Token
ERC-3643 or ERC-1400, selected at scoping. ERC-1410 partitions where you need tranches or series
ISO/IEC 27001 certified · EU · MiFID II · Prospectus · AIFMD · MAR · DORA
MiFID II Tokenization Development Company for EU Issuers
Prospectus-compliant STO development across the whole EU stack. We build tokenization platforms that enforce your classification your counsel reached, the exemption you are relying on, the depositary and valuation duties if your vehicle pools, the obligations that follow admission, all in the contract. Where you hold an authorisation, we work to the resilience terms it requires in your contract with us.
For EU issuers of tokenized securities, whether you are authorised or issuing through an SPV. This page shows how each EU rule becomes a platform feature. Not an EU issuer, or after the wider build?Authorised firms and fund managers Asset owners issuing for the first time
- 2019Founded
- 12Tokenization Platforms Delivered
- 17+Smart Contract Audits Delivered
- 0Exploits Shipped to Mainnet
The Regime Decides the Architecture, Not the Other Way Round
Four decisions set the shape of an EU tokenized securities platform, and all four are made before anyone writes a transfer rule.
- 01What your token confers
decides whether it is a financial instrument.
- 02Whether it is a financial instrument
decides whether you file a prospectus or rely on an exemption.
- 03Whether capital is pooled under manager discretion
decides whether AIFMD lands on top of both.
- 04Whether you hold an authorisation
decides whether DORA already governs how you are allowed to buy a platform like this one.
4decisions
All four come before the first transfer rule. Settled in order, each answer narrows the build.
Settled in that order, each answer narrows the build. Settled late, they arrive as a rebuild: wrong transfer logic, the wrong investor test in the eligibility rules, a register that cannot produce what your NCA asks for, and a token already issued.
So we take them first, with your counsel, and write the answers down. Each section below closes on what its regime becomes in the contract, because that is the part you are buying. The four answers are the architecture review: bring them and the call produces a scope.
Bring Your Four AnswersThe Contract, Regime by Regime
Each regime below becomes a layer of the platform. Open one and work it through.
Is Your Token a Transferable Security Under MiFID II? What makes a token a transferable security
A token that confers ownership in, or a claim against, an issuer or an underlying asset is a transferable security under MiFID II Art. 4(1)(44) and falls inside Annex I Section C(1). Two things do not change that:
Form - Paper or DLT, the classification is the same.
Yield - An ownership-conferring token is a security whether or not it distributes anything.
Three categories are settled:
Ownershiptokenized equity, fund units, fractional interests in a vehicleSettled
Debtbonds, notes, any repayment obligationSettled
Derivative exposureto an assetSettled
Yield without ownershipdecided on the rights and the structureNot settled
One case is not settled.
A revenue share that creates an enforceable claim against the issuer is a transferable security, and one that does not may sit elsewhere. It is the most common place a tokenized offering is misclassified, so it needs a written opinion.
MiCA does not apply once the token is a security
MiCA Art. 2(4)(a) excludes MiFID financial instruments, so there is no white paper. The disclosure document is a prospectus. Read ESMA's Art. 2(5) guidelines in their current version, and your own NCA's token-classification note. BaFin, AMF, AFM, CSSF, CONSOB and CNMV have each published one, and they differ.
Issuing does not need a MiFID licence
The Prospectus Regulation borrows MiFID II's definition, but MiFID authorisation attaches to underwriters, placing agents and trading venues, not the issuer. If you are already authorised, check which of your permissions your distribution model uses. That decides which requirements reach the build.
MiFID II STO Development: What Classification Changes in Your Platform
These are the MiFID II requirements that reach the build where your distribution runs through a MiFID permission. Each one becomes a rule in the contract.
Client categorisation (Annex II): every investor is retail, professional (per se or on request) or an eligible counterparty
What we build
Each investor tier is a credential on the on-chain identity registry. The transfer function checks it before every transfer, so eligibility is enforced, not kept as a flag in a CRM
Re-categorisation: a client can opt up to professional, and their status has to be reviewed over time
What we build
The credential expires. A stale verification blocks the transfer instead of allowing it
Product governance (Art. 16(3), 24(2)): a target market and a negative target market for each instrument
What we build
Jurisdiction and investor-type blocks encoded per token, the negative set included, enforced and not just documented
Costs and charges disclosure (Art. 24(4)): shown to each client before and after investing
What we build
Per-client cost reports for both stages
Communications recording (Art. 16(7)): kept five years, extendable to seven
What we build
A retention clock held in the document registry
Prospectus Regulation Tokenization Development: Do You File or Do You Exempt?
Classification tells you the Prospectus Regulation applies, not that you are filing. A public offer in the EU, or a request for admission to a regulated market, engages Art. 3. Then an exemption decides.
Below the threshold
The test
Under €12 000 000 per issuer or offeror over 12 months, for a non-passported offer, from 5 June 2026 (amended Art. 3(2)). A Member State may elect €5 000 000 instead, so your home figure governs
Qualified investors only
The test
MiFID II professional clients and eligible counterparties (Art. 1(4)(a))
Under 150 persons
The test
Fewer than 150 per Member State, other than qualified investors (Art. 1(4)(b))
Large tickets
The test
Minimum denomination of €100 000 per unit, or minimum consideration of €100 000 per investor (Art. 1(4)(c)–(d))
On a token, ordinary behaviour can break an exemption:
- A forwarded deck or an uncontrolled secondary transfer ends "qualified investors only"
- The 150 count needs a method documented at launch
So the platform holds the limit:
- The offer page, subscription flow and transfer function enforce the same ceiling
- From the same registry
- With a count you can audit afterwards
An exemption enforced by a marketing policy is an exemption you are hoping about.
A DLT Pilot MTF does not waive the prospectus. The regime relaxes trading and settlement rules, not the issuer's disclosure duty.
Prospectus-Compliant STO Development: What a Tokenized Prospectus Must Carry
If no exemption holds, you file.
Pick the format. A base prospectus suits a continuous programme of tokenized bonds or other non-equity securities. It is approved once, and final terms are filed per issuance. We build to whichever format your counsel chooses.
Disclose what paper does not. The securities description and risk factors (Art. 6, Art. 16) should also cover:
- The network and consensus mechanism
- Contract addresses and audit history
- The token standard and identity mechanism
- The upgrade path and recovery procedures
- Custody failure and operational risks such as oracle, bridge and congestion
Carry an independent audit.
We treat an independent audit, with all material findings fixed, as part of a tokenized prospectus. No article names it, but Art. 6's material-information standard reaches the audit findings, because the smart contract is the instrument. It cannot be our own review. An open finding is a disclosure problem, and a disclosure signed off by the firm that wrote the code is not what Art. 11 responsibility intends.
AIFMD: Start With the Depositary
Most WealthTech issuances are fund units. Once money is pooled under manager discretion, AIFMD applies, and its depositary rule most often decides whether the fund can tokenize at all.
Art. 21 requires one depositary per AIF, with no exemption by size, strategy or investor type. It sits in the AIF's home Member State and is one of:
- An EU credit institution
- A MiFID firm whose permissions include asset safekeeping
- For closed-ended unleveraged AIFs only, another prudentially regulated institution with minimum own funds of €730,000
It performs three functions, and each reaches the platform:
Safe-keeping
Instruments held in segregated custody, with strict liability for loss regardless of fault (Art. 21(12)). Other assets, such as real estate: title verification and records (Art. 21(8)(b))
Instruments held in segregated custody, with strict liability for loss regardless of fault (Art. 21(12)). Other assets, such as real estate: title verification and records (Art. 21(8)(b))
What we build
A register the depositary can read directly, not only you
Cash monitoring
All cash flows, and notice of all subscriptions, with each AIF's cash segregated
All cash flows, and notice of all subscriptions, with each AIF's cash segregated
What we build
Subscription state and settlement modelled separately. Pending units stay non-transferable until cash is confirmed
Oversight
Subscription and redemption procedures, NAV verification, distribution review (Art. 21(9))
Subscription and redemption procedures, NAV verification, distribution review (Art. 21(9))
What we build
A read interface and a feed the depositary can check, with distribution runs reproducible from the register
The depositary is a prerequisite you satisfy before there is a build to make.
Is Your Vehicle an AIF, and Which Tier?
Is it an AIF? All three conditions are required:
- Capital raised from multiple investors
- A defined investment policy, written or de facto
- Investment for the benefit of those passive investors
The operating-business carve-out is narrow. Real estate, fleet, leasing and private-credit vehicles run by a manager for passive investors are AIFs, whatever staff or assets they have. ESMA's March 2025 guidelines treat a token giving a proportional share of pooled returns, redeemable for a share of portfolio value, as a unit in a collective investment undertaking. Treat AIFMD as the default. The carve-out needs a formal opinion.
Registered or fully authorised? The thresholds are aggregate at AIFM level, on total assets including leverage, not NAV:
- Under €100M, if leveraged or with redemption rights inside five years
- Under €500M, if unleveraged and closed-ended
Registration exempts the manager from the operating conditions, the depositary, the annual report and the investor-disclosure set, but forfeits the EU marketing passport until it opts in (Art. 3(4)). A manager that later crosses a threshold needs a depositary integration, a valuation feed, Annex IV reporting and the full disclosure set. So we ask at scoping where the threshold sits against your raise plan, and build or stub those interfaces to match.
Valuation, Exit and What the AIFMD Stack Becomes in the Contract
Three more requirements reach the contract:
Valuation independent of portfolio management, with the AIFM liable even when an external valuer is used (Art. 19)
In the contract
NAV posted at source quorum with a deviation guard and depositary cross-check. An outlier halts the run instead of pricing the subscription
Art. 16 liquidity tools: side pockets, gates, notice periods, suspensions
In the contract
ERC-1410 partitions let a side pocket and a per-tranche lock-up share one register. A gate disclosed but missing from the contract is a disclosure failure
Retail access (ELTIF 2.0 or UCITS) with a PRIIPs KID
In the contract
The KID joins the anchored document set, on its own retention clock
→ Fund-unit mechanics by instrument are scoped at the architecture review on the tokenization development page .
MAR — What Attaches, and When MAR scope is instrument-based, not entity-based.
That is the most common scoping mistake in this area.
When MAR attaches
It attaches when a financial instrument is to either:
Admitted to trading
on an EU regulated market, MTF or OTF, with SME growth markets and DLT MTFs included
The subject of a request for admission
(Art. 2(1)(a)–(c))
A tokenized transferable security is caught as its underlying instrument class. The DLT form changes nothing, and whether you hold an EU authorisation is irrelevant.
Filing a prospectus for a public offer, with no venue involved, does not trigger MAR. The trigger is the request for admission.
What the issuer carries once it attaches
- Inside-information disclosure (Art. 17)
- Insider lists (Art. 18)
- Managers' transaction notifications (Art. 19)
- Retention: disclosed inside information is kept five years (Art. 17(2))
In the build
The reporting view outputs in the shape your NCA expects, and the document registry carries that five-year clock alongside the Prospectus Art. 21(7) ten-year duty for prospectus, final terms and supplements, the ELTIF Arts. 23–24 set and the PRIIPs KID. One registry, four retention clocks, which is why retention is a contract parameter rather than a wiki page. CSDR sits beside it: where book-entry form is required, the register and any CSD link are designed to satisfy it rather than retrofitted after admission.
DORA — What Your Authorisation Obliges You to Demand From Us
DORA is the one regime on this page that governs your purchase of this platform rather than your issuance. It applies automatically by entity type, on the day your authorisation is granted, not by enrolment. Art. 2(1) names:
What it makes you demand from us
We are not a financial entity. We are an ICT third-party service provider to one. That makes Article 30 the clause set your procurement team has to get into our contract and it is why we put the reason on the table at scoping rather than waiting for your redlines.
Four of the nine mandatory provisions in Art. 30(2) decide how a platform is built rather than how it is papered:
- Where the service runs and where data is stored
- Availability, authenticity, integrity and confidentiality of data including personal data
- Access, recovery and return of your data in an easily accessible format on insolvency, discontinuation or termination
- Incident assistance at no additional cost
Where the platform supports a critical or important function, Art. 30(3) adds:
- Quantitative performance targets
- Participation in your threat-led penetration testing
- Unrestricted inspection rights for you, your NCA and the Lead Overseer
- An exit strategy with a mandatory transition period
Alongside the contract
- Register of Information (Art. 28(3)) is filed annually at roughly 50 fields per contract, which is why our sub-processor data arrives structured rather than as a PDF
- Exit plan (Art. 28(8)) needs a real, tested migration path.
In the build
We deploy the platform into your cloud or on-premise estate, under your accounts, and hand you the code outright, so the thing your critical function depends on is not sitting inside a vendor you would have to exit. A platform you own and control is an exit plan that passes its test. A platform rented from the vendor who built it is the concentration risk Art. 28 asks you to assess before you sign. The Art. 30 clause set is signed, including the Art. 30(3) additions where the platform supports a critical or important function. The vendor risk pack downloads without a call.
What We Build
Compliance
The identity registry with its trusted-issuer and claim-topic registries, and a modular compliance contract with one rule module per obligation: eligibility, jurisdiction, lock-up, freeze, forced transfer, recovery
Documents and upgrades
ERC-1643 for document anchoring, hash and URI on-chain and document off-chain. Transparent proxy, proxy admin and timelock for upgrades, with multisig approval and a mandatory delay
Around the token
Cap table, transfer-agent logic, investor portal, issuer dashboard, admin panel, and a regulator reporting view shaped for NCA and ESMA outputs
Assurance
Our internal security review before mainnet, with a documented findings report. An independent third-party audit is separate and cannot be us
Ownership
White-label. You own the code outright at delivery, deployed by us into your own estate, with no licence fee and nothing to rent back
The full stack, the component table and the conformance register are on the tokenization development page.
MiFID II Smart Contract Audit: Reviewing Code Against the Rules
A security audit checks one question well: can this contract be exploited? It covers static analysis, reentrancy, access control, arithmetic, upgrade safety, and you should not launch without it. It does not ask whether the contract does what your offering documents say. For a regulated issuance, that is the question that reaches your NCA, and the one a regulator-grade smart contract audit has to answer.
- A security audit checksCan an attacker move tokens they do not own?A regime review checksCan an ineligible investor hold them, under the categories your MiFID II classification actually created?
- A security audit checksDoes the upgrade path have an access-control flaw?A regime review checksDoes an upgrade trigger a disclosure obligation you have not planned for?
- A security audit checksDoes the distribution function overflow?A regime review checksDoes it pay in the order your fund documents and preference terms specify?
- A security audit checksIs the document registry writable by the wrong role?A regime review checksDoes it hold Prospectus Art. 21(7)'s ten years and MAR Art. 17(2)'s five, as separate clocks?
- A security audit checksCan the register be corrupted?A regime review checksCan your depositary actually read it to discharge its Article 21 oversight?
- A security audit checksIs the pause function safe?A regime review checksDoes the exemption ceiling hold when the subscription flow is under load?
We do both, and we say which is which.
Code we did not write
A genuinely independent audit. Smart contract audit is a standalone service for us, with 17+ delivered for other teams.
A platform we built
Our review is internal, so an audit your prospectus describes as independent cannot be ours. We arrange one from a firm that did not write the code, manage the remediation and re-test against the findings.
A regime review is not a substitute for a security audit, and we will not sell it as one.
It is the compliance-grade review a security audit does not cover, and that is what your compliance lead is accountable for.
The National Layer: Can the Token Legally Be the Security ?
The EU stack decides whether your token is a security and what you must disclose. National civil law decides whether it can legally be that security, and that is where a build gets blocked after everything else is settled.
The register law in four Member States
BaFin
CSSF
AMF
CONSOB
BaFinGermany
eWpG — electronic securities, including crypto securities
The law that decides what your register must be.CSSFLuxembourg
Blockchain Laws I–III
The law that decides what your register must be.AMFFrance
DEEP — dispositif d'enregistrement électronique partagé
The law that decides what your register must be.CONSOBItaly
Fintech Decree
The law that decides what your register must be.In the build, it comes down to one question: is your chain the register, or a mirror of one?
Constitutive of title
Where national law makes the on-chain entry constitutive of title, the contract is the record, and the transfer function is the settlement event.
Licensed registrar
Where the law instead requires a licensed registrar to maintain the official register, the contract becomes the instruction layer. We build the registrar interface plus the reconciliation that keeps the two identical, because a divergence between them is a title dispute, not a sync bug.
These are two different builds, and the choice is neither ours nor yours. It is your register law's. We establish which one applies in the compliance specification, before a single transfer rule is written. Getting it wrong is the most expensive error available on this page: it is found after issuance, and it is not patchable in a module.
Six answers settle your national position.
We work through them with your counsel before the specification is signed:
- The national prospectus cap
- The liability model
- The securities-register law
- The AIFMD private-placement terms, if your manager is below the thresholds
- Whether your Member State exercised the MiFID Art. 39 branch option
- Your NCA's published stance
Bring the country and we will tell you which of the two register builds it puts you in.
Bring Your JurisdictionWhy Us on the EU Regime Specifically
ISO/IEC 27001 – Information Security Management System
Certified ISMS covering what we handle during an engagement: your documents, the source code, and build and deployment credentials.
We are not in the data path after handover. The platform runs on your infrastructure under your accounts, so your investors' records never sit with us. That narrows both your Art. 28 concentration assessment and your sub-processor chain.
Our ISO 27001 status is in the vendor risk pack, with our GDPR data processing statement and sub-processor register. Your third-party risk assessment can run on documents rather than assurances, and your DORA Article 30 review has something to cite under ICT risk management.
Across the EU, the UK and the US
We have delivered across the EU, the UK and the US, covering fund, bond and private credit structures, including two builds published in full with the clients named. What we put in front of your compliance lead is the architecture, the audit methodology and the test evidence read against your own fund documents.
Behind that sits where the article citations above come from
We maintain it per-regime, article-by-article readiness record (MiFID II, Prospectus, AIFMD, MAR, CSDR, DORA and the rest) and each one checked against the in-force text and re-checked when it changes. It is why we can tell you that Article 21 depositary requirement has no exemption by size, strategy or investor type, and why we corrected our own prospectus threshold the day the Listing Act moved it.
What it means for you
The regulatory questions that normally arrive three months into a build. Sort of which NAV priced that subscription, what happens when a claim lapses, who may post a valuation, which retention clock applies to which document are answered in the specification and not discovered in testing.
What an EU Engagement Delivers
- Classification mapped to code
Your counsel's determination encoded as claim topics, eligibility rules and transfer conditions
- Exemption enforced, not assumed
If your route depends on investor type or a headcount, the contract holds the ceiling — auditable after the fact
- Prospectus technical annex
The DLT, contract addresses, audit history, upgrade and recovery mechanics your offer document has to disclose, written in the form it is filed
- Depositary integration
Subscription cash routing, NAV oversight feed, distribution review — built so your depositary reads the register rather than your report
- NCA-shaped reporting view
Structured outputs for supervisory requests, with the retention clocks set per duty
- DORA Article 30 clause set
Signed, including the Art 30(3) additions where the platform supports a critical or important function
- The codebase
Yours outright at delivery
How an EU Engagement Runs
- Step 1 of 4Classification and route, on the record
We work through the tests with your counsel and the determination is written down before anyone designs a transfer rule.
- Step 2 of 4Specification
We map every obligation above to the module that enforces it. You approve the map with your compliance lead, or with your counsel if the vehicle is an SPV.
- Step 3 of 4Build, review, audit, file
We build the contracts and interfaces, then run our internal security review. A firm that did not build the platform then performs the independent audit your prospectus has to reference. We arrange it and manage remediation until the findings are clean, and the technical disclosure is ready before you file.
- Step 4 of 4Handover
Mainnet, monitoring, the conformance register, and the code.
What Compliance Leads Ask Us
“
Why not a platform that already has the licences?
OUR ANSWER
It is a different purchase. A licensed platform sells you its permissions and its structure. We build the platform around your structure and hand it over, with the code yours outright. If their shape genuinely fits, that is the simpler answer and we will say so.
01 / 05
Know Your Regulatory Path Before You Brief Your Board
Get the compliance brief for issuers. It opens with the MiFID II instrument classification test, then covers the Prospectus Regulation, the EU Listing Act, PRIIPs, MAR, CSDR, and GDPR, plus AIFMD and ELTIF if a manager runs your vehicle, and AML and DORA where your existing authorisation already triggers them.
Download the Compliance BriefGet a Sample Security Audit Report
The audit is a disclosure item in your prospectus, so it is worth seeing one before you commission it. Every file read in full and not sampled. Each finding is proven through executable proof-of-concept exploits against the real contract stack. Severity is reported from Critical to Informational, not filtered to a clean headline.
Download the Audit ReportThe EU Tokenization Tech Stack We Build On
Each layer is chosen with you at scoping, against your existing systems and your data-residency and resilience requirements.
01Frontend and Backend
02Database
or the database you already run03Blockchain Networks
Chain-agnostic: public EVM, non-EVM or a permissioned ledger, chosen at scoping04Smart Contract Languages
Solidity and Vyper on EVM chains, Rust on non-EVM chains05Blockchain Dev Tools
06Valuation feeds
Signed by your administrator/valuation function, or by Chainlink where an external source is needed07KYC / Compliance Integration
08Cloud Infrastructure
or your own estate where data residency requires it
Ready to Build on the EU Regime Rather Than Around It?
Bring your classification opinion and your offer route. We will tell you what the platform has to enforce.
Share Your Offer Route no call required
FAQs
Questions Issuers Ask Before the First Call
01Is our tokenized fund unit a financial instrument?
Yes. Any token conferring ownership of, or a claim on, a fund, bond or equity instrument, and negotiable on the capital market, is a transferable security under MiFID II Art. 4(1)(44) and sits in Annex I Section C(1), regardless of yield structure. That classification sets your prospectus path, your eligibility rules and your reporting, which is why we settle it before architecture.
02Does AIFMD apply to our build?
If the structure pools investor capital under manager discretion and the investors are passive, treat it as yes. The operating-business carve-out is narrow and needs a formal opinion, not a self-assessment. Where it applies, the depositary, the valuation function and the liquidity tools are scoped into AIFMD fund tokenization development from day one, the depositary in particular, because Article 21 has no exemption by size, strategy or investor type.
03Can we rely on the €12M exemption?
Check your home Member State before planning around the figure. From 5 June 2026 the Prospectus Regulation sets a single €12M threshold per issuer over 12 months for non-passported offers, but a Member State may elect €5M instead, and may still require a national disclosure document below either. Our part is making the ceiling enforceable. If the exemption depends on investor type or a headcount, the platform should hold that limit, not your marketing policy.
04Does our chain choice affect our regulatory position?
Not your instrument classification, which follows the rights your token confers, not the ledger it sits on. What the chain affects is your operational posture: key management, resilience, and the ICT third-party arrangements DORA already puts on you. We scope the chain against those, not against gas fees.
05Will you sign our DORA Article 30 clauses?
Yes, and we would rather see them at scoping than at contract, because DORA-compliant tokenization platform development starts there. The Art. 30(2) set is standard for us. Where the platform supports a critical or important function, the Art. 30(3) additions — performance targets, TLPT participation, inspection rights, exit transition period — are worth walking through early, because two of them have architecture consequences. Code ownership and no hosting dependency are what make the exit clause real rather than drafted.
06What happens if the rules change after we've launched?
Compliance rules can be updated without redeploying the whole stack or migrating existing holders. Upgrades run through multi-signature approval and a mandatory delay, each one logged. Where the change touches your offer terms it is also a disclosure event — a supplement under Prospectus Art. 23, with the withdrawal rights that follow, which we scope with your counsel rather than deploying around.
Everything on this page is the engineering consequence of each regime, not legal advice, and no substitute for your own counsel's determination. Article references are to the measures in force at the date shown and are re-verified at each revision.
