How to analyze the risks of a tokenization project

A tokenization project usually arrives with a polished pitch deck, the name of a well-known blockchain and the promise of easy access to a previously restricted asset. None of that tells you whether the project is sound.

This article proposes a seven-layer analysis checklist. It does not repeat why the technology does not eliminate risk; that is covered in why tokenizing an asset does not eliminate risk. The focus here is practical: what to ask for, where to check and which answers should raise a red flag. The references are reports from the International Organization of Securities Commissions (IOSCO) and the Financial Stability Board (FSB), as well as rules from the CVM (Comissão de Valores Mobiliários, Brazil’s securities regulator), consulted on October 8, 2026.

The seven-layer checklist

Layer	Central question
1. Asset	What is behind the token, and how much does it yield or is it worth, without the technology?
2. Legal structure	Against whom is your right, and which record is legally valid?
3. Offering regulation	Is the offering subject to any regulator’s rules?
4. Code	Does the smart contract do what it promises, and who can change it?
5. Custody	Who holds the real asset and who holds the keys?
6. External data	Where does the information that drives the contract come from?
7. Exit	How, and at what price, can you get out?

The order matters. The first three layers decide whether the project deserves technical analysis. If the asset is weak or the right is vague, a flawless code audit will not save the investment.

1. The asset: analyze it as if there were no token

Start by describing the asset in your own words: a rented property, a pool of receivables, corporate debt, a commodity stockpile. Then ask the questions you would ask with no blockchain at all.

• Where does the return come from? Rent, interest, future sale, appreciation?
• What would knock that return down? Vacancy, default, falling prices, operational problems.
• Who appraised the asset, and with what method? An appraisal done by the same company selling the token has an obvious conflict.

If the answer to “where does the return come from” is vague, or depends on new buyers coming in, stop here. A return that depends only on new money coming in is the hallmark of a Ponzi scheme.

2. The legal structure: what the token gives you

A token is a record. What matters is the right that record represents and against whom it can be enforced. Ask for the transaction’s legal document (contract, issuance deed, offering rules) and look for three answers.

• Who the issuer is, with its registered business name and CNPJ (Brazil’s corporate taxpayer ID), and whether the asset is held in its name or by a company created solely for the transaction.
• Which record is legally valid. IOSCO observed, in a November 2025 report, that operators take different approaches: some treat an off-chain record as the official source of ownership, others combine the two, others give priority to the on-chain record. According to the report, this variation can confuse investors about which is the official record of their asset and lead to disputes if not clearly disclosed (IOSCO, 2025).
• What happens if the issuer goes bankrupt. Is the asset kept separate from the company’s assets, or does it become part of the bankruptcy estate?

For real estate, the difference between a token and ownership is the subject of does a token represent legal ownership of a property?.

3. Offering regulation: verify before you trust

In Brazil, the CVM states that the fact an asset is digital or on a blockchain “is irrelevant” to deciding whether it is a security. What counts is its economic nature (CVM, Guidance Opinion 40, 2022). If the token works as a collective investment offered to the public, the offering must follow capital markets rules.

A common route for smaller offerings is investment crowdfunding, governed by CVM Resolution 88. In the consolidated text consulted on October 8, 2026, this route requires a CVM-registered platform, a raise of up to R$ 15 million and a period of up to 180 days. Non-qualified investors are limited to R$ 20,000 per year in these offerings, with exceptions provided in the rule, and sign a risk acknowledgment form. The resolution itself requires the platform to warn that “the CVM does not review offerings in advance.” The rule is under review; the context is in real estate tokenization in Brazil: who regulates what.

In practice:

• Check whether the platform is registered. The CVM publishes the list on its open data portal (Crowdfunding Platforms: Registration Information).
• Read the offering’s key information, especially the risk warnings section that Resolution 88 requires.
• Be wary of anyone who says “tokens don’t need regulation.” It may be true in a specific case, but the blanket statement contradicts what the CVM says.

4. The code: what the contract does and who controls it

The smart contract is the program that controls the token on the blockchain. It can restrict who buys, block transfers and distribute payments. How this works with real assets is covered in smart contracts applied to real-world assets.

To analyze the risk, ask:

• Was the code audited by an independent firm? Ask for the full report, not just a badge, and check whether the issues found were fixed.
• Can the contract be upgraded, and by whom? Upgrade power makes it possible to fix bugs, but also to change rules after you have bought.
• Who holds the admin keys? A single person with the power to freeze or move tokens is a single point of failure.

IOSCO notes that code errors can cause transactions not to execute as intended and that, on permissionless public blockchains, fixing those errors after deployment is not simple. Flaws can also be exploited by attackers.

5. Custody: two vaults to check

There are always two kinds of safekeeping: of the real asset and of the token. Ask who holds each, under which regulator, and whether investors’ assets are kept separate from the custodian’s own assets. The custody layers are detailed in custody of tokenized assets: who controls what.

The FSB lists custodians among the third parties tokenization depends on, alongside oracles and services that convert between the traditional system and the blockchain (FSB, October 2024). Each third party is a company that can fail.

6. External data: who feeds the contract

Code cannot see the physical world. Rent payments, unit values and custody balances reach the network through oracles, services that write data from outside onto the blockchain. The FSB points out that rules for data providers in traditional markets may not fully cover oracles and that they can be targets of attacks and manipulation.

The key question is simple: who feeds the contract, and who checks that source? If the answer is “the issuer itself,” you are trusting its word, now in digital form. The full topic is in oracles: how a physical asset gets onto the blockchain.

7. Exit: how you leave the investment

Assess the exit before the entry. Is there redemption by the issuer, with a defined timeframe and price? Is there a secondary market with real buyers, or only the promise of one? Resolution 88 requires the platform to warn about the difficulty of selling securities of a company not registered with the CVM that are not traded on a regulated market. In any case, consider that there may be no buyer and that you could lose the entire amount invested.

Conflicts of interest: the layer that cuts across all others

In many projects, the same company originates the asset, appraises it, issues the token, runs the platform, holds the keys and feeds data to the contract. IOSCO observes that when the separation between functions disappears, conflicts of interest that are hard to manage can arise, such as when an agent trades on its own account and settles both its own trades and those of other participants.

Ask which functions are concentrated in a single company or group and who, from outside, checks each one.

Red flags

• A promised or “guaranteed” return, without explaining where it comes from.
• An issuer without a verifiable business name, CNPJ or address.
• A platform that does not appear on the CVM list offering something that works as a collective investment.
• No legal document, or only a technical white paper.
• A code audit that is mentioned but not published.
• One person with the power to freeze, issue or move tokens, without external oversight.
• Pressure to decide quickly and bonuses for bringing in other investors.

To recognize known frauds, see crypto scams: how to spot and report them.

Key takeaways

• Analyze the project from the outside in: asset, legal rights and regulation first; code, custody and data afterward.
• In each layer, the decisive question is who is accountable if something goes wrong, and whether that answer is in writing.
• A refusal to show documents, audits or registrations is, in itself, information about the risk.