1.1 The Stakes: RWA Markets Can't Scale Without Legal Clarity
- What legal clarity means for a tokenized asset, in supervisors' own terms, and the five questions it has to answer
- Which pools of capital, from bank balance sheets and retirement savings to insurers and collateral, apply legal tests
- What unsettled answers have cost issuers, venues and holders, and what followed where answers arrived
- Where the answers stood on 11 October 2026, and why legal clarity is necessary for scale but not sufficient
The first paper, Real-World Assets: What They Are and Why They're Changing Finance, described what tokenized real-world assets (RWAs) are, how they are built and who builds them. The first paper's Section 4.5 recorded that rwa.xyz put distributed tokenized assets at $38.62 billion on 25 September 2026. The Securities Industry and Financial Markets Association (SIFMA) put global fixed income at $160.7 trillion and the market capitalization of listed equities worldwide at $157.8 trillion, both for 20251. On 9 October 2026, the Monetary Authority of Singapore's (MAS) Managing Director, Chia Der Jiun, said that there had been some progress globally in tokenizing bond issuance, private credit and corporate debt, equities, precious metals and money market funds, but that tokenized activity "remains small relative to conventional markets for these assets"2.
This section asks what legal clarity has to do with that gap: what it means for a token, which capital waits on it, what its absence has cost, and what followed where it arrived. The evidence supports a narrower form of the title's claim: legal clarity is a precondition for reaching the large regulated pools of capital on the same terms as traditional assets, but it does not bring that capital in by itself. Statuses are as of 11 October 2026 unless a sentence gives its own date, and nothing here is legal advice; see the paper's disclaimer.
What Legal Clarity Means for a Token
What the law has to supply. On 1 October 2026, Sasha Mills, the Bank of England's Executive Director for Financial Market Infrastructure, set out in a speech what a tokenized security needs from the law3. Her list begins with a record: "A tokenised security needs a legally authoritative record"3. It continues: ownership has to be evidenced and transferred, competing claims have to be resolvable, insolvency protections have to work, and responsibility for keeping the record has to be clear3. The list also names settlement: "Settlement must be final and irrevocable"3. She follows the list with a sentence about technology: "Faster technology does not automatically produce clearer legal effect"3.
What a bank supervisor tests. The cryptoasset standard of the Basel Committee on Banking Supervision (Basel Committee), in its version effective from 1 January 2026, gives a tokenized traditional asset held in a bank's banking book generally the same credit risk treatment as the traditional asset only if the asset meets the standard's classification conditions4. One condition requires all rights and obligations to be "clearly defined and legally enforceable in all the jurisdictions where the asset is issued and redeemed", and the applicable legal framework to ensure "settlement finality"4. The standard requires a bank to carry out a legal review showing that the condition is met and to make the review available to its supervisors on request4. The International Organization of Securities Commissions (IOSCO) wrote in November 2025 that "It can be unclear whether the existing legal treatment for financial assets equally applies to those that are created or represented in the form of tokens"5.
For a token, legal clarity comes down to five questions, listed below with what each answer decides and where this paper takes it up.
| Question | What the answer decides | Where this paper takes it up |
|---|---|---|
| What is the token, legally? | Which body of law applies: securities law, crypto-asset law, e-money or payment law, or banking law | Sections 2.2 and 2.3, then 3.4, 3.5 and 4.3; Step 1 of the roadmap (Section 6.1) |
| Who may issue, sell and trade it? | Which licenses the issuer, its intermediaries and any trading venue need, and where the token may trade after issuance | Sections 3.6 and 4.6 and Section 5; Step 2 (Section 6.2) |
| Who may buy and hold it? | Investor eligibility, the offering exemptions, and the identity checks a transfer must pass | Sections 4.4 and 7.3; Step 3 (Section 6.3) |
| What does the holder own if something fails? | Whether the record is legally authoritative, who holds title, and how holders fare in an insolvency | Steps 2 and 5 (Sections 6.2 and 6.5) |
| What settles the trade, and when is it final? | The settlement asset, whether a stablecoin or central bank money, and the legal moment of finality | Sections 3.3, 4.1 and 4.2 |
Each later section of this paper answers one or more of these questions for one jurisdiction or one step of the roadmap; this section asks what is at stake in the answers.
The Capital That Waits on Legal Answers
Banks. On 5 March 2026 the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board and the Office of the Comptroller of the Currency (OCC) said in answers to frequently asked questions (FAQs) that an eligible tokenized security "should be treated in the same manner as the non-tokenized form of the security would be treated under the capital rule"6. The FAQs define eligible tokenized securities as those conferring legal rights identical to those of the non-tokenized form; tokenized securities without identical rights, "including legal ownership rights", are outside the answers' scope6. In the European Union, Article 501d of the Capital Requirements Regulation, applicable since 9 July 2024 until a dedicated regime for crypto-asset exposures applies, says that exposures to tokenized traditional assets "shall be treated as exposures to the traditional assets that they represent"7. Other crypto-asset exposures, apart from certain asset-referenced tokens, take a 1,250% risk weight7. Under the Basel standard, a tokenized asset that fails the classification conditions falls into Group 2 and, if it also fails separate hedging criteria, takes a 1,250% risk weight; a bank's total exposure to Group 2 cryptoassets is generally limited to 1% of its Tier 1 capital and must not exceed 2%4.
Retirement savings. The Investment Company Institute (ICI) estimated total US retirement assets at $51.2 trillion on 30 June 2026, 33% of US household financial assets8. The US Department of Labor's proposed rule of 31 March 2026 recounts that in May 2025 the Department rescinded its 2022 guidance, which had cautioned 401(k) plan fiduciaries to exercise "extreme care" before considering adding a cryptocurrency option9. The proposal would state that the prudence duty "does not require or restrict any specific type of designated investment alternative", and its preamble says there is "no per se rule" on including actively managed investment vehicles that invest in digital assets9. For retirement plans, the question is what a fiduciary may prudently choose, and US policy on it moved in 2025 and 2026 through a rescission and a proposed rule.
Insurers. On 13 August 2024 the National Association of Insurance Commissioners' (NAIC) statutory accounting working group adopted revisions establishing that "directly held crypto assets are nonadmitted assets for statutory accounting"10. Its definition of crypto assets covers only assets that "do not provide the asset holder with enforceable rights to or claims on underlying goods, services, or other assets"10. A token that gives its holder an enforceable claim on an underlying asset falls outside that definition.
Collateral. In guidance of 8 December 2025, staff of the U.S. Commodity Futures Trading Commission (CFTC) said that registered entities and registrants are required to demonstrate that non-cash assets collected as regulatory margin "meet legal enforceability requirements", and advised market participants to consider whether a tokenized form of an asset gives its holder "legal and economic rights that are the same or functionally equivalent" to those of the traditional form11. The first paper's Section 6.1 records the CFTC staff's answers of 24 September 2026 on tokenized money market fund shares as uncleared swap margin, and the Eurosystem's acceptance, from 30 March 2026, of eligible assets based on distributed ledger technology (DLT) as collateral.
What the tests share. For banks, US insurers and collateral takers, part of the test the rules apply is legal: identical legal rights, legal enforceability and settlement finality, or an enforceable claim on an underlying asset. Each of these tests asks one of the questions in the table above, chiefly what the holder owns and what settles the trade.
What Unsettled Answers Have Cost
When the answer came after the sale. The first paper's Section 1.3 describes how issuers that tried to comply in the security token offering cycle of 2017 to 2019 rebuilt the legal answer deal by deal, often through bespoke legal opinions. On 16 November 2018 the U.S. Securities and Exchange Commission (SEC) announced settled orders against two issuers of tokens sold in initial coin offerings (ICOs), Airfox and Paragon, and called them "the Commission's first cases imposing civil penalties solely for ICO securities offering registration violations"12. Both agreed to return funds to harmed investors, register the tokens as securities, file periodic reports and pay $250,000 penalties each12. According to the SEC's orders, both had conducted their ICOs in 2017, after the Commission had warned in its DAO Report of Investigation that ICOs can be securities offerings12. The first paper's Section 6.1 follows Paragon's case to the $167,665.15 approved for distribution from its Fair Fund. On 13 July 2020 the SEC announced a settled order finding that contracts which individuals entered into through a mobile app, giving synthetic exposure to the prices of US stocks and exchange-traded funds, "were security-based swaps subject to U.S. securities laws"13. The developer, Abra, and a related company agreed to a combined penalty of $150,000, without admitting or denying the findings13. In each of these cases the regulator's answer on classification came after the product had been sold.
What uncertainty costs before a launch. The European Commission's impact assessment of 4 December 2025 reports stakeholders' view that post-trade legislation has not kept pace with technology, leaving legal uncertainty for those wishing to use DLT outside the EU's DLT Pilot Regime, and adds: "These uncertainties increase compliance risks and costs for market participants willing to explore innovative business models"14. In its discussion of central securities depositories (CSDs) that offer services in other member states, the assessment cites one CSD's estimate of EUR 20,000 to 25,000, on average, for a legal opinion on compliance with one country's legal framework, and one CSD that spent almost EUR 1 million on legal fees in an effort to set up passporting arrangements across many member states14. Both figures come from its discussion of cross-border services by CSDs, not of DLT. On 24 September 2026 the European Banking Authority (EBA) said that classifying crypto-assets under the Markets in Crypto-Assets Regulation (MiCA) is a challenge for industry and supervisors that results in "avoidable costs and delays for firms in product roll-out"15.
What venues did not offer. An automated market maker (AMM) is a pool that prices trades by formula, and the SEC's order of 17 September 2026, which grants temporary, conditional exemptions to venues trading tokenized national market system (NMS) stock, calls those venues tokenized securities venues (TSVs)16. The order says that "permissioned AMM Liquidity Pools are unavailable for trading Tokenized NMS Stock, which may be a result of ambiguity surrounding the regulatory status of a TSV and how a TSV trading Tokenized NMS Stock could comply with the Federal securities laws"16.
What holders did not get. On 1 September 2025 the Executive Director of the European Securities and Markets Authority (ESMA), Natasha Cazenave, said that tokenized instruments offered by several fintech firms to give exposure to listed shares "typically do not confer shareholder rights", and that structuring them as synthetic claims rather than direct ownership "can create a specific risk of investor misunderstanding"17. IOSCO wrote that "Investors face legal risks if ownership or transfers made using tokens on the DLT are invalidated or not recognized as envisaged"5. The first paper's Section 5.2 records OpenAI's statement that tokens referencing OpenAI were not OpenAI equity, and its Section 6.1 records how tokenized stock exposure sold through crypto platforms, from Mirror to FTX and Binance, ended as bankruptcy claims or a wind-down.
In this record the costs fall in three places: on issuers as penalties, legal work and delay; on venues as market structures that were unavailable; and on holders as rights they did not have.
Where Clarity Arrived, and What Followed
Japan. Japan's Act No. 28 of 2019 amended its Financial Instruments and Exchange Act in two steps, which took effect on 7 June 2019 and 1 May 202018. The category that the first paper's Section 6.2 describes as "electronically recorded transferable rights" first appears in the version of the Financial Instruments and Exchange Act in force from 1 May 202018. By the count of the Japan Security Token Offering Association, 92 security token issues, one of them in 2019, totaled ¥342.35 billion from 2019 to the end of 2025, and annual issuance went from ¥51.85 million in two issues in 2020 to ¥167.18 billion in 27 issues in 202519.
Hong Kong. The first paper's Section 6.2 records that the Securities and Futures Commission set out its frameworks for tokenized products in two circulars of 2 November 2023, that 13 tokenized products had been offered to the public by March 2026, and that two stablecoin issuer licenses took effect on 10 April 2026. HSBC holds a stablecoin issuer license granted by the Hong Kong Monetary Authority, and on 11 October 2026 its stablecoin page read: "HSBC has not yet issued any stablecoins in Hong Kong"20.
The United Kingdom and the European Union. The first paper's Section 6.2 records that the UK's Digital Securities Sandbox regulations have been in force since 8 January 2024, that the EU's DLT Pilot Regime has applied since 23 March 2023, and that, under MiCA, 39 e-money tokens had been issued and no asset-referenced token had been authorized by 1 September 2026. The first paper's Section 6.3 records that the list of authorized DLT market infrastructures that ESMA still linked on 27 September 2026 showed six, the latest authorized on 26 November 2025. The Bank of England's dashboard, last updated on 9 October 2026, lists 17 entrants approved at Gate 1 and two approved at Gate 2, the stage that permits live activity21.
In these sequences the legal answer came first, and activity, where it followed, came slowly and at small scale. The dates show order, not cause.
Where Clarity Stands on 11 October 2026
The United States. The US Department of the Treasury's interim final rule of 30 September 2026 states that the GENIUS Act "takes effect on January 18, 2027"22. The rule adds that from that date it will generally be unlawful to issue payment stablecoins in the United States unless the issuer is licensed or approved as a permitted payment stablecoin issuer22. The first paper's Section 6.3 reached the same date by the Act's own effective-date rule. The first paper's Section 6.1 records that a Senate vote to end debate on the motion to proceed to the Digital Asset Market Clarity Act (H.R. 3633) failed 49 to 50 on 15 September 2026, and that the bill was not law as of 27 September 2026. The first paper's Section 6.3 also records, as of 27 September 2026, two SEC proposals of 2026: Regulation Crypto Assets, which would exclude investment contracts involving crypto assets that are themselves securities, and transfer-agent rules, which would permit a blockchain as the master securityholder file.
The European Union. On 9 October 2026 the EU's finance ministers reached agreement at Council on the market integration and supervision package, at a meeting chaired by the Irish Presidency of the Council of the European Union23. The Presidency described the package as amending "over 18 different pieces of EU legislation" and said it "delivers important reforms across trading, post-trading, asset management, distributed ledger technology and settlement finality"23. The first paper's Section 6.3 records that on 4 December 2025 the Commission proposed reforming the DLT Pilot Regime as part of that package. On 11 October 2026 the European Parliament's procedure file for that proposal still read "Awaiting committee decision"24.
The United Kingdom and Asia. The first paper's Section 6.3 records, as of 27 September 2026, that firms can apply to the Financial Conduct Authority for authorization under the UK's new cryptoasset regime from 30 September 2026, and that the regime "is expected to come into force on 25 October 2027". The same section records, as of that date, that Singapore's consultation on its stablecoin amendments takes comments until 16 October 2026, and that the main provisions of Japan's Act No. 64 of 2026 take effect no later than 22 July 2027. On 9 October 2026 MAS's Managing Director also said: "We are also reviewing other aspects of tokenisation that may require further legal clarification"2.
On 11 October 2026 the answers were arriving at different speeds: some in force, some enacted with a start date still ahead, and some still proposals or negotiating positions.
Necessary, Not Sufficient
In the same speech of 1 October 2026, Mills said: "Efficient technology is insufficient if ownership, transfer and finality remain uncertain"3. She added: "Progress will not come from regulatory action alone: it will require firms to invest, collaborate and turn technological possibility into services that customers use"3. Chia of MAS said: "Taken together, industry standards and legal and regulatory clarity lay important foundations for commercial adoption"2. He went on: "Scale requires customers, counterparties and financial market infrastructure to move together"2. The European Commission said in December 2025 that the DLT Pilot Regime "has seen limited uptake due to its restrictive design, including limitations on its scope and scale"25. Here the law existed, and its design limited its use, in the Commission's account.
Legal clarity is necessary for tokenized markets to reach the capital described in this section, and it is not sufficient to bring that capital in. The supervisors quoted here name what else scale needs: firms that invest and collaborate, and customers, counterparties and market infrastructure that move together.
Bridge to Section 1.2
Section 1.2 will trace how the rules for tokenized assets moved from a patchwork toward written frameworks, and where that shift stood in October 2026. Section 1.3 will then explain how the rest of the paper is ordered.
Treat the legal answers as the first design input, not the last review. A token whose rights, title and settlement are settled in each target jurisdiction can meet the tests that banks, US insurers and collateral takers apply; a token whose answers are pending reaches only the buyers who can live with that uncertainty. For most projects in October 2026, that means designing to what is in force, such as MiCA and existing securities law, and to the US banking agencies' capital FAQs, rather than to proposals that may change before they take effect.
- On 25 September 2026 rwa.xyz put distributed tokenized assets at $38.62 billion; SIFMA put global fixed income at $160.7 trillion and listed equity market capitalization at $157.8 trillion for 2025; and on 9 October 2026 MAS's Managing Director said tokenized activity in bonds, private credit and corporate debt, equities, precious metals and money market funds "remains small relative to conventional markets for these assets".
- Several large pools of capital apply legal tests: US bank capital FAQs give the same treatment to tokenized securities with identical legal rights and leave others outside their scope; the Basel standard requires legal enforceability and settlement finality; CFTC staff guidance says registered entities and registrants are required to demonstrate that non-cash margin meets legal enforceability requirements; and the NAIC's crypto-asset definition turns on whether the holder has an enforceable claim.
- Unsettled answers have had costs: SEC penalties when the classification answer came after the sale, in 2018 and 2020; "avoidable costs and delays" that the EBA linked to MiCA classification on 24 September 2026; and tokenized instruments giving exposure to listed shares that, ESMA's Executive Director said in 2025, "typically do not confer shareholder rights".
- Where legal answers arrived, activity followed slowly: on 11 October 2026 two of 17 UK sandbox entrants had been approved at Gate 2, which permits live activity, and HSBC, which holds a Hong Kong stablecoin issuer license, had not yet issued.
- Legal clarity is necessary but not sufficient: the Bank of England's Sasha Mills said progress "will not come from regulatory action alone", MAS's Managing Director said scale requires customers, counterparties and financial market infrastructure to move together, and the European Commission said the DLT Pilot Regime saw limited uptake due to its restrictive design.