[Column] Token Securities Can Be Controlled Even on Public Chains

Example image of the blockchain that underpins token securities. Source=Shubham Dhage/ Unsplash
Kim Hyobong's Legal Crypto is a column that is serialized on the trends of digital asset legislation and policies both domestically and internationally. Experts, including Kim Hyobong, a lawyer at the law firm Bae, Kim & Lee, CPA Choi Heekyung, and lawyer Woo Jiwon, provide the latest updates on digital asset regulations.

With the implementation of the token securities system set for February 4, 2027, the issuance and distribution system of token securities is being specified through subordinate regulations. According to the draft enforcement decree of the Electronic Securities Act announced by the financial authorities, participants in the distributed ledger are limited to account management institutions such as the Korea Securities Depository and securities companies, and the structure that uses virtual assets (digital assets) as fees is also blocked, which appears to be designed based on a private chain.

Of course, there is a reason for the financial authorities' caution. It can be interpreted as an intention to prevent unverified third parties from accessing the distributed ledger where the rights of securities are changed. However, using a public blockchain does not mean that anyone can record the rights of securities. There are already successful cases abroad where securities are issued on public blockchains while controlling the recording of rights changes to only approved entities. In other words, it is not the chain itself but the securities placed on it that are subject to control.

In December 2024, the German Federal Financial Supervisory Authority (BaFin) approved the payment platform 21X as the trading and settlement integration system for the EU distributed ledger pilot scheme. 21X started operating on a public blockchain (Polygon) where anyone can participate in verification from May 2025. Polygon uses a Proof-of-Stake (PoS) consensus mechanism, and the validators of the network are not directly designated or controlled by 21X, so the verification of the underlying blockchain network is distributed. Instead, 21X, as a market infrastructure operator, exercises control over the smart contracts operating on it to implement the necessary controls for financial regulation.

A closer look at the technical structure of 21X shows that it separates access rights to the Polygon blockchain network itself and access rights to the securities trading and settlement services operated by 21X. Access to the network itself is generally allowed, but trading and settlement services can only be used by authorized participants.

This control is applied by implementing wallet whitelists, role-based access control, and trader qualification verification functions in smart contracts. In other words, only registered wallets can trade after passing through asset-specific whitelists, and permissions are divided according to roles such as traders and issuers. Core contracts cannot be modified after deployment, management keys are protected by secure hardware, and emergency stop devices are in place to prevent malfunctions.

The European Securities and Markets Authority (ESMA) also mentioned the case of 21X in its DLT Pilot Regime evaluation report published in 2025, stating that the permissionless structure of the underlying network and the permissioned access structure of regulated financial services can coexist technically.

According to ESMA, the smart contracts of 21X are categorized into three main categories.

First, financial product smart contracts (Instrument Token Smart Contracts) manage the issuance and ownership records of security tokens. For example, when an issuer issues a certain number of token securities, this smart contract can manage the issuance volume and ownership status of those tokens. Order book smart contracts (Order Book Smart Contracts) support the submission and matching of buy and sell orders and link the transfer of security tokens and settlement assets after the transaction is completed. Finally, whitelist smart contracts (Whitelist Smart Contracts) manage the access rights of investors and participants, granting access rights to wallets after completing the KYC and AML verification procedures for investors.

For various types of smart contracts, ESMA explains that limiting access rights to administrative functions and conducting external security audits and code reviews before deployment are important elements of risk management.

Of course, having such control mechanisms does not eliminate all risks. Moreover, it will be difficult to fully allow domestic public blockchains at this early stage of token securities issuance. However, it is necessary to reconsider overly restrictive definitions of the technical characteristics of distributed ledgers in legislation.

Rather, the legislation should stipulate that it is sufficient to ensure that the changes in ledger rights are clear and verifiable in total from a technology-neutral perspective, and that necessary controls for financial regulation are implemented transparently regarding administrative authority and key management. Since the requirements for distributed ledgers have not yet been finalized, it is hoped that reasonable token securities regulations can be designed through sufficient opinion collection during this legislative announcement period.