No blockchain is "legal" or "illegal" for tokenization in Spain: Law 6/2023 and MiCA apply to the asset, the issuer, the ERIR and the other entities involved, not to the network. Choose Solana, an EVM chain or ISBE based on who must read and write, the token standard, the secondary market, cost and each network's risks.
This guide is for issuers, banks, asset managers, exchanges and fintechs comparing networks before a regulated issuance. It includes Spain's blockchain services infrastructure (ISBE), data as of October 16, 2026 and four typical scenarios. If you are only weighing EVM chains, we have a separate comparison of Ethereum, Arbitrum and Base.
The network does not comply with the law: the asset and the parties that issue and record it do
Spain's Law 6/2023 on Securities Markets allows transferable securities to be represented in "systems based on distributed ledger technology" (art. 6.1) and names no network. What it requires is an outcome: the system must guarantee the integrity and immutability of the issuance, identify the holders, and determine the nature, characteristics and number of the securities (art. 6.5).
No blockchain delivers that outcome on its own: the network, the smart contract and the entities do it together. The issuer appoints the ERIR in the issuance document. It can be the issuer itself or an entity it chooses, but in every case it must be authorized for the activity in art. 126(a) (art. 8.4). If the securities are admitted to trading on a trading venue, responsibility for those requirements lies with the market infrastructure authorized by the CNMV (art. 8.5).
- MiCA starts from technology neutrality (recital 9) and does not apply to crypto-assets that qualify as financial instruments (art. 2(4)(a)). A tokenized security stays under MiFID II and Law 6/2023, whatever the network.
- Stablecoins. If the token is an e-money token (EMT), its issuer must be a credit institution or an electronic money institution (art. 48(1)(a) MiCA). The network does not matter here either.
- DLT Pilot Regime. Regulation (EU) 2022/858 says references to a specific type of distributed ledger technology should be avoided (recital 9).
So the useful question is not "which network is legal" but on which network you can meet those obligations with the least friction, at what cost and with what risks.
Comparison: Ethereum, its L2s, Polygon, Solana and ISBE
We compare four families of networks. Ethereum (layer 1) and its layer 2 networks, such as Arbitrum and Base. Other EVM chains, such as Polygon. Solana, which is not EVM. And ISBE, a public-permissioned network on Hyperledger Besu, promoted by the Community of Madrid and operated by Alastria. Data as of October 16, 2026.
| Criterion | Ethereum (layer 1) | Ethereum L2s (Arbitrum, Base) | Polygon (Polygon Chain) | Solana | ISBE (Main network) |
|---|---|---|---|---|---|
| Who reads and who writes | Public and permissionless: anyone can read and write | Public; on Arbitrum, a single active sequencer orders transactions | Public; each span has a single block producer, selected from the validators | Public | Anyone can read (public explorer); only KYB-verified participants write, through the ISBE Client |
| Who validates | Anyone who deposits 32 ETH and runs the clients | The L2 executes; Ethereum settles and keeps the data | Up to 105 active validators, staking POL | Validators staking SOL; 18 hold more than a third (Oct 16, 2026, our calculation) | Number not published; according to its documentation, ISBE runs them |
| Virtual machine and language | EVM; Solidity | EVM; Ethereum tooling works (Arbitrum) | EVM-compatible | sBPF; Rust (for example, with Anchor). Not EVM | EVM on Hyperledger Besu; Solidity with Hardhat or Foundry |
| Securities standard | ERC-3643 (status: Final) | ERC-3643, deployed by the issuer | ERC-3643, deployed by the issuer | Token-2022: transfer hook, accounts frozen by default, permanent delegate and pause | Official ERC3643 template |
| Who deploys | The issuer or its provider, no permission needed | The issuer or its provider, no permission needed | The issuer or its provider, no permission needed | The issuer creates a mint account under the existing token program | ISBE, through its Factory; certifying your own contract takes 2 to 12 weeks |
| Finality | About 15 minutes | Depends on Ethereum; withdrawing from an optimistic rollup takes about 7 days | 2 to 5 s (Heimdall v2) | ~12.8 s as of Oct 16, 2026; Alpenglow (activation scheduled for Oct 21, 2026) targets ~150 ms | Immediate (QBFT); one block every 2 s |
| Fee per transaction | Gas in ETH; varies with demand | Lower than on layer 1 | Gas in POL | 5,000 lamports per signature, plus an optional priority fee | No gas fees; subscription from €500 to €5,000 a month (ADM1010 v1.0) |
| EURC in its MiCA white paper | Yes | Base, yes; Arbitrum is not listed | Not listed | Yes | Not listed |
| Signatures and wallets | ECDSA | Ethereum wallets and addresses work (Arbitrum) | Depends on the custodian: check it supports the chain | Ed25519: EVM keys do not work | EVM on the Main network; the Bare network uses the P256 curve |
| Risk to watch | Glamsterdam, expected in Q4 2026, date not yet confirmed | Maturity varies by network; single sequencer (Arbitrum) | Validator set capped at 105 | Outages from 2021 to 2024, none since Feb 6, 2024; consensus change scheduled for Oct 21, 2026 | Young network (launched Dec 18, 2025); can pause contracts (options 1 and 2) |
Who reads, who writes and where the data lives
- Public and permissionless (Ethereum, its L2s, Polygon and Solana). According to the European Data Protection Board (EDPB), on permissionless blockchains anyone can read, write or create blocks; on Arbitrum and Polygon, block production is restricted (see the table). Anyone can also see the token's transfers. On Solana, Confidential Balances hides amounts and balances but not addresses, and can only be enabled on new tokens.
- Public-permissioned (ISBE). Anyone can browse the network in its public explorer, but only legal entities from the European Economic Area verified through KYB and
did:isbecan write, always through the ISBE Client, the only way in. - Private (for example, your own Besu network). You control who validates, but you will have to show the ERIR, the auditor and investors how you guarantee the integrity that art. 6.5 requires.
Personal data. The EDPB's Guidelines 02/2025 (version 2.0, adopted July 7, 2026) conclude that, in general, it is not advisable to store personal data on the blockchain. They also note that how visible it is who sends what to whom affects the choice of blockchain. In practice, KYC data stays off-chain, and the chain holds cryptographic commitments or references.
Sovereignty and data location. On a public network you do not choose where validators are. ISBE is promoted by the Community of Madrid with NextGenerationEU funds and operated by Alastria. The README of its start-here repository lists node deployment with a European provider under Release 2026.2, while its FAQ mentions AWS and Azure. The sources have changed over time, so if location is a requirement, get it in writing.
Token standard, language and audit
- EVM chains and ISBE: ERC-3643. It is an Ethereum standard for security tokens with Final status. It requires an onchain identity system to check who may receive the token, and it includes pausing and freezing. It works on any EVM chain, and ISBE offers it as an official template designed exclusively for tokenizing securities. More in our ERC-3643 glossary entry.
- Solana: Token-2022. ERC-3643 cannot be deployed on Solana. The equivalent is built with Token-2022 extensions, and solana.com itself publishes the mapping: the KYC whitelist goes into a transfer hook, freezing into the freeze authority and forced recovery into the permanent delegate. We explain it in Token-2022 for regulated tokens.
- Solidity or Rust. If you already have audited Solidity contracts, EVM chains and ISBE can reuse them (on ISBE, adapted to its deployment option). For Solana, the official migration guide recommends a full rewrite in Rust for most projects. Neon EVM, one of the routes for running Solidity on Solana, ended development and support on October 1, 2026.
- Who deploys. On public networks, the issuer or its provider deploys. On ISBE, every deployment goes through the network's Factory (ECO1020 policy): with the ERC3643 template in the wizard, the issuer signs and deployment is immediate; if you bring your own contract, certification takes from 2 to 4 weeks (level C) to 4 to 12 weeks (level A).
- Audit and code changes. A Solana program can be upgraded as long as its upgrade authority exists, and verified builds let you check that the deployed binary matches the published source. On ISBE, custom contracts (option 2) must grant ISBE governance the pauser role. On any network, review and document who can change or stop the code after the audit: art. 6.5 requires integrity and immutability.
Custody and secondary market: the infrastructure picks the network
Securities admitted to trading on a trading venue can only be represented on DLT "within the framework of" the DLT Pilot Regime, Regulation (EU) 2022/858 (art. 6.2 of Law 6/2023). And each Pilot Regime infrastructure establishes or documents the rules for the network it uses, including access rules and rules on the participation of validating nodes (art. 7(2) of the Regulation). In practice, the infrastructure picks the network.
- As of October 16, 2026, ESMA's list shows seven DLT Pilot Regime infrastructures authorized in the EU. One was authorized by the CNMV: Securitize Europe DLT TSS, run by Securitize Europe Brokerage and Markets SV, since November 26, 2025.
- The same day, Securitize announced it would launch its European trading and settlement system on Avalanche.
- If a secondary market is part of the plan, first ask which networks the infrastructure supports: issuing elsewhere may force you to migrate the issuance later. We cover it in how the secondary market for security tokens works in Spain.
Custody. Your custodian has to support the chosen network. Solana signs with Ed25519, so EVM keys and addresses do not work there (MetaMask, however, has supported Solana accounts since July 8, 2025). On Arbitrum, by contrast, Ethereum wallets and addresses work as they are.
Cost: per-transaction fees or a subscription
- Ethereum. Gas is paid in ETH, and its price rises and falls with demand.
- Ethereum L2s. They batch transactions and post the data to Ethereum, which makes each transaction cheaper.
- Polygon. Gas is paid in POL, the native token of Polygon Chain.
- Solana. 5,000 lamports per signature (0.000005 SOL), plus an optional priority fee. Storing data also requires a refundable deposit proportional to the account's size.
- ISBE. There is no gas cost per transaction, but there is a subscription. Under fee policy ADM1010 v1.0 of December 16, 2025: Small plan, €500 a month and 50,000 transactions; Medium, €2,000 and 300,000; Large, €5,000 and 1,000,000; plus €0.020 per additional transaction. Note: the policy sits in ISBE's legal repository on GitHub, and the FAQ on redisbe.com says the criteria for joining ISBE are still being defined.
We do not give per-transaction figures in euros for public networks: they depend on the native token's price and on demand at any given moment. There are also costs outside the network: development, audit, the ERIR and integration. Moving from Solidity to Rust means rewriting and auditing again. On ISBE, add onboarding (six steps, according to its documentation) and certification. We break it down in how to use ISBE: onboarding, requirements and fees.
Each network's risks, with date and source
- Ethereum. Finality takes about 15 minutes. ethereum.org warns that a critical bug in a client with a two-thirds majority could finalize an incorrect chain. The next upgrade, Glamsterdam, is expected in Q4 2026, with no confirmed date (page last updated September 14, 2026).
- Ethereum L2s. According to ethereum.org, their safety depends on the underlying technology, smart contract security and the network's maturity. On Arbitrum, one sequencer is active at a time. And withdrawing funds from an optimistic rollup to Ethereum means waiting out a challenge period of roughly seven days.
- Polygon. It supports up to 105 active validators. Finality on the network comes in 2 to 5 seconds, but withdrawals to Ethereum wait for the relevant checkpoint.
- Solana. It suffered outages or severe degradation between September 2021 and February 2024, and its status page records no mainnet incidents after February 6, 2024 (checked October 16, 2026). That day, 18 validators held more than a third of the stake (our calculation). And Alpenglow, a breaking consensus change, is scheduled to activate on October 21, 2026.
- ISBE. It launched on December 18, 2025 and does not publish how many validators it has (its documentation says ISBE runs them). Under QBFT, if more than a third of validators stop participating, the network stops producing blocks. ISBE can pause contracts (through an irrevocable role in option 1; in option 2, unless the owner has revoked it) and, as a last resort, filter addresses at the network client. Part of its code sits in restricted-access repositories.
Issuer powers are another risk on any network. With Token-2022 (permanent delegate, pause, frozen accounts) or ERC-3643 (pause, freeze, wallet recovery), the issuer can act on third parties' balances. For a regulated security these are compliance functions; for investors, they are a counterparty risk that must be disclosed in the issuance document.
Four scenarios and which network fits
These are typical lines of reasoning, not recommendations: every case needs its own legal analysis.
1. SME debt with an ERIR and no secondary market. Few investors, almost all in Spain, no plan to list. ISBE or a public EVM chain with ERC-3643 fit. ISBE brings the ERC3643 template, a network with no gas fees and identified participants, and redisbe.com already reports a case: Token City taking part in the design, issuance and management of a bond on the ISBE network, with a procedure that includes registration as an ERIR with the CNMV. In exchange, it requires onboarding, certification and deployment by its staff. A public EVM chain starts without onboarding, but transfers are visible to everyone and gas is paid in a token whose price moves. More in tokenizing securities on ISBE with ERC-3643 and an ERIR.
2. A fund with international investors. Reach and settlement in tokenized euros or dollars matter most. A public network fits. EURC, Circle's euro stablecoin, is listed in its MiCA white paper on Ethereum, Base, Avalanche and Solana, as well as Stellar; and BlackRock and Securitize opened a BUIDL share class on Solana in March 2025. Choose Ethereum or an L2 if your custodians and ecosystem are EVM, and Solana if you want Token-2022 controls in the token itself. ISBE is designed for identified participants from the European Economic Area, which adds friction to distribution outside Europe.
3. A public traceability or credentials project. If there are no crypto-assets or securities, data protection, organizational identity and sovereignty weigh more. ISBE fits: did:isbe identity with KYB, no gas fees, operated by Alastria, and traceability cases in its catalog such as Digitanimal (livestock), Bikiot (bicycles) and iPASS (digital product passport). More on building on ISBE.
4. A fintech or bank with stablecoin payments or a high-turnover asset. Per-transaction fees, finality and stablecoin liquidity matter most. Solana fits: a base fee of 5,000 lamports per signature, Token-2022 with confidential balances and an auditor key, and EURC, USDC and PYUSD on the network. You have to accept its outage history and the transition to Alpenglow. If your contracts are already in Solidity, an Ethereum L2 avoids a rewrite. And if the token is an EMT, the issuer must be a credit institution or an electronic money institution. More on Solana development.
Frequently asked questions
Has the CNMV approved any blockchain for tokenization?
No. Law 6/2023 allows "systems based on distributed ledger technology" without naming networks (art. 6.1), and MiCA and the DLT Pilot Regime are technology-neutral. What gets authorized are entities: the ERIR (art. 8.4) or Pilot Regime infrastructures, such as the one the CNMV authorized for Securitize in November 2025.
Is Solana or Ethereum better for tokenizing assets?
It depends on the project. Ethereum and its L2s offer ERC-3643 and reuse Solidity contracts. Solana offers Token-2022, a base fee per signature and finality of about 12.8 seconds as of October 16, 2026, but requires programming in Rust. Neither complies with the law on its own: that depends on the asset, the issuer and the ERIR.
Can ERC-3643 be used on Solana?
Not directly: it is an Ethereum standard, and Solidity contracts cannot be deployed on Solana as they are. solana.com shows how to reproduce its controls with Token-2022: a transfer hook for the whitelist, the freeze authority to freeze and the permanent delegate to recover tokens.
Does using ISBE give an issuance more legal validity?
Nothing indicates that it does. No source says ISBE is an ERIR or that deploying on ISBE is enough to comply with Law 6/2023, and the two securities cases published on ISBE rely on an ERIR. ISBE "positions itself" as a qualified electronic ledger (qDLT) under eIDAS 2, but we have not been able to verify that it has been granted qualified status.
Can I store investor data on the blockchain?
It is not advisable. The EDPB's Guidelines 02/2025 (version 2.0, July 2026) conclude that, in general, personal data should not be stored on the chain. KYC data stays off-chain, and the chain holds cryptographic commitments or references.
How we approach it
Unknown Gravity is a Spanish tokenization technology and blockchain infrastructure company and a member of Alastria, the association that operates ISBE. Before proposing a network, we review with you the asset and its regime, the ERIR, the planned secondary market and the risks of each option. We build smart contracts in Solidity for EVM chains and ISBE, and programs in Rust for Solana. The ERIR role, authorizations and legal advice belong to authorized entities and to your legal counsel.
Sources
- Law 6/2023, arts. 6 and 8 (BOE, in Spanish)
- Regulation (EU) 2023/1114, MiCA (EUR-Lex)
- Regulation (EU) 2022/858, DLT Pilot Regime (EUR-Lex)
- List of authorised DLT market infrastructures (ESMA)
- Securitize: EU approval and TSS deployment on Avalanche (Nov 26, 2025)
- EDPB Guidelines 02/2025, version 2.0
- ERC-3643 (Ethereum Improvement Proposals)
- Finality on Ethereum (ethereum.org)
- Optimistic rollups and the challenge period (ethereum.org)
- Client diversity on Ethereum (ethereum.org)
- Glamsterdam upgrade (ethereum.org)
- A gentle introduction to Arbitrum (Arbitrum docs)
- Polygon Chain (Polygon docs)
- ERC-3643 on Solana: mapping to Token-2022 (solana.com)
- Alpenglow: activation and finality (solana.com)
- Fees on Solana (solana.com)
- ISBE network parameters (docs.redisbe.com, in Spanish)
- ISBE contract deployment options (docs.redisbe.com, in Spanish)
- ISBE policies, ADM1010 included (GitHub)
- EURC MiCA white paper (Circle)
Framework verified as of October 16, 2026. Choosing a network for a regulated issuance? Talk to us.