Tokenised Securities Custody Rules in the EU
Custody obligations for digital securities are no longer a grey area. This guide cuts through the regulatory noise so wealth managers, family offices and advisors can conduct informed due diligence before allocating to tokenised assets.
Why Tokenised Securities Custody Rules Now Matter
The rapid growth of tokenised securities — debt instruments, fund units and structured products issued on distributed ledger technology (DLT) — has forced regulators to codify custody obligations that previously existed only in informal guidance. For advisors, the stakes are high: recommending a tokenised instrument without verifying the custody framework exposes clients to operational, legal and counterparty risk. ESMA has repeatedly signalled that existing MiFID II safekeeping rules apply to tokenised securities by economic substance, not merely by legal form. In parallel, national frameworks such as Liechtenstein's Token and Trusted Technology Service Provider Act (TVTG) and Germany's Electronic Securities Act (eWpG) have created specific registrar and trustee roles. Ignoring these layers is not a viable compliance posture. Understanding them is now a baseline expectation for any adviser conducting proper due diligence.
The MiCA and MiFID II Custody Framework Explained
Markets in Crypto-Assets Regulation (MiCA), fully applicable since December 2024, governs asset-referenced tokens and e-money tokens, but explicitly carves out financial instruments already covered by MiFID II. This means tokenised bonds, shares and fund units fall primarily under MiFID II Article 13 and the UCITS/AIFMD depositary rules — not MiCA. The practical implication: a tokenised security must be held by a licensed depositary or investment firm authorised to provide custody, regardless of whether settlement occurs on-chain. ESMA's 2023 guidelines on DLT pilot regime participants further clarified that smart-contract-based settlement does not replace the legal obligation to segregate client assets. Advisors should request written confirmation of the custodian's regulatory licence, its jurisdiction of authorisation, and how client assets are segregated at both the on-chain and legal-entity level.
Liechtenstein TVTG: A Benchmark for Token Custody
Liechtenstein's TVTG, in force since 2020, is widely regarded as one of the most comprehensive token-economy laws in Europe. Under TVTG, a Physical Validator — a regulated service provider — is responsible for linking legal rights to tokens and ensuring those rights can be exercised. This creates a direct legal nexus between the on-chain token and the underlying asset, closing a gap that exists in many other jurisdictions. For wealth managers sourcing tokenised securities via platforms that issue under TVTG — such as those facilitated through Investhub's Liechtenstein-based infrastructure — due diligence should include reviewing the Physical Validator's FMA licence, the token contract's audit trail, and the issuer's prospectus or offering documentation. The TVTG framework also mandates clear procedures for key management and succession, which is especially relevant for family offices with long-duration holdings.
Segregation, Key Management and Operational Risk
Regulatory compliance on paper is necessary but not sufficient. Advisors must evaluate the operational mechanics of custody: how private keys are managed, whether multi-signature or multi-party computation (MPC) schemes are used, and whether the custodian holds keys in cold storage or in hot wallets exposed to online risk. Under MiFID II Article 13(7) and ESMA's Guidelines on Internal Controls, client assets must be segregated from the firm's own assets at all times — a principle that translates on-chain to segregated wallet addresses or sub-accounts, ideally verifiable on a public ledger. Failure to segregate correctly has been the single most common enforcement trigger in European digital-asset regulatory actions to date. Advisors should also confirm insurance coverage, business continuity plans and the custodian's procedure for handling a fork or token migration event.
Cross-Border Custody: EEA Passporting and Third-Country Risk
Many tokenised securities are structured across multiple jurisdictions — an issuer in Liechtenstein, a custodian in Luxembourg, and investors across the EEA. MiFID II passporting allows an authorised investment firm to provide custody across EEA member states, but passporting does not eliminate local risk. Advisors must verify that the custodian's passport has been notified in the client's home member state and that local investor-protection rules are not stricter. Where a custodian is located outside the EEA — for example, in Switzerland or the British Virgin Islands — MiFID II Article 18 imposes additional due-diligence obligations, including assessment of the third-country legal regime's insolvency protections. FMA Liechtenstein has published guidance confirming that TVTG service providers operating within the EEA notification framework satisfy EEA custody standards, a point worth raising explicitly with compliance teams.
Stablecoin Settlement and Custody Interaction
An increasingly common feature of tokenised securities transactions is settlement in stablecoins or central bank digital currency (CBDC) equivalents rather than traditional T+2 cash. Under MiCA, e-money tokens used for settlement are subject to their own custody obligations: the issuer must hold reserve assets with an authorised credit institution. Advisors should not assume that stablecoin settlement is risk-free simply because it is faster. Key questions include: Is the stablecoin MiCA-compliant? Are reserve assets held in segregated accounts? What is the redemption mechanism if the stablecoin issuer becomes insolvent? Platforms such as Investhub that integrate stablecoin settlement for tokenised securities should be able to provide documentation of the stablecoin's MiCA registration or equivalence status. Settlement efficiency gains are real, but they do not substitute for rigorous counterparty assessment.
Due Diligence Checklist for Advisors
Before recommending any tokenised security to a client, advisors should work through a structured checklist. First, confirm the custodian's regulatory licence and jurisdiction. Second, obtain written evidence of client-asset segregation at both the legal-entity and on-chain level. Third, review the Physical Validator's or registrar's role under the applicable token law (TVTG, eWpG or equivalent). Fourth, verify key-management procedures, including cold storage ratios and MPC usage. Fifth, assess stablecoin settlement risk where applicable. Sixth, confirm insurance and business continuity arrangements. Seventh, check that the custodian's EEA passport is notified in the client's home jurisdiction. This checklist is not exhaustive — complex structured products may require additional review — but it covers the baseline obligations that regulators, including ESMA and FMA Liechtenstein, consider non-negotiable for investor protection.
Key Takeaways
- Tokenised securities fall under MiFID II custody rules by economic substance; MiCA governs stablecoin settlement separately.
- Liechtenstein's TVTG creates a legally binding link between on-chain tokens and underlying rights via the Physical Validator role.
- Client-asset segregation must be verifiable both at the legal-entity level and on-chain; failure to segregate is the leading enforcement trigger.
- Cross-border custody requires verified EEA passport notification and, for third-country custodians, additional MiFID II Article 18 due diligence.
FAQ
Do MiCA custody rules apply to tokenised securities?
Not directly. MiCA explicitly excludes financial instruments already regulated under MiFID II, such as tokenised bonds, shares and fund units. Those instruments remain subject to MiFID II safekeeping rules and, where applicable, UCITS or AIFMD depositary requirements. MiCA does apply to stablecoins used for settlement within the same transaction flow.
What is a Physical Validator under Liechtenstein TVTG?
A Physical Validator is a TVTG-regulated service provider that creates and maintains the legal link between a token on a DLT system and the underlying right or asset it represents. They must hold an FMA Liechtenstein licence and are responsible for ensuring token holders can exercise their rights. This role is unique to the TVTG framework and adds a layer of legal certainty absent in many other EU jurisdictions.
How should advisors verify client-asset segregation for tokenised securities?
Advisors should request written confirmation that client assets are held in segregated wallet addresses or sub-accounts distinct from the custodian's own assets, with documentation of the segregation methodology. Where the ledger is public, on-chain verification should be possible. Internally, the custodian must also maintain legal-entity-level segregation in line with MiFID II Article 13(7).
Is stablecoin settlement for tokenised securities safe?
Stablecoin settlement offers speed and efficiency advantages but introduces specific risks: the stablecoin must be MiCA-compliant, reserve assets must be held in segregated accounts at an authorised credit institution, and redemption mechanisms must be tested. Advisors should request the stablecoin issuer's MiCA registration documentation or equivalence assessment before relying on stablecoin-settled transactions for client portfolios.
What happens to tokenised securities if the custodian becomes insolvent?
Under MiFID II, correctly segregated client assets are ring-fenced and should not form part of the custodian's insolvency estate. However, on-chain, private-key access may complicate recovery if key management is not properly documented. Advisors should review the custodian's insolvency procedures, confirm insurance arrangements, and check whether the token law in the relevant jurisdiction (e.g., TVTG) provides explicit insolvency protections for token holders.
Does EEA passporting cover digital-asset custody services?
Yes. An investment firm authorised in one EEA member state to provide custody of financial instruments can passport that service across the EEA under MiFID II. However, advisors must verify that the passport has been formally notified in the client's home member state. Liechtenstein-based firms operating under TVTG and holding FMA authorisation can passport custody services into EU member states via EEA Agreement provisions.
Custody is the operational foundation of any tokenised securities allocation — get it wrong and every downstream protection a client believes they have may be illusory. Wealth managers and family offices should treat custody due diligence as a non-negotiable first step, not an afterthought. Investhub facilitates token issuance under the TVTG framework and integrates regulated custody and stablecoin settlement into its infrastructure, precisely to address the compliance gaps outlined above. If you are assessing a tokenised allocation and want to understand how the custody framework operates in practice, speak with the Investhub team before committing capital.