Tokenization and capital markets: regulatory limits

Tokenizing a financial security means recording ownership of it, or of a right linked to it, in a token, usually on a distributed ledger technology (DLT) network, of which blockchain is the best-known example. The promise is familiar: smaller fractions, faster settlement, automatic rules built into the asset itself.

What tends to be left out of the promise are the limits. This article covers them in the capital markets: shares, debt securities, fund units and collective investment contracts. The situation described is as of October 8, 2026, based on regulators’ documents. Real estate has its own map in Real estate tokenization in Brazil: who regulates what.

Two ways to tokenize a security

IOSCO, the organization that brings together the world’s securities regulators, distinguishes two models (IOSCO, November 2025):

• Native token: the asset is born on the network. The blockchain record is the official record itself.
• Digital twin: the asset was issued the traditional way, off-chain, and the token is a representation of it.

In January 2026, the SEC, the U.S. securities regulator, proposed a similar division, looking at who does the tokenizing. In the issuer-sponsored model, the company itself (or an agent of it) issues the security in token form. In the third-party model, someone unaffiliated with the issuer creates a token that mirrors someone else’s security, either by holding the original security and issuing a claim on it or by creating a synthetic instrument that merely tracks its price (SEC, January 28, 2026). This difference will matter later on.

First limit: technology does not change the nature of the asset

Regulators repeat the same idea in different words.

In Brazil, the CVM (Comissão de Valores Mobiliários, Brazil’s securities regulator) states in Guidance Opinion 40, from 2022, that the fact that an asset is offered digitally or based on a distributed ledger “is irrelevant” to classifying it as a security (CVM, Opinion 40). If the token has the characteristics of a collective investment offered to the public, the CVM regulates it. The criteria are explained in the article on real estate tokenization cited above.

In the United States, Commissioner Hester Peirce summed it up in July 2025: “Tokenized securities are still securities,” and those who deal in them must comply with securities laws (SEC, July 9, 2025). IOSCO follows the same line and recommends to its members the principle of “same activity, same risk, same regulatory outcome.”

In practice, this means there is no technological shortcut. A debenture on a blockchain is a debenture. A tokenized fund unit is a fund unit.

Second limit: a public offering is still a public offering

Opinion 40 makes a useful distinction. Tokenization itself does not require prior approval or registration with the CVM. But if securities are issued for public distribution, the issuer and the offering are subject to regulation (CVM, Opinion 40).

The same opinion highlights two points that often surprise people:

• An offering of securities issued abroad may be irregular if it targets the Brazilian public without registration, and the use of Portuguese in the offering and in customer service may be enough to establish that targeting.
• The CVM recommends that offerings explain the drawbacks of the chosen technology, how the investor holds the token (whether they control their own private key or custody is delegated), in which venues the token can be traded and what controls exist over the origin of buyers’ funds. That last point connects with the obligations described in Anti-money laundering on crypto platforms.

For small companies, the most common route is investment crowdfunding under CVM Resolution 88. In the consolidated text in force, an offering through a registered platform is exempt from registration if it raises up to R$ 15 million within 180 days, and the ordinary investor is limited to R$ 20,000 per year in these offerings, with exceptions set out in the rule (CVM Resolution 88). The statement the investor signs explains the reason for the cap: the risk and lack of liquidity of this type of investment. Tokenization does not change these limits.

Third limit: where the token can be resold

A large part of the argument for tokenization is liquidity: selling at any time, to anyone. That is precisely where regulation is most restrictive.

CVM Resolution 88 allows a crowdfunding platform to broker resales of securities of companies that raised capital through it, if the company consents (Arts. 15 to 17). But the same rule prohibits the platform from offering a centralized system in which buy and sell orders meet and form a price, from registering trades closed elsewhere and from having a market maker. It also bans terms such as “exchange,” “over-the-counter market” and “secondary market,” which could make you think there is a regulated market behind it. Setting up a real trading venue requires specific authorization as an organized market.

International experience points in the same direction. According to IOSCO, tokenization has changed the creation and issuance of assets more than their distribution and trading, which still depend on traditional infrastructure and intermediaries. In the examples analyzed of tokenized short-term funds, secondary trading is limited and generally only occurs among investors pre-approved on a list, the so-called whitelist (IOSCO, November 2025). Being technically able to transfer a token does not mean there is someone willing to buy it, nor that the transfer is permitted.

Fourth limit: the token may not be the asset

Here the difference between issuer and third party comes back. When the one tokenizing is not the issuer, what you buy may be something else.

The statement by the SEC divisions in January 2026 says that the rights of a token created by a third party “may or may not be materially different” from those of the original security. Such a token may not represent an ownership interest in the issuer and therefore may not grant shareholder rights. The holder may also bear risks that the direct investor does not, such as the bankruptcy of the third party holding the security. If the token is merely a synthetic instrument tied to the price (a swap, in U.S. terminology), it generally does not grant ownership, voting or information rights in the company (SEC, January 28, 2026). The SEC itself notes that the text reflects the staff’s views and has no force of rule.

IOSCO describes the same problem from the legal side. Securities laws were written for paper certificates and book-entry records. It is not always clear whether they apply equally to tokens, and, with digital twins, the variety of structures can leave the investor unclear about what rights they have over the asset and how they can transfer it.

What the infrastructure adds

Even when the legal classification is clear, the technology brings its own risks. The IOSCO report lists attacks on network nodes, congestion, data leaks, market fragmentation, smart contract failures and loss of private keys. It also points to two structural bottlenecks: the lack of communication between different blockchains, which scatters liquidity into islands, and the lack of a reliable settlement asset, the network’s “money” used to pay for securities without counterparty risk.

The Financial Stability Board (FSB), which brings together G20 authorities, assessed in October 2024 that, given its still-small scale, tokenization did not pose a material risk to financial stability. But it listed the vulnerabilities to watch: liquidity and maturity mismatches, leverage, asset quality, interconnectedness and operational fragilities (FSB, October 2024).

For investors, these limits add to the risks of the asset itself, which tokenization does not eliminate. This point is detailed in Why tokenizing an asset does not eliminate risk, and the loss can be total.

What the CVM is testing in 2026

As of October 8, 2026, the CVM had not created a specific rule for tokenized securities. What exists is a testing path.

Sandbox. In the first cycle of the regulatory sandbox, an environment in which companies test new models with temporary exemptions from rules (CVM Resolution 29/2021), the CVM approved four projects, three of them with securities in token form. One of them, involving debentures and closed-end fund units, could only be traded by qualified and professional investors. On the page consulted, the CVM states that no new admission process is planned (CVM, Regulatory Sandbox).

Working group. In July 2026, CVM/PTE Ordinance 177 created the Tokenization Working Group (GTT), with representatives from 14 of the agency’s departments and an initial term of 120 days, extendable by another 30. The group studies registration, deposit, custody, trading and settlement of securities on DLT (CVM, July 17, 2026). According to the GTT page, updated on October 7, the proposal for an experimental regime has been delivered, and the workstreams on infrastructure and cybersecurity, governance and supervision are still under way (CVM, GTT page).

DLT Pilot Program. On September 15, 2026, the GTT delivered to the CVM’s Board a draft resolution creating a testing program covering the issuance, offering, trading, custody, deposit and settlement of shares, debentures, receivables certificates and fund units on distributed ledger networks. The tests would last 60 days, extendable by up to 30, and would serve to assess technical, operational and legal feasibility, interoperability between networks and regulatory gaps (CVM, September 16, 2026). As of the date of this article, the editorial team had not found approval of the draft by the Board or publication of the resolution.

A pilot is a supervised test, not a general authorization. If someone uses the name of the CVM’s sandbox or pilot to sell an investment, check on the CVM website whether that company and that offering are actually included.

How to read a tokenized offering

The following questions follow from the limits described above:

• Who issued the token? The issuer of the security itself or a third party? If a third party, what rights does the token grant, and what happens if that third party goes bankrupt?
• What is the CVM classification? A registered offering, an offering exempted under a specific rule, such as crowdfunding, or neither?
• Where can I resell? Is there an authorized venue for this? Are there restrictions on who can buy?
• Who holds the key? You, the platform or a hired custodian? Losing the key can mean losing access to the asset.
• What is in writing? Does the offering document explain the technology’s risks, as Opinion 40 recommends?

Be wary of anyone who treats blockchain as a guarantee of liquidity, legality or returns. It is a means of recording.

Key takeaways

• Tokenizing changes the format of the record, not the nature of the investment. If the token is a security, CVM rules (or SEC rules, in the U.S.) still apply.
• The most concrete limits lie in the public offering, resale and the token’s rights. A token issued by a third party may not grant the rights of the original asset and adds that third party’s risk.
• As of October 2026, the CVM is still in the testing phase: sandbox, working group and a pilot awaiting approval. Definitive rules for tokenized securities do not yet exist.