This guide maps which regulator and which licence apply to each tokenisation activity in the United Kingdom and the United Arab Emirates, with Ireland and Guernsey as the usual structuring routes. It is part of Ctrl Alt Insights and follows the guide to what real-world asset tokenisation is and how it works. It is general information, not legal advice. The sources were last opened on .
Key takeaways
- The legal nature of the token decides the regime: a tokenised share, bond or fund unit stays under securities law.
- UK funds: FCA Policy Statement PS26/7 of gives final guidance on distributed ledger technology in authorised funds.
- UK market infrastructure: the Digital Securities Sandbox is due to run until , and a Gate 1 notice permits no live activity.
- Dubai: issuing an asset-referenced virtual asset is a Category 1 VA Issuance, with monthly disclosure, six-monthly audits and paid-up capital of at least AED 1,500,000.
- Promotion rules differ by regime and are never merged into one sentence.
- No single licence covers the UK, the EEA, Guernsey and Dubai; Ctrl Alt uses four.
The principle: regulation follows the asset, not the ledger
A token takes its legal treatment from the rights it carries; the ledger changes the record, not the instrument. The FCA's cryptoassets page, last updated on , says tokens that amount to a specified investment are security tokens and are likely to sit inside its regulatory perimeter. A tokenised share, bond or fund unit keeps the rules of a share, a bond or a fund unit.
A token that is not a financial instrument falls under a cryptoasset or virtual-asset regime instead: the Markets in Crypto-Assets Regulation (MiCA) in the EU, and the rulebooks of the Virtual Assets Regulatory Authority (VARA) in Dubai outside the Dubai International Financial Centre (DIFC).
One project can answer to several regulators. An interest in a Guernsey vehicle, placed with professional clients in the EEA and promoted in the UK, touches three of them. That is why Ctrl Alt offers an asset tokenisation platform run by four regulated entities, each described on the page about Ctrl Alt: entities and licences.
Terms used in this guide
- Tokenisation
- Representing an asset, or ownership of it, using distributed ledger technology (DLT), in the FCA's words on its PS26/7 page.
- Security token
- A token that amounts to a specified investment under the UK Regulated Activities Order.
- ARVA
- Asset-referenced virtual asset: under VARA's rules, a virtual asset that represents a real-world asset, the income from it, or both.
- Category 1 VA Issuance
- An issuance that is itself a licensed activity in Dubai; each ARVA also needs VARA's approval.
- DSD
- Digital securities depository, the designation a sandbox entrant receives at Gate 2.
- Non-mass-market investment
- The FCA category whose promotion to retail investors COBS 4.12B restricts.
The glossary has more regulatory terms defined.
United Kingdom: the FCA perimeter
UK Regulator: Financial Conduct Authority
The UK has no separate tokenisation licence. A firm needs FCA authorisation for the regulated activity it carries on, whatever the ledger, and three layers matter in 2026: fund rules, promotion rules and the firm's own permissions.
Fund tokenisation: PS26/7
Authorised funds can use DLT within the existing framework. The FCA published Policy Statement PS26/7, Progressing fund tokenisation, on , and its rules and guidance took effect immediately. It contains:
- guidance for authorised fund managers on DLT, including the industry-led Blueprint model for tokenised funds;
- Handbook guidance for managers who keep the unitholder register on DLT;
- optional rules for direct-to-fund dealing, in which an investor transacts with the fund itself.
It applies to UCITS management companies, UK alternative investment fund managers of authorised funds and their depositaries. Read the rule text in the PDF on the FCA page, not this summary. The page on the fund tokenisation platform for asset managers shows where a registrar and digital transfer agent fit in.
Promotions of tokenised securities
Promotion rules follow the instrument as well. Where a tokenised security is a non-mass-market investment, COBS 4.12B (last updated on ) bars a firm from communicating or approving a promotion that a retail client is likely to receive. Exemptions for certified high net worth and sophisticated investors carry conditions: a suitability assessment, a personalised risk warning, a 24-hour cooling-off period and no incentives. The section does not apply to promotions directed only at non-retail clients, and classifying a product is a matter for the firm's compliance function.
What authorisation looks like in practice
A UK tokenisation firm is an authorised firm with a Firm Reference Number, not the holder of a token-specific licence. Ctrl Alt Ltd is authorised and regulated by the Financial Conduct Authority (FRN 1045023); it announced the authorisation on , having previously operated as an appointed representative. The permissions attached to the FRN are on the FCA Register.
A separate regime for cryptoasset firms follows: final FCA rules published on apply to firms granted permission on or after . How it will sit beside the rules for security tokens is an open point.
United Kingdom: the Digital Securities Sandbox and the Synchronisation Lab
UK Regulators: Bank of England and Financial Conduct Authority
The Digital Securities Sandbox (DSS) is the UK's regulated live environment for issuing, trading and settling securities on distributed ledgers. The Bank of England and the FCA operate it, and it is due to run until 8 January 2029, unless HM Treasury extends it by legislation.
It covers notary, maintenance and settlement of financial securities, alone or with the operation of a trading venue. Equities, bonds, money market instruments, fund units and emissions allowances are among the instruments in scope; derivative contracts and unbacked cryptocurrencies are not. Live activity is subject to limits set by the Bank.
How the sandbox gates work
A firm moves through four gates, and live business starts only at the second.
| Gate | Allows | Designation |
|---|---|---|
| Gate 1: testing | Testing and engagement with the regulators; no live activity | Sandbox entrant |
| Gate 2: go-live | Live business under initial limits | DSD or authorised operator of a trading venue |
| Gate 3: scaling | Scaling, on a glidepath to full authorisation | DSD or authorised operator of a trading venue |
| Gate 4: possible permanent regime | Full authorisation outside the sandbox | To be decided |
| Source: Bank of England, Digital Securities Sandbox page. | ||
The Bank's DSS dashboard, last updated on , lists 17 Gate 1 approval notices and two Gate 2 notices, so most entrants are still testing.
Where Ctrl Alt sits
Ctrl Alt Ltd holds a Gate 1 Sandbox Approval Notice dated ; the dashboard records that the group first passed Gate 1 as Alt Ltd on . Gate 1 is the testing stage, and the dashboard states that an entrant has no permission for live activity until it is approved at Gate 2.
The Bank's Synchronisation Lab is a separate, non-live environment in which prospective synchronisation operators show how they would connect asset ledgers to RT2, the Bank's renewed settlement engine. It is not a regulatory sandbox and supports no real-money payments. The Bank selected 18 organisations and lists Ctrl Alt under delivery versus payment for tokenised securities, testing settlement of a digital gilt. Both programmes are documented on the sandbox status and security evidence page.
Dubai: VARA and asset-referenced virtual assets
AE Regulator: Virtual Assets Regulatory Authority
In Dubai outside the DIFC, a token that represents a real-world asset is regulated by VARA, which its register describes as the sole authority for virtual assets across Dubai's free zones and mainland. The rules below come from Annex 2 of the Virtual Asset Issuance Rulebook, in the version effective from .
Category 1 issuance
Issuing an asset-referenced virtual asset (ARVA) is a Category 1 VA Issuance, a licensed activity. The issuer also needs VARA's approval before issuing each ARVA. The whitepaper must state, among other things:
- the rights or value the token grants and how it keeps that value;
- whether the token is a direct or fractional right of ownership in the reference assets;
- how settlement and transfer-of-title requirements for the underlying asset are met;
- redemption rights and custody arrangements.
The public register gives a worked example. Ctrl Alt Solutions DMCC holds VASP Licence VL/25/05/002, issued on , for Broker-Dealer Services and Category 1 VA Issuance. The licence condition limits both to Qualified and Institutional Investors under a VA Limited Licence, in the context of tokenising ARVA authorised by Dubai Land Department (TRE-1110 and TRE-A104). The issuer's TRE-1110 whitepaper, dated , says that it was notified to VARA before issuance and that VARA has not verified its content.
Ongoing obligations
An ARVA issuer reports on a fixed calendar. At least monthly it publishes the number and value of ARVAs in public circulation and, where it holds reserve assets, their value and composition, with a statement of whether the token is fully backed. Every six months it commissions an independent audit of those figures.
The capital floor is the higher of AED 1,500,000 and 2% of the average market value of the reserve assets over the preceding 24 months. Invented figures show where the percentage test takes over.
| Reserve assets | 2% test | Floor |
|---|---|---|
| 20,000,000 | 400,000 | 1,500,000 |
| 75,000,000 | 1,500,000 | 1,500,000 |
| 200,000,000 | 4,000,000 | 4,000,000 |
| Illustrative arithmetic in AED, not data about any issuer. The 2% test sets the figure once average reserve assets exceed AED 75 million. | ||
Marketing and investor classes
Marketing rules bind anyone who markets a virtual asset in or targeting the UAE, licensed or not. Under the VARA Marketing Regulations, such marketing must not include a call to buy and must carry two statements, on loss of value and on the absence of financial protection. Marketing of a product limited to certain investor classes must be accessible to those classes alone.
ARVA marketing adds two rules: a statement that the token is not covered by any investor protection or deposit guarantee schemes, and a ban on the term stablecoin unless VARA has approved a single-asset ARVA with reserve assets. Property tokens are therefore not described that way on this site. See how the Dubai Land Department project works and the platform behind the Dubai property tokens.
The rest of the UAE: ADGM, DIFC and the federal regulators
AE Regulators: FSRA, DFSA and the federal authorities
VARA's remit stops at the two financial free zones and sits beside the federal regulators. None of Ctrl Alt's four licences was issued by the bodies below, so this section is a map only.
Abu Dhabi Global Market (ADGM). The Financial Services Regulatory Authority (FSRA) regulates the zone. ADGM's digital assets page says a digital token with the characteristics of a security is regulated as a security, and that firms need a Financial Services Permission.
DIFC. The Dubai Financial Services Authority (DFSA) regulates the zone. Its rulebook guidance, GEN Appendix 6, treats a token that falls within the definition of a security or a derivative as an investment token. Related financial services, promotions and public offers in or from the DIFC need DFSA approval or authorisation.
Federal regulators. The Central Bank of the UAE licenses payment token issuance, conversion, and custody and transfer under its Payment Token Services Regulation. The federal securities regulator, whose website now carries the name Capital Market Authority, announced a virtual assets framework on . The VARA register entry for Ctrl Alt Solutions DMCC also shows a registration number from that authority.
Ireland and the EEA: MiFID for tokenised financial instruments
IE Regulator: Central Bank of Ireland
In the EEA a token that qualifies as a financial instrument stays under MiFID, and MiCA covers the rest. ESMA's MiCA page describes the regulation as covering crypto-assets that existing financial services legislation does not regulate.
Ctrl Alt Technologies Limited is the worked example. The Central Bank of Ireland register lists it under reference C571300 as an investment firm authorised under the European Union (Markets in Financial Instruments) Regulations 2017. The company lists two permissions: receipt and transmission of orders, and placement of financial instruments without a firm commitment. It announced the authorisation on , with passporting across the EEA, for eligible counterparties and professional clients only.
Guernsey: licences for vehicles, registrars and transfer agents
GG Regulator: Guernsey Financial Services Commission
Guernsey supplies the vehicle and the register in a tokenisation structure. The Guernsey Financial Services Commission (GFSC) register shows Ctrl Alt Corporate Services Limited, reference 3085959, as a fiduciary primary licensee under Guernsey's fiduciaries law of 2020 and as an investment licensee for controlled investment business under the Protection of Investors (Bailiwick of Guernsey) Law, 2020.
According to the company's announcement of , the first licence covers corporate administration, directorship and governance for its vehicles, and the second covers acting as registrar and digital transfer agent for interests in funds and vehicles.
Two announced transactions used the route: a debt transaction for a UK bank, with the law firm Carey Olsen (), and a tokenised structured product on Solana issued through a Guernsey-domiciled vehicle ().
Which licence for which activity
No activity has the same regulator in all four jurisdictions. The table pairs each activity with its regime and, where one exists, a licence a reader can check on a public register. A dash marks a pairing outside the sources opened for this guide.
| UK | Ireland, EEA | Guernsey | Dubai |
|---|---|---|---|
| Issuing a tokenised fund unit | |||
| FCA. The authorised fund manager issues units under the existing fund rules, with PS26/7 guidance on DLT. | Home fund authority. A fund unit is a financial instrument, so securities law applies and MiCA does not. | GFSC. Interests in funds and vehicles come under the Protection of Investors Law, 2020. | DFSA in the DIFC, where a token with the rights of a security is an investment token. Elsewhere in Dubai, VARA classifies the token. |
| Keeping the register or acting as transfer agent | |||
| FCA. PS26/7 adds Handbook guidance for managers who keep the unitholder register on DLT. | – | GFSC. Example: Ctrl Alt Corporate Services Limited, 3085959, registrar and digital transfer agent. | For the Dubai property tokens, ownership is recorded at Dubai Land Department's registry, according to the issuer's whitepaper. |
| Arranging or placing with professional investors | |||
| FCA. An authorised firm with the relevant permissions. Example: Ctrl Alt Ltd, FRN 1045023. | Central Bank of Ireland, MiFID. Example: Ctrl Alt Technologies Limited, C571300: receipt and transmission of orders; placement without a firm commitment. | – | VARA. Broker-Dealer Services. Example: Ctrl Alt Solutions DMCC, VL/25/05/002, Qualified and Institutional Investors only. |
| Issuing a property-linked token in Dubai | |||
| Not applicable: the activity is defined by Dubai's rules. A property-linked token offered in these markets is assessed under their own securities rules. | VARA. Category 1 VA Issuance, with approval of each ARVA. Example: VL/25/05/002, for TRE-1110 and TRE-A104. | ||
| Operating settlement infrastructure | |||
| Bank of England and FCA. Digital Securities Sandbox until 8 January 2029; live from Gate 2. Example: Ctrl Alt Ltd, Gate 1 notice of 4 December 2025, testing only. | – | ||
| Promoting to investors | |||
| FCA. COBS 4.12B for non-mass-market investments: retail restriction and a prescribed warning. | MiFID client categories. Ctrl Alt Technologies Limited serves eligible counterparties and professional clients only. | – | VARA. Marketing Regulations: no call to buy and two risk statements. ARVA marketing adds the statement on protection schemes. |
| Last reviewed . Each example shows a licence type; none is a statement that the licence is sufficient for a particular mandate. | |||
Promotion rules compared
The regimes prescribe different words for different audiences. They are set out one by one because a single merged sentence would satisfy none of them.
United Kingdom: COBS 4.12B.21R
Prescribed risk warning in a promotion of a non-mass-market investment:
Don't invest unless you're prepared to lose all the money you invest. This is a high-risk investment and you are unlikely to be protected if something goes wrong.
Retail access runs only through the investor exemptions, without incentives.
Dubai: VARA Marketing Regulations, I.C.3
No call to buy, and two statements:
Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner or investor in a Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection.
Marketing restricted to an investor class must reach that class alone.
Dubai: ARVA marketing, Annex 2
In addition, all marketing of an ARVA states that the token:
is not covered by any investor protection or deposit guarantee schemes.
The term stablecoin is reserved for approved single-asset ARVAs with reserve assets.
EEA: MiFID client categories
Neither text above carries over. Ctrl Alt Technologies Limited states the audience instead: its products and services are intended only for eligible counterparties and professional clients as defined under MiFID legislation.
The texts that apply to this site are on the page with the UK and Dubai risk warnings in full.
How to check a firm on each register
Every licence claim in this guide can be checked on a public register in a few minutes. The steps use Ctrl Alt's four entities and note the discrepancies a careful reader will find.
- FCA Register. Search the FCA Register for 1045023, the Firm Reference Number of Ctrl Alt Ltd, and read the permissions on the firm's page.
- Central Bank of Ireland. Open the firm profile for C571300. The live Ctrl Alt site prints the same number with two leading zeros.
- GFSC. Open regulated entity 3085959. The register prints the address as 18-20 Smith Street; the live site says 16-20.
- VARA public register. Open the entry for reference VL/25/05/002 and read the licence condition. The register says Ctrl Alt Solutions DMCC; the footer of the live site says Ctrl Alt Solutions FZCO.
- Companies House. Confirm company number 16547640 behind the FRN: incorporated on , status active.
For any firm, check three things: the legal name matches the contract, the permission covers the activity, and any investor-class condition includes you.
What is still unsettled
Four points were open on .
- The regime after the sandbox. The Bank intends participants to move to a permanent regime when the DSS ends, but Gate 4 is only a possible regime and its legal category is undecided.
- Security tokens beside the UK cryptoasset regime. The new rules apply from 25 October 2027; how a firm handling both tokenised securities and other cryptoassets will be authorised should be checked against the FCA's timetable.
- Dubai's property certificate. The ARVA rules for a direct right of ownership are public, but the instrument linking each token to the land register in the Dubai Land Department project has not been published in full.
- Cross-border recognition. No source opened for this guide lets one jurisdiction recognise another's tokenisation licence; a MiFID passport stops at the edge of the EEA.
Ctrl Alt's answer to this map is one regulated entity per jurisdiction.
The licence behind each entity is listed under Ctrl Alt licences and register entries.
Frequently asked questions
Is tokenisation legal in the UK?
Yes. Tokenisation is lawful in the UK and is regulated according to what the token represents. The FCA says tokens that amount to specified investments are likely to be inside its perimeter, so a firm needs authorisation for the regulated activity it carries on. PS26/7 of 30 April 2026 applies the same approach to authorised funds.
Can a UK fund keep its register on a blockchain?
Yes. PS26/7, published by the FCA on 30 April 2026, added Handbook guidance for authorised fund managers who keep the unitholder register on distributed ledger technology. The guidance took effect immediately. Read the rule text in the policy statement before relying on this summary.
What is the Digital Securities Sandbox?
It is a regulated live environment, run by the Bank of England and the FCA, in which firms issue, trade and settle securities on distributed ledgers within limits. Gate 1 is testing only and live business starts at Gate 2. It is due to run until 8 January 2029.
Which tokenisation activities need a VARA licence?
In Dubai outside the DIFC, issuing an asset-referenced virtual asset is a Category 1 VA Issuance and needs a VARA licence plus approval of each token. Placement and distribution fall under Broker-Dealer Services. The register entry for Ctrl Alt Solutions DMCC, VL/25/05/002, shows both activities.
What is an asset-referenced virtual asset?
It is the category in VARA's rules for a virtual asset that represents a real-world asset, the income from it, or both. Its issuer needs a Category 1 licence, discloses circulation at least monthly, commissions an independent audit every six months and holds paid-up capital of at least AED 1,500,000.
Can one licence cover the UK, the EEA and Dubai?
No. Each regime authorises a legal entity for activity in or from its own territory. Ctrl Alt uses four: Ctrl Alt Ltd (FCA, FRN 1045023), Ctrl Alt Technologies Limited (Central Bank of Ireland, C571300), Ctrl Alt Corporate Services Limited (GFSC, 3085959) and Ctrl Alt Solutions DMCC (VARA, VL/25/05/002).
UK United Kingdom: Don't invest unless you're prepared to lose all the money you invest. This is a high-risk investment and you are unlikely to be protected if something goes wrong.
AE Dubai (VARA): Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner or investor in a Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection.
Ctrl Alt does not provide investment advice or recommendations. This page is for information only and is not investment advice.
Sources
Primary sources, each opened on . Register entries and other regulator pages are linked where they are cited.
- Financial Conduct Authority, PS26/7: Progressing fund tokenisation, 30 April 2026.
- FCA Handbook, COBS 4.12B: Promotion of non-mass market investments.
- Bank of England, Digital Securities Sandbox.
- Bank of England, Digital Securities Sandbox Dashboard, updated 9 October 2026.
- Bank of England, Synchronisation Lab, updated 5 August 2026.
- VARA, Virtual Asset Issuance Rulebook, Annex 2: Asset-Referenced Virtual Assets Issuance Rules.
- VARA, Regulations on the Marketing of Virtual Assets and Related Activities 2024.
- VARA public register, Ctrl Alt Solutions DMCC.