Asset tokenization platform: components, standards, costs and build vs buy

An asset tokenization platform is the software and legal setup that records ownership of a real-world asset as a token on a blockchain, such as a fund share, a bond or a stake in a property company. It also enforces who may hold the token, who may receive it and which record counts as the official register.

This guide explains the parts of such a platform, the token standards it uses, the US and EU rules that shape it, and what a build costs. After reading it, you can decide whether to build your own platform, license one, or combine the two. Security teams use the same word for something else: replacing card numbers and other sensitive values with substitutes inside private systems. The data tokenization guide explains that meaning and how it differs from asset tokens.

Where the market stands in 2026

The first security token wave ran from 2018 to 2020, promised fast liquidity for illiquid assets and mostly did not deliver it. Issuers tokenized small private deals, investors could not find buyers, and the regulated trading venues saw little volume.

Since then, most growth has come from tokenized money market funds and short-term government debt funds that large asset managers issued on public chains. BlackRock's BUIDL fund launched in 2024 with Securitize as its transfer agent and has since spread to several chains. These funds already had a legal wrapper and a regulated manager, and the blockchain improved settlement, transfer and use as collateral. Private credit, tokenized gold and fund share classes followed.

The data site rwa.xyz counted about $39 billion of distributed tokenized real-world assets on October 19, 2026, held by about 5.3 million addresses, a figure that excludes stablecoins.

US rules that changed in 2025 and 2026

• SEC staff statement, January 28, 2026. Three SEC divisions said that a tokenized security is still a security, and the statement separates issuer-sponsored tokens from tokens created by a third party. Third-party tokens can be custodial, where a firm holds the real security and issues a token against it, or synthetic, where the token only tracks the security's price.
• DTC tokenization pilot. In December 2025, SEC staff gave the Depository Trust Company a no-action letter for a three-year pilot, under which DTC participants can choose to have their holdings of Russell 1000 stocks, major index ETFs and US Treasuries recorded as tokens. DTCC planned to start the rollout in the second half of 2026.
• SEC innovation exemption, September 17, 2026. The SEC issued a five-year conditional exemption for venues that trade tokenized versions of exchange-listed stocks. The order limits how many different stocks a venue may trade and how much volume it may handle, and it excludes synthetic tokens.
• GENIUS Act. The act became law on July 18, 2025 and sets a federal regime for payment stablecoins. Regulators proposed the detailed rules in 2026, and the act takes effect no later than January 18, 2027. Stablecoins matter to tokenization because the cash side of a tokenized trade often settles in stablecoins.

In the EU, the DLT Pilot Regime has applied since March 2023 and lets market infrastructures trade and settle securities on a blockchain under set size limits, but only three infrastructures had been authorized by mid-2025. In December 2025, the European Commission proposed to raise the limits sharply and to remove the time limit on permissions.

Components of an asset tokenization platform

A complete platform has the layers in the table below, whether you build it or license it, and when a platform lacks one of these layers, staff do that layer's work by hand with spreadsheets and email.

Permissioned token standards

A plain ERC-20 token lets anyone send tokens to anyone. Securities cannot move that way, so a tokenization platform uses contracts that check a set of rules before each transfer.

ERC-3643 is the most widely used open standard for this. It began as the T-REX framework and is now a Final ERC. On every transfer, the token asks an identity registry whether the receiver is verified, and a compliance contract then checks rules such as a maximum number of holders, blocked countries or holding periods. The standard also gives appointed agents the power to freeze balances, pause the token and force a transfer after a court order or a lost key.

The older ERC-1400 family splits balances into partitions for tranches or lockups, links documents to the token and returns a code when a transfer is refused, and it still appears in older deployments. Some issuers use a plain ERC-20 token with an allowlist and a transfer check that the issuer controls. Wallets and DeFi apps already support plain ERC-20 tokens, but the issuer must write more of the rules as custom code, which needs a careful smart contract audit.

In most countries, the legal register stays the official record of ownership, and the token is a copy of it. A few countries recognize securities that exist only on a ledger, such as Switzerland under its DLT Act and Germany under its electronic securities law. Everywhere else, the platform needs a process that keeps the token balances and the legal register in agreement.

The transfer agent question

In the US, issuers of registered securities, and many private issuers, use a transfer agent to keep the official shareholder register. Several tokenization firms registered with the SEC as transfer agents, so for their clients one regulated firm keeps both the on-chain record and the legal register. A platform builder has three options:

• Register as a transfer agent, which is a regulated activity with record-keeping duties.
• Contract with a transfer agent that accepts blockchain records.
• Treat the token as a convenience copy of a register kept somewhere else.

Custody and key recovery

Custody covers two separate questions. The first is who holds the underlying asset, such as the Treasury bills, the building or the painting, which a custodian or trustee holds under a normal custody agreement. The second is who holds the keys to the investors' tokens.

Institutions use their own qualified custodian or an MPC wallet provider, but retail investors will lose keys, so the platform needs a written recovery process. The process verifies the investor's identity again and then uses the forced-transfer function to move the tokens to a new wallet. A lost key must not mean a lost security. The guide to crypto wallet development compares MPC and HSM key storage.

Choosing a blockchain

Most institutional tokenized funds launched on Ethereum mainnet or on EVM networks such as Polygon, Avalanche, Arbitrum and Base. Stellar, Solana and purpose-built ledgers such as Canton and Provenance are also in use. Four factors decide the choice:

• Buyers and collateral venues. A fund token that exchanges and DeFi protocols accept as collateral is more useful than a token on a chain those venues do not support.
• Privacy. Public chains show every holding and every transfer. Some issuers accept this exposure, while others need a permissioned network or a privacy layer.
• Operational control. An issuer can deploy permissioned contracts on a public chain and control transfers without running its own network. A private network gives full control, but the token cannot interact with public DeFi apps. The guide to private blockchain development covers that choice.
• Multi-chain issuance. Each extra chain adds a register to reconcile and a bridge to secure.

Building a tokenization platform step by step

1. Fix the legal structure first. Choose the asset, the legal wrapper (a fund, a special purpose vehicle or SPV, or a note), the offering exemption or license, the investor types and the countries, since every technical decision below depends on these answers.
2. Write a compliance matrix. List each restriction, such as eligible investor types, blocked countries, holding periods, holder caps and lockups, and for each one decide whether the contract enforces it, the back office enforces it, or both do.
3. Pick the token standard and chain. Use ERC-3643 or an equivalent unless the asset needs something it lacks, and pick the chain where your buyers and collateral venues already are.
4. Design the register and reconciliation. Decide which record is legally binding and how the transfer agent sees on-chain events, and write down how staff resolve a mismatch.
5. Build onboarding and identity. Connect KYC, AML and accreditation checks and link each investor to a wallet, issuing on-chain eligibility claims only after the checks pass.
6. Connect the cash flows. Build the subscription and redemption flows, the bank and stablecoin payment routes, NAV calculation for funds and the payout logic.
7. Audit and test failure cases. Commission an external audit and rehearse a lost key, a sanctioned holder, a court-ordered transfer, a paused token and a chain reorganization.
8. Launch small. Start with one asset, one chain and one investor class, and add more after the operating process works.

Cost and timeline drivers

A minimal in-house platform covers one asset type and uses an audited ERC-3643 implementation with licensed KYC and custody. Such a build typically needs two backend engineers, one smart contract engineer, one frontend engineer and a product lead, with part-time legal and compliance help. That team needs four to six months for a first production release, roughly 25 to 35 person-months of engineering, with legal fees, audits and vendor licenses on top. These figures are an estimate from team size and duration, not a quote.

These factors move the cost most:

• The number of countries and investor classes, because each one adds rules and onboarding variants.
• Whether you must become a transfer agent or trading venue, or connect to one.
• Compliance rules that the standard's modules do not already cover.
• Secondary trading, which is a separate regulated business in most countries.
• Bank connections and fiat reconciliation.

Build vs buy for an RWA tokenization platform

Licensed tokenization platforms and white-label issuance software are on the market, and for a single issuer, licensing is almost always cheaper than building. Building makes sense in three cases:

• Tokenization is your product, and you plan to serve many issuers.
• You need a regulatory status that no vendor can give you.
• Your asset has features that no vendor supports.

Many issuers take a middle route: they license the regulated parts, such as transfer agency, KYC and custody, and build the investor screens and the asset-specific logic themselves. The DeFi tokenization guide covers tokenized assets that connect to lending and trading protocols.

Questions for a vendor or development team

• Which token standard do you deploy, and was that exact code audited? Can we read the audit reports?
• Who authorizes freezes, forced transfers and key recovery, and who holds those roles?
• Which record is legally binding, and how does it stay in line with the chain?
• Which regulatory licenses do you or your partners hold, and in which countries?
• Can we export the cap table and move the tokens if we leave?
• Which tokenized offerings run on your software today, and can we speak to those issuers?

When tokenization adds little

Some offerings have a few dozen investors who will never trade, and no counterparty will accept the token as collateral. For those offerings, tokenization adds cost and regulatory work with little benefit. Tokenization helps most when transfers are frequent, when settlement today is slow or costly, or when the token opens new distribution or collateral uses. For a deal-level view, read the guide to RWA tokenization by asset class, and the security token offering page covers the legal basics.

Frequently asked questions