How to Issue Digital Securities in the EU: A 2026 Regulatory Guide

Issuing digital securities in the European Union is no longer experimental. The legal framework is in force, the operational infrastructure is live, and serious issuers in Germany, Austria, Switzerland, and across the EU are completing regulated digital securities offerings every month. What remains genuinely confusing for founders, CFOs, fund managers, and financing consultants is the operational reality: which regulation applies to which instrument, what the practical sequence is, who all the required counterparties are, and what it costs end-to-end compared with building the same stack independently.

This guide walks through that operational reality, from regulatory perimeter to the moment the first token is settled in an investor's wallet, with the level of detail a CFO would want before booking a kick-off call.

Why issue digital securities in 2026

Tokenised real-world assets on public chains crossed $26.4 billion in March 2026, roughly a 300% year-over-year increase. McKinsey projects the market to reach $2 trillion by 2030; Standard Chartered's forecast is $30 trillion by 2034. The numbers move because the underlying business case finally works: digital securities cut issuance and lifecycle cost by an order of magnitude, settle near-instantly, support fractional ownership at scale, and embed compliance directly into the instrument.

For European issuers the practical applications cluster around four archetypes:

• SME financing: subordinated loans (Nachrangdarlehen) and profit participation rights (Genussrechte) raised under ECSPR for issue sizes up to €5M.

• Mid-market growth capital: equity and convertible structures under the simplified prospectus regime between €1M and €8M.

• Private-markets fund raises: tokenised fund units, private-credit feeders, and real-estate SPVs under MiFID II and AIFMD.

• Bond and corporate-debt issuance: tokenised Anleihen and structured notes, often under Germany's eWpG as Kryptowertpapiere.

Two facts frame the rest of this guide. First, primary issuance infrastructure is mature: every serious platform in the European market can run a compliant primary offering. Second, regulated secondary trading is rare: as of April 2026 only four infrastructures hold DLT Pilot Regime authorisations EU-wide. The implication for issuers is direct: design the primary issuance properly, treat secondary liquidity as a roadmap topic, and do not commit to platform vendors that pretend otherwise.

"Most issuers we work with want the same thing: a regulated path to capital that goes live in weeks, not months, with a clear cost number. The framework exists in 2026. What's missing for most teams is a map of which framework applies to their deal." - Lukas Wipf, CPO & Co-Founder, ONINO (LinkedIn)

The EU regulatory map: six frameworks, one decision

The single most common mistake in digital securities issuance is selecting a platform or a structure before naming the regulatory perimeter. The decision tree starts here.

A few clarifications worth fixing in everyone's head:

MiCAR does not cover tokenised securities. This is the single most repeated misconception. ESMA's March 2025 guidelines on the classification of crypto-assets as financial instruments confirm a hierarchical test: if an instrument meets the criteria of a financial instrument under MiFID II, it sits outside MiCAR. A tokenised equity, bond, fund unit, or profit-participation right remains a security and is governed by MiFID II, the Prospectus Regulation, and national securities law. MiCAR is only relevant to a digital-securities deal if the structure incorporates a crypto-asset layer, such as stablecoin distributions or an embedded EMT.

The DLT Pilot Regime is not an issuer regime. It authorises market infrastructures (DLT MTFs, DLT settlement systems, and combined trading-and-settlement systems) to operate under a sandbox derogation framework. Issuers benefit from it indirectly through the venues that hold it. As of April 2026 only four infrastructures EU-wide hold DLT Pilot authorisations: CSD Prague (DLT Settlement System), 21X AG and 360X AG (DLT MTFs, both authorised in April 2025), and Securitize Europe (DLT TSS via CNMV, early 2026). ESMA is reporting on the regime in 2026 with recommendations on whether to make elements permanent.

eWpG is German-specific and is the heart of the German story. It created the legal category of the Kryptowertpapier - an electronic security registered on a decentralised register rather than at a central securities depository. The Kryptowertpapier is the instrument most BaFin-approved German digital-securities offerings now use. We treat it in detail further down.

Choosing the right instrument

The instrument decision is partly legal and partly commercial. The four most common European instruments in 2026:

Nachrangdarlehen (subordinated loan). A debt obligation ranked behind senior creditors. Widely used in German SME financing for its flexibility and exemption from the prospectus obligation under VermAnlG below the threshold. Best fit for established cash-flow businesses raising sub-€8M. Limited investor rights (no voting, no upside beyond the coupon).

**Genussrechte (profit participation rights).** A hybrid instrument granting an economic interest in profits without voting rights. The workhorse of German mid-market structured financing. Best fit when the issuer wants downside protection for investors via profit-linked returns but does not want to dilute control. Often combined with a Haftungsdach for licensed distribution.

Equity tokens. Tokenised shares with voting rights and dividend entitlement. Best fit for growth-stage companies running a Series A-equivalent on-chain. Heavier on legal structuring than debt instruments; cap-table implications are real and permanent.

Anleihen (corporate bonds). Tokenised bond obligations with defined coupon and repayment terms. Best fit for established issuers raising senior debt at scale. In Germany, frequently structured as Kryptowertpapiere under eWpG.

Fund units. Tokenised LP interests or fund shares. Best fit for asset managers running tokenised private-credit, private-equity, or real-estate funds. Trigger AIFMD considerations on top of MiFID II and the Prospectus Regulation.

A simple matrix, where ● means strong fit and ◐ means viable but requires careful structuring:

The matrix is a heuristic. The real decision turns on tax treatment, investor base, and the issuer's existing capital structure - all of which should be worked through with a securities lawyer before the platform conversation begins.

The seven-step issuance process - expanded

The headline structure of a digital securities offering is the same across regimes. The detail inside each step is where most teams underestimate the work.

Step 1: Legal structuring (2-4 weeks)

Deliverables. Instrument type confirmed (equity, debt, Genussrechte, fund unit), regulatory route selected (ECSPR, prospectus, exempt, eWpG), investor eligibility defined, SPV or issuer entity confirmed.

Who owns it. Issuer's securities lawyer, with platform input on operational feasibility.

Common pitfalls. Choosing a route that does not match the target investor base (e.g. running an accredited-only structure when the distribution model assumes retail), or underestimating how long it takes a tax advisor to sign off on the tokenised wrapper.

Step 2: Offering documentation (4-8 weeks)

Deliverables. Depending on size: an information memorandum (exempt), a Key Investment Information Sheet (KIIS, for ECSPR), or a full prospectus filed for BaFin Hinterlegung. Subscription agreement, investor questionnaire, risk disclosures, and tax-treatment annex.

Who owns it. Securities lawyer drafts; issuer fact-checks; platform provides templates and embedded compliance fields.

Common pitfalls. Underestimating the SAFT-style accounting history if the issuer has done any prior token activity. Late changes to instrument terms that cascade into document rewrites. Marketing material drafted before the offering document is approved, triggering early Werbung issues.

Step 3: Platform setup and token configuration (1-3 days for white-label deployments)

Deliverables. Configured white-label environment under the issuer's domain and brand, token contract deployed with the right standard (typically ERC-3643 / T-REX for permissioned EU securities, ERC-1400 in some legacy stacks), transfer restrictions and whitelist rules encoded, distribution logic and vesting parameters set.

Who owns it. Platform vendor configures; issuer reviews and signs off.

Common pitfalls. Treating the token standard as an afterthought. Permissioned standards (ERC-3643) enforce compliance at the protocol level - every transfer is gated by an on-chain identity check. Unpermissioned standards (ERC-20) do not, and retrofitting compliance afterwards is painful. ONINO deploys ERC-3643-compatible environments under the white-label model in under 24 hours.

Step 4: Investor onboarding and KYC/AML (parallel, 1-4 weeks)

Deliverables. KYC/AML verification integrated with a licensed provider (typically an EU eIDAS-compliant onboarding partner), accredited / qualified investor checks for relevant tiers, whitelist of approved wallet addresses, identity claims attested on-chain.

Who owns it. Platform handles the workflow; the licensed KYC provider performs the actual verification; the issuer reviews edge cases.

Common pitfalls. Onboarding starting too late. KYC can run in parallel with documentation and platform setup - sequencing it after the offering opens is a guaranteed timeline slip.

Step 5: Offering period and subscription (variable, typically 2-8 weeks)

Deliverables. Live offering page under issuer's brand, subscription flow, payment collection via a regulated payment institution or escrow account, real-time subscription tracking, minimum-funding-condition logic.

Who owns it. Issuer markets; platform runs the operational rails; payment institution holds funds in escrow until closing conditions are met.

Common pitfalls. Marketing that crosses into prohibited Werbung territory before the documentation is officially deposited. Distribution channels (LinkedIn, email, partner platforms) without a documented marketing-compliance review.

Step 6: Token issuance and register entry (1-2 weeks)

Deliverables. Tokens minted to verified wallets, ownership recorded. For German Kryptowertpapier issuances, the Eintragung in the BaFin-supervised crypto-securities register is the legal act that establishes ownership.

Who owns it. Platform mints; Registerführer performs the register entry; custodian holds keys where required.

Common pitfalls. Treating the register entry as a technical formality. It is the legal event that creates the security in the German system. Without the entry, no Kryptowertpapier exists.

Step 7: Post-issuance lifecycle management (ongoing)

Deliverables. Cap-table maintenance, dividend or coupon distributions, voting and shareholder meetings, corporate actions (splits, consolidations, redemptions), tax reporting per investor jurisdiction, ongoing investor communications, regulatory reporting.

Who owns it. Platform handles automated rails; issuer signs off on corporate actions; paying agent processes distributions where required.

Common pitfalls. Choosing a platform that wins on issuance UX but neglects lifecycle. Most issuers spend more cumulative time on lifecycle than on issuance over a five-year hold.

The eWpG deep-dive: what German issuances actually require

If the issuance is a Kryptowertpapier under Germany's eWpG, platform selection is not enough. You also need a separately licensed counterparty: the Kryptowertpapierregisterführer.

The register operator (§ 16 eWpG)

The Registerführer maintains the cryptographic register that records who holds the security. The register entry is the legal act that establishes ownership - not the token transfer itself. The role is authorised under § 1 Abs. 1a S. 2 Nr. 8 KWG and is supervised by BaFin. It is a distinct licence from crypto custody (§ 1 Abs. 1a S. 2 Nr. 6 KWG), although several providers hold both.

Tangany (Munich) is currently the most widely used Registerführer in the German market, holding the relevant BaFin authorisations and operating across multiple live eWpG issuances. Other registrars exist and the landscape is evolving as BaFin issues additional authorisations. The practical point: a platform's "German readiness" should be verified by its documented Registerführer relationships and live eWpG deal references, not by slideware.

What to verify before committing

Before selecting a platform for a German digital-securities issuance, get specific answers to:

1. Which Registerführer has the platform used on live issuances, and how many?

2. Is the platform-Registerführer integration contractually bundled, or does the issuer contract separately with each?

3. What are the combined platform + Registerführer + custody fees per issuance?

4. Is a Haftungsdach included for distribution activities, or does the issuer need its own licence?

5. What is the documented BaFin engagement history for prior issuances?

Registrar fees typically run €1,000-2,000 per issuance and Haftungsdach fees typically run ~€1,000 per issuance for structures that benefit from a liability umbrella. These are real, recurring line items, not afterthoughts.

The partner stack you actually need

A serious digital-securities issuance involves at least six counterparties. Anyone selling you a single-vendor solution is either bundling these inside their stack or quietly leaving gaps. The honest map:

The "ONINO handles" column is the value proposition of a managed white-label platform: the issuer keeps the relationships under one commercial roof rather than negotiating six separate vendor contracts. The issuer's lawyer remains the issuer's relationship - outsourcing legal counsel to a platform vendor is not advisable.

Costs and timelines, itemised

The €25,000 managed-platform figure and the €150,000-€400,000 DIY range are accurate but anonymous. The detail that makes them credible:

DIY build (first issuance)

Subsequent issuances on a DIY stack are cheaper at the marginal cost, but maintenance, regulatory updates, and platform evolution remain a recurring engineering cost.

Managed platform (ONINO)

The 80-90% cost reduction is structural: a managed platform amortises the regulatory, audit, and engineering work across many issuers. For sponsors running multiple offerings, the marginal cost of each subsequent issuance drops further because the platform configuration, KYC database, and partner relationships are reusable.

The secondary-market reality check

Most digital-securities marketing implies that once an asset is tokenised, a functioning secondary market follows. The evidence does not yet support this for the general case.

As of April 2026 the regulated EU secondary-market map is small:

National-venue routes exist outside the DLT Pilot framework - most notably Stokr's CSSF-supervised marketplace in Luxembourg - and partner-broker routes connect tokenised assets to ATS-style venues in the US. The list is the list.

The honest read for issuers in 2026: design the primary issuance properly, accept that secondary liquidity for most asset classes is still partner-and-roadmap territory, and discount platform pitches that claim otherwise.

Token standards: why ERC-3643 matters

Most issuers do not need to know what an ERC standard is. The exceptions are: deals that target institutional buyers who run their own token diligence, and deals that anticipate listing on a regulated secondary venue.

ERC-3643 - formerly known as T-REX (Token for Regulated EXchanges) - is the open-source permissioned-token standard that has become the de facto institutional baseline in 2026. Unlike ERC-20, an ERC-3643 token cannot be transferred unless both sender and receiver have completed verified identity checks on-chain and the transfer meets all encoded regulatory rules. The standard secures $32 billion+ in tokenised assets across the T-REX Network as of April 2026. DTCC joined the ERC-3643 Association in March 2025 and is integrating the standard into its ComposerX tokenisation platform.

For European digital-securities issuances aimed at institutional investors or future MTF listing, ERC-3643 compatibility is the safe baseline. ONINO deploys ERC-3643-compatible environments by default.

Five common mistakes

Five anti-patterns we have seen across DACH digital-securities RFPs in the last 24 months. Each is more expensive than it looks.

1. Picking ECSPR for a deal that needs a prospectus. ECSPR caps at €5M per issuer per 12 months. A €12M raise structured as ECSPR is not a structure - it is a regulatory breach in progress. If the issue size exceeds the ECSPR cap, the answer is simplified prospectus disclosure or a multi-tranche design, not a creative reading of the cap.

2. Assuming MiCAR covers a tokenised equity or bond. It does not. Tokenised securities are financial instruments under MiFID II and sit outside MiCAR. A platform marketed primarily on "MiCAR readiness" is signalling the wrong perimeter for a securities deal.

3. Selecting a platform without verifying Registerführer relationships (DE). For an eWpG issuance, the Registerführer is the legal act-creator, not a sidecar. A platform that cannot name its Registerführer partner and live deal count for German issuances is not German-ready.

4. Treating tokenisation as a tax-optimisation tool. It is not. Immobilienabschreibung (IAB) and other tax-optimised German real-estate structures depend on specific allocations of depreciation and flow-of-funds that do not travel cleanly into tokenised wrappers. The honest answer for IAB-driven deals is to keep the structure conventional and tokenise the next non-IAB project.

5. Choosing a platform before naming the regulation, instrument, investor base, and distribution model. The meta-mistake. Without those four variables fixed, no feature comparison or price sheet will produce the right answer.

What's coming in H2 2026

Three developments will reshape the practical issuance experience before year-end.

ESMA's DLT Pilot Regime review (March-June 2026). ESMA is reporting on the Pilot Regime and recommending whether to make elements permanent. A favourable review with clearer thresholds would expand the authorised-venue list materially in 2027 and reduce the secondary-market gap that currently constrains the European tokenisation market.

MiCAR transitional period ends 1 July 2026. Existing crypto-asset service providers under national regimes must complete their MiCAR transition by this date. For tokenised securities the direct relevance is limited - these instruments are governed by MiFID II - but any deal structure that incorporates a crypto-asset layer (stablecoin distributions, EMT-denominated coupons) needs to confirm its counterparties have completed the transition.

Confidential-computing standards mature. The T-REX Network announced a collaboration with Zama in March 2026 to add institutional-grade confidentiality to on-chain RWA tokenisation. If confidential-computing features become standard across the ERC-3643 ecosystem, the institutional case for EVM-native tokenisation strengthens considerably and on-chain issuance becomes viable for use cases where data sensitivity has been the blocker.