When a platform describes itself as "regulated," that word can mean many things. In the context of digital securities in the EU, it refers to a specific set of authorizations, registrations, and oversight obligations that a platform must hold and comply with before it can legally issue, distribute, or custody digital securities. Understanding what regulated infrastructure actually consists of matters for anyone issuing securities on a platform, investing through one, or evaluating one as a business partner. This article explains each layer clearly.

What "Regulated" Actually Means for a Platform

Regulation in financial services is not a single status. It is a collection of specific authorizations, each granted by a competent authority, each covering a defined set of activities. A platform that is "regulated" for one activity may not be authorized for another. A platform that holds authorization in one EU jurisdiction may not be passported to operate in others. The label alone tells you very little; the specific authorizations held are what matters.

For a digital securities platform operating in the EU, the relevant regulatory question is: which activities does this platform perform, and does it hold the authorization required for each of those activities? The core activities of a digital securities platform are issuing or arranging the issuance of securities, distributing those securities to investors, maintaining the investor registry, and providing custody of the digital securities. Each activity has its own rule: issuing your own securities needs no licence; placing or brokering for others needs a permission under § 15 WpIG or a liability umbrella (Haftungsdach); keeping a crypto securities register needs a permission under § 1 Abs. 1a S. 2 Nr. 8 KWG, crypto custody one under Nr. 6. The software that connects them needs none.

A platform that performs these activities without the required authorizations is operating illegally. The issuer who uses such a platform may also face regulatory exposure, even if they were unaware of the platform's compliance status. This is why understanding the regulatory stack of any platform you work with is a basic due diligence requirement, not a technical detail.

The EU Regulatory Layers: BaFin, eWpG, ECSPR and MiCA

The EU regulatory framework for digital securities platforms is built from several interlocking pieces. Each addresses a different dimension of the platform's activity.

BaFin authorization is the foundational layer for platforms operating in the German market. BaFin is Germany's Federal Financial Supervisory Authority and the competent authority for authorizing investment firms, regulated markets, and financial service providers under German and EU law. A platform offering investment services in Germany must hold the relevant BaFin authorization or operate through a BaFin-authorized entity.

The Electronic Securities Act (eWpG) is a German law that created the legal framework for digital securities to exist as valid securities under German law without a paper certificate. eWpG introduced two new forms of electronic securities: central register securities held in a traditional central securities depository, and crypto securities recorded in a decentralized crypto securities register supervised by BaFin. For a digital security issued under eWpG to be legally valid, it must be registered in one of these registers. A platform that issues digital securities in Germany without the correct register entry is not issuing valid securities under German law, regardless of the blockchain technology used.

The European Crowdfunding Service Providers Regulation (ECSPR) applies to platforms that facilitate crowdfunding for business purposes, including debt and equity instruments, up to EUR 5 million per project owner over 12 months. ECSPR authorization permits a platform to operate across EU member states under a single passport. Platforms holding ECSPR authorization are listed in the ESMA register of authorized crowdfunding service providers, which is publicly accessible.

The Markets in Crypto-Assets Regulation (MiCA) covers crypto-assets that do not qualify as financial instruments under MiFID II. Digital securities classified as transferable securities under MiFID II are outside MiCA's scope. However, platforms that handle asset-referenced tokens, e-money tokens, or other crypto-assets alongside their digital securities activity need to assess MiCA compliance separately.

Why It Matters for Issuers and Investors

For issuers, what matters is that every licensed activity in the setup is performed by a party holding the permission for it. If someone brokers the offering or keeps the register without permission, that is unauthorised business and exposes the issuer to regulatory action and investor claims. The software itself needs no licence.

For investors, the platform's regulatory status determines what protections apply. Investors subscribing through a regulated platform are entitled to the investor protections mandated by EU law: disclosure obligations, cooling-off rights under ECSPR, pre-contractual information requirements, and access to complaint and redress mechanisms. An investor who subscribes through a setup where a licensed activity runs without permission loses these protections.

For business partners evaluating a platform - whether as a bank considering a white-label arrangement, a financing consultant sourcing infrastructure for clients, or a fund manager selecting an issuance venue - the regulatory stack is the most important factor in due diligence.

What Under-Regulated Infrastructure Gets Wrong

Platforms that operate with incomplete regulatory coverage typically fall into recognizable patterns. Some hold authorization for one activity such as technology provision and imply it covers the full investment service. Others operate under a sandbox or pilot regime and present this as equivalent to full authorization, when sandbox participation is specifically limited in scope and duration.

A third pattern is geographic mismatch: a platform authorized in one jurisdiction operating in another without the required passport or local authorization. ECSPR passporting works EU-wide after a notification through the home regulator for crowdfunding activities within the regulation's scope, but activities outside that scope require separate national authorization.

The practical test is straightforward: ask the platform to provide its specific authorizations by name, the issuing authority for each, and the activities each authorization covers. A compliant platform answers this question precisely and quickly. Vague references to being "compliant with EU regulations" without specifying the authorization held are a reliable indicator that the regulatory picture is incomplete.

ONINO is a software provider and holds no financial-services licence. For each activity in your setup, ONINO shows you which pre-integrated partner holds the permission, for example the BaFin-authorised registrar or the custody partner. The same applies to audit trail and record-keeping requirements that regulated platforms must satisfy as part of their ongoing supervisory obligations.

ONINO supplies the software for investor onboarding, reporting and compliance workflows; the regulatory duties stay with the issuer and its licensed partners. You can focus on structuring your deal and building your investor base. Platform setup takes less than a week; when the first offering goes live depends on structuring and partner onboarding.

Further reading: MiFID II compliance for issuers

FAQ

Which party needs which permission in a digital securities issuance?

Issuing your own securities needs no licence. Placing or brokering securities for others needs a permission under § 15 WpIG or a liability umbrella (Haftungsdach); keeping a crypto securities register needs a permission under § 1 Abs. 1a S. 2 Nr. 8 KWG, and crypto custody one under Nr. 6. Each permission sits with the party that performs the activity.

What are the benefits of a regulated financial infrastructure?

Regulated infrastructure provides legal certainty for all parties. Issuers know that every licensed activity is performed by a party holding the permission for it. Investors have enforceable rights and access to regulated complaint mechanisms. For cross-border activity, a regulated platform with ECSPR or MiFID II passporting can operate across multiple EU member states without each issuance requiring separate national approval.

What are the 4 types of securities under EU law?

MiFID II categorizes financial instruments into transferable securities, money market instruments, units in collective investment undertakings, and derivative instruments. Digital securities that encode the same economic rights as traditional transferable securities are regulated under the same framework, regardless of the technology used to issue or record them.

Does a white-label platform need a licence?

The software itself needs no licence. What needs a permission is the activity: if the platform operator also places the offering, keeps the register or holds custody, it needs the permission for that activity or works with a partner who holds it. ONINO is a software provider and holds no financial-services licence; the licensed functions run through pre-integrated partners.

Summary

• "Regulated" is not a single status but a collection of specific authorizations, each covering defined activities; the relevant question is which authorizations a platform holds and for which activities.

• The EU regulatory stack for digital securities platforms includes the registrar's BaFin permission, the eWpG register entry, ECSPR for cross-border crowdfunding up to EUR 5 million, and MiCA for crypto-assets outside the MiFID II financial instrument definition.

• For issuers, a permission gap anywhere in the setup creates regulatory exposure and potential liability toward investors.

• For investors, a regulated platform provides enforceable rights, disclosure obligations, and access to complaint mechanisms that do not exist on unregulated platforms.

• The practical test: ask the platform for its specific authorizations by name and issuing authority; a compliant platform answers this question precisely.