Stakeholder Letter: Feedback on the Consultation Paper on Asset Tokenisation

PUBLIC

6 November 2026

Dear Stakeholders,

Re: Feedback on the Consultation Paper on Asset Tokenisation

The Bermuda Monetary Authority (Authority or BMA) is grateful to all stakeholders who responded to the Consultation Paper on Asset Tokenisation published on 9 April 2026. The responses reflected substantial practical experience across digital asset business, investment business, investment funds, banking, legal services, assurance, market surveillance, token standards, custody, cybersecurity and tokenisation infrastructure.

This Stakeholder Letter summarises the principal themes raised during the consultation and outlines the Authority’s response and intended approach.

1. Overview and the Authority’s approach

Respondents broadly supported the Authority’s view to build the framework through targeted amendments to the existing regulatory regimes rather than introduce a separate tokenisation framework or licensing regime. Stakeholders also generally supported the principles of substance over form, technology neutrality, proportionality and consistent regulatory outcomes for comparable risks.

The Authority intends to retain this overall architecture. The proposed legislative amendments could establish a single harmonised definition of ‘tokenised investment’ in the Investment Business Act 2003 (IBA), with the other relevant regulatory frameworks cross-referencing that definition. The Authority intends to provide additional guidance on how specific tokenisation-related risks, including technology, custody, operational resilience, cyber risk, conduct and anti-money laundering/anti-terrorist financing/counter-proliferation financing (AML/ATF/CPF) considerations, should be addressed under the existing legal, regulatory and supervisory frameworks, considering the regulated activity, the function performed and the systems or arrangements within an entity’s control.

A recurring theme was that responsibility should follow legal accountability, operational control and the function performed. The Authority agrees that expectations should not be unnecessarily duplicated across participants in the value chain. At the same time, reliance on another regulated party will not remove an entity’s responsibility for its own activities, customer outcomes, governance and risk management.

2. Definitions, harmonisation and regulatory perimeter

Respondents strongly supported harmonisation across the IBA, the Investment Funds Act 2006, the Fund Administration Provider Business Act 2019, the Digital Asset Business Act 2018 (DABA) and the Digital Asset Issuance Act 2020. Stakeholders considered a single authoritative definition of ‘tokenised investment’ important to reducing uncertainty and avoiding inconsistent treatment across regimes.

The Authority intends to proceed with a harmonised definition anchored in the economic and legal characteristics of the instrument. The proposed framework will continue to recognise both digital twin and

BMA House
43 Victoria Street
Hamilton HM 12 Bermuda
Phone: 441.295.5278
Email: enquiries@bma.bm
Website: www.bma.bm
P.O. Box 2447
Hamilton HM JX
Bermuda

native token models, while applying model-specific expectations where their legal records, backing arrangements and operational risks differ.

Several respondents requested additional examples for hybrid instruments, revenue-participation arrangements, synthetic exposures and structures that combine characteristics of investments, funds and digital assets. The Authority intends to provide practical examples and explanatory guidance where appropriate to support consistent classification.

Respondents also supported alignment of qualified investor terminology. The Authority will continue its work to harmonise the definition of this investor category across the relevant Acts.

3. Cross-regime exemptions and transitional arrangements

There was strong support for optional mirrored exemptions and for avoiding dual licensing where the same activity and risks are already subject to effective supervision under another BMA framework. Respondents requested clarity on eligibility, the meaning of activities conducted ‘exclusively’ in relation to tokenised investments, the treatment of ancillary activities and the process for electing or changing the primary regulatory framework.

The Authority intends to retain the proposed cross-regime exemption approach. The implementing provisions will clarify that an exemption may remain available where an entity conducts ordinary ancillary activities that are integral to the regulated tokenisation business. The Authority will also clarify the process for relying on an exemption and the circumstances in which a change in business model may require reassessment.

Several stakeholders asked that exemptions be extended to Class A and Class B Registered Persons and to conventional distributors and sub-distributors of tokenised fund interests. The Authority intends to clarify through guidance that the scope of tokenised funds will be strictly limited to instances where the fund register itself is tokenised; consequently, Class A and Class B Registered Persons providing investment management services to these funds do not trigger a licensing requirement under the DABA, meaning no dual licensing overlap exists to necessitate a cross-regime exemption for this activity. The Authority wishes to clarify that Class A and Class B Registered Persons conducting any other activities would not be eligible for the cross-regime exemptions. The approach also recognises that conventional distributors and sub-distributors of tokenised fund interests should not be treated as conducting digital asset business or as Secondary Offerors merely because fund interests are represented as tokens, where they remain limited to conventional primary distribution and redemption activities.

Respondents consistently requested a transparent transition roadmap, appropriate transitional treatment for existing structures, and sufficient implementation periods for amendments to contracts, governance, technology and key-management arrangements. The Authority agrees that implementation should be phased and transparent. The Authority will provide further information on transitional arrangements and implementation, including where additional implementation periods may be appropriate. Existing statutory waivers, exemptions and licence classes will remain available where appropriate during the transition.

4. Roles and responsibilities

Respondents generally found the Primary Tokeniser, Secondary Offeror and Custodian classifications clear and useful, particularly because they are functional descriptions rather than new licence categories. Stakeholders requested more detail where one entity performs several roles, where functions are delegated within a group or to third parties, and where conventional distributors, brokers, trustees, technology providers or non-custodial software are involved.

The Authority will retain the three-role framework and clarify through guidance how expectations apply proportionately according to the functions performed. Primary Tokenisers will retain primary responsibility for key aspects of the tokenisation structure within their control, while Secondary Offerors and Custodians will remain responsible for the activities and functions they perform.

The Authority agrees that Secondary Offerors and Custodians should not be treated as guarantors of matters that remain under the control of a Primary Tokeniser. Reasonable reliance on Primary Tokenisers and appropriately qualified third parties will be permitted where appropriate, subject to proportionate, riskbased due diligence.

Where a single entity performs multiple functions within the tokenisation lifecycle, expectations associated with each role will apply proportionately, having regard to the nature, scale, complexity and risk profile of the activities performed. Appropriate governance arrangements should address potential conflicts of interest and risks arising from the concentration of multiple roles.

The Authority also notes feedback that autonomous protocols and non-custodial software should not be treated as Secondary Offerors solely because they facilitate transactions. Technology providers engaged by regulated entities may nevertheless be subject to applicable outsourcing and vendor-management expectations.

5. Due diligence and legal certainty

Respondents supported robust due diligence and legal certainty but frequently considered that the proposed cross-jurisdictional legal review could become disproportionate if interpreted as requiring a comprehensive legal opinion in every jurisdiction where a token holder might be located. The Authority agrees that legal assessments should be risk based and proportionate, focusing on material legal risks and jurisdictions relevant to the entity’s role, business model and operations.

For digital twins, the envisaged framework will retain the expectation that the underlying assets or rights exist and that appropriate arrangements are maintained to preserve the relationship between the token and the underlying asset, including proportionate verification, reserve, legal and reconciliation arrangements.

Appropriate governance and remediation arrangements should address circumstances in which token records or transactions require correction or intervention.

Stakeholders also requested greater clarity on bankruptcy remoteness, issuing structures and self-custody. The appropriate legal and asset-protection arrangements will depend on the structure, token holder rights and the applicable legal framework.

6. Token standards and technical implementation

Respondents strongly supported a technology-neutral and outcomes-based approach. The Authority will not prescribe a particular blockchain environment or token standard. The Authority will clarify through guidance that the focus will be on the effectiveness of compliance and governance controls rather than their specific technical implementation, allowing controls to operate at the appropriate layer of the technology stack.

Cross-chain distribution, bridging and other forms of interoperability may introduce additional risks or affect embedded compliance controls. The Authority will clarify through guidance that entities should apply appropriate risk management measures having regard to their role and degree of control over token transfers.

7. Risk management, outsourcing and operational resilience

Respondents supported the proposed counterparty, liquidity, operational, recovery and wind-down requirements, subject to proportionality. The Authority will clarify through guidance that risk management should reflect the entity’s role and the nature, scale, complexity and overall risk profile of its tokenisation activities.

The Authority recognises the additional risks associated with tokenisation-specific technology and infrastructure, including smart contracts, oracles, administrative privileges, cross-chain activity and other critical technology dependencies. The Authority will provide guidance on how these risks should be addressed proportionately within an entity’s risk-management framework. The existing Operational Resilience and Outsourcing Code will remain the baseline for tokenisation-related outsourcing, with appropriate attention to tokenisation-specific service providers such as oracles, smart-contract developers and tokenisation-platform providers.

The Authority agrees that vendor management should reflect the specific risks associated with tokenisation-related service providers. Supporting guidance will address proportionate ongoing monitoring, reassessment and contingency planning.

8. Reconciliation, attestations and proof of reserve

Respondents broadly supported a tiered approach comprising internal reconciliation, external attestation and Proof of Reserve (PoR) assurance for structures backed by off-chain assets. Stakeholders also emphasised that verification methods and frequencies should be proportionate to the characteristics and risks of the tokenisation arrangement.

The Authority intends to retain a risk-based verification framework. Primary responsibility for PoR attestations regarding the backing of tokenised assets will remain with the Primary Tokeniser. Custodians will remain responsible for appropriate reconciliation of assets under their custody, while Secondary Offerors may conduct proportionate due diligence and place reasonable reliance on Primary Tokenisers and appropriately qualified third parties.

For native tokens that do not represent external underlying assets, the Authority will clarify through guidance that the reconciliation, attestation and PoR requirements applicable to digital twins will not apply. The focus will instead be on appropriate token-level and technology-related controls.

For tokenised investment funds, the Authority will clarify through guidance that existing the Net Asset Value (NAV) calculation, fund-accounting and unit-reconciliation processes will remain primary where only the fund register is tokenised, without creating duplicative PoR requirements merely because of tokenisation.

9. Secondary markets, listing and market integrity

Respondents supported documented listing and delisting policies but requested greater differentiation between trading venues, brokers, execution-only firms, distributors and permissionless protocols. The Authority agrees that obligations should reflect the degree of control over admission, execution, price formation and ongoing market operation.

The Authority will clarify through guidance that Secondary Offerors responsible for listing decisions will be expected to maintain risk-based and proportionate listing governance, appropriately assess the token and associated risks, and maintain clear monitoring and delisting procedures. Brokers will be subject to proportionate expectations reflecting the nature of the services they provide, including whether they provide advice or operate on an execution-only basis.

Listing criteria should focus on relevant legal, structural, disclosure and technical considerations, taking account of the nature and characteristics of the token. The Authority recognises that market capitalisation, trading volume and liquidity considerations may need to be applied proportionately, particularly for new or infrequently traded tokenised products.

Market integrity in tokenised markets may require analysis across venues, chains and products. The Authority intends to clarify through guidance the extent to which firms should incorporate relevant on-chain and off-chain information into their monitoring, proportionate to their role and market impact. Comprehensive market surveillance will remain principally the responsibility of entities operating trading venues, while other intermediaries will be expected to identify and escalate suspicious activity within their business and cooperate with venues and competent authorities.

The Authority also intends to apply AML/ATF/CPF and Sanctions requirements to secondary-market activities involving tokenised investments(including tokenised investment funds) on a basis consistent with the treatment of comparable activities in traditional finance, having regard to the regulated activity and the role performed by the relevant entity.

The Authority also notes feedback on collateralised lending and borrowing of tokenised assets, including valuation, margining, custody, liquidation and rehypothecation. The Authority may consider these matters in future policy work.

10. Native tokens and authoritative records

Respondents generally supported the tailored treatment of native tokens. The Authority will clarify through guidance that, where tokens are issued directly and solely in tokenised form, the focus is on the integrity, governance, security and resilience of the on-chain environment, rather than requirements relating to underlying off-chain assets where none exist. Entities should maintain appropriate contractual and legal arrangements governing token holder rights, together with governance and remediation arrangements appropriate to the token structure. Any on-chain intervention should have an appropriate legal basis and be subject to appropriate governance controls.

The Authority will continue to consider the interaction between native-token models and Bermuda company, property and insolvency law. Any necessary legislative amendments will be progressed with the appropriate government stakeholders.

11. Conduct, disclosure and customer outcomes

Respondents supported principles-based conduct requirements covering fair treatment, transparency, suitability, market abuse, user-interface design and customer education. Stakeholders consistently requested proportionality between retail and institutional business and between advisory, execution-only, distribution and custody models.

The Authority will clarify through guidance that conduct expectations should be applied proportionately, having regard to the client type, product complexity and service provided. The nature and extent of protections will reflect the client type, with expectations calibrated appropriately for retail, institutional and sophisticated investors.

The Authority will also provide guidance on the disclosure of the nature of the token and associated holder rights, together with material legal, operational, liquidity and technology risks relevant to the particular tokenisation arrangement. Where appropriate, Secondary Offerors may refer to disclosures produced by the Primary Tokeniser provided the information is readily accessible and meets the applicable disclosure standards.

For tokenised investment funds, the Authority will clarify through guidance that disclosures should clearly explain redemption processes, transfer mechanisms and any limitations on secondary-market trading. Tokenisation arrangements should remain consistent with the fund’s disclosed redemption terms, liquiditymanagement procedures and applicable regulatory requirements.

12. Cyber risk and technical controls

Respondents strongly supported robust cyber and operational resilience outcomes. However, many cautioned that fixed multi-signature thresholds, mandatory timelocks, mainnet shadow forking and other named techniques could become outdated or disproportionate. The Authority agrees that the framework should remain risk- and outcomes-based, focusing on the effectiveness of controls rather than prescribing a single technical implementation.

The Authority will set out proportionate security outcomes through guidance while allowing entities flexibility in the controls through which those outcomes are achieved, provided they can demonstrate that the controls are effective.

The Authority will also provide guidance on cryptographic lifecycle management, including appropriate migration planning for emerging threats and changes in cryptographic standards.

13. Tokenised investment funds

Respondents strongly supported the tailored treatment of tokenised investment funds and the continued primacy of the Investment Funds Act 2006. The Authority agrees that the use of distributed ledger technology to maintain a tokenised fund register should not alter the fund's fundamental regulatory treatment or give rise to duplicative requirements where existing fund controls already achieve the intended regulatory outcomes.

The Authority will clarify through guidance the expectations for fund operators, investment managers, administrators, transfer agents, distributors and custodians. While fund operators may appoint fit and proper service providers to perform specific functions, the fund operator remains responsible for the overall operation, governance and oversight of the fund, including ensuring that outsourced or delegated activities are appropriately supervised and that the fund continues to comply with applicable regulatory requirements. The fund operator should ensure that appropriate technical due diligence is undertaken on the tokenisation infrastructure, whether conducted directly or through a service provider, with the scope of that due diligence proportionate to the relevant tokenisation risks.

The Authority will also clarify that conventional distribution of tokenised fund interests does not, by itself, constitute Secondary Offeror activity. Secondary-market expectations apply where an entity actively facilitates or conducts secondary trading.

Existing fund valuation, NAV, accounting and reconciliation requirements will remain the principal controls, with additional expectations applying where necessary to address risks introduced by tokenisation.

Where a fund register is tokenised, the Authority will clarify through guidance that fund documentation should clearly identify the authoritative legal record, while appropriate controls should preserve investor eligibility restrictions and ensure that token transfers accurately reflect legal ownership.

14. Implementation and interim measures

The Authority intends to propose legislative amendments to introduce and harmonise the definition of ‘tokenised investment’ across the relevant regulatory regimes. The amendments will provide a consistent statutory foundation while preserving the principle that regulatory treatment follows the legal and economic substance of the instrument and the function performed.

Separately, the Authority intends to issue supporting guidance applicable to tokenisation activities across the relevant regulated sectors. The guidance will clarify how existing legal, regulatory and supervisory requirements apply to tokenisation activities, including the allocation of responsibilities, proportionality and technology-specific risks. The guidance will supplement, and will not replace, the applicable legislation, regulations, rules and codes.

To provide regulatory clarity during the period before the legislative amendments take effect, the Authority intends to introduce an interim safe-harbour provision aimed at avoiding duplicative licensing requirements where the relevant activity and risks are already subject to effective supervision under an existing BMA regulatory framework. The scope, conditions and duration of the interim provision will be set out separately.

15. Continued industry engagement

The Authority also intends to establish a consultative industry group to support continued engagement as the tokenisation sector develops. The group will provide a forum for industry feedback on emerging business models, market practices, technical developments and areas where further regulatory or supervisory clarification may be appropriate.

16. Next steps

The Authority has completed its review of the detailed consultation feedback with the relevant supervisory, legal, policy, conduct, AML/ATF/CPF, cyber and sectoral teams. The policy positions set out in this letter will be taken forward through the legislative, regulatory and supervisory measures described above.

The Authority will publish further information on the sequencing and implementation of the legislative amendments, supporting guidance, the interim safe-harbour provision and the consultative industry group. This will include the treatment of existing structures and any relevant transitional arrangements.

The Authority will continue to engage with stakeholders as the framework is finalised and implemented.

The Authority thanks all respondents for their detailed and constructive submissions. The feedback has assisted the Authority in refining the framework to ensure it remains proportionate, technology neutral, aligned with international standards and supportive of responsible innovation in Bermuda.

Stakeholders seeking further clarification or additional information on these matters should contact the Authority at policy@bma.bm.

Sincerely,
The Bermuda Monetary Authority