Code Cannot Rule Alone: New Study Reveals the Legal Limits of Tokenized Finance

Tokenization has been heralded as the next structural transformation of global capital markets: the conversion of bonds, shares, real estate and funds into digital representations recorded on distributed ledgers. A new comparative study published in Frontiers in Blockchain argues, however, that the technology’s most celebrated promise—”compliance by design,” where algorithmic code itself guarantees rights and eliminates the need for trust—is running into a paradox that no amount of cryptography can resolve on its own. Blockchain, the researchers find, cannot independently settle the fundamental legal questions of what a token actually is, or whether an on-chain transfer can be enforced against the entire world rather than just the parties to a contract.

The research team, led by scholars from Université Mohammed V de Rabat and United Arab Emirates University, analyzed the regulatory models of Switzerland, the European Union, the United Arab Emirates and the United States through a Law and Economics lens, treating each legal framework as a dynamic incentive system designed to minimize institutional transaction costs. The stakes are far from academic. By 2025, the total capitalization of crypto-assets exceeded $4 trillion, and stablecoin transfer volumes reached an unprecedented $27.6 trillion—a volume that surpasses the combined processing power of the world’s largest traditional credit networks. Tokenization, the authors conclude, is no longer a niche experiment but an infrastructure challenge to the legal foundations of global finance.

At the heart of the study is a deceptively simple question of ontology: what, legally speaking, is a token? Technically, a token is nothing more than a cryptographically secured entry in a decentralized database managed by a network of nodes. Yet through the mechanism of representation, that entry can stand for a stake in a company, a share of a building, a debt security or a digital currency. The researchers distinguish three structural configurations. In direct tokenization, the token is itself the legal instrument, so an on-chain transfer equals an immediate and absolute transfer of ownership—the pinnacle of compliance by design. In indirect tokenization, the token represents rights over an intermediary such as a special purpose vehicle, reintroducing traditional counterparty risk. In the “digital twin” model, the token is merely an informational mirror with no independent legal force, offering minimal efficiency gains.

Whether a token can count as property in the strict legal sense is not a pedantic debate. That classification is the linchpin for creating perfect security interests, recovering assets when a custodian goes bankrupt, and building a liquid secondary market. Skeptics such as legal scholar Stevens argue that digital assets resist classical property doctrines: unlike a physical object, a private key is information that can be copied or secretly appropriated without the original holder being physically dispossessed. Yet legislatures and courts are increasingly overriding this hesitation. Switzerland’s DLT Act of 2021 created “DLT uncertificated securities” in its Code of Obligations, elevating the distributed ledger to a legally recognized support for rights equal in standing to traditional registries. The Dubai International Financial Centre’s Digital Assets Law of 2024 goes further, declaring in Article 15 that control of a private key is the functional equivalent of physical possession. In England, the High Court’s decision in D’Aloia v. Persons Unknown signaled that blockchain assets can be protected by civil injunctions even before their classification is definitively settled.

The technological machinery of “lex cryptographia”—code that enacts and enforces rules—has advanced dramatically. Smart contracts, self-executing programs running on platforms like the Ethereum Virtual Machine, hard-code contractual terms so that settlement, asset servicing and governance occur without manual intervention. Permissioned enterprise ledgers such as Hyperledger Fabric and Corda can process upward of 3,000 transactions per second, meeting the demands of capital market infrastructure while providing the confidentiality that public chains lack. The state of the art for institutional security tokens is the ERC-3643 standard, which decouples investor identity from the token through the ONCHAINID system: investors receive digital identities carrying encrypted Know Your Customer attestations from accredited providers, and Zero-Knowledge Proofs allow the protocol to verify compliance attributes such as qualified investor status without exposing personal data on a public ledger.

The economic payoff of this architecture comes from atomic settlement. In on-chain Delivery versus Payment at T+0, smart contracts sequester both the tokenized security and the digital cash in a digital escrow, executing the exchange entirely or not at all according to the ACID principles of distributed databases. This eliminates the settlement window that plagues traditional markets, where two-day (T+2) cycles generate, by industry estimates from Goldman Sachs and Banco Santander, annual infrastructure costs of $11 billion to $20 billion through immobilized capital, margin calls and lingering counterparty risk. But there is a catch, and it is the study’s central systemic finding: the automation breaks if the cash leg still relies on legacy banking rails such as SWIFT or TARGET2. Without a wholesale central bank digital currency, the promise of instantaneous, risk-free settlement remains functionally incomplete.

The four jurisdictions studied embody strikingly different answers to these challenges. Switzerland represents radical legal integration: its DLT Act makes an on-chain inscription a transfer of ownership enforceable against all, and Project Helvetia demonstrated that tokenized assets can be settled atomically in wholesale central bank digital currency. The European Union has instead chosen supervised experimentation, with a six-year DLT Pilot Regime capped at EUR 6 billion in aggregate capitalization—a limit critics consider too timid to attract major institutions—and, crucially, no wholesale CBDC, forcing reliance on stablecoin substitutes that reintroduce bank counterparty risk. The United Arab Emirates pursues competitive specialization through its financial free zones: the DIFC codifies private-key possession and guarantees clients priority reclamation of assets in insolvency, while Abu Dhabi’s ADGM has legally validated “governance by code,” allowing a DLT Foundation’s rules to live inside smart contracts, and the central bank is actively piloting a digital dirham. The United States remains the fragmented outlier, split between the SEC and CFTC and still governed by the 1946 Howey test; the GENIUS Act of July 2025 imposes 1:1 reserve requirements on stablecoin issuers but does not take effect until 2027 at the earliest.

Despite these divergences, the study identifies powerful functional convergences. Every jurisdiction now applies a “substance over form” principle, qualifying tokens by their economic reality rather than their label—a token marketed as a utility asset that pays dividends will be requalified as a security, with consequences ranging from nullity of issuance to criminal sanctions. Programmable standards like ERC-3643 and ERC-1400 are becoming a common on-chain language across legal traditions, and Multi-Party Computation has emerged as the global custody standard, fragmenting private keys across independent parties so that no single entity ever holds the complete secret. These cryptographic safeguards, the authors note, were hardened by catastrophic failures such as the 2022 collapse of FTX, where billions in client funds were misappropriated in the absence of legally robust asset segregation.

Yet three structural locks still hold systemic adoption back. The monetary lock is the absence of operational wholesale central bank digital currencies: although the Bank for International Settlements, the Banque de France and Project Helvetia have proven the technology works, deployment depends on sovereign monetary policy decisions beyond the reach of financial regulators. The contractual lock lies in the stablecoin market itself, where analysis of the terms of dominant issuers like Tether and Circle reveals limited redemption access, broad liability disclaimers, and legal characterizations that would likely relegate holders to unsecured creditor status in a bankruptcy—a first-order systemic risk in a market representing over 80% of stablecoin capitalization. The regulatory fragmentation lock, finally, keeps cross-border payment corridors slow and expensive even as most organizations experiment with stablecoin payments. The researchers also flag the collapse of the algorithmic stablecoin Terra USD, which evaporated $45 billion in 72 hours in 2022, as the definitive caution against automated arbitrage without tangible reserves.

The study’s conclusion is stark and, for the tokenization industry, humbling: tokenization does not yet constitute an autonomous “on-chain” financial law. Code is a powerful executor of rights, but it cannot create them; it presupposes their existence within a broader legal order. The jurisdictions that most successfully reduce institutional transaction costs—Switzerland and the DIFC—are precisely those that have permanently and explicitly aligned their positive law with on-chain realities. Until wholesale central bank money, robust insolvency protections and coherent cross-border rules catch up, the future of tokenized finance will be decided not by the sophistication of its protocols but by the willingness of sovereign legal systems to meet the code halfway.

Subject of Research: Legal and economic analysis of financial instrument tokenization across four regulatory regimes

Article Title: Compliance by design or law by decree? A comparative analysis of the tokenization of financial instruments

Article References: Sadok, H., Kassimi, S., AlQodsi, E. M., El Hadi El Maknouzi, M., Jadalhaq, I. M., & Alshawabkeh, I. (2026). Compliance by design or law by decree? A comparative analysis of the tokenization of financial instruments. Frontiers in Blockchain, 9, Article 1934036. https://doi.org/10.3389/fbloc.2026.1934036

Image Credits: AI Generated

DOI: 10.3389/fbloc.2026.1934036

Keywords: tokenization, blockchain, smart contracts, stablecoins, central bank digital currency, financial regulation, Swiss DLT Act, MiCA, DLT Pilot Regime, GENIUS Act, compliance by design, systemic risk