Step 2 — Map Your Regulatory Path

Your regulatory path determines how you write the smart contract, not the other way around, so scope it before you spend a dollar on engineering. Tokenized fund interests are securities in every major jurisdiction, which means the exemption or license you choose dictates which investors can hold your token, how long they must hold it, and which transfers the contract has to block on-chain. Get this wrong and you redeploy contracts after launch, which is the most expensive mistake in tokenization.
For a U.S. raise from accredited investors, Regulation D Rule 506(c) is the default. It permits unlimited capital and general solicitation, but you must take reasonable steps to verify accredited status, and it carries a 12-month holding period enforced through on-chain transfer restrictions (liquidmercury.com). For token design, that means your contract needs a verified-investor registry and a lockup that releases automatically after the holding period clears.
Regulation S governs offers to non-U.S. persons and pairs naturally with Reg D for cross-border raises. It requires a distribution compliance period during which tokens cannot flow back to U.S. holders (innreg.com). Your compliance engine enforces this with geo-fencing and identity checks at the transfer level, so the token has to know which jurisdiction each holder sits in before it settles any trade.
For the EU, the framework operators most often misread is the security-token rule. MiCA does not cover tokenized fund interests. MiCA applies to cryptocurrencies and stablecoins, while tokenized securities fall under MiFID II and, for fund vehicles, AIFMD (investax.io). Treating MiCA as the EU standard for a tokenized fund is the single most common jurisdiction mistake, and it surfaces in counsel review months into a build when the structure has to be reworked. If you target EU LPs, structure the offering as a MiFID II-compliant instrument, then use passporting for pan-European distribution under that regime.
Germany's Electronic Securities Act (eWpG) and Luxembourg's DLT laws let you issue blockchain-native securities without paper certificates, and the DLT Pilot Regime, live since March 2023, gives approved operators temporary exemptions from certain MiFID and CSDR settlement rules (investax.io). Both narrow your venue choices, so factor them into the regulatory budget before you pick a chain.
Singapore treats security tokens identically to traditional securities under the Securities and Futures Act. Any platform touching issuance, custody, or secondary trading needs a Capital Markets Services (CMS) license, and exchange-style venues need a Recognized Market Operator (RMO) license (investax.io). For token design, plan to either hold these licenses or partner with an entity that does, because MAS will not let you operate the capital-markets functions without one. MAS published an Operational Guide for Tokenized Funds in November 2025 through Project Guardian, covering NAV calculation, onboarding, and compliance, which gives operators a concrete reference for what regulators expect.
Use these frameworks to scope legal cost before you engage counsel. A Reg D 506(c) raise to U.S. accredited investors is the cheapest and fastest path. Adding Reg S for offshore LPs roughly doubles the compliance-engineering work because the contract now enforces two jurisdiction rulesets at once. A Singapore CMS structure is the heaviest, since it pulls in licensing timelines measured in months. Bring counsel a defined jurisdiction map rather than an open question, and you cut both the legal bill and the project timeline.

Step 4 — Design and Deploy Your Smart Contracts

Every smart contract decision in a tokenized fund is a control decision about who can do what to investor holdings after issuance. Treat the architecture as a question of who holds the keys to mint, freeze, and reverse, not as a question of which framework your developer prefers. The vendor builds the contracts. You own the consequences when an investor's status changes or a wallet gets compromised.

ERC-3643 deploys in a fixed sequence, and the order reflects how compliance gets enforced. You deploy the identity registry first, then the compliance contract, then the token contract (chainalysis.com/blog/introduction-to-erc-3643-ethereum-rwa-token-standard). The identity registry maps wallet addresses to verified on-chain identities. The compliance contract checks the sender and receiver against your jurisdiction, accreditation, and sanctions rules before every transfer. The token contract holds the actual balances and defers to both before it moves anything.

Four operator controls must stay under your authority, not the vendor's. ERC-3643 lets the issuer mint, burn, block, and force transfers at any time (tokeny.com/erc3643). You need mint to issue new tokens against new subscriptions, burn to retire them on redemption, force transfer to move tokens during a court order or a recovered wallet, and revoke to cut off a holder who moves to a restricted jurisdiction. Confirm in writing that the deploying party assigns these admin roles to a wallet you control, ideally a multi-signature setup rather than a single key. If the vendor retains the admin keys, the vendor controls your cap table.

Two items operators routinely under-scope

Upgradability decides whether you can fix a bug after launch, and most operators never ask about it before signing. A contract deployed as immutable cannot be changed, so a logic error in distribution or compliance becomes permanent. A contract deployed behind an upgrade proxy can be patched, but the upgrade authority becomes a new attack surface and a new governance question. Ask the vendor which pattern they use, who holds the upgrade key, and what the upgrade approval process looks like. There is no universally correct answer. There is only an answer you have decided on rather than inherited by default.

Audit scope is the second blind spot, and a vague RFP produces a vague audit. A smart contract audit can mean a full review of every contract in the deployment, or it can mean a quick pass on the token contract while the compliance and identity logic go unchecked. The compliance contract is where your regulatory enforcement lives, so an audit that skips it leaves your highest-risk code unreviewed. Specify in the RFP that the audit covers the identity registry, the compliance module, and the token contract, name the audit firm, and require the report before mainnet deployment. Ask who pays to re-audit after any upgrade, because that cost recurs for the life of the fund.

Step 6 — Set Up Custody

Custody for a tokenized fund is a licensing question first and a vendor question second. Under U.S. law, your fund's assets often require a qualified custodian, and SEC Rule 17f-5 and 17f-7 govern how registered funds hold assets through foreign and securities-depository custodians. Holding the underlying private credit notes or treasuries is a different legal obligation than holding the private keys that control the tokens. You can satisfy one and fail the other, so map both before you shortlist anyone.

The Special Purpose Broker-Dealer framework the SEC established in 2021 lets a broker-dealer custody digital asset securities, which matters if your structure routes tokens through a regulated intermediary rather than a pure crypto custodian. A pure crypto custodian secures private keys and signs transactions. A qualified custodian carries fiduciary and regulatory obligations for the asset itself. BitGo, Anchorage, and Cactus Custody sit at different points on that spectrum, and InvestaX integrates directly with Cactus Custody for its private credit offerings. Anchorage holds a federal trust charter, which changes the qualified-custodian analysis in a way a non-chartered key manager cannot match. Pick the custodian that fits your wrapper and jurisdiction, not the one with the best dashboard.

MPC vs. HSM is your risk dial, not a vendor detail

Key management decides who can move your tokens and how an attacker would have to defeat your controls. Multi-party computation splits a private key into shares held across separate parties or devices, so no single machine ever holds the full key and no single compromise signs a transfer. Hardware security modules keep the full key inside a tamper-resistant device and sign inside that boundary. MPC removes the single physical point of failure and supports flexible signing policies across people and locations. HSM gives you a hardened, well-understood device with a long audit history in traditional finance.

Treat the choice as your decision, not the custodian's internal preference, because it sets your recovery story and your approval thresholds. Ask each candidate how many signers a transfer requires, how a lost share gets reconstituted, and who can override a freeze. Those answers tell you whether you keep operator control or hand it to the custodian. The right setup matches your fund's signing policy to the controls you retained in your smart contracts at Step 4.

Step 8 — Secondary Market: What Operators Can and Cannot Do

Secondary liquidity is the most over-promised claim in tokenization marketing, and operators should price their expectations to reality before they pitch LPs on it. Tokenizing a fund does not create a market for its shares. It creates the technical ability to transfer them, which is a different thing. Whether those transfers can happen at scale depends on which regulated venue you build toward, and every jurisdiction gates that venue behind a license.

In the United States, running a marketplace for tokenized securities requires an Alternative Trading System (ATS) registered with FINRA or broker-dealer registration, and custody of the tokens themselves falls under the Special Purpose Broker-Dealer framework the SEC established in 2021. Most fund operators will not hold either license. You partner with a registered ATS rather than become one, and that partnership decision belongs in your Step 2 scoping, not your post-launch wish list.

The EU and Singapore follow the same partner-or-license logic. In the EU, secondary trading of tokenized securities runs through a Multilateral Trading Facility under MiFID II, with the DLT Pilot Regime offering approved operators temporary exemptions to trade and settle on-ledger. In Singapore, MAS requires a Recognized Market Operator license for any venue trading capital markets products, the same license a conventional exchange holds. None of these venues is something you spin up alongside a token contract.

Policy-gated transfers are not a market

Most operators conflate two capabilities that behave nothing alike. ERC-3643 enforces compliance on every transfer through an on-chain controller that checks sender and receiver eligibility, which lets a holder move tokens peer-to-peer to another whitelisted, KYC-verified investor. That is policy-gated P2P transfer, and it solves the problem of a known buyer and a known seller settling a private trade with atomic delivery-versus-payment.

Exchange-style liquidity is the ability to sell into an order book at a market-clearing price without finding a counterparty yourself. On-chain RWA markets rarely deliver this, because the permissioned investor pool is small, accreditation requirements thin out eligible buyers, and Reg D holding periods lock tokens for twelve months. Tell your LPs the truth. Tokenization gives them faster, cleaner settlement when they find a buyer, not a guarantee that one exists.