Blockchain Arbitration & Commerce Society (BACS) · no. 12 · 13 October 2026
Almost every project that reaches us has started at the end. The network has been chosen, the smart contract written, the interface designed, and only then does someone ask what is required for any of it to be lawful.
The right order is the reverse, and not out of caution but out of arithmetic: the legal decisions determine the technical architecture, so taking them afterwards means rebuilding what has been built. These are the seven, in the order they have to be taken.
1. What right does the token actually confer
This is the first and the most frequently skipped. A security token is not a legal category: it is the digital representation of a right that already has a regime of its own. Shares, bonds, fund units, a contractual claim, a revenue participation, a beneficial interest in a vehicle that owns an asset. Each of those is a different instrument, with its own supervisor, documentation and limits.
And there is a distinction that decides disputes: the token and the underlying right are not the same thing. Transferring the token on-chain does not necessarily transfer the right. If the instrument creating that right — the articles, the issuance deed, the vehicle’s constitution — does not establish that transfer of the token is the mode of transferring the right, what you have is a parallel register that may stop matching the legal position on day one.
Until this question has been answered in writing, everything else is decoration.
2. Where you issue from, and to whom you may offer
These are two decisions, not one, and they are frequently confused.
The first is where the issuer is domiciled. The second is to whom the product may be offered. And the second governs the first: incorporating in an accommodating jurisdiction does not displace the law of the place where the investor is solicited. An issuer established abroad that places securities among residents of a State is subject to that State’s regime, whatever its own seat.
The useful question is therefore not “where do I incorporate” but “whom do I want to sell to, and what structure permits that at the lowest regulatory cost”. Once that is settled, the jurisdiction of issuance very nearly chooses itself.
3. The European perimeter
If the token represents a financial instrument — and most security tokens do — it falls outside MiCA. The crypto-asset regime does not apply; the securities regime does: MiFID II, the Prospectus Regulation and, where trading or settlement on distributed ledger infrastructures is intended, the pilot regime under Regulation (EU) 2022/858.
The most immediate practical consequence is the prospectus. A public offer of securities requires an approved prospectus unless it falls within an exemption, and the exemptions run along four axes: the status of the investor, the number of offerees per Member State, the minimum amount per investor or the denomination per unit, and the aggregate size of the offer. Since June of this year, following the listing package reform, the aggregate threshold below which no prospectus is required is twelve million euros across the Union, with each Member State able to reduce it to five.
The national position is worth checking before relying on an exemption. This is the kind of figure that moves and does not tolerate recollection.
4. The vehicle, and what stands behind the token
If the token represents an interest in an asset, somebody has to own that asset. Usually a vehicle established for the purpose.
That is where the questions project documentation rarely answers begin. Is that vehicle insulated from the promoter’s insolvency risk? What happens to the asset if the issuer fails? Who holds the physical asset or the title evidencing it? Is there a depositary, and is it liable for anything?
A token backed by an asset that sits within the issuer’s insolvency estate is not a backed token. It is an ordinary claim with a technological layer.
5. The register, which is the question almost nobody asks
Who keeps the authoritative record of title: the chain, or a register?
In many legal systems title to certain securities requires entry in a register kept by an authorised entity. Where that is so, the chain may be evidence, even excellent evidence, but it is not the register. And then the token is a receipt for something that lives somewhere else.
The DLT pilot regime exists precisely to allow a distributed register to perform that function under defined conditions. Deciding at the outset whether one operates inside that regime or outside it changes the architecture entirely.
6. Transfer restrictions must match the contract
A security does not circulate freely. There may be restrictions by investor type, by jurisdiction, by lock-up period, by prior identification of the acquirer.
A token, by contrast, moves by default to any address, in any country, in seconds. That is its technical virtue and its legal defect.
So the smart contract has to carry the controls — whitelists, time locks, jurisdiction exclusions — and those controls must match the restrictions in the offering document exactly. Where they do not, the problem runs both ways: the contract permits what the document forbids, and the document promises what the contract does not secure. Both are compromised.
7. What happens when something goes wrong
This is the section drafted last, in haste and by copying, and it is the one that determines what everything else is worth.
The forum and the governing law have to be fixed, and fixed on the assumption that the typical dispute will not be between the issuer and an investor in the same country, but between parties in different States over an asset that is in none of them. A well-built arbitration agreement resolves that stretch: one seat, one set of rules, an arbitrator who understands the subject matter, and an award enforceable under the New York Convention.
But the decisive point is still missing, and it is the one we have been repeating in these pages for a year: an award obliges a person; it does not move an asset. It does not reverse a confirmed transaction, nor reach someone who controls a set of keys and chooses not to comply.
Which is why the last question of structuring is also the most neglected: what can a decision actually act upon? An escrow, a multi-signature authorisation, an issuer function permitting freeze or reassignment, a registrar within reach of a court. If none of those points exists, the best award in the world is a piece of paper.
That check costs an afternoon when done at the design stage and is impossible afterwards.
The order matters more than the list
The seven decisions are not independent. The first determines the regime, the regime determines to whom you may offer, that determines where it makes sense to issue, and the jurisdiction determines how title is registered and which restrictions have to be coded.
Taken in that order, each one narrows the next and the work converges. Taken backwards, each one invalidates the last.
BACS is a non-profit arbitration institution registered in the EU Transparency Register (REG 9106897105368-14) and operates a Court of Arbitration specialised in digital assets. This article is for informational purposes and does not constitute legal advice.
This article follows our previous piece on how a bank should prepare for asset tokenisation.
