Primer on the custody of security tokens

Key takeaways

• Security tokens fall under MiFID II and related securities regulations, not MiCA.

• Custody rules vary across Europe. Germany has a dedicated crypto securities custody license.

• Issuance, registration, distribution and custody are distinct roles, each with separate regulatory requirements.

• Security token custody goes beyond key management, covering asset protection, transactions and compliance.

• Market growth depends on regulatory harmonization and secondary trading across Europe

What are security tokens?

Security tokens belong to the broader family of digital assets. They are traditional securities, representations of value or rights, recorded on a distributed ledger instead of in a conventional register. 

Tokenized securities can take many forms, from bonds and shares to fund units, structured products and emission allowances. In 2024, for example, the German development bank KfW
issued a €100 million bond as a crypto security on Polygon, with ownership recorded in a blockchain-based register.

Since the first offerings in the late 2010s, we've witnessed an ever-growing number of security tokenization projects take shape. In the second half of 2025, 71 digital securities were issued in Germany under the country's electronic securities law, a record according to the
Deka Digital Asset Monitor. Issuance volume nearly tripled from the previous half-year to around €280 million. BCG expects digital real-world assets (RWA), currently valued at $30 billion, to represent 16% of investable assets by 2035.

Having worked with tokenized assets since 2021, we at Tangany have seen the field mature, with established players expanding their offering, regulations and pilot projects framing and encouraging adoption. But the complexity of security token custody hasn't diminished. Who can issue a token, who can hold it on a client's behalf, and which regulatory regime applies? These are questions we get every day. And it's not surprising. Security tokens sit at the intersection of securities law and blockchain infrastructure, and inherit the complexity of both.

To bring some clarity on the matter, this article walks through what security tokens are and the regulatory framework that governs them (part I) and the parties involved in bringing them to market and what custody involves (part II). This guide focuses on the European context, since that's where our expertise as an EU-regulated custodian lies.

Part I: Legal regimes of security tokens

The rules governing the space of security tokens in Europe have arrived in stages, sometimes complemented by local regimes, creating a patchwork of international and national rules.

European regulation for security tokens

Legally, a security token is a token that meets the definition of a financial instrument under EU law. That definition comes from the Markets in Financial Instruments Directive (MiFID II), applicable since January 2018. Section C of Annex I lists the categories covered by the directive, including shares, bonds, fund units, and a handful of others.

In March 2023, the DLT Pilot Regime Regulation (EU) 2022/858 amended the definition to explicitly include "such instruments issued by means of distributed ledger technology".

That classification is the starting point. It determines which legal regime applies, what disclosure obligations exist, the legal structure for ownership, the controls a custodian has to apply, and the rights a token holder actually has. 

As financial instruments, security tokens are subject to MiFID II and related regulations, such as the Prospectus Regulation, which applies when offering a security to the public, or the European Crowdfunding Service Providers Regulation, which offers a lighter, capped alternative to a full prospectus for smaller raises.

Security tokens that qualify as transferable securities (essentially tokenized shares and bonds) can also fall under the Central Securities Depositories Regulation (CSDR). Its
Article 3 requires transferable securities admitted to trading or traded on trading venues to be represented in book-entry form and, where traded on a trading venue, recorded in a central securities depository (CSD), a rule written with traditional infrastructures in mind. In 2023, the EU's DLT Pilot Regime responded to that mismatch by exempting authorized DLT market infrastructures from that requirement and opening a regulatory sandbox to settle security tokens.

Security tokens are excluded from MiCA

The crypto-specific rulebook came later, with the Markets in Crypto-Assets Regulation (MiCA) which covers crypto-assets that financial services law didn’t already address. Crypto assets such as utility tokens, e-money tokens and asset-referenced tokens are now governed by a dedicated EU regime, while Article 2(4)(a) excluded financial instruments from MiCA explicitly. 

To settle the uncertainty over which regime a token falls under, ESMA published
guidelines in 2025 on the qualification of crypto-assets as financial instruments. They confirm that tokenization does not change classification. Additionally, the agency confirmed that a token is a transferable security when it is not a payment instrument, and belongs to a class of interchangeable tokens that is negotiable on the capital market, such as tokens carrying rights to those of shares or bonds.

One important consequence of this separation is that crypto-asset service provider (CASP) authorization, granted under MiCA, does not extend to tokenized securities. 

For example, a CASP authorized to custody crypto-assets under MiCA cannot rely on that license to custody a tokenized stock: that activity falls under MiFID II and national law instead. This has two consequences. 

First, custody of security tokens requires an authorization under the applicable securities or banking framework, for example as a credit institution, as an investment firm providing safekeeping alongside investment services, or under a national regime such as Germany’s. 

Second, distributing and executing orders for tokenized securities requires a separate arrangement, such as the firm’s own MiFID authorization or a tied-agent relationship with a MiFID-authorized firm. MiCA becomes relevant again if a transaction is settled using an e-money token, such as a euro stablecoin, in which case the payment leg falls under MiCA and, depending on the setup, PSD2 as well.

Which regulatory frameworks apply to digital assets? Click here to view the full image.

National regulatory frameworks 

Alongside this European framework is a fragmented national landscape. Several jurisdictions have introduced additional national laws to govern how that security can be issued and registered on a blockchain.

France, Switzerland and Luxembourg have each adapted their securities law to blockchain-based registers, and these laws mostly deal with issuance and registration:

• France introduced the Dispositif d'Enregistrement Électronique Partagé (DEEP) in 2018, digitizing the register of unlisted financial instruments on a shared ledger.

• Switzerland's DLT Act introduced Registerwertrechte, ledger-based securities recorded on a DLT-based register, building on the country's existing intermediated securities law.

• Luxembourg built its framework incrementally across four separate laws between 2019 and 2024, moving step by step from recognizing DLT-based transfers, to native issuance, to the EU's DLT Pilot Regime and DLT-based collateral.

Liechtenstein took a broader route: its Token and TT Service Provider Act (Token- und VT-Dienstleister-Gesetz, TVTG) of 2020 treats a token as a container for almost any right, and since the 2025 MiCA implementation it covers only tokens outside MiCA (FMA). 

Germany is the jurisdiction with the most active market by issuance volume. After having introduced a dedicated crypto custody license in 2020, the country gave tokenized bonds a full legal basis the following year with the Electronic Securities Act (Gesetz über elektronische Wertpapiere, eWpG). This law drew a clear line between two kinds of digital security: a Zentralregisterwertpapier, recorded in a traditional central register, digital in form but not on a blockchain, and a Kryptowertpapier, recorded in a dedicated crypto securities register instead. The law originally covered only bonds and fund units, until Germany's Future Financing Act (Zukunftsfinanzierungsgesetz, ZuFinG) extended it to shares in 2023, as crypto securities, only registered shares of German stock corporations.

Most other member states have no bespoke security token legislation at all, leaving issuers and distributors there with two practical routes:

• Tokenizing on top of a conventional security: Issue the security conventionally, in the existing register, and offer a token on top of it. 

• Issue security tokens under another country's framework: the issuer can use a framework abroad, for example a licensed registrar in Germany, France or Luxembourg, and offer the security at home under a passported prospectus where one is required.

Click here to view the full image.

These national laws mostly settle how a security token is issued and registered. Who may then hold it for clients is a separate question, and the answers again differ from country to country. 

Legal frameworks for the custody of security tokens

Custody of security tokens is legally distinct apart from other activities for a specific legal reason: Under MiFID II, the safekeeping and administration of financial instruments for clients is classified as an ancillary service, not one of the core investment services such as trade execution. 

In Germany, it runs through a separate authorization under national banking law rather than through securities law directly. An issuer, a distributor, and a custodian can all be regulated, licensed entities, and still each hold a different piece of the puzzle, none of them automatically covering what the others do.

Germany is the only jurisdiction in the table above with a custody license specifically built for security tokens. 

In Germany, holding crypto securities is a licensed financial service in its own right: qualified crypto custody (qualifiziertes Kryptoverwahrgeschäft), defined in the KWG and authorized by BaFin. Since 30 December 2024, it covers crypto-based financial instruments (kryptografische Instrumente), including the private keys for crypto securities, crypto fund units, and other DLT-based securities. Depending on their structure, it can also cover tokenized products issued abroad, such as tokenized stocks or ETFs, where the custody service is provided in Germany.

For issuers in member states without a bespoke framework, one route is to issue under German law: debt instruments can be issued as a Kryptowertpapier through a BaFin-licensed crypto securities registrar, with custody provided by a firm licensed for qualified crypto custody. Crypto shares, by contrast, are only available to German stock corporations. Where the instruments are offered to the public in other member states, a BaFin-approved prospectus can be passported. Distribution to investors, and custody arrangements for investors outside Germany, remain subject to the rules of the investors' jurisdictions.

Tangany was one of the first companies to receive a BaFin license for crypto custody (Kryptoverwahrgeschäft) under the KWG in October 2021, a license that, since December 2024, continues as a qualified crypto custody (qualifiziertes Kryptoverwahrgeschäft). Tangany also holds a MiCA CASP authorization for the custody and administration of crypto-assets on behalf of clients and for transfer services for crypto-assets, and, since March 2026, a payment institution license under the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz - ZAG), the German implementation of the PSD. Together, these cover custody of security tokens and crypto-assets as well as related payment services. The crypto securities register itself is kept by licensed registrars that Tangany works with.

Part II: The custodian in the tokenization chain

After the deep dive into the legal regimes, our second part looks at who does what when a security token comes to market, and what custody involves in practice.

The roles in a security token issuance

Bringing a security token to market involves more separate roles than the technology suggests. One firm can combine several of these roles, but a license for one role doesn't cover the others:

• The issuer creates the instrument and owes investors the rights it carries.

• The registrar keeps the legal record of ownership. For German crypto securities, this is the Kryptowertpapierregisterführer, the licensed registrar of the crypto securities register.

• The bookrunner structures the deal and finds investors.

• The distributor, often a bank or broker, offers the product to its own clients.

• The custodian holds investors' positions on their behalf.

• A settlement agent connects the transaction to the payment system for the cash leg.

Security token issuance process

Behind the scenes of security token custody

Custody of a security token combines key aspects:

• the technical infrastructure that stores and moves it, 

• the servicing of the instrument over its life, 

• the connection to the rest of the chain (registrar, settlement agent, trading venue), 

• the regulatory obligations of safekeeping a financial instrument.

From a technical perspective, the private keys are generated and stored in tamper-resistant hardware security modules, and more than one authorized person must approve a transaction before it moves. On top of that sits the wallet architecture. Wallets are blockchain addresses maintained by the custodian where clients' tokens are held, used to receive tokens and to sign and send transfers on client instruction. Custodians can set one wallet per client or pool them across clients with off-chain bookkeeping, depending on the use case. 

The custodian also integrates with the blockchain the token was issued on, reading and executing the transfer rules written into the token's smart contract. It then handles the events that occur over the instrument's life such as redemptions and coupon or dividend payments. Each of these should be recorded in a clear, auditable trail for the client and for the regulator. Finally it must integrate with the token issuance and settlement ecosystem. For instance it connects to the settlement agent that handles the cash leg, and to a trading venue if the token trades. 

Compliance adds a further layer of complexity to the setup. Because a security token is also a financial instrument, its custody carries the obligations of holding securities:

• client assets that remain protected if the custodian fails,

• control over the asset at all times,

• processing of corporate actions,

• reconciliation with the official records.

In Germany specifically, as an obligated entity under the Anti-Money Laundering Act, custodians must appoint a Money Laundering Reporting Officer and perform identity checks and monitor transactions as part of daily operations. The custodian’s IT security and operational resilience are held to bank standards: DORA, or, for custodians holding only the KWG license, BaFin's BAIT until the end of 2026. 

Custody setup for security tokens: Click here to view the full image

A real-world example: Exporo

Exporo, a Hamburg-based real estate investment platform, has used tokenized bonds since before the eWpG existed. In July 2019, it issued a token-based bond on Ethereum for a medical office building in Hamburg, under an EU prospectus registered in Luxembourg and notified to BaFin, giving investors fractional exposure to the property.

Exporo's issuance process begins when an investor subscribes to a property investment through exporo.de and pays the subscription amount to the issuer. The issuer is a property company that also owns the underlying real estate. The company then issues a purpose-bound security for that specific property, in digital form. Each investor receives a secure account through which they can access their investment. The corresponding digital securities are recorded in the account. The record is protected in a decentralized way by a network of more than 8,000 servers worldwide.

Tangany became Exporo's custodian mid-2021, holding security tokens on its behalf. The setup uses omnibus wallets with off-chain bookkeeping, which cut the cost per user by 75% compared with Exporo's previous solution. Existing users were migrated within two months, and the tokens became tradable around the clock on a secondary market.

At Exporo, we're proud to have Tangany as our trusted partner for real estate tokenization. With over 750,000 customers, Tangany has proven their expertise in securely managing digital assets on the blockchain. What sets Tangany apart is their seamless integration of blockchain technology, which remains invisible in the background, while offering significant cost reductions, up to 75%, compared to traditional industry practices. Thanks to Tangany's innovative solution, we can confidently offer our clients the benefits of blockchain-based investing.

Everything that can be digitized will be digitized

We believe that everything that can be digitized will be digitized, and securities are well on their way. In Germany, cumulative issuance for security tokens under the eWpG, since the 2021 law, has crossed €1.23 billion. While this volume remains low, notably compared to the
€80 billion in electronic securities issued through Clearstream’s D7 platform, the trajectory is clearly upward. The pace, however, will depend on secondary trading, which the ECB described as still scarce in April 2026.

Pressure for harmonization is building, with 39 European financial institutions calling for a larger and permanent DLT Pilot Regime in April 2026, as covered in our report on
the state of DLT adoption in European TradFi. Until then, custody of security tokens will follow national lines.

Germany's crypto custody license, which Tangany has held since October 2021, predates MiCA by several years. When MiCA took over the governance of crypto-assets, the German license kept the part MiCA excluded: security tokens and other DLT-based financial instruments. As more securities move onto blockchain registers, their custody will keep depending on national rules, and licenses like this one are likely to become a standard part of the setup behind them.

DISCLAIMER: This article is for general information only and does not constitute legal or regulatory advice.