You choose a legally registered issuing entity (often an SPV), align its governance and corporate documents with the token issuance through board and shareholder resolutions, and confirm which licenses or regulatory approvals its business model and token type require.
An issuing framework is the legal and structural setup that lets your company issue security tokens in a compliant, transparent, and enforceable way. It confirms that the issuer is a legally registered entity, authorized to raise capital and issue digital securities under its jurisdiction, and that its corporate documents and governance support the offering. In practice this means choosing the right issuing entity, passing the board and shareholder resolutions that attach the token to that entity, and confirming which licenses or approvals the business model requires. Done properly, the token issuance is recognized by law and both issuer and investors are protected.
This is a legal-structuring phase, so treat it as educational reference rather than legal advice, and confirm the specifics with qualified securities counsel in each relevant jurisdiction. If you are structuring a dedicated vehicle for the raise, the SPV tokenization guide and the broader jurisdiction guides go deeper on the trade-offs summarized here.
Choose the Issuing Company
The issuing company is the legal foundation behind the offering. It determines the regulatory environment, tax obligations, and compliance requirements that apply, and it is what connects the tokenized asset to the real world. A clearly defined, reputable entity builds investor trust, establishes legal ownership of the underlying asset, and provides the framework for enforcing investor rights, transparent operations, and future scalability. Getting this decision right is critical for legal clarity, investor confidence, and long-term success.
Are you tokenizing through your holding company?
The first decision is whether the offering will run through an existing entity or a new, purpose-built one. If you tokenize directly through your parent or holding company, its existing registration, governance, and balance sheet carry the offering, and you can skip the vehicle-selection questions below. If you instead isolate the asset in a dedicated entity, work through the vehicle and jurisdiction choices that follow. For a company issuing tokens against its own shares, the how-to-tokenize-company-equity guide walks through the equity-specific steps in detail.
Note: If you are using your parent company for the tokenization project, you can skip the investment-vehicle selection and move directly to aligning that company’s governance with the issuance.
Choose the investment vehicle type
When a dedicated entity is preferable — to ring-fence a single asset, isolate liability, or optimize for a target investor base — the common structures are:
- SPV (Special Purpose Vehicle). A standalone entity formed to hold one asset or project and issue against it. The most common choice for isolating a single tokenized asset.
- SPC (Segregated Portfolio Company). A single legal entity with multiple ring-fenced portfolios, useful when several assets or offerings need to be legally segregated under one umbrella.
- Fund. A pooled investment vehicle where the token represents an interest in a managed portfolio rather than a single asset.
The right choice depends on tax efficiency, the regulatory environment, investor accessibility, and how many assets you intend to bring to market. See the SPV tokenization guide for how these vehicles map to a token structure.
Best practices for selecting a jurisdiction
Jurisdiction shapes setup speed, banking access, tax treatment, and which investors you can reach. Common starting points include:
| Jurisdiction | Best suited for |
|---|---|
| British Virgin Islands (BVI) | Fast, straightforward international setups where local banking is not required |
| Gibraltar | Fund structures |
| Cyprus | EU-focused small and medium-sized businesses |
| USA | US companies and issuers wanting a familiar, quick setup |
| Liechtenstein | Larger projects targeting the EU market |
| Switzerland | Larger projects targeting the EU market |
| Other | Bespoke situations where jurisdiction-specific counsel is required |
These are orientation points, not recommendations — the optimal jurisdiction depends on your asset, investor base, and tax position. Review the relevant jurisdiction guides and confirm with counsel before incorporating.
Choose the issuing company type
Within the chosen jurisdiction, the entity’s legal form determines its governance, liability profile, and how it can raise capital. Depending on jurisdiction, the available entity types typically include:
- BVI Business Company
- Corporation — C (U.S.)
- Corporation — S (U.S.)
- Nonprofit Corporation
- DAO Limited Liability Company (U.S.)
- Government-Owned Enterprise (GOE)
- Joint Venture
- Limited Liability Company (LLC)
- Limited Liability Partnership (LLP)
- Limited Partnership (LP)
- Private Joint-Stock Company
- Private Limited Company
- Public Joint-Stock Company
- Public Liability Company (PLC)
- Sole Proprietorship
- State-Owned Enterprise (SOE) (U.S.)
Selecting the right entity type and jurisdiction together lays the foundation for legal clarity and regulatory alignment for everything that follows.
Align Token Issuance with the Issuing Company
Once the entity is chosen, the token issuance has to be integrated into that company’s governance and legal processes. This has two parts: verifying that the entity is real and properly constituted, and formally attaching the token to it so the token carries enforceable rights.
Verify the issuing company
Verification establishes the legal existence, ownership, and credibility of the company offering the tokens. It confirms official registration details, corporate structure, and authorized representatives — building trust, preventing fraud, and satisfying the compliance checks that regulators and investors expect. Documents that typically serve as issuing-company verification include:
- Certificate of Incorporation (or the equivalent company-registration document)
- Company Extract from the official registry showing shareholders and directors
- Proof of Address for the company (for example, a utility bill or lease)
- ID documents of authorized representatives (passport or national ID)
- Company Charter or Bylaws, confirming legal structure and signing authority
Eligibility and control can be represented on-chain through the Stobox DID registry, so verified status is provable without Stobox ever storing the underlying identity documents.
Attach the token to the issuing company
Attaching the token means legally and technically linking it to the company so the token represents real rights — equity, debt, or revenue share — within the entity’s legal structure. The token is issued from a recognized legal entity (an SPV or operating company), which is what makes the investor’s claim enforceable and tied to actual value. To formally establish that link, the issuer generally prepares:
- Board Resolution or Shareholder Resolution approving the tokenization and the offering
- Updated Company Charter or Articles reflecting token-related provisions, where applicable
- Legal Opinion or Declaration stating how the token maps to company equity, debt, or revenue rights
- SPV setup documents, where a Special Purpose Vehicle is used
- Smart contract reference cited in the legal documentation, binding the on-chain issuance to the company structure
On the technical side, the token itself is issued and managed through Stobox Compass, which enforces these rights and transfer rules at the protocol layer via STV3 — Stobox’s programmable security-token architecture — alongside the open ERC-7943 (uRWA) standard that Stobox backs for compliant issuance. Stobox’s own STBX security token is a live example of equity issued and governed this way. Because Compass is non-custodial, the issuing entity retains control of its own keys while the legal and on-chain records stay aligned. Issuers that want to run compliant issuance under their own brand can also deploy this stack as white-label tokenization infrastructure.
Select the Applicable License
The final piece of the framework is confirming whether the issuer needs a regulatory license and, if so, recording it. Specifying the license the issuer holds establishes regulatory compliance, defines the scope of permissible activities, and streamlines due diligence. The selected license type also sets the issuer’s regulatory obligations, reporting standards, and operational limitations.
Just as important is assessing whether a license is required at all for the issuer’s business model and token type. Operating a regulated activity without the appropriate authorization can carry serious civil and, in some jurisdictions, criminal liability, so this assessment should be undertaken diligently and confirmed with qualified securities counsel.
Note: If the issuer is not a licensed business and its model does not require authorization, the licensing details below can be skipped — but document the reasoning behind that conclusion.
Available licenses and what they authorize
Where a license applies, the issuer selects the relevant one(s) from the categories below. Most tokenization issuers will need none of these, or only one; the list is a reference for identifying whether a regulated activity is in scope.
- Alternative Investment Fund Manager (AIFM) License. Authorizes management of alternative investment funds under EU regulations.
- Asset Management Company License. Permits management of pooled investment funds such as mutual funds or hedge funds.
- Broker-Dealer License. Permits acting as a broker or dealer for securities transactions. Any success or placement fee on a raise is handled by a licensed broker-dealer, never by Stobox.
- Credit Institution License. Authorizes taking deposits from the public and granting credit for the entity’s own account.
- Crowdfunding Service Provider License. Permits operating a digital platform connecting businesses seeking funding with investors.
- Crypto Custodian License. Authorizes secure storage of digital assets for clients.
- Crypto Exchange License. Permits operating a cryptocurrency exchange.
- Crypto Payment Processor License. Authorizes processing of crypto payments.
- Crypto-Asset Service Provider (CASP) License. Authorizes crypto-asset services such as exchange, custody, and other regulated activities, ensuring compliance with frameworks like MiCA, AML, and CTF. Required for businesses offering crypto-related financial services, including trading, custody, issuance, and advisory.
- E-Money Issuer License. Allows issuance of electronic money — electronically stored monetary value representing a claim on the issuer.
- Electronic Money Institution (EMI) License. Authorizes the issuance of electronic money and payment services.
- Family Office License. Allows managing assets exclusively for a family or small group of families.
- Full Banking License. Grants authorization for the full range of banking services, including deposits, loans, and payments.
- Insurance Undertaking License. Authorizes carrying on insurance business by contracting to provide financial protection against specified risks.
- Investment Advisor License (EU MiFID II / US SEC registration). Authorizes providing investment advisory services in compliance with EU or US regulations.
- Market Operator License. Required to operate and manage a regulated financial market, such as a stock exchange.
- Money Transmitter License. Authorizes money-transmission services under local and international regulations.
- Mutual Fund License. Permits managing mutual funds for diversified investment portfolios.
- Payment Initiation Service Provider (PISP) License. Enables a third-party provider to initiate a payment order from a user’s bank account with their consent.
- Payment Institution License. Permits providing payment services such as transfers and remittances.
- Portfolio Management License. Authorizes managing investment portfolios for clients.
- Private Fund License. Authorizes managing private investment funds, typically for high-net-worth individuals or institutions.
- Restricted Banking License. Allows limited banking services, often under specific conditions or for a niche market.
- Stored Value Facility License. Permits issuing and managing instruments that store monetary value, such as prepaid cards or digital wallets.
- Trust Company License. Authorizes acting as a fiduciary, holding assets in trust for beneficiaries and performing related administrative duties.
- UCITS License (Undertakings for Collective Investment in Transferable Securities). Authorizes managing investment funds that comply with EU UCITS regulations.
- Virtual Asset Service Provider (VASP) License. Authorizes virtual-asset services such as exchange or custody.
Recording license details
Where a license applies, two details complete the record. The license number is captured so the specific authorization can be identified and cross-checked against the issuing regulator’s public register. A copy of the license is retained alongside the issuing company’s verification documents, so the authorization can be produced during counterparty and investor due diligence. Together these tie the stated license to a verifiable source and keep the compliance file complete.
What you carry into the next phase
You now have a legally constituted issuing entity, the governance approvals that attach the token to it, and a clear read on your licensing obligations. That framework is the foundation for Phase 6: Prepare Legal Documentation, where the offering documents, subscription terms, and disclosures are drafted to match the entity and structure you have just defined.