Securities markets
DLT Pilot Regime and tokenization
"Issuance and trading of tokenized securities on DLT under Regulation (EU) 2022/858. Fit with MiFID II, CSDR and the prospectus rules."
Distributed Ledger Technology (DLT) Regulation
Specialist legal advice on distributed ledger technology (DLT): the DLT Pilot Regime, how MiCA and the AMLR apply, tokenization of securities and financial instruments, and the design of blockchain-based market infrastructures.
Working with DLT or tokenizing securities? Free legal assessment
Tell us about your project and we will tell you which legal regime applies to you.
- 50+ entities advised
- Reply within 24 h
- No commitment
- DLT Pilot Regime
- Reg. (EU) 2022/858
- Pilot regime applies from
- March 23, 2023
- Spanish securities law
- Law 6/2023
Services
Legal services for distributed ledger technology
Six lines of work to design, authorize and operate DLT infrastructures with full legal certainty under the EU framework.
DLT Pilot
DLT Pilot Regime (Regulation (EU) 2022/858)
Advice on entering the EU pilot regime: DLT trading infrastructures (DLT MTF), settlement infrastructures (DLT SS) and combined ones (DLT TSS).
Learn more →
DLT MTFDLT SSDLT TSSExemptions
Tokenization
Tokenization of securities and financial instruments
Legal structuring of the issuance and recording of tokenized securities on DLT: fit under MiFID II, prospectuses and the securities market regime.
Learn more →
Security tokensMiFID IIProspectusRecording
MiCA
DLT under MiCA
Analysis of how MiCA treats crypto-assets issued on DLT: classification, issuer obligations and CASP services.
Learn more →
MiCACASP
Infrastructure
Legal design of DLT infrastructures
The project’s legal architecture: network governance, smart contracts, settlement finality and key custody.
Learn more →
GovernanceSmart contracts
Markets
DLT and the securities market
Fit within market infrastructure regulation (MiFIR, CSDR) and CNMV authorization of DLT platforms.
Learn more →
CSDRMiFIR
AML/CFT
AML compliance for DLT environments
AML program for DLT infrastructures: KYC, Travel Rule, on-chain traceability and compliance with the AMLR and Law 10/2010.
Learn more →
AMLROn-chain
Use cases
Applied DLT: every sector has a different regulatory fit
Securities markets, payments, digital identity, supply chain or public registries: distributed ledger technology is put into practice under different legal frameworks depending on the use case.
Stablecoins and payments
On-chain settlement and electronic money
"EMTs and ARTs under MiCA on DLT: issuance license, reserves, redemption and transparency obligations."
Real World Assets
Tokenization of real-world assets
"Real estate, private debt, funds: how to structure the legal representation of the asset and its secondary trading."
Identity and data
eIDAS 2 and the European Digital Identity Wallet
"Decentralized digital identity and verifiable credentials: fit with eIDAS 2 and the GDPR in DLT architectures."
Consequences
Why does DLT require legal design from day 1?
Operating on DLT does not mean operating outside the law. The EU framework is comprehensive: if the project does not fit correctly, regulatory, tax and reputational risk can bring operations to a halt.
Legal uncertainty over token ownership if the legal representation of the underlying asset is not designed correctly.
Incorrect fit under MiFID II: a token that is a financial instrument requires a prospectus, authorization and the market infrastructure regime.
Criminal risk for unauthorized issuances of tokenized securities (Criminal Code Art. 282 bis and offenses against the socioeconomic order).
Reg. (EU) 2022/858
Pilot regime
Operating outside the DLT Pilot Regime without the required authorization means losing the EU passport and facing penalties.
MiCA
Cessation of activity
Providing crypto-asset services without a CASP license, even on a DLT, leads to a shutdown and a fine.
GDPR
up to €20 million
The right to be forgotten and the immutability of DLT pull in opposite directions: a poorly designed architecture exposes you to data protection penalties.
Are you designing a distributed ledger technology project?
We help you structure its legal fit from day one: DLT Pilot Regime, tokenization of securities, MiCA, AMLR and data protection. Regulatory design and defense.
Frequently asked questions
Distributed ledger technology: common questions
What exactly is distributed ledger technology (DLT)?
Distributed ledger technology (DLT) is an infrastructure that lets you record, share and synchronize data and transactions in a decentralized way across several nodes, with no need for a central authority.
Article 3(1) of Regulation (EU) 2022/858 defines it as "a technology that enables the operation and use of distributed ledgers". Blockchain is the best-known type, but not the only one: there are also DAGs, Hashgraph and other architectures.
How does DLT differ from blockchain?
DLT is the generic concept: any ledger distributed across nodes. Blockchain is a specific type of DLT in which information is grouped into cryptographically linked blocks.
Every blockchain is DLT, but not all DLT is blockchain. The distinction matters because EU legislation uses the broad term "DLT" so as not to fall behind later technological innovations.
What does the DLT Pilot Regime regulate?
Regulation (EU) 2022/858, which has applied since March 23, 2023, creates an EU pilot regime for DLT-based market infrastructures. It allows new ways of trading and settling tokenized securities to be tested, with certain exemptions from MiFID II, MiFIR and CSDR.
It provides for three types of infrastructure: DLT MTF (multilateral trading facility), DLT SS (settlement system) and DLT TSS (combined trading and settlement system). Each one requires a specific permission from the competent authority.
Is DLT subject to MiCA?
MiCA does not regulate DLT as a technology, but rather the crypto-assets issued and traded on it. If your project uses DLT to issue tokens that meet the definition of a crypto-asset under MiCA (utility token, ART or EMT), MiCA obligations apply.
If the tokens are financial instruments, MiCA does not apply: MiFID II applies and, where relevant, the DLT Pilot Regulation.
What is a security token and how does it fit with DLT?
A security token is the digital representation of a financial instrument (share, bond, fund unit) recorded on DLT. It is subject to securities market regulation: MiFID II, the Prospectus Regulation and CSDR.
Issuing one requires a prospectus (or an exemption), a place in an authorized infrastructure and a legal architecture that links the token to the underlying right.
Does DLT conflict with the GDPR?
There is a real tension between the immutability inherent in DLT and GDPR rights (especially the right to erasure, Art. 17). The European Data Protection Board has issued guidelines on processing personal data on blockchain.
The solution lies in design: store personal data off-chain, use hashes and anonymization techniques, and document the legal basis for the processing.
How does the AMLR affect DLT infrastructures?
Regulation (EU) 2024/1624 (AMLR) and the Travel Rule apply to crypto-asset service providers (CASPs) operating on DLT. This means KYC, screening, on-chain monitoring and suspicious transaction reporting.
AML design should treat the traceability inherent in DLT as an advantage, not an obstacle.
What role do the CNMV and the Bank of Spain play in DLT projects?
The CNMV is competent to authorize DLT Pilot infrastructures, supervise tokens that are transferable securities and monitor compliance with MiFID II and MiCA on market matters.
The Bank of Spain steps in when there are implications for payments, the issuance of electronic money or tokens referenced to a fiat currency (EMTs).
Practical guide
Practical guide to DLT projects
Launching a DLT project means designing the technology layer, the legal layer and the compliance layer at the same time. These are the areas your legal team must tackle from the start.
DLT Pilot Regime
A harmonized EU framework for DLT infrastructures that trade and settle tokenized securities, with controlled exemptions from MiFID II and CSDR.
Two regimes for tokens
How the token is classified (financial instrument vs. MiCA crypto-asset) determines the applicable regime and the competent supervisor.
Beyond the white paper
Issuance and custody agreements, network governance, smart contracts and incident resolution mechanisms must all be properly set out.
Roadmap to launch a DLT project in 10 steps
- Defining the use case, the underlying asset and the rights attached to the token.
- Analyzing the regulatory fit: financial instrument, MiCA crypto-asset, electronic money or utility token.
- Choosing the DLT architecture (public, private or permissioned) and the technical type (blockchain, DAG, etc.).
- Governance structure: nodes, validators, consensus rules and upgrade mechanisms.
- Fit within the DLT Pilot Regime (Reg. (EU) 2022/858) for tokenized securities, with CNMV authorization.
- Designing the AML/CFT program in line with the AMLR, Law 10/2010 and the Travel Rule.
- A GDPR-compatible data protection policy: off-chain data, hashes and data subjects’ rights.
- Key contracts: issuance, key custody, smart contracts, terms of use and dispute resolution.
- Implementing internal controls: cybersecurity (DORA), business continuity and technology audit.
- Exit plan from the pilot regime: how to migrate operations to a stable regulatory framework when appropriate.
Need to validate the regulatory fit of your DLT project? See our crypto services or request an external expert report.
DLT in operation
Distributed ledger technology: from technical concept to legal design
Operating on DLT means bringing several layers together: defining the asset, regulatory fit, governance and compliance. We show you how each layer connects to the rule that applies to it.
1) ClassificationWhat is your token, legally?
Before any issuance, the legal nature of the token must be determined: financial instrument, MiCA crypto-asset, electronic money or utility token.
- MiFID II analysis
- MiCA analysis
- Legal opinion
2) InfrastructureChoosing the DLT Pilot model
Three formats depending on the infrastructure’s role: trading (MTF), settlement (SS) or combined (TSS), each with its own authorization.
- DLT MTF
- DLT SS
- DLT TSS
3) GovernanceOn-chain and off-chain governance
Rules for nodes, validators, smart contracts, key custody and upgrade processes: everything must be documented in contracts.
- Nodes and validators
- Smart contracts
- Key custody
4) ComplianceFull compliance for DLT infrastructures
Several sets of rules apply to a DLT infrastructure at the same time: MiCA or MiFID II, the AMLR, the GDPR, DORA and, where relevant, the pilot regime. Designing them consistently from the outset avoids later rewrites and supervisory roadblocks.
Tip: most regulatory incidents in DLT projects do not come from a technical failure but from an improvised legal architecture.
Quick mapWhich regime applies to your DLT project?
Tokenized securities
MiFID II + CSDR + DLT Pilot Regulation. CNMV authorization.
Crypto-assets
MiCA + AMLR. CASP license, white paper and AML program.
Utility / consumer use
General contract law, the GDPR and any applicable sector-specific rules.
DLT playbook
DLT in practice: rule, requirements and evidence
Reg. (EU) 2022/858 — DLT Pilot
Specific permission for a DLT MTF, DLT SS or DLT TSS, and limits on size and on the types of eligible securities.
Project report, risk management manual, transition strategy and CNMV authorization.
MiFID II
Regime for tokens that are financial instruments: prospectus, authorization, best execution.
Approved prospectus, best execution policy and transaction records.
MiCA
Regime for crypto-assets that are not financial instruments: white paper, CASP license, governance and custody.
Notified white paper, CASP application file, internal policies and ART/EMT reserves.
AMLR
AML program adapted to DLT environments: KYC, Travel Rule, on-chain monitoring.
AML manual, KYC files, Travel Rule records and reports to SEPBLAC.
GDPR
Handling personal data in immutable architectures: data minimization, legal basis and exercise of rights.
Record of processing activities (RoPA), data protection impact assessment (DPIA), privacy policy and data subject rights procedure.
DORA
Digital operational resilience: cybersecurity, incident management and third-party oversight.
DORA policy, incident register, penetration testing and ICT provider mapping.
Common mistakes when designing a DLT project
Patterns that slow down authorizations and increase regulatory and reputational risk.
- Classifying as a utility token an asset that is actually a financial instrument.
- A DLT design with personal data on-chain and no impact assessment (DPIA).
- No upgrade or incident resolution mechanisms for smart contracts.
- Key custody without a clear segregation of roles or operational continuity.
- Ignoring the DLT Pilot Regime when the project does require it.
Working glossary
Key concepts in distributed ledger technology
These terms come up in any DLT project, in the rules that apply to it and in filings with supervisors. Knowing them well avoids costly ambiguity.
DLTTechnology
Distributed Ledger Technology
A ledger distributed across several nodes with no central authority. Formally defined in Art. 3(1) of Reg. (EU) 2022/858.
Blockchain is a subtype.
DLT MTFTrading
DLT multilateral trading facility
A DLT infrastructure authorized to trade tokenized securities under the EU pilot regime.
Authorization: CNMV.
DLT SSSettlement
DLT settlement system
A DLT infrastructure authorized to settle tokenized securities, with limited exemptions from CSDR.
Interplay with CSDR (Reg. (EU) No 909/2014).
DLT TSSCombined
DLT trading and settlement system
An infrastructure that combines trading and settlement in a single DLT environment authorized under the pilot regime.
The newest model in Reg. (EU) 2022/858.
TokenDigital asset
Digital representation on DLT
A unit of value recorded on DLT that can represent economic, usage or governance rights, or financial instruments.
Its nature determines the applicable regime.
Smart contractSelf-executing
Self-executing contract
Code that automatically executes previously agreed terms when predefined conditions are met on the DLT.
It does not replace the underlying legal contract.
ConsensusGovernance
Validation mechanism
Rules by which the nodes of a DLT agree on the state of the ledger: PoW, PoS, PBFT and others.
It determines security and performance.
PermissionedAccess
Permissioned DLT
A DLT network in which access, validators or both are restricted to authorized entities. Common in institutional projects.
The opposite of public (permissionless) DLT.
DORAReg. (EU) 2022/2554
Digital operational resilience
An EU regulation that imposes cybersecurity, incident management and ICT third-party oversight obligations on financial entities.
It also applies to DLT infrastructures.
Free resource · PDF
Download the 10-step DLT Checklist
The roadmap to design a distributed ledger technology project with a solid regulatory fit: token classification, infrastructure, governance, AML and data protection.
- Map of applicable regimes: DLT Pilot, MiFID II, MiCA, AMLR
- DLT infrastructure design roadmap
- Key documents for the supervisor
- Professional PDF · 7 pages
No spam. Your email is only used to send you this checklist and, occasionally, regulatory updates on DLT, MiCA and the pilot regime.
Your download has started
The checklist is downloading now. If it does not start automatically, click here.
Need help with your DLT project after reading it? Write to us directly:
Contact
Book a call
Tell us about your DLT project and we will explain how to structure it legally from day one.
Regulatory framework for distributed ledger technology in the EU and Spain
The regulation of distributed ledger technology (DLT) in the European Union is not concentrated in a single law but spread across a legislative ecosystem that combines market infrastructures, crypto-assets, anti-money laundering, data protection and operational resilience. The first text specifically designed for DLT is Regulation (EU) 2022/858 of the European Parliament and of the Council of May 30, 2022 on a pilot regime for market infrastructures based on distributed ledger technology, which has applied since March 23, 2023.
The DLT Pilot Regulation (Regulation (EU) 2022/858)
The DLT Pilot Regime sets up an EU sandbox so that market infrastructures (trading and settlement) can operate on DLT with targeted exemptions from MiFID II, MiFIR and CSDR. It defines three models: DLT MTF, DLT SS and DLT TSS, all subject to authorization by the competent authority (in Spain, the CNMV) and to quantitative limits on the value of eligible instruments. It is an intermediate step to test the technology under controlled conditions before a definitive regulatory framework.
MiCA and the crypto-asset dimension
Regulation (EU) 2023/1114 (MiCA) does not regulate DLT as a technology, but it does regulate the crypto-assets issued on it when they are not financial instruments. Obligations on white papers, CASP authorization, governance, capital and custody sit alongside the underlying DLT architecture.
MiFID II, MiFIR and CSDR
When a token issued on DLT meets the definition of a financial instrument (shares, bonds, derivatives, fund units), the securities market regime applies. The MiFID II Directive and the MiFIR and CSDR Regulations govern issuance, trading, settlement and recording. The DLT Pilot Regulation introduces limited exemptions to allow experimentation.
The AMLR and AML obligations
The new Regulation (EU) 2024/1624 (AMLR), together with Directive (EU) 2024/1640 and the new EU authority AMLA, sets up a single AML framework that fully applies to DLT infrastructures providing crypto-asset services. The traceability inherent in DLT is a key tool for complying with the Travel Rule and for on-chain monitoring.
GDPR, DORA and operational resilience
The technology layer of DLT is also subject to the GDPR (with its classic tension with immutability) and to the DORA Regulation (EU 2022/2554) on digital operational resilience, fully applicable since January 2025 to financial entities and their ICT providers, including DLT infrastructure providers.
How it fits in Spain
Spain transposes and applies this ecosystem through the Securities Markets and Investment Services Law (Law 6/2023), its implementing rules, Law 10/2010 (AML/CFT) and the supervisory work of the CNMV, the Bank of Spain and SEPBLAC. Getting a DLT project authorized requires coordinated navigation between these bodies.
DLT-related services
Related areas
Official sources
Key legislation, linked to the official text:
- Regulation (EU) 2022/858 of May 30, 2022 on a pilot regime for market infrastructures based on distributed ledger technologyEUR-Lex · Official Journal of the EU
- Law 6/2023 of March 17 on Securities Markets and Investment ServicesBOE · consolidated text
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .