6.2 The Patchwork That Exists Today
- Which bodies of law a tokenized real-world asset passes through, and why no jurisdiction among the eight covered has a single rulebook for it
- Where the eight jurisdictions agree, and the layers underneath the token where they diverge, in one table dated 27 September 2026
- How the patchwork also runs inside single jurisdictions, from the United States to the United Arab Emirates
- Where national regimes do not meet across borders: conflict of laws, stablecoins, the travel rule and tax reporting
Section 6.1 argued that law is part of a tokenized real-world asset's value, and that where rules get in the way, the friction comes from uncertainty, divergence and miscalibration rather than from the existence of rules. That law is not one law. A tokenized fund unit or bond is governed at once by the rules that decide what the token is and who may buy it, where it trades and how a trade settles, who holds title to it and what happens if an intermediary fails, what it settles in on its cash leg, how a bank that holds it must capitalize the position, how its transfers are screened for money laundering, and how it is reported for tax.
This section maps what is in force on 27 September 2026 in eight jurisdictions, the United States, the European Union, the United Kingdom, Switzerland, Singapore, Hong Kong, Japan and the United Arab Emirates, layer by layer rather than country by country. Where a rule is still a proposal, a consultation or a bill, this section labels it as such and gives its date; Section 6.3 takes up the jurisdictions already moving and what their pending changes would alter.
The Token Taxonomy paper's Section 7.4 already compares seven of these jurisdictions, all but Japan, country by country; this section compares all eight by layer, and only for real-world assets.
What follows is a map, not a ranking, and none of it is a legal opinion for any transaction (Section 6).
One Token, Several Rulebooks
A tokenized real-world asset passes through seven bodies of law at once. Securities or fund law decides what the token is and who may buy it, illustrated below by Singapore's prospectus rule and its exemptions. Market-infrastructure law decides where it trades and how a trade settles, illustrated by the EU's DLT Pilot Regime and the UK's Digital Securities Sandbox. Private law decides whether the ledger entry counts as legal title and what happens to the holder if an intermediary fails, illustrated by Delaware's stock-ledger statute and the DIFC's digital-assets law. Payments law governs the stablecoin or tokenized deposit that settles the cash leg, illustrated by the GENIUS Act and the EU's e-money token regime. Prudential law decides how a bank that holds the token must capitalize the position, illustrated by how differently Hong Kong, Singapore and Japan treat the Basel cryptoasset standard. Anti-money-laundering rules decide what information must travel with a transfer, the travel rule described below. Tax reporting decides what an intermediary must report to a tax authority, under the OECD's Crypto-Asset Reporting Framework (CARF), for which jurisdictions have committed to dates of first exchange, described below.
Each of these seven layers is written and supervised jurisdiction by jurisdiction, and inside a single jurisdiction more than one of them can answer to a different regulator. Nor do the eight jurisdictions move together within a single layer. Settlement cycles are one example: the United States moved equities and most corporate bonds to a one-day cycle on 28 May 2024, while the European Union, the United Kingdom and Switzerland have coordinated a joint move to the same cycle only on 11 October 2027 (Section 1.3). For a tokenized real-world asset, the question is rarely whether it is regulated; it is how many rulebooks apply and whether they fit together.
The diagram draws the token in navy and the seven bodies of law that govern it in six green boxes, because anti-money-laundering rules and tax reporting share one box. Each is written and supervised jurisdiction by jurisdiction. The dashed arrows show the extra question a cross-border sale raises, shown in red: which country's answer applies. The diagram simplifies two things. Several of these boxes have more than one regulator inside a single jurisdiction, and the boxes are not independent: the classification decided in the first one shapes much of what follows in the rest.
Where the Rulebooks Agree
The token. On the first layer, the eight jurisdictions largely start from the same place: a tokenized security remains the security it represents. The SEC staff said in January 2026 that putting a security on a blockchain does not change how the federal securities laws apply to it (Section 4.2). ESMA takes the same position for the EU, that a tokenized financial instrument remains a financial instrument (Section 2.1). The FCA classifies a cryptoasset by "its legal and economic substance" rather than by its label or its technology1. The Monetary Authority of Singapore applies existing requirements to tokenized products on the principle of "same activity, same risk, same regulatory outcome"2. Hong Kong's Securities and Futures Commission set out its tokenization framework in two circulars of 2 November 20233, after already warning in 2021 that stock tokens were likely to be securities under Hong Kong law (Section 6.1). Switzerland made the ledger-based security a form of security in its Code of Obligations (Section 6.1).
The differences at the edges. Japan gives one group of security tokens its own statutory name rather than a separate regime. Under an unofficial English translation of the Financial Instruments and Exchange Act, rights such as trust beneficiary interests and fund interests become "electronically recorded transferable rights" once they can be transferred electronically, a category inside the same Act4. Inside the European Union, national law can block the category itself. Slovakia's securities regulator told ESMA that "the Slovak securities legislation does not enable the issuance of tokenised transferable securities"5, and Czechia's regulator said that applying ESMA's guidelines to certain tokenized securities is "prevented by legislative barriers" in its Civil Code, with "no formal legislative proposal or defined timeline" for changing the law5, positions both notified in ESMA's compliance table dated 17 July 2026. The European Banking Authority has said that the same token can be a financial instrument in one member state and an asset-referenced token in another (Section 6.1). The United Arab Emirates may be a further case of disagreement inside a single country, taken up below in this section.
The limits of agreement. Agreement on classification settles which body of law applies; it does not make that law the same everywhere. Retail access, for example, runs on different hooks from one jurisdiction to another. In Singapore, an offer of tokenized securities, securities-based derivatives contracts or units in a collective investment scheme needs a prospectus registered with MAS unless an exemption applies2. In Hong Kong, 13 tokenized products had been offered to the public as of March 20263. In the European Union, a DLT multilateral trading facility may admit natural persons directly as members or participants only where the national competent authority permits it6.
The rest of this section follows the layers under the token, where the answers diverge.
The Map on 27 September 2026
The table below draws the Swiss, US, German and Hong Kong (1 August 2025) facts already given in Section 1.1, Section 1.3, Section 4.1 and Section 6.1, and sets out, for each jurisdiction, the venue regime for DLT securities, whether a ledger entry counts as legal title, the stablecoin regime on the cash leg and the year of first committed CARF exchange, from these sources6782391011512131415161718192021222324.
| Jurisdiction | DLT-specific venue regime | Ledger entry as legal title | Stablecoin regime (cash leg) | First CARF exchange |
|---|---|---|---|---|
| United States | None; tokens use existing licenses such as broker-dealer and ATS; SEC temporary exemption for tokenized NMS stock until 17 September 2031 | State corporate and commercial law; Delaware lets a corporation keep its stock ledger on distributed networks, administered by or for the corporation | GENIUS Act enacted 18 July 2025, not yet in effect | 2029 |
| European Union | DLT Pilot Regime since 23 March 2023; EUR 6 billion aggregate cap; permissions of up to six years | National law: Germany's electronic securities (2021); Slovak law does not enable tokenized transferable securities | MiCA e-money tokens since mid-2024; 39 issued, no asset-referenced tokens authorized (1 September 2026) | 2027 (Cyprus 2028) |
| United Kingdom | Digital Securities Sandbox regulations, in force 8 January 2024, ceasing 8 January 2029 | Digital things can be property (2025 Act; England and Wales, Northern Ireland) | FCA issuer rules final, in force 25 October 2027 | 2027 |
| Switzerland | DLT trading facility license since 1 August 2021; one license holder on FINMA's list (27 September 2026), not flagged for private participants | Ledger-based securities in the Code of Obligations since 1 February 2021 | No stablecoin-specific statute; payment-instrument bill consulted to 6 February 2026, dispatch expected second half of 2026 at the earliest | 2028 |
| Singapore | None; platforms must be approved exchanges or recognized market operators | Existing law; MAS asks issuers to disclose which record, on-chain or off-chain, is definitive of ownership | 2023 framework not yet in statute; stablecoin-specific amendments proposed 1 September 2026 | 2028 |
| Hong Kong | None; tokenized SFC-authorized open-ended funds may trade on licensed virtual asset platforms (20 April 2026 pilot framework) | Existing law, found "sufficiently flexible" for tokenized bonds by the government (29 June 2026); legislative review to follow | Ordinance in operation since 1 August 2025; two licenses effective 10 April 2026 | 2028 |
| Japan | None; security tokens trade on proprietary trading systems such as ODX's START (since December 2023) | Certified-platform rule: transfer notices through certified platforms carry a certified date (since 2 August 2021) | Payment Services Act regime; two registered intermediaries (27 August 2026) | 2027 |
| United Arab Emirates | In ADGM, no DLT-specific category: dealing in security tokens is regulated as dealing in securities | DIFC Digital Assets Law 2024 (property, control, title), free zone only | CBUAE payment-token regulation since 31 August 2024; foreign-currency tokens only to buy virtual assets onshore | 2028 |
Reading the table. The venue column shows three models: bespoke DLT venue regimes in the European Union, the United Kingdom and Switzerland; existing market licenses with no DLT-specific venue category in Singapore, Hong Kong and Japan, and in ADGM in the UAE; and, in the United States, existing licenses plus a temporary SEC exemption for tokenized NMS stock (Section 6.1). Two routes carry a fixed end date: the UK sandbox's regulations "are to cease to have effect on 8th January 2029"7, and the US exemption runs to 17 September 2031 (Section 6.1); in the EU, a specific permission is valid "for a period of up to six years from the date of issuance"6. The caps differ too: the EU limits the value of instruments on a DLT market infrastructure to EUR 6 billion in aggregate6, HM Treasury may direct the regulator to restrict UK sandbox activity "by reference to a number, value or another metric"7, and the US order carries its own volume caps (Section 6.1). The title column shows different kinds of answer. Switzerland and, in the EU, Germany, for example, give ledger-based securities a statutory basis (Section 6.1); the DIFC made digital assets a category of property, with a presumption that the person in control has "the superior legal title"15; the UK's 2025 Act says a thing, including a digital one, "is not prevented from being the object of personal property rights merely because it is" neither a thing in possession nor a thing in action12; Delaware's statute lets a corporation keep its stock ledger on distributed networks11; Hong Kong's government said the findings of its review suggest that the legal and regulatory environment is "already sufficiently flexible" for tokenized bond issuances and announced a legislative review considering "possession and transfer"13; Japan's rule deems notices given through certified platforms to carry a certified date14, a platform-specific rule rather than a general title rule. The cash-leg column shows four statuses on 27 September 2026: in force in the EU, Hong Kong, Japan and the UAE; enacted but not yet in effect in the United States; final but not yet in force in the UK; and stablecoin-specific legislation proposed in Singapore and Switzerland.
Coherence and adoption. In the United States, where the table shows no DLT-specific venue license, title under state corporate and commercial law and a stablecoin act not yet in effect, products sold under US securities law, registered or exempt, held 58.6% of the value of the ten largest tokenized Treasury products on 27 September 2026, by this section's arithmetic on the figures in Section 6.1 (19.7% plus 38.9%). Switzerland, whose ledger-based securities provisions have been in force since 1 February 2021, had one holder of its DLT trading facility license on FINMA's list of 27 September 2026, not flagged for private participants8. The map records where the rules differ; it does not show that coherent rules produce adoption or that fragmented rules prevent it.
The Patchwork Inside One Jurisdiction
United States. The SEC and the CFTC split federal oversight of these markets between two agencies. Their harmonization memorandum of 11 March 2026 says onchain systems "increasingly blur traditional jurisdictional lines" and lists among its aims "Clarifying product definitions through joint interpretations and rulemakings," while stating that the memorandum "does not supersede any applicable laws or regulations nor does it create any legally binding obligations"25. The cash leg adds a federal and state layer of its own. The GENIUS Act lets a state-qualified issuer with not more than $10 billion outstanding opt instead for a state regime that is "substantially similar" to the federal one16. As of 27 September 2026 the Act is not yet in effect: it takes effect on "the earlier of" 18 months after its enactment or 120 days after the primary federal regulators issue final implementing regulations16. Title to shares of a US corporation, separately, rests on state corporate and commercial law: Delaware, for example, lets a corporation keep its stock ledger on distributed networks, provided the ledger records transfers of that stock as governed by Article 8 of the state's commercial code11.
European Union. EU regulations sit on top of 27 national bodies of corporate and securities law. The DLT Pilot Regulation itself says that the recording of securities and the maintenance of securities accounts are "also covered by non-harmonised provisions of national law, such as corporate and securities law"6. The European Commission counted "only four participants" in the Pilot Regime after more than two years, and consultation respondents called divergent national securities and corporate laws the "most pressing challenge" (Section 6.1). The Slovak and Czech positions described above show the result in practice: one set of ESMA guidelines, applied in some member states and blocked by national law in others5. The cash leg has its own seam inside the EU. The European Banking Authority says MiCA's articles "do not explicitly refer to" multi-issuer stablecoin schemes with a non-EU issuer, that questions on the permissibility of that model "remain unanswered by the European Commission," and that crypto-asset service providers that also provide payment services with e-money tokens still face a double authorization requirement17.
United Kingdom. From 25 October 2027, two perimeters will run side by side. Tokenized securities stay specified investments, classified by their substance under existing law1, while the new cryptoasset regime's perimeter amendments "shall come into force in full on 25 October 2027"1, and the FCA's stablecoin issuer rules come into force the same day18. DLT-specific infrastructure for tokenized securities, meanwhile, sits in a sandbox whose regulations "are to cease to have effect on 8th January 2029"7. The FCA and the Bank of England "will allow certain stablecoins to be used for settlement within the Digital Securities Sandbox"18. The 2025 property Act, for its part, extends to England and Wales and Northern Ireland only12, a patchwork inside the UK itself.
United Arab Emirates. At least four rulebooks can reach the same token here, depending on where the firm sits. Federally, a Cabinet Decision of 12 December 2022 defined a virtual asset and said "This does not include the digital representation of fiat currency, securities or other assets," leaving the financial free zones and digital securities to their own regulations26. In Dubai outside the DIFC, VARA's Issuance Rulebook treats a virtual asset representing an "interest in any financial instrument" as a real-world-asset-referenced token whose issuance needs a VARA license27, and reserves stablecoins referenced to the UAE dirham to the CBUAE's "sole and exclusive regulatory purview"27. In ADGM, Abu Dhabi's financial free zone, dealing in security tokens is regulated "as Security instruments" under its financial services law, while virtual assets are "Treated as commodities"10. In the DIFC, Dubai's financial free zone, its own Digital Assets Law of 2024 governs property in digital assets15. Onshore, the CBUAE's payment-token regulation limits foreign-currency tokens to buying virtual assets23. The 2022 federal definition excluded digital representations of securities, while VARA's current rulebook reaches tokens that represent an interest in a financial instrument; neither text says how the two lines meet for a tokenized security issued in mainland Dubai.
Different statutes for the token and its cash leg. Hong Kong, Singapore and Japan put a tokenized security and a stablecoin under different statutes; Switzerland's stablecoin-specific statute was still a bill on 27 September 2026. In Hong Kong, the SFC's framework governs tokenized securities and funds3, while the HKMA licenses stablecoin issuers21. In Singapore, securities law governs tokenized capital markets products2, while under a separate payments-law track, for which MAS proposed legislative amendments on 1 September 2026, non-MAS-regulated stablecoins "will be treated as Digital Payment Tokens"20. In Japan, the Financial Instruments and Exchange Act governs security tokens4, while the Payment Services Act governs stablecoins, with two intermediaries on the FSA's list of registered providers as of 27 August 202622. In Switzerland, ledger-based securities sit in the Code of Obligations (Section 6.1), while a stablecoin bill awaited a dispatch to Parliament that the Federal Council expected "in the second half of 2026 at the earliest"19.
Where the Pieces Do Not Meet
Which law governs the token. Two international texts address which law governs a security or a digital asset, and neither gives the eight jurisdictions a common rule. The Hague Securities Convention, in force since 1 April 2017, has three contracting parties, Mauritius, Switzerland and the United States28, so of the eight jurisdictions covered here, only the United States and Switzerland are parties. The Convention covers securities held with an intermediary. UNIDROIT's Principle 5 proposes a sequence instead: first the law specified in the digital asset itself, then the law specified in the system on which it is recorded, and, where there is an issuer, then the law of the issuer's statutory seat; its commentary says that location-based connecting factors "usually have no useful role to play" in the law applicable to proprietary issues relating to digital assets29. Principle 5 is soft law: it binds no state unless that state enacts it. Section 6.1 already covers the EU's Settlement Finality Directive, which protects transfer orders and netting only inside a system a member state has designated.
Stablecoins do not travel automatically. Authorization in one jurisdiction does not, by itself, carry a stablecoin into another. In the United States, from 18 July 2028 a digital asset service provider may offer or sell a payment stablecoin to a person in the United States only if a permitted issuer issued it, subject to the Act's exceptions; a foreign issuer qualifies only if, among other conditions, the Treasury finds its home regime comparable and the issuer registers with the OCC16. In the European Union, the EBA has said MiCA's articles do not explicitly refer to third-country multi-issuer stablecoin schemes, and their permissibility remains an open question17. In Singapore, recognition of "a limited number of foreign-issued stablecoins regulated under a comparable foreign regulatory framework" is only proposed20. Onshore in the UAE, a registered foreign-currency token may be used as a means of payment only for the "purchase of a Virtual Asset or Virtual Asset derivative"23. In Switzerland, under the pending bill, stablecoins issued abroad would be treated as cryptoassets for trading rather than as Swiss stable payment instruments19. A tokenized security sold across borders can therefore settle in a cash token that the buyer's own rules do not recognize.
The travel rule. FATF's July 2026 targeted update reports that, of 109 responding jurisdictions, 91 (83%) had passed legislation implementing the travel rule, and that 55 of those 91 (60%) had not yet taken any supervisory or enforcement action on travel-rule compliance; both figures come from jurisdictions' self-reported responses to FATF's survey30. Thresholds differ. The European Union applies the same information requirements to crypto-asset transfers "regardless of their amount," applying from 30 December 202431. In the United States, FinCEN's 2019 guidance on convertible virtual currency (CVC) treats a transmittal "of $3,000 or more (or its equivalent in CVC)" as one that may trigger the funds travel rule32. The EU rule for crypto-asset transfers does not reach tokens that are financial instruments: the Regulation's definition of a crypto-asset excludes the categories that MiCA excludes31.
Tax reporting. Under the OECD's Crypto-Asset Reporting Framework, jurisdictions have committed to first exchanges by 2027 (46 jurisdictions, including the United Kingdom, Japan and 26 EU member states), by 2028 (27, including Hong Kong, Singapore, Switzerland, the UAE and Cyprus) and by 2029 (four, including the United States), on the OECD's list last updated 14 September 202624. On these commitments, CARF exchanges between some pairs of the eight would begin in 2027 and between others only in 2029; a commitment is not yet an exchange.
What Converges and What Does Not
Standards converge. IOSCO's principle that regulation should deliver "same activity, same risk, same regulatory outcomes" (Section 6.1) is close to the Monetary Authority of Singapore's principle quoted earlier in this section. Global standards exist for the travel rule30, for tax reporting24 and, in the Basel Committee's cryptoasset standard, for bank capital (Section 6.1).
Implementation does not. Bank capital shows it. Hong Kong brought the Basel cryptoasset standard into operation on 1 January 202633. Singapore deferred it "to 1 January 2027 or later"34. Japan has, since 2022, deducted crypto-assets held by banks from common equity tier 1 capital as an interim treatment, and said it would revisit that treatment once the Basel Committee reached agreement35. The UK's prudential regulator expects to consult on its own framework only "in 2028 at the earliest" (Section 6.1). In the United States, the banking agencies' March 2026 FAQs give eligible tokenized securities generally the same capital treatment as their non-tokenized equivalents (Section 1.2). FATF's own ratings of these jurisdictions against its virtual-asset standard, Recommendation 15, also differ, and come from assessments made in different years30.
Stablecoin rules show both. Once in effect, the GENIUS Act bars permitted and foreign issuers from paying holders "any form of interest or yield" solely for holding the stablecoin16. Under the FCA's final rules, in force from 25 October 2027, UK issuers may not pay holders interest or yield from backing assets, an approach the FCA calls "in line with the approach taken by other international jurisdictions including the EU and the US"18. Singapore proposes an interest ban of its own for its regulated stablecoins20. On reach, the FCA's final rules "do not prohibit third parties from paying rewards to their own customers from their own account"18, and the GENIUS Act's interest ban is addressed to issuers16. The principle is shared; the dates, the definitions and the reach are set jurisdiction by jurisdiction.
Bridge to Section 6.3
This map is a snapshot, and many of its cells carry a pending date rather than a settled one. Section 6.3 looks at the jurisdictions already moving and at what their pending changes would alter if they take effect. Section 5.6 will take up jurisdictional fragmentation itself as a risk to projects, rather than as a legal description. Section 6.4 explains why the regulatory question sits at the center of the rest of this paper. The premise behind this map is set out in the Section 6 introduction.
- None of the eight jurisdictions has a single rulebook for tokenized real-world assets: securities, market-infrastructure, private, payments, prudential, anti-money-laundering and tax rules all apply, each set jurisdiction by jurisdiction.
- The eight largely start from the same place on the token itself, a tokenized security remains a security, with differences at the edges: Japan's statutory name for one group of security tokens, national barriers in Slovakia and Czechia, and, in the UAE, a 2022 federal definition that excluded securities beside a Dubai rulebook that reaches tokens representing financial instruments.
- They diverge beneath the token. Three have bespoke DLT venue regimes (the UK's regulations cease on 8 January 2029); the United States, Singapore, Hong Kong, Japan and ADGM in the UAE use existing market licenses, and the United States adds a temporary exemption for tokenized NMS stock to 17 September 2031; title answers range from ledger-based securities statutes and property statutes for digital assets to existing law and platform-specific rules; and, as of 27 September 2026, stablecoin regimes are in force in four, enacted or final but not yet in force in two, with stablecoin-specific legislation proposed in two.
- The patchwork also runs inside single jurisdictions: the SEC and the CFTC coordinate through a non-binding memorandum, the UAE has federal, Dubai, ADGM and DIFC rulebooks, and in the UK tokenized securities stay in the existing perimeter while a separate cryptoasset regime comes into force in full on 25 October 2027. Hong Kong, Singapore and Japan also put tokenized securities and stablecoins under separate statutes.
- Across borders, neither the Hague Securities Convention nor UNIDROIT's Principle 5 gives the eight a common rule on which law governs a token; authorization in one jurisdiction does not by itself carry a stablecoin into another; the EU applies its travel-rule information requirements to crypto-asset transfers regardless of amount, while US guidance says the funds travel rule may apply to virtual-currency transmittals of $3,000 or more; and first CARF exchanges are committed for 2027, 2028 or 2029 depending on the jurisdiction.