Tokenized asset custody: who controls what

When you buy a stock through a broker, custody is almost invisible: there is a custodian, a central depository and an official record of who owns it, and you rarely think about them. In a tokenized asset, that structure does not disappear. It is split into new parts, and each one may be in the hands of someone different.

Custody, here, is the safekeeping and control of an asset on behalf of its owner. This article separates the custody layers of a tokenized asset, shows which Brazilian rules apply to each one and lists the questions that help you understand who controls what. For the basic concept, see what asset tokenization is.

The four layers of custody

A token representing a real-world asset involves, in the newsroom’s assessment, at least four distinct things to safeguard:

1. The underlying asset, what the token represents: a property, gold in a vault, a batch of receivables, a debenture.
2. The legal ownership record, the official ledger that says who the owner is under the law.
3. The private keys, which move the token on the network.
4. The administrative powers over the smart contract, such as freezing, pausing or upgrading.

The Financial Stability Board (FSB), a body that brings together regulators from the major economies, notes that the network does not perform all functions by itself. Custody and redemption of tokens may require third-party providers, and underlying assets such as gold may need physical safekeeping. The token, on its own, safeguards nothing off the network.

Layer 1: who holds the underlying asset

The first question is simple and often forgotten: where is the asset? A property remains registered at the real estate registry office. Gold remains in a vault, under someone’s responsibility. A receivable remains a claim against a debtor, with documents kept by a company.

If whoever holds the underlying asset fails, loses the asset or disappears, the token may keep circulating on the network with nothing behind it. Real estate cases illustrate this separation well: see whether a token represents legal ownership of a property and the difference between a token and a property title.

Layer 2: who records ownership

In the Brazilian securities market, two functions handle the record, each regulated by the CVM (Comissão de Valores Mobiliários, Brazil’s securities regulator):

• Bookkeeping. Under CVM Resolution 33/2021, the bookkeeping agent (escriturador) maintains the registry books, records who holds each security and registers collateral and other encumbrances on it. Only financial institutions may apply for authorization for this activity.
• Custody. Under CVM Resolution 32/2021, the custodian keeps, controls and reconciles the investor’s positions, carries out their transfer orders and handles asset events, such as interest payments. Banks, brokerages, distributors and central securities depositories may apply for authorization.

When a security is tokenized, there are two possibilities. The token may be a mirror of the official record, which stays with the bookkeeping agent or the custodian, or the network itself may be the record. The second model depends on rules that are still being tested, as explained in how debenture tokenization works. In September 2026, CVM staff delivered to the Board a proposal for a pilot to test, among other things, bookkeeping, custody and central depository services on distributed ledger networks. It was a draft under internal review as of the date of the news item.

In the mirror model, if the token and the official record diverge, the official record decides. That is why having the token in your wallet does not replace being in the registry.

Layer 3: who has the keys

On the network, whoever has the private key moves the token. BCB Resolution 520, from the Banco Central (Brazil’s central bank), defines the private key as the instrument for controlling virtual assets, a cryptographic signature mechanism that authenticates transactions.

There are two basic arrangements, explained in detail in custodial and non-custodial wallets:

• Self-custody. You keep the key. No one moves the token without you, but if you lose the key or fall for a scam, there may be no one to turn to. In permissioned tokens, the issuer can sometimes reissue or recover the position, which shows you are not the only one with power over it.
• Third-party custody. A company keeps the key on your behalf. You depend on its security, honesty and solvency.

CVM Guidance Opinion 40, from 2022, recommends that offerings of tokens that are securities disclose whether the investor will be able to control the private key, whether custody will be delegated and who the custodians are. The FSB points out that custodians may find it hard to maintain sound key management and data integrity between the network and traditional systems.

Layer 4: who can change the contract

Many real-world asset tokens give powers to administrators. The technical standard ERC-3643, used here only as an example, provides for agents who can freeze wallets, force transfers, recover tokens for those who lost their key and pause the whole token.

In practice, this means the key that controls the contract may be worth more than yours. This layer of control is detailed in smart contracts applied to real-world assets. For custody, the question is: who keeps the admin keys, and with what safeguards?

Which rule applies: CVM or Banco Central

The split begins with Law 14,478/2022. Article 3 defines a virtual asset as a digital representation of value that can be traded or transferred electronically, used for payments or investment. But it expressly excludes representations of assets whose issuance, bookkeeping, trading or settlement is already provided for in law or regulation, “such as securities and financial assets”.

In practice:

• A token that is a security (for example, a debenture or a collective investment contract in token form) follows CVM rules, including those on custody and bookkeeping. The criteria for knowing when a token is a security are in tokenization and capital markets: regulatory limits.
• A virtual asset outside that scope follows BCB Resolution 520, in force since February 2, 2026, which governs virtual asset service providers, including custodians.

There are gray areas, and the classification of a specific token depends on case-by-case analysis.

What BCB Resolution 520 requires of custodians

For virtual assets, the central bank’s rule sets out requirements that help you understand what to expect from a custodian. Among them:

• What custody is. Article 9 includes safekeeping and control of private keys, an up-to-date description of each client’s position, reconciliation of that position with the network, execution of the holder’s orders and handling of asset events.
• Asset segregation. Articles 29 and 30 require client assets to be held in wallets separate from those used by the provider, with proof-of-reserves methods and an independent audit every two years, with the report published on the company’s website.
• Key protection. Article 49 calls for a documented policy on key generation, storage and access. If the company uses multiple or segmented keys, they must be kept in different locations.
• Custody agreement. Article 73 requires an agreement with the client that discloses, among other points, the types of wallet used (hot, warm or cold, depending on how connected they are to the internet), the risks of the safekeeping method and how to transfer custody to another custodian.
• Court orders. The same article prohibits safekeeping mechanisms that create obstacles to the immediate fulfillment of court orders concerning the assets in custody.

The rule also provides for what happens if the custodian hired by a provider becomes insolvent, goes bankrupt or enters a resolution regime: the provider must, at the holder’s request, recover the assets and transfer them to the holder or to another custodian. This does not eliminate the risk. The recent history of exchanges that collapsed holding client assets, discussed in the article on custodial wallets, shows why asset segregation matters.

Questions to ask before investing

• Where is the underlying asset and who is responsible for it?
• Who is the bookkeeping agent or the official ownership record? Is the token a mirror or the record itself?
• Who holds the private keys: me, the platform or a hired custodian? Is it authorized by the CVM or the Banco Central?
• Are client assets kept separate from the company’s? Is there proof of reserves and a published audit?
• Who has the contract’s admin keys and what do they allow?
• If the platform shuts down, how do I recover my asset?

The FSB also warns of concentration risk: when a few providers hold assets for many institutions, the failure of one of them can affect the whole market. Investments in tokenized assets may have low liquidity and may result in partial or total loss of the amount invested. See also why tokenizing an asset does not eliminate risk.

Key takeaways

• Custody of a tokenized asset is not a single thing. There are at least four layers: the asset, the ownership record, the keys and the contract.
• In Brazil, Law 14,478/2022 separates the fields: a token that is a security falls under the CVM; a virtual asset outside that scope falls under the Banco Central and BCB Resolution 520.
• Having the token in your wallet is not enough. What protects you is knowing who holds each layer and what happens if someone fails.