ISBE's Main EVM network offers an ERC3643 template for shares, bonds and funds, and deployment goes through ISBE's infrastructure. But deploying isn't enough to comply with Spain's Law 6/2023: the issuer drafts the issuance document and appoints an ERIR authorized for custody (Article 8.4). ISBE provides the network; the ERIR keeps the register.
ISBE (Spain's Blockchain Services Infrastructure) is a set of public-permissioned networks led by the Community of Madrid and operated by Alastria. This guide explains what Spanish law requires, what ISBE brings, what it doesn't solve and what the official sources say about its two securities cases. Everything was checked as of October 16, 2026.
What Law 6/2023 requires of a security recorded on a blockchain
Spain's Law 6/2023 on Securities Markets and Investment Services (LMVSI) accepts systems based on distributed ledger technology (DLT) as a way to represent transferable securities, alongside book entries and paper certificates (Article 6.1). The law applies to the security, not to the network: the CNMV, Spain's securities regulator, notes that whether a crypto-asset is a financial instrument is decided case by case, regardless of the technology behind it.
If you choose that format, the law requires, among other things:
- A system with safeguards (Art. 6.5). It must guarantee the integrity and immutability of the issuance, identify holders directly or indirectly, and determine the nature, features and number of the securities. The whole issuance must use the same form of representation (Art. 6.1).
- An issuance document (Art. 7). It identifies the entity responsible for the register and the securities, and it must contain sufficient information about the systems where they are recorded, including how they work and how they are governed (Art. 7.4). It is filed with that entity and made available to holders and the public (Arts. 7.2 and 7.3).
- An ERIR (Art. 8.4). The entity responsible for administering the registration and recording of the securities. We cover it in the next section.
- Legal effects on-chain. The security comes into existence with its first record in the system (Art. 10.1) and is transferred by the recorded transfer, which has the same effect as delivering the certificates (Art. 11.1).
- Attachments and inheritance (Art. 12.1). The system must be able to record attachments, court enforcement, transfers on death and encumbrances.
An issuance doesn't need prior administrative authorization (Art. 34.1). But if you offer the securities to the public, the general rule is to publish a prospectus under Regulation (EU) 2017/1129 (Art. 35.1), with exemptions such as certain offers below €8 million in the EU over twelve months (Art. 35.2.b). In some exempt issuances marketed to the public with advertising, an entity authorized to provide investment services must be involved (Art. 36.1). MiCA, on the other hand, does not apply to crypto-assets that are financial instruments (Art. 2.4 of MiCA). We go deeper in Law 6/2023 and securities tokenization and in our entry on tokenized transferable securities.
The ERIR: who keeps the register and who can be one
Article 8.4 of Law 6/2023 requires the issuer to appoint one or more entities responsible for administering the registration and recording of the securities in the system. They can be the issuer itself or entities it appoints, and the appointment goes in the issuance document. But there is a limit: in every case, it must be an entity authorized for the activity in Article 126(a), that is, safekeeping and administration of financial instruments for clients.
The CNMV spells this out in its Q&A on DLT-based financial instruments: for securities not traded on a Pilot Regime infrastructure, the ERIR first needs authorization for the ancillary custody service. It isn't a new type of entity but a new function or form of custody. So an issuer can only be its own ERIR if it holds that authorization. In addition:
- Official register. The CNMV keeps a register of ERIRs for each issuance (Art. 2(b) of Royal Decree 815/2023).
- Functions. Ensuring the integrity of the register, identifying holders, issuing certificates of entitlement (Art. 14), handling interest, dividends and other corporate events, and recording attachments and encumbrances.
- Contingency plan. Mandatory (Art. 5.2 of Royal Decree 814/2023). According to the CNMV, it must cover network incidents and even moving the register to another network.
- Liability. The ERIR is liable to anyone harmed by records not made, inaccurate or late (Art. 8.6).
- If the security trades under the Pilot Regime. When it is admitted to a DLT market infrastructure authorized by the CNMV under Regulation (EU) 2022/858, those functions fall on the infrastructure that settles it (Art. 8.5). See DLT Pilot Regime.
More detail in our ERIR entry and in our list of companies authorized as ERIR in Spain.
Step by step: issuing a tokenized security on ISBE
The exact order is set by the ERIR and the issuer's legal counsel. These are the steps you can't skip when the chosen network is ISBE's Main EVM:
- Classify the asset. Confirm with your legal counsel that the token is a transferable security and which offering regime applies: prospectus or exemption.
- Choose the ERIR. An entity authorized for custody, or the issuer itself if it is. Agree with it on the permissions it needs in the contract.
- Onboard the company on ISBE. Digital certificate of the legal representative, KYB verification and a did:isbe identifier. Legal entities in the European Economic Area can join.
- Choose a template or a custom contract. The ERC3643 template, pre-certified and built on ISBE's Core contracts and Diamond architecture, or an approved custom contract (mode 2), whose conformity review takes 4 to 12 weeks at level A, "Critical/Regulated." Mode 3, direct deployment, is meant for testing or for cases without demanding sector regulation.
- Set up the roles. Initial roles are listed in the deployment request and can be assigned to DIDs, not just addresses. The CNMV describes an issuance contract with functions only the ERIR can use: creating or removing securities at an address, freezing them and transferring them to another one.
- Build and test locally. On a local Besu network, without waiting for onboarding. The technical process is in how to deploy a smart contract on ISBE.
- Hand over and deploy. For a custom contract, according to ISBE's documentation, its staff deploy to PRE (Testnet, Chain ID 11073) and then to PRO (Mainnet, Chain ID 33073). With the template, deployed from the wizard, your company signs and ISBE's Factory deploys the contract immediately (ECO1020 policy).
- Issuance document and registration. The document describes ISBE as the recording system, including how it works and how it is governed, and is filed with the ERIR. The CNMV processes the ERIR's registration for that issuance.
- First record and placement. The security comes into existence with its first record on the network in favor of the issuer or the subscribers (Art. 10.1). Placement follows the LMVSI and MiFID II.
ISBE's ERC3643 template: what it includes and what to check
ERC-3643 (T-REX) is a proposal created on July 9, 2021 that now has "Final" status in the Ethereum proposals repository. It must be ERC-20 compatible and used with an on-chain identity system, and it defines interfaces for the token, the identity registry, compliance, trusted issuers and claim topics. We explain it in our ERC-3643 entry.
ISBE describes its template as an implementation of the ERC-3643 standard built on its Core contracts, with role-based access control, pausing, decentralized identity (DID) integration and ERC165 interface detection. Compared with an ERC-20, it adds a mandatory whitelist, compliance rules, full or partial freezing, forced operations and wallet recovery. Its compliance modules include balance caps and daily and monthly volume limits.
This table maps what the CNMV describes for the ERIR to the roles documented in the template:
| What the CNMV describes for the ERIR | Role and functions in ISBE's ERC3643 template |
|---|---|
| Limiting which addresses the security can move between (whitelist) | Mandatory whitelist validation; compliance rules under COMPLIANCE_ROLE |
| Creating securities at an address | MINTER_ROLE: mint, batchMint |
| Removing securities from an address | CONTROLLER_ROLE: forceBurn |
| Freezing securities, including while a certificate of entitlement is outstanding | FREEZE_ROLE: setAddressFrozen, freezePartialTokens |
| Transferring to another address: attachments, enforcement, inheritance | CONTROLLER_ROLE: forceTransfer |
| Returning the securities to their holder if keys are lost | RECOVERY_ROLE: recoveryAddress |
| Handling interest, dividends and other events | SNAPSHOT_ROLE: snapshot, balanceOfAt |
Three things we check before choosing between the template and a custom contract:
- Identity interfaces. The template page talks about a whitelist and DIDs, but it doesn't describe the identity, trusted issuer and claim topic registries defined in EIP-3643. If your ERIR or your platform relies on those interfaces, confirm it with ISBE.
- Who holds COMPLIANCE_ROLE. According to the documentation, that role can bypass all validations. The issuance document should say who holds it.
- Documented cases. As of October 16, 2026, the template's real-world use cases section reads "in the process of being documented."
What ISBE brings to a securities issuance
- A permissioned network with identity. Only verified organizations write, with KYB and did:isbe, and anyone can browse the network in its public explorers. The issuer, the ERIR and intermediaries are identified on the network; identifying each investor is still the ERIR's job, through the token's whitelist.
- Roles per organization. Contract permissions can be assigned to organizations' DIDs, not just to individual private keys.
- A circuit breaker. ISBE can pause the contract in serious incidents: in mode 1, through an irrevocable PAUSER_ROLE. ISBE presents this as a safeguard for regulated clients.
- Predictable costs. There is no per-transaction gas cost. Fee policy ADM1010 v1.0, dated December 16, 2025, sets monthly subscriptions starting at €500 for 50,000 transactions.
- Jurisdiction. It is a Spanish infrastructure, backed by the Community of Madrid and operated by Alastria, open to legal entities in the EEA. Its public repository announces, for Release 2026.2, node deployment with a European provider.
None of this makes ISBE responsible for the security's compliance. It gives the issuer and the ERIR a technical basis to demonstrate it. To compare ISBE with the other infrastructures, see ISBE, Alastria and EBSI: how they differ.
What ISBE doesn't solve
- It isn't an ERIR. ISBE doesn't present itself as one, and the law requires an entity authorized for custody (Art. 8.4). Its compliance page says the infrastructure takes the LMVSI into account, among other frameworks; that doesn't shift the issuer's or the ERIR's obligations onto ISBE.
- It doesn't classify the security or replace the prospectus, or the involvement of an investment services firm where the law requires it (Arts. 35 and 36).
- It isn't a market. Trading tokenized securities on a Pilot Regime infrastructure requires that infrastructure to hold its own Pilot Regime authorization (in Spain, from the CNMV). Deploying on ISBE doesn't provide it.
- It doesn't replace the ERIR's contingency plan. That plan must cover what happens if the network fails or stops being viable, including moving the register to another network.
- It adds a third-party power that must be disclosed. ISBE can pause the contract (directly, in mode 1). If it can't and the provider doesn't, it can filter the contract's address at network client level, with documented grounds (a security incident, a court order or another legal mandate) and approval from its governance committee. Our reading: since the issuance document must describe how the system works and is governed (Art. 7.4), that power should appear in it and in the contingency plan.
Cases in the official catalog: Token City and Bit2Me STX
The redisbe.com catalog lists 15 use cases, and two involve tokenized securities. Here is exactly what each source says, and what it doesn't.
Token City. The catalog describes it with the issuance, registration and transfer of bonds on DLT. A redisbe.com article dated August 13, 2026, titled (in Spanish) "Token City issues a bond on the ISBE network…," specifies that the company takes part in the project to design, issue and manage a bond on the network. The procedure described follows the usual steps: public deed and registration with the Commercial Registry, registration as ERIR with the CNMV, issuance and subsequent transferability, and listing on DLT debt markets. Token City added a Transaction Reporting module that records the participants, ISIN, price, quantity and time of each trade. According to the same article, it was registered in February 2026 as a securities agency (agencia de valores) in the CNMV register. The article gives no ISIN, amount or date for the issuance on ISBE.
Bit2Me STX. The catalog says the platform operates under CNMV supervision and allows the issuance and trading of tokenized shares and bonds. The redisbe.com article of August 4, 2026 states that Bit2Me STX "is deploying" on ISBE its platform for issuance, trading, custody and settlement, and that it is thereby laying the groundwork to join as a federated network. It adds that Bit2Me STX also takes on the ERIR function. On its regulatory status, it says the CNMV authorized it in November 2025 to become a securities agency and that it was in the final stage of obtaining a trading and settlement system license (DLT TSS) under the Pilot Regime.
One point not to mix up: the bond that Bit2Me STX issued, traded and settled in the CNMV sandbox (Valorix Token 4T24, €145,000) was tested between November 12, 2024 and February 20, 2025. ISBE launched on December 18, 2025, so that bond was not issued on ISBE.
Neither source says which token standard they use on ISBE, and the ERC3643 template doesn't yet document real deployments. What both cases do show is the underlying rule: an ERIR appears in both, and in neither is ISBE the one performing that function. To know which entity is registered as the ERIR for a given issuance, the reference is the CNMV's official register.
Who does what in an issuance on ISBE
| Party | What it does | Basis |
|---|---|---|
| Issuer | Classifies the security, drafts the issuance document, appoints the ERIR and, if it operates on the network, onboards on ISBE | Arts. 7 and 8.4 LMVSI |
| ERIR | Keeps the register, identifies holders, issues certificates, handles corporate events and attachments, and maintains the contingency plan | Arts. 8, 12 and 14 LMVSI; Art. 5.2 RD 814/2023 |
| CNMV | Authorizes custody, registers each issuance's ERIR in its official register and supervises | Art. 2(b) RD 815/2023; CNMV Q&A |
| ISBE (its Managing Entity) | Requires KYB and did:isbe from organizations, reviews or approves the contract, deploys it to PRE and PRO and keeps the ability to pause it | docs.redisbe.com; Framework Membership Agreement |
| Technology integrator | Designs and builds the contract, tests it, prepares the handover to ISBE and the technical description of the system for the issuance document | Contract with the issuer |
| Investor | Uses an address on the token's whitelist; the ERIR handles their identification | Art. 8.4 LMVSI; CNMV Q&A |
| Pilot Regime infrastructure, if the security trades | Takes on the ERIR functions for admitted securities | Art. 8.5 LMVSI; Regulation (EU) 2022/858 |
In our work building on ISBE, we act as the integrator: we prepare the contract in the chosen mode, assign the roles to the right DIDs, test on a local Besu network and write the technical description of the network for the issuance document. We don't act as ERIR or legal counsel: we work with the ERIR and the law firm the issuer appoints.
Frequently asked questions
Is ISBE an ERIR?
No. ISBE doesn't present itself as an ERIR, and Law 6/2023 requires the ERIR to be an entity authorized to safekeep financial instruments (Art. 8.4 together with Art. 126(a)). In the two securities cases in its catalog, that role belongs to another entity.
Can the issuer be its own ERIR?
Yes, if it is authorized for the custody service in Article 126(a) of Law 6/2023. Article 8.4 allows the issuer to appoint itself, but the CNMV clarifies that, for securities not traded under the Pilot Regime, the ERIR needs that prior authorization.
Do I have to use ISBE's ERC3643 template?
No. It's a pre-certified template that ISBE maintains on its Diamond architecture. You can hand over a custom contract and go through the mode 2 approval; for a regulated case, level A takes 4 to 12 weeks. The law doesn't mandate a token standard, it mandates functions: integrity, holder identification, attachments and certificates.
Who deploys the security's contract on ISBE?
According to ISBE's documentation, its staff do, in all three modes: first to PRE (Testnet) and then to PRO (Mainnet). The issuer or its integrator hands over the code and the configuration, including the initial roles. With the ERC3643 template in the wizard, the ECO1020 policy has the issuer sign the transaction and ISBE's Factory deploy the contract immediately.
Can ISBE pause my token?
Yes. In mode 1, ISBE keeps an irrevocable PAUSER_ROLE; in mode 2, the owner can revoke it, with residual risk; in mode 3 it isn't guaranteed. As a last resort, ISBE can filter the contract's address, with documented grounds and approval from its governance committee.
Does MiCA apply to a tokenized bond on ISBE?
No, if the bond is a financial instrument: MiCA excludes crypto-assets that qualify as such (Art. 2.4 of MiCA). MiFID II and Law 6/2023 apply instead, whether it is recorded on ISBE or on another network.
Sources
- Law 6/2023 of March 17 on Securities Markets and Investment Services (BOE, in Spanish)
- CNMV Q&A on DLT-based financial instruments (in Spanish)
- ERC-3643: T-REX - Token for Regulated EXchanges (Ethereum Improvement Proposals)
- ISBE template catalog: ERC3643 (docs.redisbe.com)
- ISBE deployment modes (docs.redisbe.com)
- Mode 1: Proxy Diamond with the ISBE library (docs.redisbe.com)
- Mode 3: direct deployment (docs.redisbe.com)
- ISBE network security and governance (docs.redisbe.com)
- Smart contracts on ISBE: troubleshooting FAQ (docs.redisbe.com)
- ISBE onboarding process (docs.redisbe.com)
- ISBE network parameters (docs.redisbe.com)
- ISBE use cases (redisbe.com, in Spanish)
- Token City issues a bond on the ISBE network (redisbe.com, August 13, 2026, in Spanish)
- Bit2Me STX deploys its Stock Exchange 3.0 on ISBE (redisbe.com, August 4, 2026, in Spanish)
- ISBE regulatory compliance page (redisbe.com, in Spanish)
- ISBE — Release 2026.1 project documentation (GitHub red-isbe/start-here, in Spanish)
- ISBE policies: ECO1010, ADM1010 and Framework Membership Agreement (GitHub red-isbe, in Spanish)
Framework verified as of October 16, 2026. Planning a tokenized securities issuance and considering ISBE as the network? Talk to us.