The most expensive mistake in this field is building the token first. It is expensive because the token is the only part that can be rewritten in an afternoon, and everything it depends on takes months and costs money to change. What follows is the dependency order, read from the asset upward, with the failure mode of each link.
The asset does not move
Whatever is being tokenized already exists, already sits in a jurisdiction, and already belongs to someone under that jurisdiction’s law. A warehouse receipt, a land registry entry, a fund’s unit register — there is an existing authoritative record, and it is not yours.
This sounds obvious and is routinely skipped. The test is simple: if a dispute went to court in the country where the asset sits, what document would the judge look at? If the answer is not the ledger, the ledger is a secondary record, and every design decision after this one has to account for keeping the two in agreement.
The vehicle is doing more work than it looks
Almost every structure puts a company, trust or fund between the asset and the investors. It is worth being precise about what that vehicle is for, because it is not paperwork.
It gives the asset a legal owner that can contract, be audited and be wound up on its own. It creates a boundary so that a claim against the sponsor does not reach the asset, and a failure of the asset does not reach the sponsor’s other business. And it converts an indivisible, illiquid thing into something that can be issued in units.
That boundary — usually discussed as bankruptcy remoteness — is the property most of the structuring cost is buying. It is also the property most easily undermined after the fact, by the sponsor treating the vehicle as a division of itself: paying its bills from the wrong account, commingling cash, signing without authority. A vehicle that is not respected in operation will not be respected in an insolvency.
What to check
- The vehicle can hold title in its own name in the asset’s jurisdiction.
- Its constitutional documents limit it to this asset and this purpose.
- Its accounts, signatories and records are genuinely separate.
- There is a defined way to wind it up and distribute the proceeds.
The interest is the thing being sold
Investors do not buy the building. They buy shares, units or notes issued by the vehicle that holds the building. This distinction carries the entire regulatory weight of the structure, because in most jurisdictions that interest is a security, and the obligations attach to it regardless of how it is recorded.
Supervisors have converged on describing tokenization as a delivery method rather than a new asset class, and the phrase is not dismissiveness — it is a precise statement of where the obligations sit. Disclosure, eligibility of holders, record-keeping and reporting follow the instrument. Changing the medium changes the operational characteristics and nothing else.
The register is where ledgers actually bite
Someone must be able to state authoritatively who holds the interest today, and produce that answer for a date in the past. In many regimes, maintaining that record for a registered security is itself a reserved function performed by a registrar or transfer agent.
This is the single place where the jurisdiction of the vehicle changes what software can do. A small number of jurisdictions have amended their company and securities law so that an entry on a distributed ledger is the legal record. In those places the token can be the register, and the reconciliation problem genuinely disappears.
Everywhere else, an off-chain register remains authoritative and the token is a mirror of it. That is a workable design, but it should be chosen knowingly: two records that must agree will eventually disagree, and somebody has to own the procedure for what happens when they do.
The holder is a person, not a wallet
Eligibility rules are facts about people: where they are resident, what they have been assessed as, whether they appear on a list, how long they must hold. A wallet address carries none of this. It can carry a flag that an institution has checked and vouched for those facts, which is a different and weaker thing, and the weakness is the subject of a separate note.
Reading the chain backwards
A useful exercise before committing to a structure: start at the token and walk down, asking of each link what would have to be true for it to fail, and who would notice. Most designs survive the first two questions. The ones that survive all five are the ones with counsel in the vehicle’s jurisdiction involved before the contracts were written rather than after.
The tokenization page sets out the same chain more briefly, and the coverage map shows which of these links any technology layer can and cannot perform.