--- title: "Digital asset custody: who may safekeep tokenized securities" url: "https://www.unknowngravity.com/en/articulos/custodia-activos-digitales-espana" site: Unknown Gravity published: "2026-05-31T13:17:22+00:00" modified: "2026-10-15T19:06:12+00:00" language: en description: "Differences between crypto-asset custody (CASP/MiCA) and tokenized financial instruments: authorized entities, ERIR, DORA." section: "Home > Blog > Digital asset custody: who may safekeep tokenized securities" --- # Digital asset custody: who may safekeep tokenized securities ## Quick answer Digital asset custody follows two regimes depending on the nature of the asset. If it is a crypto-asset that is not a financial instrument, custody is a crypto-asset service provider (CASP) service under MiCA. If it is a tokenized security, that is, a financial instrument represented on a network, safekeeping corresponds to authorized entities under MiFID II and the LMVSI, with an ERIR (the entity responsible for registration and recording) administering the register. ## Two assets, two regimes The word custody conceals two legally distinct services. The boundary is not set by the technology, which in both cases may be a blockchain, but by the nature of the asset held. That classification determines the applicable rules, the authorized entity and the guarantees the holder receives. The crypto-asset regulation governs the provision of services on crypto-assets that are not financial instruments, and includes among them the custody and administration of crypto-assets on behalf of clients. But it expressly excludes from its scope crypto-assets that qualify as financial instruments within the meaning of MiFID II (MiCA, Regulation (EU) 2023/1114, Art. 2(4)). Consequently, a token representing a share, a bond or a fund unit does not fall under MiCA: it is governed by securities markets rules. ## Crypto-asset custody: the CASP service under MiCA When the asset is a crypto-asset that is not a financial instrument, for example a utility token or a cryptocurrency, holding it on behalf of third parties is a service reserved to an authorized crypto-asset service provider. MiCA subjects these providers to an authorization and supervision regime, with capital, governance and conduct requirements, and specific obligations for the custody service (MiCA, Regulation (EU) 2023/1114). The CASP custodian must keep a record of positions per client, separate clients' crypto-assets from its own, and be accountable for their availability. Holding the cryptographic keys that control access to the crypto-assets is the operational core of the service: whoever controls the keys controls the asset. Hence the importance of key-custody policies, backup procedures and the provider's liability in the event of incidents. ## Custody of tokenized securities: authorized entities and the ERIR The second regime applies when the digital asset is a financial instrument represented through distributed ledger technology. Ley 6/2023 (Spain's Securities Markets Law, LMVSI) recognizes DLT systems as a valid way to represent transferable securities, alongside book entries and certificates (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053). Being financial instruments, their safekeeping and administration on behalf of clients is an ancillary investment service subject to MiFID II and the LMVSI (MiFID II, Directive 2014/65/EU). This service may be provided by entities authorized to safekeep financial instruments: credit institutions and investment services companies and brokerage firms with the relevant authorization. Operating a technological infrastructure is not enough; authorization for the investment service of safekeeping is required. Where the credit institution is at the same time the depositary of a collective investment scheme, it also performs the depositary and oversight functions imposed by the collective investment regime (Ley 35/2003 on collective investment schemes). ### The role of the ERIR For securities represented through DLT, a figure appears that has no equivalent in crypto-asset custody: the entity responsible for registration and recording. The ERIR administers the register of the securities on the network, identifies the holders, determines the nature and number of securities and guarantees the integrity and immutability of the entries, and must also have a contingency plan for the continuity of the register (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053). The CNMV authorized Ursus-3 Capital, a brokerage firm, as the first ERIR in Spain on November 22, 2024. It is important not to confuse recording and custody. The ERIR administers who is listed as holder on the network; custody as an investment service refers to the safekeeping of the instruments on behalf of the client. A single authorized entity may take on both functions, but they are distinct responsibilities with their own legal bases. ## Asset segregation Separating the client's assets from the entity's own is a principle common to both regimes, though with different anchors. In the custody of financial instruments, the client-asset protection rules derived from MiFID II require identifying and separating each client's securities and avoiding their use for the entity's own account without consent (MiFID II, Directive 2014/65/EU). In crypto-asset custody, MiCA requires the provider to keep clients' positions segregated from its own and to maintain a faithful record of positions (MiCA, Regulation (EU) 2023/1114). Segregation serves a protective function: in the event of the custodian's insolvency, the client's assets must not be confused with the custodian's estate. In the digital environment, segregation also projects onto the management of keys and addresses, so that each client's positions are identifiable and can be reconstructed. ## DORA: the operational resilience layer Over both regimes operates the digital operational resilience regulation, applicable to financial entities and their technology providers. DORA requires technology risk governance, incident management and reporting, periodic resilience testing and control of the risk of critical third-party providers, and is fully applicable since January 17, 2025 (DORA, Regulation (EU) 2022/2554). For a digital asset custodian this translates into concrete obligations: continuity plans, cybersecurity incident management, infrastructure testing and oversight of the providers that underpin the recording and custody operation. The strength of the keys or the smart contracts does not exempt it from the resilience framework; it complements it. ## Self-custody versus regulated custody Self-custody means the holder keeps, by themselves, the keys that control their crypto-assets, without an intermediary. It is legitimate for crypto-assets and grants direct control, but it shifts all the operational risk to the holder: losing the keys means losing the asset, with no third party to answer for it. There are none of the segregation, supervision or resilience guarantees proper to a regulated custodian. In the field of tokenized financial instruments, self-custody does not fit in the same way. The recording of ownership rests on an ERIR and custody as an investment service is reserved to authorized entities, so the model is built on supervised intermediaries, not on individual holding of keys outside the system. The choice between direct control and regulated protection depends on the type of asset and the holder's profile. ## Frequently asked questions ### Is a tokenized security held in custody under MiCA? No. A tokenized security is a financial instrument, so its safekeeping is governed by MiFID II and the LMVSI, and it is provided by an authorized entity. MiCA excludes from its scope crypto-assets that are financial instruments (MiCA, Regulation (EU) 2023/1114, Art. 2(4)). ### What is the difference between an ERIR and a custodian? The ERIR administers the register of the securities on the network and identifies the holders; the custodian safekeeps the instruments on behalf of the client as an investment service. A single authorized entity may take on both, but they are distinct functions (Ley 6/2023, Spain's Securities Markets Law, LMVSI, BOE-A-2023-7053). ### Can a technology company safekeep tokenized securities without a license? No. The safekeeping of financial instruments is a service reserved to authorized entities under MiFID II and the LMVSI. Operating the technological infrastructure is not the same as being authorized to provide safekeeping (MiFID II, Directive 2014/65/EU). ### Does DORA apply to crypto-asset custodians? Yes. DORA reaches financial entities, including crypto-asset service providers, and their critical technology providers, with full application since January 17, 2025 (DORA, Regulation (EU) 2022/2554). ## What this means for you Before entrusting a digital asset to a custodian, first identify what the asset is. If it is a crypto-asset, verify that the provider is authorized as a CASP under MiCA. If it is a tokenized security, check that custody is provided by an entity authorized for financial instruments and who acts as the ERIR. In both cases, the segregation of your assets and DORA compliance are indicators of how robust the service is. Self-custody offers control, but without the protections of a regulated custodian. *This content is for general information and educational purposes only. It is not legal, tax or investment advice and does not replace consultation with a qualified professional. Regulation on tokenization and crypto-assets evolves; always check the version in force of the rules cited in the BOE (boe.es) and EUR-Lex (eur-lex.europa.eu).* Planning to issue or tokenize assets under Spain's regulated framework? At Unknown Gravity we support you end to end. [Book a meeting](/en/meeting).