tier 3: Interoperability and Settlement

1. Facilitate settlement in central bank money for institutional-scale tokenized asset transactions, either through wholesale CBDC issuance on DLT platforms or through bridge mechanisms linking DLT systems to existing RTGS infrastructure. (Precedent: Swiss Project Helvetia III; ECB Pontes/Appia; Germany Bundesbank Trigger Solution; France Banque de France DL3S; Canada Project Samara.)

2. Permit atomic (DvP) settlement as a recognized settlement method, with legal clarity that atomic settlement constitutes delivery and payment for the purposes of settlement finality legislation, and structural separation between trading and clearing. (Precedent: SDX atomic settlement; ADGM RCH/DSF separation; ECB exploratory work.)

3. Enable CSD participation in DLT without requiring CSDs to abandon existing infrastructure, allowing gradual migration through hybrid models. (Precedent: Clearstream D7 DLT; Luxembourg Control Agent role; DTC Tokenization Pilot.)

Tier 4: Cross-Border Coordination

1. Adopt UNIDROIT Principles on Digital Assets and Private Law (published October 2023) as a basis for harmonizing private law treatment of tokenized assets across jurisdictions, particularly regarding custody, transfer, and insolvency. (Precedent: 75+ UNIDROIT member states.)

2. Recognize foreign custodial arrangements where the foreign custodian is subject to equivalent prudential supervision and the foreign jurisdiction provides equivalent bankruptcy protection. (Precedent: FINMA Guidance 01/2026 foreign custodian requirements; ADGM IOSCO MMoU reliance.)

Source: UNIDROIT Principles on Digital Assets and Private Law (Oct 2023); IOSCO Policy Recommendations for Crypto and Digital Asset Markets (Nov 2023)

8. Decision Matrix

The following decision matrix assists regulators and market participants in determining the appropriate custody and settlement framework based on asset type, market context, and regulatory objectives.

Decision Matrix A: Custody Model Selection

Decision Matrix B: Settlement Approach Selection

Decision Matrix C: Segregation Model Selection

Verification Notes

All factual claims in this document were verified against the canonical rwa-regulation-fact-matrix.json (per-jurisdiction t5 facts for all 21 jurisdictions) and the underlying source-regulation files. Aggregates ("six DLT Pilot authorizations", "21 jurisdictions") are derived from the matrix. This refresh integrated four newly surveyed jurisdictions -- Cayman Islands, British Virgin Islands, Ireland, and Abu Dhabi (ADGM) -- across every model bucket, settlement table, CSD section, comparative table row, and decision matrix.

Verified Claims

1. Swiss Art. 242a DEBA bankruptcy segregation: Verified via FINMA Guidance 01/2026, Mondaq analysis, CMS LawNow analysis, and Chambers Blockchain 2025 Switzerland. Art. 242a provides bankruptcy segregation for crypto-based assets where the custodian has undertaken to keep assets available and assets are individually attributable; FINMA Guidance 01/2026 overlays per-client segregation expectations.

2. EU DLT Pilot Regime authorizations and CSDR exemptions: Per the matrix, six authorizations as of the ESMA register (January 2026): CSD Prague (Oct 2024), 21X AG (Dec 2024), 360X AG (Apr 2025), Axiology (Lithuania), LISE SA (France, 13 Oct 2025), Securitize (Spain/CNMV, Nov 2025). Verified via ESMA DLT Pilot Regime page and ESMA Article 14 Report (June 2025).

3. EU Settlement Finality Regulation proposal (Market Integration Package, adopted 4 Dec 2025): Verified via Ashurst analysis, Bird & Bird analysis, and European Commission publication. Proposed conversion of SFD to directly applicable Regulation with technology-neutral finality definitions, plus DLT threshold EUR 6B to 100B, confirmed.

4. SEC Rule 15c3-3 guidance for digital assets (Dec 2025); SPBD optional since May 2025; SAB 121 rescinded by SAB 122 (Jan 2025): Verified via SEC Division of Trading and Markets statement and Sidley Austin analysis. US tokenized trades settle conventionally T+1 via NSCC/DTC; there is no statutory on-chain atomic settlement-finality regime.

5. OCC interpretive letters (IL 1170, 1183, 1184): Verified via OCC IL 1183, OCC IL 1184, and OCC press release (May 2025).

6. DTC Tokenization Pilot no-action letter (Dec 2025): Verified via SEC no-action letter and DTCC press release. Three-year pilot, eligible securities (Russell 1000, Treasuries, ETFs), H2 2026 launch confirmed; DTC remains golden record and the pilot settles on traditional (non-atomic) rails.

7. SDX atomic settlement and Project Helvetia III: Verified via SNB Project Helvetia page, BIS Project Helvetia, and SDX wCBDC pilot announcement. Production-grade atomic DvP incl. wCBDC; extension to mid-2027 and addition of RTGS link plus BX Digital connection confirmed.

8. ECB Pontes (end Q3 2026) and Appia (early 2028): Verified via ECB dual-track press release (July 2025) and ECB Appia roadmap blog (March 2026).

9. Clearstream D7 DLT and Luxembourg Control Agent role (Blockchain Law IV): Verified via Clearstream press release and Deutsche Borse press release. Investre authorized as first Control Agent 21 July 2025 (per matrix).

10. UK DSS Gate 1 entrants (16 firms) and Property (Digital Assets etc) Act 2025: 16 firms hold Gate 1 approval (HSBC, J.P. Morgan, Euroclear, Tradeweb, LSEG B3); no Gate 2 progressions; DSS operational until December 2028. Property Act received Royal Assent 2 December 2025 establishing digital assets as a third category of personal property; commercial-settlement-system exemption to be disapplied for cryptoasset DvP; Project Meridian / synchronisation service targeted 2028 (per matrix).

11. Singapore broad custodial definition and BLOOM settlement: MAS may treat control of access to a token (including one of several keys/key shards) as custodial (SF(LCB)R); PS Reg requires distinct blockchain addresses; BLOOM (Oct 2025) develops a settlement-asset layer enabling exchange with finality, and tokenized MAS bills settled via CBDC (Nov 2025) (per matrix).

Newly Integrated Jurisdictions (this refresh)

• Cayman Islands (t5): VASP custody licence (Phase 2, eff. 1 Apr 2025) -- segregation of client virtual assets from proprietary, custody contracts, cybersecurity. The March 2026 tokenised-funds framework imposes NO additional custodian mandate solely for tokenisation. NO DATA FOUND for a Cayman-mandated settlement-finality regime or atomic/T+0 rule; settlement governed contractually via offering document and operator approval. (Source matrix; CIMA.)

• British Virgin Islands (t5): VASP Act Section 27 written safekeeping arrangements -- client assets identified/identifiable, segregated, accounted for; encumbering client deposits prohibited unless agreed; ownership follows private-key control (unhosted wallets excepted). NO DATA FOUND for a BVI-specific settlement-finality or DvP/atomic-settlement regime. (Source matrix; BVI FSC.)

• Ireland (t5): Depositary mandatory for UCITS/AIFs; private-key safekeeping must offer the same security as traditional assets; MiFID CAR and MiCAR Art. 75 custody/segregation/reconciliation. Tokenised financial instruments settle within EU CSDR / T2S / DLT Pilot. DP12 (5 Mar 2026) envisages atomic DvP of tokenised ETFs against wholesale CBDC, but NO DATA FOUND on a live Irish DLT settlement system as of 4 June 2026. (Source matrix; CBI.)

• Abu Dhabi (ADGM) (t5): Custody of Digital Securities via a separately licensed legal entity (DSF holding an FSP for Providing Custody, or RCH) -- stricter than the VA regime; CSD functions under COBS Ch. 10; independent third-party reconciliation at least annually. DvP (irrevocable, unconditional transfer) is the settlement standard via RCH or DSF; the trading venue cannot self-settle within the same legal entity; Remote Clearing Houses are not permitted; instantaneous/atomic DvP supported by the DSF. (Source matrix; ADGM FSRA.)

Items Requiring Further Verification

• Australia DAP/TCP asset-holding, segregation, and settlement-finality standards: The Corporations Amendment (Digital Assets Framework) Act 2026 is enacted (Royal Assent 8 Apr 2026) but commences 9 April 2027; the operational custody/segregation/finality standards are to be set by ASIC consultation and are NOT VERIFIED.
• Japan native on-chain security-token pilots and settlement finality: "Native" security-token pilots (Nomura/SBI/Daiwa/MUFG) and Japan's on-chain settlement-finality treatment are NOT VERIFIED in the source matrix.
• South Korea DvP/atomic settlement: Register-effect transfer finality under the amended AERSB is confirmed, but a DvP/T+0 regime is NOT VERIFIED.
• Cayman / BVI VASP custody minimum-capital amounts: Enhanced VASP custody prudential requirements apply, but the specific minimum-capital figures are NOT VERIFIED.
• Bahrain settlement finality / atomic settlement: NOT VERIFIED (not addressed in the source matrix).