Tokenised Real-World Assets: Custody, Oracles, Finality

Q: What does it mean that a tokenised asset is a pointer rather than the asset?

A token on a ledger records a balance and executes transfer rules; it does not contain a share, a bond or a fund unit. Those remain legal claims governed by company law, an indenture or a fund's constitutional documents, and they are held and administered by the same institutions as before: issuers, transfer agents, custodians and central securities depositories. What tokenisation moves is the register of ownership, or a mirror of it, onto a shared ledger. Every property the asset depends on, who holds it, who may own it, what it is worth, and when a transfer is legally complete, still comes from outside the ledger. The architecture of a tokenisation platform is therefore the design of those four boundaries, which the article calls custody, eligibility, oracles and settlement finality, rather than the design of the token contract.

Q: What is the difference between native issuance, a mirrored register and a receipt token?

In native issuance the ledger balance is the legal register of record, which requires a legal regime that recognises a DLT register, such as the EU DLT Pilot Regime, and an operator who can act under lawful instruction. In the mirrored model the register of record stays at the transfer agent or CSD and the token is a synchronised copy, updated from finalised ledger events; if the chain fails, the register continues and the mirror is rebuilt, which makes it the pragmatic default for existing funds and bonds in 2026. A receipt or wrapper token represents a claim on a custodian that holds the underlying asset, not a claim on the issuer, so holders carry custodian credit risk and the wrapper's redemption terms. The receipt model is the fastest to launch and the one most often marketed, wrongly, as owning the asset itself.

Q: Why does a security token need forced transfer, freeze and recovery functions?

Because a security must remain administrable when a holder loses a private key, when a court orders a transfer, when a holder becomes ineligible, or when a position must be corrected after an error. A plain fungible token has none of these functions, so a lost key means a lost position and a court order cannot be executed. ERC-3643, the most widely deployed permissioned-token standard for securities, specifies an agent role with forced transfer, address and partial-balance freezing, and recovery of tokens from a lost wallet to a new wallet bound to the same verified identity. These mirror what a transfer agent already does with a lost certificate. A token lacking them is a bearer instrument, and most securities regimes do not permit bearer form, so the functions are a legal requirement expressed in code rather than an optional feature.

Q: How does on-chain eligibility checking work for a tokenised security?

The transfer function consults an identity registry that maps wallet addresses to verified on-chain identities, a trusted issuers registry that lists who may attest claims about those identities, a claim topics registry that defines which claims an investor must hold, such as completed KYC or accreditation in a given jurisdiction, and a compliance contract that holds rules such as holder-count limits, concentration caps and lock-ups. A transfer is refused on-chain if any check fails, so a secondary trade between two eligible holders settles without the issuer in the loop while a transfer to an ineligible wallet cannot occur. The limit is that the check verifies that a wallet is bound to a verified identity, not that the verified person is the one acting; account takeover of an eligible wallet is approved by the contract, which is why institutional key custody rather than the compliance contract is the control for that threat.

Q: What role do oracles play in tokenised real-world assets, and why is an oracle a counterparty?

A tokenised asset depends on facts the ledger cannot observe: the fund's net asset value, the reserve balance backing a receipt token, coupon and redemption dates, corporate actions and the expiry of eligibility claims. Each fact enters through an oracle, and whoever signs the fact can move the value or behaviour of every token that reads it, which makes the oracle a counterparty with accountability rather than a neutral utility. For regulated instruments the accountable source already exists and is itself regulated, so the correct pattern is signed publication from the fund administrator, paying agent or custodian with the ledger verifying the signature, as Chainlink Proof of Reserve feeds do for collateral. Every fact should be stored with its signature, source and time in an append-only log, and the contract should degrade safely when a fact is stale, typically by refusing new issuance while continuing to honour existing claims.

Q: When is a tokenised transfer actually final?

At three different moments that the architecture must name separately. It is probabilistically done when a chain reorganisation is unlikely, finalised when the chain's consensus rules make reversal infeasible, and legally final when the governing law or the settlement system's rules say it cannot be unwound. On Ethereum, blocks are finalised when a supermajority of staked ETH attests across two consecutive epoch checkpoints, roughly 12.8 minutes after inclusion, and reverting a finalised block would cost an attacker at least a third of all staked ETH. Solana exposes commitment levels with finalized meaning the block is rooted and will not roll back, and permissioned BFT ledgers finalise in one round within seconds. None of these is legal finality, which is a property of the regime the system operates under, such as the EU DLT Pilot Regime. Downstream systems such as the legal register, statements and collateral eligibility should update only from finalised events.

Q: Is delivery versus payment atomic on a blockchain?

Only when both legs, the security token and the cash instrument, are on the same ledger and are locked and released in one state transition, typically through an escrow or DvP contract. If the cash leg is a bank transfer, a stablecoin on a different chain or a central-bank account, the swap is two transactions and one can complete while the other fails, which is the classic payment-system problem. The honest options are escrow with timeout and reversal, which is a saga with compensating actions; a hash-time-locked construction across chains, which is sound but operationally fragile; or placing the cash leg on the same ledger as a tokenised deposit or stablecoin, which is the direction the BIS unified-ledger blueprint describes. Until the same-ledger option exists for a given currency and asset, the platform should assume the cash leg is remote and design the reconciliation exception queue before anything else.

Q: What does the EU DLT Pilot Regime require of a tokenisation platform's architecture?

Regulation (EU) 2022/858, applying from 23 March 2023, lets authorised market infrastructures trade and settle tokenised financial instruments under adapted rules, but only within limits that the platform must compute and enforce. Shares may be admitted only from issuers with a market capitalisation under EUR 500 million, bonds and money-market instruments only with an issue size under EUR 1 billion, and fund units only where the fund's assets are under EUR 500 million. The aggregate value recorded on one DLT market infrastructure may not exceed EUR 6 billion at admission, and once EUR 9 billion is reached the operator must activate its transition strategy to move instruments to conventional infrastructure. These thresholds belong in the admission path as code, and the transition strategy must be a rehearsed migration of the register, not a document. Tokenised securities fall outside MiCA, which excludes crypto-assets that qualify as financial instruments.