Stakeholder Letter: Feedback from Discussion Paper on Asset Tokenisation

30 March 2026

Dear Stakeholders,

Re: Feedback from Discussion Paper on Asset Tokenisation

In November 2025, the Bermuda Monetary Authority (Authority or BMA) issued the Discussion Paper - Asset Tokenisation to better understand the state of the industry, gauge the demand for tokenised assets and identify regulatory or legislative gaps. The objective was to provide greater clarity in the market and to support the successful development of tokenisation in Bermuda.

Responses were received from a diverse range of stakeholders across the tokenisation ecosystem, including financial technology companies, global financial services firms, law firms, tokenisation platform providers and industry associations. Stakeholders provided comprehensive perspectives on both technical and regulatory considerations. This letter summarises the feedback and outlines the BMA’s general views. A Consultation Paper (CP) will be issued in April 2026 detailing the BMA’s policy regarding the regulatory approach to asset tokenisation.

Summary Of Feedback

Respondents expressed support for a principles-based regulatory framework for tokenisation and welcomed clarity on the BMA’s expectations of the industry. Respondents also identified areas within Bermuda’s legislative framework that require amendments to support the successful development of an asset tokenisation framework, noting that certain matters fall outside of the BMA’s direct remit. Considering observed limitations, several respondents encouraged a phased implementation approach as policy work in this area advances.

1. Use Cases and Industry Outlook

Regarding demand for asset tokenisation, respondents explained that while there is demand and potential for tokenisation in Bermuda, broader adoption would depend on legal certainty and careful integration of requirements within the BMA’s current regulatory framework.

Respondents noted ongoing interest in the tokenisation of assets, particularly equity, real estate-backed debt, and tokenised fund structures. One respondent highlighted ongoing exploratory work related to tokenised reinsurance contracts, including proof-of-concept initiatives involving the tokenisation of reinsurance portfolios. Respondents also expressed that while demand for Insurance‑Linked Securities (ILS) has not yet materialised, interest is likely to emerge over time; notably, there is a growing interest in parametric insurance as a product well-suited for tokenisation.

Respondents reported limited demand for the tokenisation of alternative assets. In particular, they highlighted significant statutory impediments to the tokenisation of domestic real estate, noting that restrictions under the Immigration Protection Act 1956 render such initiatives impractical within the existing legislative framework. Several respondents stated that targeted legislative amendments would be required to enable the development of tokenised property portfolios.

BMA House
43 Victoria Street
Hamilton HM 12 Bermuda
Phone: 441.295.5278
Email: enquiries@bma.bm
Website: www.bma.bm
P.O. Box 2447
Hamilton HM JX
Bermuda

Licensing and Regulation

Some respondents noted that the proposed framework should apply solely to tokenised ‘financial’ assets. Notably, all respondents requested guidance regarding licensing and regulatory requirements for those issuing or otherwise engaging with tokenised assets and emphasised that enhancements to the regulatory framework should not impede innovation.

Regarding the regulatory framework, respondents expressed support for bringing tokenisation platform operators within scope and for developing a more activity‑based and platform‑centric regulatory approach under the Digital Assets Business Act 2018 (DABA). This would address risks relating to custody, segregation of client assets, operational resilience, and conflicts of interest.

All respondents recommended streamlining the licensing and supervisory processes to avoid inefficiencies that could arise from dual licensing obligations. They emphasised the need to clarify when a token would fall under the DABA, Investment Business Act 2003 (IBA) or the Investment Funds Act 2006 (IFA) and recommended the harmonisation of investor qualification definitions across the BMA’s regulatory framework.

More specifically, respondents provided the following:

a) Tokenised investments

While respondents were supportive of a principles-based approach to the regulation of tokenised investments, views differed on whether a different regulatory framework would be necessary.

One respondent proposed developing a new risk-based regulatory framework for tokenised investments tailored to the unique risks and opportunities of the relevant investment activities. Some respondents recommended that investor suitability rules and guidance under the IBA be reviewed and updated to reflect the characteristics and expectations of digital asset customers.

Further, respondents called for enhanced clarity within existing licensing frameworks regarding the authorisation of new asset classes, including tokens backed by debt and real estate-related structures.

b) Tokenised investment funds

Respondents cautioned that requiring a license under both the DABA and the IFA would impose additional costs and lead to prolonged timelines and overlapping reporting requirements. To mitigate these concerns, they suggested merging the licensing processes or introducing targeted exemptions for regulated entities. A few respondents supported maintaining a single regulatory regime for tokenised funds that would fall under the IFA.

Additionally, respondents acknowledged the current efficiencies in the supervision process under DABA. They encouraged further knowledge transfer between the BMA’s fintech supervision team and other supervisory teams to support the effective oversight of tokenised assets across regulatory frameworks.

Respondents also noted that the tokenisation of funds raises governance concerns that may warrant legislative review and enhancements. Respondents highlighted that a fund’s constitutional documents typically set out investor rights and governance arrangements and observed that tokenisation could challenge these frameworks, particularly where the ability to identify token holders at any point in time may be limited, which may be the case in permissionless environments. Noting this challenge, they recommended implementing robust governance requirements tailored to tokenised funds to ensure that existing investor protections and oversight mechanisms are appropriately preserved.

c) Tokenisation in insurance

Respondents indicated that Bermuda’s existing innovative insurance frameworks, including the Innovative Insurer General Business (IIGB) and IILT (Innovative Insurer Long-term Business) classes, are capable of accommodating tokenised insurance and reinsurance products and, as such, did not think it necessary for a new class to be created for this activity. Instead, respondents proposed enhancing the BMA’s current regulatory frameworks to support the tokenisation of insurance products.

Regarding the types of products suitable for tokenisation in the insurance industry, respondents advised that parametric products with objective triggers are better suited to smart contracts and automated transactions, which are characteristics of Digital Ledger Technology (DLT) environments. On the other hand, traditional indemnity-based products were considered less suited to tokenisation.

In the reinsurance and ILS context, respondents noted that tokenisation offers an opportunity to enhance liquidity, but cautioned that existing governance, collateral management, and oversight functions and requirements should not be displaced, particularly given the reliance on external data and oracle mechanisms in DLT environments. They also highlighted the importance of legal certainty in areas such as insolvency treatment and the legal classification of tokens, particularly where fractionalised exposures can be distributed across borders.

d) Alternative product structures in tokenisation: Revenue-sharing arrangements

Respondents observed alternative product structures that include revenue‑sharing arrangements linked to an interest in a pool of assets. For example, tokenised participations that entitle holders to a proportional share of revenue generated by underlying assets, such as real estate, intellectual property, or other pooled resources. Respondents queried whether such products would be regarded as ‘investments’ under the IBA or as ‘investment funds’ under the IFA.

The BMA's Response:

Approach to the regulation of activities involving tokenised assets

The definition of ‘digital asset’ under DABA is sufficiently broad to encompass various token types and already provides a comprehensive regulatory framework for the tokenisation of any type of asset. While the framework addresses both financial and non-financial assets, it is the activity of tokenisation that is regulated, rather than the specific asset class. This activity-focused approach ensures consistent regulatory treatment regardless of the asset being tokenised.

The BMA's existing frameworks already accommodate tokenisation activities. DABA serves as a conducive platform-centric framework that can address various tokenisation models, including both digital twins (representing off-chain assets) and native tokens (existing solely on-chain)1 . The broad definition of ‘digital asset business’ under DABA encompasses activities related to all tokenised assets, including investments, real estate, commodities, intellectual property, art, and other asset classes.

[1] This distinction is operational in nature and serves to guide the application of regulatory requirements within a unified framework, without aiming to establish separate regulatory regimes.

In this vein, the BMA proposes overarching requirements that adequately address the regulatory needs across all tokenisable asset classes (with the exception of tokenised investment funds, which merit some specific considerations). This activity-based regulatory approach provides sufficient flexibility to accommodate innovation while maintaining appropriate safeguards regardless of the underlying asset being tokenised.

The BMA’s primary concern is whether the tokenised activity poses risks to the fair treatment of customers, asset protection and market integrity. Any enhancements to the framework will consider the unique or heightened risks associated with asset tokenisation and will clarify how existing obligations under the BMA’s regulatory framework, including the Digital Asset Business Code of Practice and other relevant policies, will apply. Where existing conduct, governance and risk management, and operational resilience requirements remain relevant, they will continue to apply.

Regulatory focus will be on expectations related to governance, custody and protection of customer assets, suitability and disclosure. Further, the BMA is concerned with ensuring that the rights, risks and protections associated with each token type are clearly understood and fairly communicated to customers; this includes clearly differentiating between tokens that confer proprietary rights and those that provide only synthetic or economic exposure. The BMA intends to clarify supervisory expectations through guidance to ensure that requirements are applied in ways that reflect the specific features and risks of asset tokens.

The BMA intends to adopt a functional approach to regulation, with requirements tailored to the specific roles that entities play within the tokenisation ecosystem. These roles include issuers, intermediaries that facilitate access to or the trading of tokenised assets, and custodians. This approach ensures that regulatory requirements align with the unique risks and responsibilities of each role, accounting for differences between digital twins and native tokens. While maintaining a unified regulatory framework, the BMA recognises the need for some differentiation to address the distinct risk profiles and operational characteristics of these token types.

As it relates to the tokenisation of alternative assets, while respondents reported limited demand in this area, the BMA has previously observed market activity involving the tokenisation of precious metals, which fell under the remit of DABA.

Regarding the tokenisation of real estate, in view of the legislative and operational limitations noted by respondents, the BMA will focus on regulatory expectations for the tokenisation of foreign real estate through a Special Purpose Vehicle.

Initial proposals to clarify the regulatory taxonomy for tokenised assets

To address the industry’s call for clarity, the BMA proposes that a definition of ‘tokenised investments’ be introduced to the regulatory framework to clarify the regulatory treatment of tokenised assets that may be considered investments as defined in the IBA. This will provide guidance on the proposed licensing and exemption framework, which is discussed in the ensuing paragraphs.

Proposed licensing and exemption framework

The BMA acknowledges the merit in streamlining the licensing process and is considering the following updates to its framework:

a) The BMA intends to review Part 1 of the First Schedule of the IBA to provide guidance as to when a token may be considered an investment. Noting the feedback on alternative product structures in relation to tokenisation, such as revenue-sharing arrangements, the BMA notes that such structures may be considered ‘rights and interests in investments’ under the IBA or an investment fund under the IFA and will assess these arrangements with a view to providing clarity on the appropriate regulatory treatment.

b) The BMA intends to harmonise the definitions of ‘qualified participants’ under section 9 of the IFA and ‘qualified acquirers’ under section 6 of the Digital Asset Issuance Act 2020 (DAIA), as part of a broader effort to establish unified investor qualification definitions across all relevant regulatory frameworks.

c) The BMA proposes an integrated exemption framework that recognises the diverse operational structures and strategic orientations of entities within the financial sector. This approach provides optional mirrored exemptions for dual-licensing scenarios, allowing entities to operate within the regulatory framework that best aligns with their business model while ensuring that all relevant risks are adequately addressed. The following exemptions are envisaged:

i. Where a licensee under DABA intends to conduct investment business specific to tokenised investments, such licensee will be exempted from the dual licensing requirement under the IBA through expansion of the definition of non-registrable persons pursuant to the Investment Business (Non-Registrable Persons) (Designation) Order 2022;

ii. Mirroring this approach, where a licensee under IBA intends to engage solely in tokenised investments, such licensee will be exempted from dual licensing requirements under the Digital Asset Business Exemption Order 2023. However, Class A and Class B Registered Persons would not be eligible for this exemption; and

iii. Where a licensee under the Fund Administration Provider Business Act 2019 intends to provide fund administration business services to tokenised funds, such licensee will be exempted from licensing requirements under DABA. Similarly, investment funds that have tokenised fund units will be exempted from requirements under DAIA.

While licensees may be exempted from specified licensing requirements, they will be expected to adhere to requirements under the Digital Asset Business Operational Cyber Risk Management Code of Practice and relevant Anti-Money Laundering and Anti-Terrorist Financing (AML/ATF) requirements. Additionally, when an entity provides custody for tokenised assets, the Digital Asset Business Custody Code of Practice is expected to apply.

Following industry consultation on the proposed licensing and exemption framework, the BMA will evaluate the feedback received and determine the appropriate approach to implementing the framework. The BMA will also consider potential impacts on current licensees engaged in tokenisation activities during this consideration process.

2. Legislative Changes Required to Facilitate Tokenisation

All respondents expressed that legislative and regulatory modernisation is required to ensure Bermuda’s legal infrastructure is fit for purpose in supporting the development and adoption of tokenised assets.

Respondents identified potential updates to company and property law needed to capture the realities of asset tokenisation.

a) Legal recognition of DLT-based registers

Respondents noted that provisions in the Companies Act 1981 (Companies Act) that require paper‑based share transfer instruments and physical registers are not aligned with the operational realities of tokenisation arrangements. They highlighted sections 48 and 65 of the Companies Act 1981 as areas requiring modernisation to permit regulated digital share transfers and enable the maintenance of on-chain registers of members. Respondents viewed the current requirement for a ‘proper instrument of transfer’ for each share transaction as a material impediment to automated, DLT-based transactions and settlement processes.

Further, respondents emphasised the importance of formally recognising DLT-based registers as official registers, both under the IFA and within the broader corporate framework, to provide greater legal certainty for tokenised assets. Respondents explained that without legal recognition of DLT-based registers, token issuers would have to reconcile on-chain registers with off-chain (i.e., traditional) registers. This could lead to increased complexity and cause delays in processing transactions.

b) Clarity on token holders’ rights

Respondents called for certainty regarding the legal classification of tokenised assets under Bermuda law. This classification dictates how proprietary rights are applied and enforced, carrying significant implications for the treatment of tokenised assets during insolvency. Additionally, respondents noted that clear guidance on settlement finality is required.

Regarding insolvency, respondents explained that the legal treatment of token holders, whether as creditors or shareholders, is unclear. This lack of ex ante clarity could result in unpredictable outcomes in insolvency proceedings. However, while the preservation of investor rights was a recurring theme, respondents cautioned that rights should not be inferred where they are not expressly granted. Token holders should only be considered shareholders if they have a legal entitlement to exercise shareholders’ rights.

c) Custody and control concerns

Respondents explained that custody can look different in the case of tokenisation and, as such, traditional requirements may need to be enhanced, particularly as some business models see certain functions converged. Further, respondents highlighted uncertainty around how ‘control’ over tokenised collateral should be established, particularly in structures involving private key custody or multi-party computation arrangements. This was noted as a key issue in the context of secured lending involving asset tokens.

One respondent raised concerns that the current stamp duty regime for registering charges, particularly for local companies, imposes materially high costs that discourage the creation of security arrangements backed by asset tokens.

The BMA’S Response:

Recognition of DLT-based registers

As it relates to recommended amendments to the Companies Act, the BMA is engaging with the relevant national stakeholders and has shared respondents' recommendations to support an effective framework for the jurisdiction.

Regarding fund tokenisation and the recognition of DLT-based registers, the BMA’s primary concern is effective governance, including reliable record-keeping and clear, enforceable rights for investors. The BMA expects records of ownership and transfers to be accurate, accessible and have appropriate risk management arrangements in place, irrespective of the form the ledger takes. Where DLT-based registers are used, the BMA expects demonstrable evidence that such arrangements meet conduct expectations relating to transparency, asset protection, accountability and the preservation of investor rights.

To this end, the BMA proposes amendments to the IFA to allow a fund register to be tokenised and maintained on-chain, and to recognise service providers that offer services solely in the context of tokenisation as having satisfied the principles that underpin traditional service provider appointment requirements.

Addressing rights in tokenisation

Central to the issue of rights in tokenisation is ensuring that such rights are clearly and accurately disclosed to investors or customers and are not misrepresentations of the rights afforded to them. Where rights are limited, conditional or derivative in nature, this should be explicitly disclosed. In the context of dispute resolution, the BMA expects effective and accessible complaint-handling and dispute resolution mechanisms.

The BMA acknowledges that, where appropriate, settlement finality and the legal recognition of asset tokens as proprietary in nature remain significant concerns. This is a broader jurisdictional issue to be decided by national stakeholders. The BMA will therefore focus on enhancing due diligence (relating to the ownership of the underlying asset) and disclosure requirements. From a conduct perspective, the BMA’s focus is on ensuring that tokenised arrangements are transparent and accurate and that governance and operational controls are in place to mitigate settlement risks in a manner that supports the fair treatment of customers.

Custody and control requirements

The BMA intends to introduce clear requirements for functional roles in tokenisation, including issuers, those that facilitate access to or trade tokenised assets, and custodians. For custodians, the requirements will emphasise the importance of safeguarding both the tokens and, in the case of digital twins, the underlying real-world assets they represent.

To address insolvency and operational risks, the BMA will require custodians of tokenised assets to establish robust bankruptcy-remoteness arrangements, ensuring that client assets are segregated from the custodian’s own assets and protected from creditor claims. Further, custodians will be subject to enhanced cyber risk management requirements, mandatory reconciliations, attestations, and proof-of-reserve requirements.

To mitigate single-point-of-failure risks, the BMA expects the use of hardware-backed solutions and highthreshold multi-signature or Multi-Party Computation (MPC) arrangements. This ensures that no single individual has unilateral access to critical private key functions.

3. Anti-Money Laundering, Anti-Terrorist Financing (AML/ATF) and Digital Identity

a) AML/ATF risks and mitigation

Respondents expressed different views regarding the AML/ATF requirements appropriate for the tokenisation ecosystem. Several respondents advocated integrating advanced on-chain analytics and automated transaction-monitoring tools to support AML/ATF compliance. Other respondents called for established intermediary‑based Customer Due Diligence (CDD) models augmented by a digital identity framework, suggesting that a layered AML/ATF regime incorporating both on-chain surveillance and interoperability with intermediary-based CDD would provide a more effective and adaptable approach. Further, one respondent recommended embedding AML/ATF functionality, such as transfer restrictions and whitelisting, directly into token standards to simplify compliance procedures.

b) CDD mechanisms

Respondents highlighted challenges with issuer-level compliance under the current AML/ATF regulatory framework, particularly in relation to secondary market transactions. They emphasised that requiring token issuers to conduct CDD on all secondary market transfers (i.e., on every secondary market transferee) could create significant barriers to efficient secondary market liquidity, including for tokenised fund interests listed on regulated foreign markets.

It was proposed that Bermuda place CDD requirements on regulated intermediaries managing secondary market platforms, rather than requiring issuers to conduct checks on all secondary market transferees.

c) Passportable ‘Know Your Customer’ considerations

Respondents strongly supported the implementation of passportable 'Know Your Customer' (KYC) solutions for tokenised assets, emphasising that such systems would streamline compliance processes and are particularly well-suited for the digital realm. While acknowledging interoperability challenges across regulatory regimes, particularly regarding digital identification frameworks and the Financial Action Task Force's (FATF) Travel Rule, respondents highlighted the significant efficiency benefits of allowing individuals and institutions to complete a single, high-assurance verification process that can then be reused across the ecosystem.

d) Digital identity integration

Respondents noted that digital identity systems could play a pivotal role in enhancing AML/ATF compliance within tokenised ecosystems by enabling more efficient, risk-based compliance processes across decentralised platforms. Respondents emphasised, however, that legal frameworks for digital identities would need to address legal recognition, liability and privacy concerns.

The BMA’s Response:

AML/ATF risks in the tokenisation ecosystem

The BMA recognises that tokenisation activities present DLT-related AML/ATF risks similar to those addressed in the digital assets regulatory framework. Additionally, while concepts such as fractionalisation and secondary market trading exist in traditional markets, tokenisation technology can amplify these risks.

Therefore, the BMA proposes expanding the application of the DAB AML/ATF Sector-Specific Guidance Notes to all Regulated Financial Institutions (RFIs) engaging with tokenised assets. In line with this outcomes-focused approach, the BMA expects RFIs to establish monitoring systems commensurate with the nature, scale and complexity of their activities. RFIs will be required to implement robust CDD and transaction monitoring mechanisms tailored to their specific tokenisation business models, ensuring that the unique risks associated with tokenised assets are appropriately identified, assessed and mitigated.

Embedded compliance

Regarding the BMA’s view on requiring token standards to be embedded with AML/ATF standards, the BMA takes a technology-neutral approach to regulation, so no specific token standard or protocol will be mandated. While the BMA acknowledges the potential benefits and efficiencies of embedded AML/ATF compliance, the BMA’s expectation is that tokenised arrangements do not impair RFIs’ ability to comply with its AML/ATF obligations.

The BMA expects RFIs to demonstrate their ability to assess whether embedded compliance controls effectively achieve their intended compliance outcomes in practice.

Passportable KYC

The BMA notes that the existing AML/ATF framework already provides for passportable KYC through its third-party reliance provisions. Specifically, Regulation 14 of the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations provides the foundational framework that enables this passportable approach to CDD between RFIs. These provisions remain fully relevant and applicable in the context of tokenisation, allowing RFIs to rely (under certain circumstances) on KYC information obtained by other RFIs without duplicating verification processes. The BMA will further consider whether any refinements may be necessary to ensure the existing framework remains optimally suited to address the unique characteristics of tokenised asset transactions.

Digital identity considerations

Regarding the feedback on digital identity service provider frameworks, the BMA continues to engage closely with industry to identify solutions that support business models and remain fully consistent with robust technical and regulatory standards.

Regarding cross-border considerations, while the BMA acknowledges the potential of digital identity providers to streamline compliance, it observes that international standards and equivalency regimes for such frameworks have not yet fully crystallised. The BMA will continue to monitor global developments to ensure the Bermuda regulatory framework remains effective, adaptable and aligned with international best practices.

4. Governance and Risk Management

a) General feedback

Respondents emphasised that governance, risk and control requirements should be proportionate and risk-based, with a focus on tokenisation functions and service providers that may contribute to systemic risk. Respondents proposed a layered approach to safeguards, including mandatory smart contract audits, high‑threshold multi-signature and time-lock governance, sequencer-level anomaly detection, comprehensive liquidity risk management frameworks and enhanced disclosures regarding liquidity mismatches.

b) Smart contracts, oracles, and other third‑party service providers

Respondents expressed concern about systemic vulnerabilities associated with ungoverned oracles and smart contract modules, noting that these components represent critical points of potential failure within tokenisation ecosystems.

Feedback varied relating to the level of regulatory oversight required for third-party service providers. Some respondents supported proportionate oversight of oracles due to their vital role in providing pricing and data inputs, while others cautioned against unnecessarily expanding the BMA’s regulatory perimeter.

Respondents highlighted the enhanced role of critical third parties, including smart contract developers, oracles, tokenisation platform providers, and custodians. Consequently, respondents recommended that the BMA issue clear supervisory expectations and explicit governance requirements for these functions.

Respondents further emphasised the need for comprehensive governance controls for smart contracts. Specifically, respondents recommended that upgradable smart contracts be subject to independent security audits and enhanced governance mechanisms to ensure appropriate checks and balances prior to the implementation of any material changes.

c) Cyber Risk and Token Standards

Respondents highlighted the importance of strengthening cyber risk oversight. They also called for the introduction of technical cyber risk standards designed to reduce operational risks, minimise reliance on manual approvals and ensure that network disruptions or technical failures do not compromise token holder rights or overall market integrity.

Respondents also supported introducing regulatory requirements for token standards. Specifically, it was recommended that token standards for those tokenised assets characterised as securities incorporate features that deliver regulatory outcomes equivalent to those achieved through existing obligations.

d) Safeguards for risks associated with tokenisation platforms

Respondents called for clear regulatory guidance for tokenisation platforms, particularly in relation to smart contract governance and control mechanisms, and recommended that Bermuda’s regulatory framework be aligned, where appropriate, with existing international risk mitigation standards for tokenisation.

e) Disclosure requirements

Respondents underscored the importance of clear and accessible disclosure requirements for token issuers and platforms. They recommended that risk disclosures be tailored to retail audiences and presented in plain language, as well as supported, where appropriate, by scenario-based examples illustrating potential risks, including those arising from smart contract failures. They further suggested that disclosure requirements be standardised across BMA-regulated entities to promote consistency.

The BMA’s Response:

Requirements regarding critical third-party service providers

The BMA expects all entities engaging in tokenisation activities to adhere to the requirements under the Operational Resilience and Outsourcing Code 2025 and follow the accompanying Guidance Note. All regulated entities are expected to maintain effective oversight of third-party arrangements to ensure that customer protections are not diluted through outsourcing. Where third-party providers perform functions that are critical to customer protection or market integrity, the BMA will consider whether enhanced supervisory requirements are appropriate.

From a conduct perspective, the BMA’s focus will be on ensuring that regulated entities retain clear accountability for customer outcomes, including where critical functions are outsourced or supported by third parties.

Governance and controls

The BMA requires governance controls to be in place to manage risks arising from smart contract vulnerabilities or upgrades, particularly where such changes may materially affect customers’ rights and access to assets or exposure to loss. From a conduct perspective, the BMA intends to emphasise clear communication to affected customers. Expectations will focus on ensuring that entities can demonstrate how smart contract risks are identified, managed and disclosed in a manner consistent with existing conduct and governance obligations.

Additionally, the BMA expects intermediaries to move beyond static defences towards automated containment mechanisms (e.g., circuit breakers and programmable risk limits) and real-time on-chain monitoring. Supervisory expectations will focus on the regulated entity’s ability to detect anomalies and execute a response (e.g., freeze function) with latency commensurate with the speed of the underlying ledger.

Token standards

The BMA considers that token standards should deliver regulatory outcomes equivalent to those achieved in traditional financial markets, particularly with respect to investor protection, asset integrity, transparency and fair treatment.

The BMA maintains a technology-neutral stance and does not mandate or endorse specific technical standards. The selection of a token standard is a strategic business decision driven by an issuer’s functional requirements. However, the BMA requires that registrants conduct rigorous technical and cyber risk assessments of their chosen standard prior to token issuance.

It is a regulated entity’s responsibility to ensure that the chosen standard supports necessary compliance features (e.g., identity recovery, freeze functions, etc.), and that any vulnerabilities in the standard or its implementation are remediated. Further, the BMA’s role is not to enforce cross-border technical capability, but to ensure the pursuit of interoperability does not introduce unmanaged cyber or operational risks.

Smart contracts

The BMA will require that all smart contracts, particularly those involving custody or asset transfer, undergo comprehensive independent security audits prior to deployment. However, audits alone are point-in-time assessments and insufficient for ongoing resilience. Therefore, the BMA would expect the implementation of continuous security lifecycles, including deterministic testing, smart contract upgrade governance, and oracle risk management.

Operational resilience and cyber security

The BMA expects regulated entities to identify, manage and mitigate operational and cyber risks that could materially impact customers, including risks arising from distributed ledger infrastructure, smart contracts, custody arrangements, third-party dependencies and network disruptions.

The BMA’s focus will be on ensuring firms have governance, risk management and control frameworks proportionate to the nature and scale of their tokenisation activities, including clear accountability for incident management, business continuity and recovery planning. Where operational failures or cyber incidents may affect customer access to assets, transaction finality, or the integrity of records, timely escalation, transparent communication to affected customers and to the BMA, and effective remediation in line with existing conduct obligations are expected.

Disclosures

The BMA considers clear, accessible and proportionate disclosure to be a cornerstone of effective conduct regulation in tokenised markets. The BMA intends to clarify expectations that issuers and entities facilitating access to, or trading in, tokenised assets provide disclosures that enable customers to understand the nature of the token, associated rights, key risks and any material operational or technological dependencies.

Disclosures should be tailored to the intended audience, with particular care taken to ensure that information provided to retail investors is presented in plain language and does not misrepresent protections or rights.

5. Conclusion and Next Steps

The BMA appreciates your engagement and remains committed to working with industry to ensure Bermuda's regulatory framework fosters innovation while upholding market integrity and customer protection.

A CP detailing the BMA’s regulatory approach to asset tokenisation will be issued in April 2026. The BMA will also continue to collaborate with relevant stakeholders on areas requiring legislative or jurisdictional input.

Please direct any inquiries regarding this letter to fintech@bma.bm.

Sincerely,
The Bermuda Monetary Authority