October 18, 2026
Author: Joao Lages
To distribute tokenized products cross-border with an EU passport, start by identifying the legal nature of the product and the regulated activity—not by choosing a blockchain. A tokenized share, bond or fund interest normally remains a financial instrument. The firm marketing, placing, advising on or transmitting orders for it therefore needs the relevant permission and, where applicable, a MiFID passport into each target Member State. The offer may also need a prospectus that has been approved and notified across borders, while retail distribution can trigger PRIIPs, product-governance and investor-protection duties.
The important practical point is that there is no single “token passport”. Several legal routes may operate together: the distributor's services passport, the prospectus notification process, a fund-marketing passport, or the European crowdfunding regime. The issuer, distributor, platform and infrastructure providers must each know which route applies to their role. This guide explains how to build that map for a European launch. It is general information, not legal, tax or investment advice for a particular transaction.
An EU passport lets a regulated firm exercise specified rights in host Member States after completing the applicable home-state notification. It does not convert every product into an EU-wide offer, validate every marketing statement or remove local conduct requirements. A firm authorised to receive and transmit orders in transferable securities may be able to provide that service cross-border, but only within its permission scope and only after the relevant notification is effective.
For public offers of securities, a different mechanism applies. Under the current consolidated Prospectus Regulation, an approved prospectus can be used in host Member States when the home competent authority sends the certificate of approval and required documents to the host authorities. An exempt offer below the applicable threshold is not eligible for this notification route. It may still be lawful, but the issuer must analyse each destination under the exemption, marketing and distribution rules that apply there.
In practice, cross-border token distribution succeeds when three questions have one consistent answer: what right does the token represent, who performs each regulated activity, and what legal basis permits the offer in each country?
Tokenization changes the record, transfer process or settlement technology. It does not normally change the legal rights that investors acquire. A digital unit representing shares, debt, a derivative or a fund interest can still be a financial instrument under MiFID II. That classification determines the authorisations, disclosure route, target-market analysis and market-infrastructure rules.
The first work product should be a written classification memorandum that connects the token terms to the underlying legal instrument. It should cover voting or payment rights, maturity, redemption, loss allocation, transferability, enforceability, governing law and the relationship between the on-chain record and the issuer's legally recognised register. Technical labels such as “RWA token” or “security token” are not enough.
This step also separates MiFID products from crypto-assets regulated under MiCA. MiCA excludes crypto-assets that qualify as financial instruments from its scope. A tokenized bond does not become a MiCA product merely because it is issued on a distributed ledger. Conversely, a crypto-asset that is not a financial instrument may fall within MiCA's issuer or crypto-asset service provider framework. Borderline analysis should follow the rights and economic substance, supported by the ESMA classification guidance and local legal advice.
Some structures are collective investment undertakings rather than direct securities issued by an operating company. Pooling capital, applying a defined investment policy and giving investors a passive return can point towards an alternative investment fund. That introduces an AIFMD or UCITS analysis and potentially a fund-marketing passport. It should not be treated as an alternative label chosen for commercial convenience.
The phrase “EU passport” is often used as if it described one approval. For tokenized products, at least four routes must be distinguished.
A transaction may need more than one route. A tokenized bond offered to retail investors could require an approved and notified prospectus, a MiFID firm with an effective services passport, a PRIIPs key information document, and compliant onboarding and payment arrangements. One completed notification does not satisfy the others.
Under MiFID II, regulated investment services include reception and transmission of orders, execution, investment advice, underwriting and placement. A cross-border operating model should identify the legal entity performing each action from the first advertisement to post-investment servicing.
Article 34 provides the framework for an investment firm to provide services in another Member State without establishing a branch. Article 35 addresses branches and tied agents established in a host state. In either case, the home authority transmits prescribed information to the host authority. The notification is service-specific and should be confirmed before the campaign opens; an authorisation in the firm's home state is not, by itself, evidence that every target country is active.
Tied-agent structures require additional care. A tied agent acts under the full and unconditional responsibility of one investment firm and within the mandate and registrations that support the activity. If the agent is established in another Member State, the branch-related framework may apply. The principal must be able to supervise communications, training, conflicts, records and complaints. A commercial partner cannot independently select products or make recommendations and then rely on the principal's licence as a retrospective endorsement.
The practical control is a country-by-country permission matrix. For each destination, record the service, client type, instrument, delivery channel, legal entity, passport status, tied-agent status, regulator reference and launch condition. Marketing should remain disabled until the responsible compliance owner has signed off that row.
The disclosure analysis is distinct from the distribution licence. From 5 June 2026, the consolidated Prospectus Regulation sets a general EU exemption for offers below EUR 12 million per issuer or offeror over 12 months, while Member States may apply a EUR 5 million threshold. Those exempt offers are not subject to the Article 25 notification process. Teams must therefore confirm which threshold is used in every target state and aggregate all relevant classes and ongoing offers correctly.
Other exemptions can apply, including offers solely to qualified investors, offers to fewer than 150 non-qualified persons per Member State, and offers with high minimum denominations or acquisition amounts. These are technical conditions, not marketing strategies. Splitting one campaign into artificial tranches, miscounting contacts or ignoring later resales creates material risk.
When a prospectus is required or drawn up voluntarily, the home competent authority approves it. At the issuer's or responsible person's request, that authority sends the host authority a certificate of approval and an electronic copy, with translations where required. The regulation states that this notification should occur within one working day after the relevant request or approval. Supplements follow the same process, and the prospectus generally remains valid for 12 months if kept complete with required supplements.
An approved prospectus is powerful because it creates a harmonised disclosure route. It does not approve the commercial merits of the investment, guarantee returns or replace MiFID controls. The website, advertisements, sales scripts and onboarding journey must remain consistent with the prospectus and present risks with appropriate prominence.
Retail distribution adds obligations that cannot be solved by translating the subscription page. Product manufacturers and distributors must define the target market, distribution strategy and any negative target market. The distributor must decide whether a service requires suitability or appropriateness assessment, obtain the necessary information and keep evidence of the result. Client categorisation, costs and charges, inducements, conflicts and best-execution or order-handling duties may also apply.
If the product is a packaged retail and insurance-based investment product, the PRIIPs Regulation generally requires a key information document to be provided in good time before the retail investor is bound. The KID is a concise disclosure, not a sales passport; the regulation expressly says it does not introduce a passport for cross-border sale or marketing. Language rules and the identity of the manufacturer and seller must be addressed for every destination.
Marketing communications must be fair, clear and not misleading. Performance scenarios, yield references, collateral descriptions, liquidity claims and comparisons need substantiation and must not obscure loss, issuer or illiquidity risk. Local consumer law, financial-promotion practice and regulator product interventions may add constraints even when the underlying EU framework is harmonised.
A compliant campaign can still fail operationally if money, ownership and tokens move through different systems without a reliable reconciliation rule. The legal register, smart contract and investor ledger should agree on who owns each unit, when title passes, what happens after a failed payment and how corporate actions are recorded.
Determine who receives investor funds, whether a payment institution or bank safeguards them, when the issuer may draw down and how refunds are processed. Determine who holds any underlying asset or financial instrument, who controls issuance and burn rights, and whether transfers are permitted only between verified wallets. AML, sanctions and fraud controls should be applied at onboarding and refreshed when risk changes.
The EU DLT Pilot Regime creates a framework for authorised DLT multilateral trading facilities, settlement systems and combined trading-and-settlement systems. It does not give every token platform permission to operate a secondary market. An operator still needs the relevant MiFID, market-operator or CSD status and a specific permission under the pilot regime. Informal bulletin boards, transfer windows and peer-to-peer matching features should be assessed for venue, brokerage and settlement implications before launch.
There is no universally best operating model. The right option depends on the product, countries, investor segment, desired control and available regulated partners.
The earlier guide to creating an investment platform without obtaining your own licence explains how these partnership models allocate regulated work. The European tokenized securities infrastructure map shows how issuance, distribution, custody, trading and settlement providers fit together. For contractual allocation, use the companion analysis of tokenization legal documentation in Europe.
A scalable launch does not mean treating the EU as one undifferentiated market. Build a controlled matrix for the initial two or three countries, then add destinations only when their conditions are met.
Each entry should have an owner, documentary evidence, expiry or review date and a technical control. For example, a platform should not merely state that France is pending; it should block French residents and French-targeted campaigns until the required passport, documents and approvals are recorded. Evidence turns legal advice into an operable release gate.
A disciplined programme can be organised into eight steps:
For a coordinated implementation, the Lympid white-label investment platform can connect the customer experience with product, onboarding and distribution workflows. That coordination can reduce hand-off risk, but it should be described accurately: Lympid and its regulated partners operate within defined mandates; the technology does not create an automatic passport for an issuer or a product.
The first failure is treating a prospectus exemption as a distribution permission. The second is assuming a home-state licence automatically covers every service and destination. The third is translating marketing after launch without rechecking risk prominence, KID language and local rules. The fourth is allowing the on-chain ledger and legal ownership record to diverge. The fifth is promising “liquidity” when no authorised venue, eligible investor base or functioning transfer process exists.
Another frequent problem is ambiguous accountability. If the issuer, technology company and investment firm each believe another party approved a campaign or complaint process, the control does not exist. Responsibility matrices should identify one accountable entity for every regulated action, backed by system permissions, escalation routes and audit evidence.
Finally, avoid designing for all 27 Member States on day one. A smaller launch with verified passports, precise disclosure, tested payments and well-trained support is more scalable than a nominally EU-wide website that cannot evidence how each country was approved.
How to distribute tokenized products cross-border with an EU passport is ultimately an operating-model question. Classify the instrument, separate the MiFID services passport from the prospectus or fund notification, identify every regulated activity and build a country matrix that connects legal approval to technical controls. Tokenization can improve issuance and administration, but it does not displace securities, marketing or investor-protection rules.
The most credible route is to launch through a regulated firm whose permissions and notifications match the product, service, client type and destination, supported by documents and infrastructure that remain consistent throughout the investor journey. Start narrowly, verify each country and expand from a tested base.
If you are considering launching a tokenised investment product, speak with Lympid.
Book a call with us today and get a free assessment.
