How Tokenized Stocks Actually Work: Custody, SPVs, Minting and Redemption

Introduction

Buying a tokenized Apple share puts five separate companies between the buyer and the stock, and the buyer holds a contract with only one of them. The issuer owes the obligation, a custodian holds the share, a broker trades it, a security agent guards the collateral, and an exchange decides who may buy at all. Each link is documented, named and regulated somewhere. None of it is visible from the ticker. The distinctions matter most in the case that has not yet happened anywhere in this market: an issuer default, where recovery depends entirely on which of those five parties is obliged to act, and how quickly. This article traces one share through that chain in order, from the broker purchase that starts it to the redemption that unwinds it, and identifies the two steps almost no retail holder is permitted to perform.

What Happens to a Real Share Before Any Token Exists?

Every tokenized stock starts as an ordinary share ↗ bought on a conventional exchange. Before any token exists, a broker fills the order, a custodian takes delivery, and a segregated sub-account records the holding. Tokenization is the last step in that chain rather than the first.

Who buys the share

The purchase runs through a licensed broker-dealer on a traditional market. For xStocks, the tokenized equity line issued by Backed Assets (JE) Limited, Alpaca Securities LLC sources and executes the underlying trade, and Kraken named Alpaca its preferred venue for sourcing and custodying those shares (Kraken, 2025). Ondo Global Markets routes the same function through United States registered broker-dealers ↗ and chartered trust companies. Neither issuer mints anything at this point. The order settles on the standard T+1 cycle that governs every US equity trade, so a token's backing spends its first day inside infrastructure that predates blockchains by decades. The share itself is unremarkable: a registered holding bought at a market price.

Why it lands in a segregated sub-account

Segregation is what separates a backed token from a promise. Backed holds each underlying asset-by-asset in dedicated sub-accounts at three named institutions, Maerki Baumann & Co. AG in Zurich, InCore Bank AG in Schlieren, and Alpaca Securities LLC in the United States, with no commingling between products (Backed Finance, 2026). One product's collateral cannot subsidise another's shortfall, because the accounts never touch. That structure also fixes what an auditor can check. A pooled account proves only an aggregate; a per-product sub-account proves that the shares behind a specific ticker exist in a specific place. Multiple custodians across two jurisdictions spread the operational risk further.

Data current as of October 2026.

Those shares sit in custody under the name of a company the buyer never deals with directly.

What Is the SPV, and Why Does It Sit Between You and the Share?

A special purpose vehicle (SPV) is a company created to do one thing and hold one kind of asset. In tokenized equities it owns the shares and issues the tokens, which places it between the holder and the collateral. That position is the whole design.

What bankruptcy-remote actually means

Bankruptcy remoteness is an outcome that a structure produces, not a label an issuer applies. Backed Assets (JE) Limited exists solely to issue and redeem xStocks, maintains its own bank and collateral accounts, and runs its own know your customer (KYC) and anti-money laundering (AML) procedures under Jersey law (xStocks Docs, 2026). It is registered with the Jersey Financial Services Commission and holds the COBO and CGPO consents required to issue security tokens. Because the vehicle carries no other business, it accumulates no other creditors. A trading loss at the parent cannot reach into it, since the parent's creditors have no claim on a separate company's assets.

The three-party control agreement

The mechanism that enforces remoteness is a three-party Account Control Agreement between the issuer, the custodian and an independent security agent (xStocks Docs, 2026). The agent has continuous visibility over the collateral accounts and one decisive power: if holder rights defined in the prospectus stop being upheld, it may assume control of those accounts, liquidate the underlying shares and distribute the proceeds. Security Agent Services AG in Zug performs that role for xStocks; Ankura Trust Company holds a first-priority perfected security interest for Ondo (Pionex, 2026). Most explanations of tokenized stocks stop at the phrase "bankruptcy-remote SPV" and never name the agent, which is the party that has to act.

What your claim really is

The token is a debt claim on the issuer, secured against shares, rather than the share itself. Holders of xStocks own a bearer tracker certificate; Ondo's holders own a structured note backed 1:1 plus a buffer held at or above 100.5% of outstanding token value as of September 2026 (Pionex, 2026). Neither reaches the share register. The registered shareholder is the issuer or its custodian, so the token holder appears nowhere in the company's own records and receives no vote ↗. What the holder does own is a secured position: a claim whose recovery depends on the collateral being intact and the agent being willing to seize it.

Creating a token against that collateral is a restricted operation, and almost no retail holder has ever performed it.

Who Is Actually Allowed to Mint a Tokenized Stock?

Minting is a wholesale function reserved for vetted institutions. Direct creation and destruction of tokens happens with the issuer in the primary market, behind onboarding requirements and minimums that exclude ordinary buyers. Retail holders acquire and exit on the secondary market instead.

Who is allowed to mint

Direct mint and burn is restricted to Authorized Participants and market makers, and requires know your business (KYB) onboarding before any access is granted (Robinhood Chain Docs, 2026). Those firms are the source of token supply, and their activity is what makes secondary-market liquidity possible. The barrier is financial as well as procedural: primary minting of xStocks carries a $100,000 minimum as of September 2026 , which makes the secondary market the only realistic retail route (DropsTab, 2026). A reader who buys a tokenized share on an exchange or a decentralized exchange (DEX) ↗ is therefore buying from a market maker's inventory, not commissioning a new share purchase.

The reserve check that gates the mint

A mint can be blocked by code before it reaches the blockchain. Chainlink Proof of Reserve supports a Secure Mint pattern in which the token contract reads the latest reserve figure and reverts the transaction when total supply plus the requested amount would exceed reported reserves (Chainlink, 2026). The check runs before issuance rather than after, which turns reserve data into a control instead of a disclosure. Configurations add a staleness threshold, so reserve data older than a set interval also rejects the mint. The practical effect is narrow but real: it prevents unbacked tokens entering circulation, and does nothing about whether the custodian is sound. Not every issuer wires the check into the contract, and a feed that reports a reserve figure is not the same as one that can halt issuance. Reading which of the two a product uses takes a look at the token contract, not the marketing page.

Unwinding that position runs the same chain backwards, and takes considerably longer.

How Does Redemption Work, and Who Can Use It?

Redemption is what gives 1:1 backing its meaning: without a path from token back to share, the backing is a claim nobody can test. The mechanics are straightforward. The access is not, and for most retail holders the right is exercised by somebody else.

How the request and burn work

Redemption runs the minting chain in reverse, one step at a time. The holder submits a request to the issuer, which confirms ownership on-chain and locks the tokens in the smart contract so they cannot be sold or transferred mid-process. The issuer then instructs the custodian to sell the matching shares on the traditional market. Cash arrives once that trade settles, the holder is paid in stablecoin or by wire, and only then are the locked tokens burned. The whole cycle takes roughly two to four business days: one day for T+1 settlement of the share sale, plus one to three days for the cash to move (MetaMask, 2026). That timetable describes the sell-the-share model rather than the whole category. Ondo settles mint and burn atomically in a single transaction, and since June 2026 has run that channel seven days a week on six of its most traded tickers (Ondo Finance, 2026).

Who can actually redeem and for what

The delay comes from traditional finance, and so does the gatekeeping. Locking and burning tokens takes seconds; selling shares and wiring money follows banking hours. More consequentially, the same Authorized Participant restriction that governs minting governs redemption, so the holder who submits a request at an issuer's primary window is normally an institution rather than an individual. What redemption returns also varies by product. Most retail routes settle in cash or stablecoin at the underlying's value, while a smaller set permits delivery of the actual share to a brokerage account. The difference decides whether a token can ever become stock.

Data current as of October 2026.

A holder who cannot redeem is left checking the backing by other means.

How Do You Verify the Shares Are Really There?

Verification runs on two layers that cover different failures. One publishes reserve data continuously and can block issuance; the other is a periodic opinion from an accounting firm. Together they confirm the shares exist without confirming the institutions holding them are sound.

Proof of reserve as a live feed

Backed publishes reserves through a live Chainlink Proof of Reserve feed rather than a quarterly document. The Network Firm acts as independent attestor and holds read-only access to the custody accounts, which lets the reserve figure reach the chain without the issuer restating it first (DropsTab, 2026). Quarterly ISAE 3000 assurance engagements sit on top, and Swiss regulation requires regular audits of the operating entity (Pionex, 2026). The continuous feed matters more than the cadence of the reports, because it is the input a smart contract can act on. A number published once a quarter can only be read after the fact. Feeds also carry a heartbeat, the maximum interval permitted between updates, and a contract that consumes one without checking its age can act on a figure that has stopped being current.

What attestation does not cover

Reserve verification answers one question and leaves several open. It confirms that shares matching the outstanding token supply sit in identified accounts on a given date. It says nothing about whether the custodian is solvent, whether the broker holding the position has lent it out, or whether the legal claim survives an insolvency proceeding. A smart contract cannot inspect a vault, recover assets from a failed custodian, or move money through the banking system. Those limits are structural rather than temporary. The blockchain layer records ownership accurately; the institutions underneath it are what the holder is actually relying on. The check available to an individual is correspondingly narrow: confirm a reserve feed exists for the specific ticker, read when it last updated, and note which custodian the attestation actually names.

Can the Issuer Lend Out the Share Backing Your Token?

In the largest tokenized equity programme, yes, and by default. Securities lending of the underlying is switched on across the product line rather than requested per product, and the firm permitted to borrow the shares is the same firm holding them.

Lending as a default setting

Lending of the underlying shares is a lineup-wide default with per-product flags in each product's Final Terms, exercised at the broker's discretion (Backed Finance, 2026). A survey of 13 lending-era Final Terms found 12 marked as permitted and only one, the Apple product, marked not applicable (as of September 2026) , which establishes that a per-product switch exists and is rarely used. The arrangement is ordinary in traditional finance, where brokers lend fully paid securities routinely. What differs here is disclosure: the default sits inside per-product legal documents rather than the product page, so a holder comparing two tickers on an exchange sees nothing that distinguishes them. A lent share also leaves the custodian's account for the duration of the loan and sits with a borrower, which adds a counterparty to the chain during exactly the period the collateral is meant to be sitting still.

One firm in three roles

Alpaca Securities occupies three positions in the same structure simultaneously: program broker, custodian, and Prime Borrower of the shares (Backed Finance, 2026). The party executing the purchase is also the party safeguarding the asset and the party entitled to borrow it. Kraken's ownership of the issuer concentrates the picture further, since Payward now owns Backed Assets (JE) Limited, which means the venue, the issuer and the broker share a corporate parent (Kraken, 2025). None of that makes a failure likely. It does mean the independence a reader would assume between those roles is thinner than the number of named entities suggests. Backed discloses supplemental Lloyd's of London cover up to $175M in aggregate custody loss (as of September 2026) , which sits above the custody arrangement as a whole rather than inside any individual loan.

What Are the Three Structures the SEC Now Recognises?

Three constructions dominate the market, and the line between them is now drawn by US regulators rather than by private drafting. A joint Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission interpretation in March 2026 split tokenized securities into those tokenized by or for the issuer and those tokenized by an unaffiliated third party (SEC Release 33-11412, 2026). The September 2026 order then made that split operative and excluded the third construction outright.

Issuer-sponsored tokenization

In the issuer-sponsored model the company puts its own shares on-chain and the token is the share. A transfer agent maintains the register, so the holder is recorded as a registered or beneficial owner with the voting rights and dividend entitlement that status carries. Nothing sits between the holder and the company. The constraint is participation rather than law: the issuing company has to act, so coverage grows one company at a time instead of one ticker at a time. That is why the model covers a handful of names while wrapper catalogues run past 700 (as of September 2026) . The SEC's order explicitly covers stock tokenized by, or on behalf of, the issuer of the underlying security (SEC, 2026).

Third-party custodial wrappers

The wrapper model accounts for almost all tokenized equity trading, and it is the structure traced through the preceding sections. An unaffiliated issuer buys the share, places it with a custodian and mints a claim against it, which leaves the holder with a contractual position rather than a registered one. The September order covers this case too — a security tokenized by a third party unaffiliated with the issuer is eligible (SEC, 2026). It attaches a condition that matters: before listing a third-party-tokenized security, a venue must notify the underlying company and wait 30 calendar days, and a timely objection blocks the listing entirely. Companies now hold a veto over who tokenizes their stock.

Synthetic exposure and why it was excluded

Synthetic products track a share price without holding the share, and the SEC left them outside the perimeter. Tokenized NMS Stock, the order says, excludes a crypto asset representing a third party's own security that provides synthetic exposure. Tokenized linked securities and tokenized security-based swaps are the named examples (SEC, 2026). The exclusion is the clearest signal in the document. A structure with no share behind it cannot be brought inside a framework built on the assumption that a share exists somewhere. The first tokenized equity cycle in 2018 relied on synthetic construction and failed to hold liquidity, which is the practical history behind the legal line.

Data current as of October 2026.

Every one of those structures assumes the parties behind it keep functioning.

What Breaks If the Issuer or the Custodian Fails?

The failure paths are documented, and none has been walked. Issuer default hands control to a security agent; custodian failure hands it to an insolvency process and an insurance policy. Both are designs on paper rather than outcomes anyone has observed.

Issuer default and the security agent

On issuer default the security agent may take control of the collateral accounts, liquidate the underlying assets and distribute proceeds to token holders under the prospectus terms (xStocks Docs, 2026). Recovery therefore depends on three things holding at once: the collateral being intact, the agent acting, and a court respecting the arrangement. The first is verifiable through reserve attestation. The second is contractual. The third has never been tested, because no tokenized equity issuer has entered insolvency. Neither Payward nor its European arm guarantees the issuer's obligations, so the security interest is the recovery mechanism rather than a parent company's balance sheet. Enforcement would also cross jurisdictions, since the issuer sits in Jersey, the custodians in Switzerland and the United States, and the security agent in Zug.

Custodian failure and what insurance covers

Custodian failure breaks the chain at a different link and the SPV structure does not dissolve the problem. Segregated, properly titled assets should sit outside a failed custodian's estate, which is the reason regulated and audited custodians are used and why collateral is held asset-by-asset. Delays and legal proceedings would still follow. The supplemental Lloyd's of London cover up to $175M is aggregate rather than per holder, and functions as a loss backstop rather than deposit insurance (Pionex, 2026). Spreading custody across Maerki Baumann, InCore Bank and Alpaca Securities limits how much of the programme any single failure reaches. No tokenized equity structure has yet faced a custody collapse or an issuer bankruptcy, so every recovery path described here remains an untested design (DropsTab, 2026).

Data current as of October 2026.

FAQ

?Do I pay tax on a tokenized stock the same way I pay tax on the real share?

Rarely, and the difference follows the wrapper. Most retail tokenized equities are debt instruments or structured notes rather than shares, so gains may be taxed as income from a security rather than as an equity disposal, and dividend value often arrives after a withholding deduction at source. A 30% US withholding deduction before reinvestment is standard on distribution venues. Treatment depends on the holder's jurisdiction and the instrument's legal form, which is a question for a local tax adviser rather than the issuer's marketing page.

?Is a tokenized stock the same thing as a stock CFD or a stock perp?

No, and the distinction is the collateral. A contract for difference or a perpetual future is a bilateral contract priced against a reference, with no share held anywhere and a recurring funding cost that a spot token never carries. A backed tokenized stock has an actual share sitting in a custody account behind it. Both deliver price exposure without shareholder rights, but only one has an asset a security agent can seize and sell.

?Does the Lloyd's cover pay out if a borrowed share is never returned?

The cover is described as supplemental protection against custody loss up to $175M in aggregate, not as a guarantee against any individual failure. Aggregate means it applies across the whole programme rather than per holder or per position, so a large loss is shared rather than fully indemnified. It also sits above the custody arrangement as a whole rather than attaching to a specific securities loan. Whether a given failure falls inside the policy depends on terms the issuer has not published.

?How is xStocks' Jersey SPV different from Ondo's BVI structured note?

Both isolate the collateral, and they do it under different law with different instruments. xStocks are bearer tracker certificates issued by Backed Assets (JE) Limited in Jersey, with a Swiss security agent controlling the accounts under a three-party agreement. Ondo's tokens are structured notes from a British Virgin Islands vehicle, where Ankura Trust Company holds a first-priority perfected security interest and the backing runs at 1:1 plus a buffer above 100.5%. Neither has been tested in an insolvency.

?What does it cost to buy one of these, all in?

The visible price is rarely the total. A secondary-market purchase carries the venue's spread, which widens sharply outside the most-traded tickers, plus network fees on the chain the token settles on. Some issuers charge a redemption fee at exit. Because primary minting is restricted, retail buyers pay whatever a market maker quotes rather than the issuer's creation price, and that difference is the real cost of the access.

?Who votes the shares sitting in custody if token holders cannot?

The custodian does, or nobody does. Across live wrapper programmes the custodian votes the shares under a standing policy or abstains (DropsTab, 2026), because the token holder is not on the register and has no instruction right. One structure has moved further: Ondo's US-custody model extends proxy materials to token holders through existing investor services infrastructure, though its offshore prospectus still describes the result as a right to express preferences rather than a binding vote.

?What happens to my token when the underlying company does a stock split?

The issuer adjusts the position rather than the holder doing anything. In wrapper structures the token supply or an exposure multiplier is adjusted pro rata so that economic value is preserved across the split. Robinhood's stock tokens implement a corporate-action multiplier that scales the effective amount without changing raw balances or total supply, which means the tokens are not rebasing. Elective corporate actions such as tender offers are handled case by case under the prospectus.

?Does "proof of reserve" mean the same thing as an audit?

No. Proof of reserve is a continuously published data feed reporting that reserves exist, and in a secure mint configuration it can block an issuance transaction outright. An audit is a periodic opinion from an accounting firm about financial statements or controls at a point in time. Backed runs both: a live Chainlink feed with an independent attestor holding read-only access to the custody accounts, plus quarterly ISAE 3000 assurance engagements. They answer different questions, and neither certifies solvency.

References / Sources