Investor onboarding for a tokenized offering is everything an issuer has to do before an investor legally owns what they paid for. It runs in six steps: the investor signs up, passes the identity and anti-money-laundering checks (known as KYC and AML), answers questions about whether the product suits them, signs a subscription, pays, and is written into the register that records who owns what. Only that last step moves ownership.

The first five steps rest mostly on EU rules and look much the same in every member state; the sixth follows national law. The same asset tokenization infrastructure can carry all six.

That leaves one question, and it decides everything else: at what moment does the investor actually own the security? Everything before the register entry is preparation for it. This post walks through the six steps in order, first in plain terms, then how each one works in practice, and finally where the real delays and the real legal risk sit.

Which rules govern investor onboarding in the EU?

Five sets of EU rules shape the process, and each one looks after a different part. The offer rules decide who may be shown the offering at all: the Prospectus Regulation for public offers of securities, the ECSPR for offers on licensed crowdfunding platforms, and the AIFMD, the EU's fund managers directive, for funds. The anti-money-laundering rules decide how identity is checked. MiFID II, the EU's main rulebook for selling securities, decides whether a product suits the investor. eIDAS, the EU's rules on electronic ID and signatures, decides which ID methods and which signatures count. And the CSDR, the EU's settlement rulebook, sets how fast a trade in a classic security has to settle, which only comes into play at the final step.

Two of them are about to change what issuers have to build. From 10 July 2027, a single EU anti-money-laundering regulation replaces the twenty-seven national rulebooks on customer checks and spells out exactly what a regulated firm has to establish about each customer. From 11 October 2027, trades in classic securities on trading venues have to settle one business day after the trade, which step 6 comes back to.

The sixth step is where EU law stops and national law starts. There is no EU-wide law on who owns a tokenized security, so each country answers "when does the investor own it" for itself. In France, for unlisted securities, an entry in a shared electronic register counts as an entry in a securities account and moves ownership. Spain and Italy tie the transfer to the entry in the register, and Luxembourg lets securities accounts and issuance accounts be kept on a blockchain. Which country's answer applies follows the register, not the investor. In Germany, for example, rights in an electronic security are governed by the law of the country that supervises its register-keeper (securities held through a custody account follow the custody rules instead), so a German crypto security sold to investors in seven countries is owned under German law. An issuer choosing where its register sits is also choosing its ownership rules.

That split is why a step-by-step map is more useful than a compliance checklist. The table below shows the whole sequence and what each step looks like from both sides of the screen. Every offering run on ONINO follows some version of it, whether the issuer tokenizes a real-world asset or runs a rail without a token at all, a rail here simply meaning the legal wrapper the investment sits in. And even on the tokenized rails, not every token is a security.

What does the investor actually do at registration and KYC?

Registration is short for the investor and decisive for the issuer. The investor, or LP in fund language, opens an account and proves who they are, while the issuer decides what this visitor may see at all. A fund under the AIFMD shows why: its EU-wide marketing passport covers only professional investors, and each country decides whether retail investors may be approached. If any passing visitor can reach the subscription form, the issuer has a marketing problem before it has an onboarding problem.

Proving identity is narrower than most issuers assume. Until July 2027, each EU country sets its own list of accepted methods: Germany allows exactly five, from an official photo ID to a qualified electronic signature (the highest grade of digital signature under EU law), and video identification survives only on a circular from BaFin, Germany's financial regulator, which BaFin itself called a bridge technology. From 10 July 2027 one EU rulebook replaces those lists. Identity documents stay allowed, but electronic ID must meet one of the two top EU security levels, which in practice points to the EU Digital Identity Wallet, a government-backed ID app on the investor's phone. Germany's savings banks have already signed up to let customers open securities accounts with it from its planned start on 2 January 2027. An issuer rebuilding this step now should keep the ID-document route and add the wallet.

When the investor is a company, the check goes one layer deeper: the firm has to identify the beneficial owners, the people who ultimately own or control the company, check whether any of them is a politically exposed person, and screen everyone against EU sanctions lists, without relying on the national ownership register alone. Any of this can be outsourced, but the responsibility stays with the regulated firm. Most larger firms outsource anyway: in IQ-EQ's April 2026 survey of more than 50 fund managers, 87% of the larger ones had moved to outsourced or hybrid KYC, though IQ-EQ sells that service itself. That makes identity a buying decision in a way the next two steps are not, and our guide to KYC and AML on tokenization platforms covers what to look for. On ONINO, the check runs through an integrated verification provider inside the issuer's onboarding flow: individual investors verify by video identification, the standard route for German investors, followed by proof of address and anti-money-laundering, sanctions and politically-exposed-person screening, while company investors go through a business check covering company documents, beneficial owners and the identity of at least one of them. On a tokenized rail, the eligibility check can also be built into the token standard instead of sitting beside it as a separate tool.

Who checks whether an investment suits the investor, and at which step?

The firm that sells the product to the investor does, not the issuer. That is the bank, adviser or licensed platform providing the investment service, and the test it runs depends on how the product is sold, not on what the product is.

Under MiFID II, the full suitability assessment applies only when the investor gets advice or hands over management of their portfolio. It covers what the investor knows and has done before, their financial situation including how much loss they can absorb, and what they want from the investment, including how much risk they will accept. Every other service needs only a lighter check that the product is appropriate for that investor. So the same tokenized bond can carry a heavy assessment when it is sold with advice and a light one when the investor decides alone, which makes this a question of how you distribute rather than a compliance question. European long-term investment funds (ELTIFs) are the exception: a retail investor needs the full assessment however the units were bought.

Two further gates decide which category an investor falls into. Under MiFID II, a retail investor can ask to be treated as a professional client and give up some of that protection, but only if the firm confirms at least two of three tests: an average of 10 significant trades per quarter over the past four quarters, a portfolio above €500,000, or at least a year in a professional role in the financial sector. Crowdfunding platforms under the ECSPR run a different gate. Before a non-sophisticated investor gets full access, the platform must check their knowledge and experience and have them simulate how much loss they could bear, and any single investment above €1,000 or 5% of their net worth, whichever is higher, needs a fresh warning, explicit consent and proof that they understand the risk. National fund rules can add categories of their own, such as Germany's semi-professional investor, who has to commit at least €200,000.

The investor meets this step third, because that is where it shows up on screen. Commercially it comes first, because for a fund restricted to professional investors, the investor's category decides whether the offering may be shown to them at all. Whoever builds the funnel should therefore sort investors by category before registration, and keep the documented assessment for step three.

What makes the subscription and the payment binding?

A subscription is only an offer until the issuer countersigns it and allocates the units, and the signature has to be the right kind. Under the EU's eIDAS rules, only a qualified electronic signature has the same legal effect as a handwritten one in every member state, so where national law asks for a handwritten signature, a scan or a click-to-accept box is not enough. On an ECSPR crowdfunding platform, a non-sophisticated investor can also withdraw within four calendar days without giving a reason, so the subscription is not final until then. This paperwork is also where the time goes: EY's February 2024 survey of more than a dozen asset managers onboarding institutional clients found that, for most, contract negotiation takes 40 to 50% of onboarding time, against an average of 18% for anti-money-laundering and KYC checks. The sample is small and institutional, so treat it as a signal rather than a measurement. Most of the work in a digital subscription process is therefore making the countersignature fast, documented and repeatable instead of piecing it together from email attachments, and the same logic favours choosing to issue without writing code over a custom build. Investor clubs that pool money in a special purpose vehicle face that step on every deal, as covered in managing SPV subscriptions at scale.

Payment then finishes the investor's side of the deal, and nothing else. Where the risk calls for it, anti-money-laundering rules make the source of the money part of the customer checks, so a transfer is evidence as well as money. A countersigned subscription creates an obligation and a cleared payment creates a receivable; neither creates an owner. On ONINO, steps 1 to 5 run as one subscription flow under the issuer's own brand: KYC for individual and company investors, anti-money-laundering screening through configurable rules or integrated screening services, suitability and appropriateness questionnaires, document delivery with e-signing, and payment with an audit trail. Licensed functions, such as keeping a crypto securities register or holding investors' tokens, sit with pre-integrated licensed partners, and the offering-level duties stay with the issuer.

When does settlement into the register transfer ownership?

When the register says so, and not before. Germany's rules are spelled out in detail, so they serve as the worked example for the rest of this section. Under its Electronic Securities Act, the holder of an electronic security is whoever is entered in the electronic securities register, and ownership only passes when the security is re-registered to the buyer on the instruction of the person entitled to it, with both sides agreeing that ownership should pass. The law is explicit: until that re-registration happens, the seller still owns it. That applies to a single entry, where the investor is named in the register. Many electronic securities use a collective entry instead: a central securities depository or custodian is entered as holder, the investor holds through a securities account, and step 6 becomes a booking in that account, as with a classic security.

"Every issuer we speak to has automated the identity check and then closes the deal over email. The register entry is the moment that counts, and in most setups nobody owns the clock on it. That is the gap worth closing before the next raise."

Lukas Wipf, Co-founder and CPO, ONINO

That leaves a window in every first allocation where the issuer holds the investor's money and the investor holds no legal title. It only closes when the register entry is made. How long it stays open is an operational choice, and published figures are rare. The best-documented ones come from showcase bonds. Siemens' first €60m digital bond in February 2023, sold directly to investors without a central securities depository and with Hauck Aufhäuser Lampe as registrar, took two days to complete. Its €300m digital bond in September 2024, with DekaBank as registrar and payment in central bank money through the Bundesbank's trigger solution, was processed within a few minutes. For ordinary offerings, we found no fund administrator, register-keeper or platform vendor that publishes a figure. What the window looks like depends on which instrument rail the offering runs on, and the ONINO platform covers several of them in parallel. For the investor, step 6 ends when the holding shows up in their account, typically a branded investor portal under the issuer's name.

The real risk sits in the last row of the table. Under German law, the register-keeper of a crypto security is whoever the issuer names to the investor, and if no one is named, the issuer itself is the register-keeper, with the entry rules and BaFin supervision that come with it. Keeping a crypto securities register is a regulated financial service in Germany, so an issuer that assumed its technology provider was doing it should check its position with a lawyer before the first allocation, not after. On ONINO, the crypto securities register is maintained by Tangany, a BaFin-authorised registrar; the permission sits with that partner, not with ONINO.

The token and the register are also not automatically the same thing: a token may be the register itself or only mirror an entry kept elsewhere, and the two give different answers when an investor loses the key to their wallet, so the offering terms should name who keeps the register and on what system. Tokens also add an onboarding task of their own: the investor's wallet has to be tied to the person who passed steps 2 and 3. Investors can hold through a wallet kept for them by a licensed crypto custodian or through a wallet of their own. ONINO supports both routes. Either way, token standards built for securities, such as ERC-3643, link each wallet to a verified identity and block transfers to wallets that are not on the list, so the eligibility rules from step 3 travel with the token.

Two design choices at step 6 stay with the issuer. The first is timing: from 11 October 2027, trades in classic EU securities on trading venues must settle one business day after the trade (T+1). In our reading, a first allocation is not a trade on a trading venue, and a crypto security re-registered outside official settlement systems is not covered either, so the real clock is how fast the register-keeper makes the entry. The second, and the one worth designing now, is ordering. German law treats the register as correct and the registered buyer as the rightful owner unless, at the moment of entry, the buyer knew otherwise or failed to know through gross negligence, which makes an unverified entry hard to unwind. Every check on who may hold the security therefore has to run before the register entry, and the same rule covers what follows the first allocation, from capital calls to redemptions and second-hand transfers.

Both choices matter more because the infrastructure is still young. By 31 May 2025, ESMA, the EU's markets regulator, counted only three approved systems in the EU's test scheme for blockchain-based trading and settlement, with a handful of issues between them. Its list has since grown to six, and in December 2025 the European Commission proposed raising the scheme's overall cap from €6bn to €100bn. The plumbing is being built, but it is still a pilot.

Where should an issuer spend the next quarter?

Ultimately, the budget should follow the time and the risk, not what vendors sell. Most effort goes into step 2, the identity check, yet EY's survey puts most of the elapsed time in the contract paperwork of step 4, and the German example puts the legal risk in step 6. KYC is not free either (in IQ-EQ's survey, 74% of fund managers said it adds six to 30 days to a fund's closing), but it is the step the market already knows how to buy, and it decides nothing about ownership. The two steps worth a quarter of engineering time are therefore subscription, to make countersignature and allocation fast and repeatable, and settlement, to run every check before the register entry and name the register-keeper in the offering terms. The time to do it is now: by the count of DekaBank, itself a register-keeper, German crypto securities issued so far have only just passed €1.23bn, so the process can still be written down before the volume arrives.

The next step is simple: before the next closing, take one live offering and fill in this table.

If you can only fix one row, fix the last one, before touching the KYC vendor.

Keep reading

Three posts pick up where this one stops. Why asset managers are missing tokenization covers the decision sitting above all six steps: whether to run a tokenized offering at all. Bringing real assets on chain deals with what has to be true before an investor ever reaches registration. And a plain tour of the platform shows the six steps as software rather than as a sequence on paper.