SAMUEL VENTIMIGLIA / PERSONAL SITELON · GMT+0REV 2026-08-19
CTO · Campsor Capital · London

· 17 min read

Tokenising property and shares: what gets built

Tokenising real estate or equity turns on one question: does the ledger become the legal register, or shadow one? That answer sets the build.

  • tokenisation
  • rwa
  • real-estate
  • equity
  • mica
  • smart-contracts
  • architecture
  • fractional-cto

Short answer. Tokenising a property or a company’s equity is not primarily a blockchain problem. It resolves to one question: does the ledger become the legal register, or shadow one? In England and Wales the answer is shadow — section 58 of the Land Registration Act 2002 makes registration at HM Land Registry the act that vests legal title, and sections 113 and 127 of the Companies Act 2006 keep the register of members as the statutory record. Delaware, Switzerland, Germany and Luxembourg have each legislated the other way for securities. That single answer sets your chain, token standard, custody model, cash leg, and whether you carry a permanent reconciliation liability. It is usually not worth doing where the asset has no natural secondary market to begin with: most of the roughly $60bn of tokenised assets shows zero weekly transfer activity, because a token does not create liquidity that was never there. Two near-term UK dates: the FCA’s fund tokenisation rules came into force on 30 April 2026, and draft legislation for a replacement Securities Transfer Tax was published on 13 July 2026 for a 2027 start.

A founder I spoke to this spring wanted two things tokenised — a composite of engagement situations I see often, but the shape is real. A mixed-use Manchester building valued around fourteen million, held through a company he controlled; and his own cap table, forty-one shareholders across three rounds, tracked in a spreadsheet that had survived two lawyers.

Same word, same deck slide, same vendor quote. Two different engineering projects, with maybe fifteen per cent of the build in common.

There is roughly sixty billion dollars of tokenised real-world assets across some seven thousand products. Of 1,289 assets worth more than a hundred thousand dollars each, 910 — about thirty-three billion dollars of nominal value — showed zero weekly transfer activity, and sixty-two assets hold eighty-eight per cent of the value. That is not a market failing. That is a market that mostly built the shadow version, met the reconciliation cost, and stopped.

What a token actually is

Three layers, always:

  1. The entitlement — freehold title, a share carrying voting and dividend rights, a fund unit, a beneficial interest. Created by statute and contract; no code touches it.
  2. The register — the authoritative record of who holds the entitlement. HM Land Registry, the register of members, a unitholder register, a CSD’s books.
  3. The pointer — the token. A row in a balance mapping saying an address controls some quantity of something.

Tokenisation works when layer three is layer two. It becomes an expensive database when layer three merely describes layer two, because then two systems can disagree and something has to decide which wins.

The registrar test

Ask it in this form: if the ledger and the official register disagree tomorrow morning, who owns the asset? Section 58(1) of the Land Registration Act 2002 is unambiguous:

“If, on the entry of a person in the register as the proprietor of a legal estate, the legal estate would not otherwise be vested in him, it shall be deemed to be vested in him as a result of the registration.”

Registration is not evidence of title. Registration is title — a forged transfer still vests the legal estate in the transferee, subject to later alteration. For UK company shares, section 113 of the Companies Act 2006 requires the register of members and section 127 makes it prima facie evidence of membership; a signed stock transfer form alone does not make the buyer a member. The token is an instruction to update the register, never the register.

The other side of the line:

Regime Instrument Can the ledger be the register?
Delaware, US Corporate stock Yes. DGCL §219(c) and §224, effective 1 August 2017, let the stock ledger be kept on “1 or more distributed electronic networks or databases”, provided records convert to “clearly legible paper form within a reasonable time”
Switzerland Shares, bonds, most claims Yes. Ledger-based securities under Art. 973d et seq. of the Code of Obligations, in force 1 February 2021. Requires a registration agreement; rights are exercised and transferred only via the ledger
Germany Bonds, fund units, electronic shares Yes, via a crypto securities register under the eWpG (in force 10 June 2021), operated under BaFin permission; extended to electronic shares by the Financing for the Future Act
Luxembourg Dematerialised securities Yes. Blockchain Law IV (law of 20 December 2024) introduced the control agent — an investment firm, credit institution or settlement organisation that holds the issuance account, tracks the ownership chain and reconciles each issuance, on two months’ notice to the CSSF
UK Authorised fund units Yes, in effect. FCA guidance in force 30 April 2026 permits the unitholder register to be recorded on DLT, subject to the conditions below
UK Land, private company shares No. LRA 2002 s.58; CA 2006 ss.113, 127

Note what the table actually says. Where the ledger can be the register, someone is still accountable for it — a registration agreement in Switzerland, a BaFin-permissioned register operator in Germany, a notified control agent in Luxembourg. No legislature decided consensus alone was sufficient. If your architecture has no named, licensed, liable party, it is not a securities architecture.

Property: the SPV indirection

Because a token cannot hold English land title, every workable property structure does the same thing: the property goes into a special purpose vehicle, the SPV is registered as proprietor at HM Land Registry, and the tokens represent shares or membership interests in the SPV. So there are two registers to keep honest — the land register, which rarely changes, and the SPV’s register of members, which changes on every trade — and the token is a pointer to a pointer. Two consequences engineers meet late.

Transfer tax moves, it does not vanish. Transferring shares in a UK company attracts stamp duty at 0.5% of consideration above £1,000, against SDLT on a direct land transfer at materially higher rates. That gap is why the SPV wrapper exists commercially, and HMRC anti-avoidance provisions bite where a structure exists solely to sidestep SDLT — tokenising neither creates that arbitrage nor protects it. The regime is moving too: HMRC published draft legislation on 13 July 2026 for a Securities Transfer Tax replacing stamp duty and SDRT with a single self-assessed digital tax from 2027, which will change the reporting integration you build.

Fractionalising a building does not fractionalise its liquidity. A single tenant defaulting still moves the whole asset. There is no partial exit from a roof. The token makes the entitlement divisible and does nothing to the cash flow’s lumpiness — most of why the transfer-activity numbers above look the way they do.

Equity: rights or exposure, pick one

For company shares the fork is sharper, and it is where most public tokenised-equity products sit on the wrong side.

Issuer-sponsored. The company issues the tokens and the ledger is, or feeds, the register of members. Holders are members: they vote, receive dividends, appear on the statutory register. The Delaware and Swiss model — the only version that means what the marketing says.

Third-party wrapper. Someone else buys the shares, holds them in a vehicle, and issues a token tracking the price. The claim is against the wrapper’s issuer, not the company. Robinhood’s tokenised stocks are debt securities against shares in an SPV; Backed Finance’s xStocks put sixty-plus US equities on Solana the same way.

ESMA’s executive director Natasha Cazenave put it plainly in a keynote on 1 September 2025:

“These tokenised instruments can provide always-on access and fractionalisation but typically do not confer shareholder rights. If structured as synthetic claims rather than direct ownership, this can create a specific risk of investor misunderstanding and underlines the need for clear communication and safeguards.”

The point is not which model is virtuous. It is that they are different systems. Issuer-sponsored needs corporate-action logic — dividends, splits, rights issues, voting — wired to the register. A wrapper needs collateral attestation, redemption mechanics and disclosure that survives a regulator reading it. Neither converts cheaply into the other, and a board that has not decided which it is buying gets whichever the vendor already built.

Transfer restrictions in code

Once you know who holds the register, the standard is a straightforward decision.

ERC-20 plus an allowlist. A mapping of approved addresses, checked in transfer and transferFrom. Fine for a closed set of a few dozen holders whose wallets you control. It fails the moment you need per-holder rules, jurisdiction logic, or claims issued by anyone but you.

ERC-1400. Partitions, document management, controller operations — but still a Draft proposal composed of four separate EIPs (1410, 1594, 1643, 1644), never finalised. Real deployments exist against a moving target.

ERC-3643 (T-REX). Final status as an ERC, created July 2021. Six interfaces, and the split is the useful part:

  • IERC3643 — the token, with compliance checks, freeze, mint/burn, batch operations
  • IIdentityRegistry — address to on-chain identity, with claim verification
  • IIdentityRegistryStorage — storage separated from registry logic, so several tokens share one verified investor set
  • ICompliance — offering-level rules: holder caps, per-holder limits, enforced through canTransfer
  • ITrustedIssuersRegistry — whose signed attestations count
  • IClaimTopicsRegistry — which claims a holder must hold

Plus IAgentRole for privileged operations.

Prefer it not for maturity’s sake but because the separation matches how the obligation is written. Who may hold this (identity) and what this offering permits (compliance) are different rules, owned by different parties, changing on different clocks. Conflate them in one contract and every jurisdiction rule change becomes a redeployment.

The FCA has effectively specified the same two components. COLL 6 Annex 4.16G describes controlling transfers so tokens move “only to known account numbers that the authorised fund manager has verified as belonging to a person who is an eligible unitholder”; 4.17G extends that to tax status and unit-class eligibility and says a firm “may utilise accepted token standards that allow for the verification of a unitholder’s identity”; 4.18G requires those contracts to be “regularly audited”, tied to Principles 2 and 3.

The admin key nobody wants to design

The requirement that kills naive designs, stated by the FCA more directly than most engineering teams state it to themselves — COLL 6 Annex 4.8G:

“Where the register is recorded on DLT, or utilises records on DLT, the responsible firm will need to ensure that it can amend that register as necessary without requiring the consent or agreement of any third party.”

Standard consensus mechanisms are carved out; everything else is not. And 4.9G names the implementations:

“The responsible firm may also be able to effect updates to the register through direct control of private keys, or a ‘master-node’ function.”

Forced transfer, mint, burn, freeze and reassignment, exercisable unilaterally. Not because anyone misunderstands immutability, but because a register that cannot be corrected cannot be a register. A holder dies. A key is lost. A court orders rectification.

Design that path deliberately: a threshold scheme over the privileged role rather than one key in one HSM; separate roles for freeze and reassignment, whose approval thresholds differ; every privileged call emitting an indexed event reconciled against a ticket; and a documented legal basis written before the first intervention is needed. In a regulated firm, ICT change-control and testing expectations reach this path too — operational-resilience requirements do not stop at the contract boundary.

Wallet aggregation. The register must state units in each class held by each holder, and a holder may hold across several addresses. 4.21G expects “systems in place (whether on or off DLT) that can aggregate the information held on the DLT” — an indexer with identity resolution, on the compliance-critical path rather than the reporting nice-to-have path.

Outage contingency. 4.25G expects alternative processes so holders can transact during a network outage, “including where use of fiat money or off-chain processes may be necessary”. 4.26G goes further: if the network is unavailable for an extended period, the manager and depositary need procedures to wind the fund up by realising assets and distributing proceeds. Your chain is a dependency with a documented failure mode. And 4.27G keeps the requirement that the register be available for inspection free of charge in the UK — a public block explorer is not that.

MiCA’s own perimeter matters here: Article 2(4) excludes instruments that are already MiFID financial instruments, the same classification boundary the CLARITY Act draws differently. On custody, MiCA Article 70 requires safeguarding and segregation and prohibits use of clients’ crypto-assets for the provider’s own account; Article 75 requires a custody policy with a register of client-held assets, a register of positions, ICT security controls and return procedures. If you have already built custody segregation to MiCA standard, the token layer is the easier half.

Valuation, and the oracle you should not build

A building has no continuous price. It is valued periodically by a qualified valuer, and the number is an opinion with a date on it. The failure mode is treating that opinion as a market price — wiring it into a feed and building redemption or collateral logic on top, so a stale opinion becomes an on-chain fact something else trusts.

The pattern that holds: publish the valuation as a signed, dated attestation from a named valuer, hashed on-chain with the report off-chain, effective date and methodology in the payload. Consumers check the date and refuse to act on a stale one. Nothing derives a live price; nothing auto-liquidates. A use case needing continuous pricing needs a continuously priced asset, and a building is not one.

The cash leg

Atomic delivery-versus-payment is the honest reason to do any of this — simultaneous transfer of asset and cash removes principal risk — and it only works if the cash sits on the same ledger. Per ESMA’s June 2025 review of the DLT Pilot Regime, 21X AG settles its cash leg in euro- and dollar-denominated e-money tokens from Circle Internet Financial Europe SAS and Quantoz Payments B.V. — EURC/USDC and EURQ/USDQ — both authorised under MiCA Article 48, with wallet whitelisting embedded in the smart contract logic.

That is the template: a regulated e-money token from an authorised institution, not whichever stablecoin has the deepest pool. It also means your counterparty set is the set that can hold that token.

As at 31 May 2025, three DLT market infrastructures had been authorised in total — CSD Prague, 21X AG and 360X AG — with minimal live trading. And Article 3 caps what can be admitted: equity at €500 million market capitalisation, debt at €1 billion issue size, under a €6 billion ceiling on aggregate market value. ESMA reports those thresholds as too restrictive in practice, excluding many large-cap issuers. Three years in, with a purpose-built regime, that is where the regulated version of this market got to.

What each layer costs

Ranges from my own engagement experience, not published benchmarks. They assume a competent in-house engineering team and exclude legal, tax and audit fees.

Layer Typical cost What drives it
Legal structure and entitlement design Legal spend, not engineering Jurisdiction; whether the ledger can be the register
Token contracts (ERC-3643, standard modules) £25k–£60k Number of custom compliance modules; upgradeability model
Identity registry and claim integration £40k–£120k Number of KYC providers; whether claims are reusable across issues
Privileged-operations path (multisig, approvals, audit trail) £30k–£80k Approval topology; regulated firm or not
Indexer, wallet aggregation, register reconciliation £60k–£180k Whether the ledger is the register or shadows one — the biggest single swing
Cash leg and DvP integration £50k–£150k Regulated EMT integration; counterparty onboarding
Smart-contract audit £30k–£90k per audit Lines of custom logic; re-audits after changes
Ongoing reconciliation and monitoring £8k–£25k per month Holder count; transfer volume; shadow-register overhead

The row that decides the project is indexer and reconciliation. Where the ledger is the register, it is reporting infrastructure. Where it shadows a statutory register, it is a permanent two-way synchronisation problem with legal consequences when it drifts — and it never gets cheaper. Same structure as choosing a latency regime: the architectural decision sets the multiple, not the implementation.

Where this goes wrong

Immutability sold as a feature. Teams ship a token that cannot be corrected, then meet the first lost key, death or court order. The privileged path is not a compromise of the design — it is part of it, and regulators now say so in writing.

Liquidity assumed rather than built. Fractionalising an entitlement does not create a market for it; nine hundred and ten tokenised assets with zero weekly transfers is the evidence. Decide who the buyers are before you decide the chain.

Compliance in the application layer. Restrictions enforced in a web front end are not enforced. The token is the perimeter — if it can move without a compliance check, it will. Rules go in canTransfer, identity claims behind a registry you can update without redeploying.

Two questions cover most of the diligence. Where does legal title actually live, and if the ledger and the official register disagree tomorrow, who owns the asset? Firm answers make this a tractable, well-understood build. Vague ones mean the technology decision is premature — and no token standard fixes that.

If you are weighing a tokenisation build and want the registrar question settled before vendor selection, get in touch. Custody, segregation and regulatory engineering for crypto-native and regulated firms is the work I do.

Sources