Tokenisation in India explained: What it means for securities, regulation and investors

Partners: Shruti Rajan and Anubhav Ghosh

This is a link enhanced version of the article that first appeared on CNBC-TV18.

India is testing tokenised bonds through SEBI and IFSCA pilots, but key questions around ownership, regulation, custody and smart contracts remain.

Securities regulators the world over have been intrigued by tokenisation — the representation of ownership or economic rights in an asset as a digital token on a distributed ledger — and by how it translates into securities trading.

Earlier this year, the SEC approved Nasdaq’s proposal to permit trading of securities in tokenised form. In India, what had long been a subject of academic curiosity now finds a proof of concept in a live IFSCA pilot at GIFT City and, onshore, in SEBI’s Demat 2.0 pilot for tokenised corporate bonds, announced on September 10, 2026. But the eternal questions persist — is a token a security? Who regulates it? And can I actually issue one today?

Is a token a “security”?

Section 2(h) of the Securities Contracts (Regulation) Act, 1956 (“SCRA”) defines “securities” to include shares, stocks, bonds, debentures and “other marketable securities of a like nature”. The definition is deliberately open-ended and can extend to a digital token where the rights it represents match those of a traditional security. That is what separates a token representing an underlying instrument, within SEBI’s investor-protection perimeter, from an asset-backed or “utility” token that references value without conferring the incidents of a security.

The emerging global answer avoids the classification question rather than resolving it. In approving Nasdaq’s tokenised trading rule in March 2026 (Release No. 34-105047), the SEC required a tokenised share to be fungible with its conventional counterpart, to carry the same CUSIP and ticker, and to confer identical rights. SEBI’s pilot arrives at the same place: the bond is issued natively as a token, yet keeps the same ISIN, coupon, maturity, covenants, rating and investor rights, so Section 2(h) never has to be stretched.

The pilot projects

SEBI has been consistent about where it stands: tokenisation is “work in progress”, built through supervised pilots rather than a standalone rulebook. The onshore landscape is now defined by Demat 2.0, announced jointly by the RBI and SEBI at the Global Fintech Fest on September 10, 2026. REC Limited issued first on September 7, raising ₹5,000 million from 18 investors, followed on September 9 by L&T (₹5,000 million) and IIFL (₹250 million). The pilot treats tokenisation as an evolution of the existing dematerialised infrastructure, not a parallel market structure that bypasses depositories.

SEBI’s FAQs put the legal consequence beyond doubt: the depository remains the authoritative record of beneficial ownership, and the ledger does not displace its statutory role under the Depositories Act, 1996. That turns on a design choice off the ledger. The depositories hold and manage the private keys for investors, so a tokenised holding sits inside the existing demat account under existing KYC, and a freeze or attachment on the account applies to the token. Control of the key is control of the asset, and that is what keeps the statutory record where it already was.

On the funds leg, it connects to the RBI’s wholesale CBDC through the Unified Market Interface, so the securities and cash legs settle atomically and the interval between trade and settlement, with the counterparty exposure in it, disappears. So does the intermediary whose rules ordinarily locate the moment at which settlement becomes final and immune from unwinding. SEBI has listed settlement finality among the pilot’s stated objectives, which is the right place for it to be resolved.

SEBI is also engaging internationally through IOSCO’s Tokenisation Working Group, which is developing a second-phase report on tokenisation adoption and “equity tokens”. This is a truly globalised effort that will allow our policy to be shaped by cross-border regulatory convergence rather than a purely domestic policy choice.

The GIFT City / IFSCA track and its immense potential

The International Financial Services Centres Authority (“IFSCA”) has moved early here as well, but has not finalised a standalone framework.

Consultation paper (February 2025). IFSCA’s “Regulatory Approach towards Tokenisation of Real-World Assets” set out the issues rather than firm rules and did not commit on whether token issuance should itself be a regulated activity. Absent a licensing category for tokenisation as a business, access is by Limited Use Authorisation under the IFSCA FinTech Sandbox Framework dated March 16, 2026. Clause 7 requires every applicant first to run the classification exercise under the IFSCA (TechFin and Ancillary Services) Regulations, 2025 — whether the activity falls within IFSCA’s perimeter at all.

Market conduct applies regardless. IFSCA notified the IFSCA (Prohibition of Market Abuse in Securities Markets) Regulations, 2026 in September 2026, consolidating insider trading and fraudulent/unfair trade practice rules for the IFSC and displacing SEBI’s 2015 and 2003 regulations within that zone. Insider trading prohibitions and bans on manipulative and unfair practices therefore already bind tokenised-securities activity in or from the IFSC, whatever the eventual tokenisation rulebook says.

Recurring legal issues

Across both tracks, the same issues recur:

1. Title and custody. Within the pilot, SEBI has answered this by keeping the depository as the authoritative Outside it, whether the depository record or the ledger entry constitutes legal title, and who is custodian of record, must be addressed contractually in every transaction.

2. AML/KYC and cross-border Tokenised instruments move across borders more easily, raising obligations around beneficial ownership identification and transaction monitoring, particularly for platforms courting foreign investors into Indian-referenced assets.

3. Smart contracts and programmability. In Demat 2.0, the bond’s economic terms are encoded into the token itself, so the documentation must say what governs if the deployed code and the debenture trust deed diverge, and who bears the loss where code executes as written and produces the wrong result. The feature cuts the other way too: transfer restrictions, eligibility conditions and lock-ins can be encoded so a non-compliant transfer fails rather than settling and being unwound. Compliance then moves from detection after the event to prevention at the point of transfer, a different supervisory proposition from the one enforcement machinery is built around.

4. Interoperability and Common technical standards across DLT platforms are absent, and SEBI has begun factoring quantum-computing risk into its supervisory view. The Demat 2.0 ledger is private and permissioned, with nodes operated by depositories and stock exchanges — market infrastructure institutions already inside SEBI’s cyber-resilience perimeter.

The Companies Act, 2013 overlay

The Companies Act, 2013 sits underneath as a separate layer. The register of members under Section 88 and the dematerialisation mandate under Section 29 both assume a depository-anchored model, which is precisely why the token has been layered on that system rather than substituted for it. Section 56’s transfer procedure and the stamp duty on the instrument of transfer assume a paper-or-demat model onto which a smart-contract transfer must still be mapped, and fractionalisation strains beneficial-ownership disclosure under Sections 89 and 90. Much of this stays dormant while the pilot is confined to corporate bonds. It becomes live the moment tokenisation moves to equity, and warrants separate treatment.

India’s approach is best understood as regulator-led, sandbox-first and deliberately incremental. SEBI has resisted a comprehensive rulebook ahead of tested pilots. IFSCA has granted conditional market access but likewise stopped short of a finished framework, preferring to resolve foundational questions — including whether tokenisation should itself be a licensed activity — through consultation. Everything visible today, onshore and in GIFT City, remains a pilot, and is better read as a test of architecture than a settled rulebook. Transaction planning should be built around that, with regulatory optionality and realistic sandbox timelines designed in.

Download PDF