Authoritative Record Tokenized Securities

This approach is more useful than choosing a preferred technology label. It lets legal, operations, compliance, and technology teams describe the same workflow using the same evidence model.

System of record and authoritative record

A system of record stores and processes information. An authoritative record is the system that the relevant arrangement treats as controlling when a specific fact is tested or disputed. One software platform can be authoritative for several facts, but its authority should not be assumed merely because it contains data.

For example, an internal trade blotter can record an execution and expected settlement instructions. It may be the operational source for the firm's pending-trade status. It does not, without more, establish that an issuer has recognized a new registered holder. Similarly, a blockchain ledger can provide strong evidence of a signed, sequenced, and confirmed token transfer. Whether that event also changes a legal position depends on the design that connects the ledger to the applicable issuer, intermediary, or depository record.

The distinction matters most during exceptions. When two screens disagree, the team must first identify the fact at issue. A balance mismatch can be a network-state question, an account-posting question, a custody-allocation question, or a record-date servicing question. The appropriate source and correction path change with the answer.

Three record architectures

SEC staff's January 2026 statement on tokenized securities is a useful taxonomy. It distinguishes securities tokenized by or on behalf of the issuer from third-party tokenization structures. Within those categories, the authority map can be materially different.

Issuer-sponsored, ledger-integrated record

In one issuer-sponsored design, distributed-ledger records are integrated into the master securityholder file. The SEC staff statement describes a model in which transfer of the crypto asset results in transfer of the security on that file. The transfer agent may maintain related identifying or non-public information in linked offchain systems.

In this design, the ledger can play a central issuer-recordkeeping role, but the institution still needs to satisfy the applicable recordkeeping, security, reporting, retention, examination, and correction requirements. SEC Division of Trading and Markets staff has said that a registered transfer agent may use DLT as its official master securityholder file, or a component of it, if the applicable requirements are met. That is a staff view, not a blanket approval of every ledger design.

Issuer-sponsored, offchain master file with ledger interaction

A second model retains the official master securityholder file in an offchain recordkeeping system. The token can be a controlled representation, a transfer instruction, or another operating interface. Its transfer may trigger a transfer-agent process that validates identity, restrictions, authority, and other conditions before the official file is updated.

The ledger then remains essential evidence of the digital event, but it does not independently settle every issuer-level question. The governing documents need to specify the relationship between the ledger transaction and the master-file posting, including the treatment of pending events, reversals, and correction authority. Article 05, Digital Twin in Securities Markets, examines this controlled-representation model.

Third-party tokenized entitlement

A third-party structure can represent an interest held through an intermediary. Under UCC Article 8, a securities account is an account in which the maintaining party undertakes to treat the account holder as entitled to exercise the rights comprising the financial asset. A security entitlement can arise through the intermediary's book-entry and account relationship.

The issuer-level master file, the intermediary's account records, the custody or depository position, the wallet registry, and the blockchain can all therefore be relevant. The account record may govern the holder's entitlement. A depository may maintain the participant-level position. The ledger may record the movement of a permitted representation. The issuer's file may continue to show a nominee as the registered holder. The representation must be understood within that chain, rather than treated as a direct issuer claim by default.

DTC's fact-specific model

The December 2025 no-action letter to DTC offers a concrete example of an authority map. It describes DTC tokenized entitlements for eligible securities held through DTC. Tokens are associated with registered wallets, while the underlying securities credited to DTC's Digital Omnibus Account are not transferable from that account until the corresponding token is burned or otherwise processed under the service.

For recording tokenization entitlements, the letter states that LedgerScan's record would constitute DTC's official books and records. LedgerScan is described as an offchain system that scans the underlying blockchains to track token movement and registered-wallet holdings. At the same time, registered ownership of securities represented by tokenized entitlements remains in the name of Cede & Co., DTC's nominee.

The example illustrates why record authority cannot be reduced to a wallet balance. Within that DTC model, the issuer-level registered owner, DTC's entitlement record, registered-wallet status, and blockchain transaction history have separate roles. The letter is a fact-specific no-action position with defined operational limitations. It should not be treated as a universal hierarchy for every tokenized-security arrangement.

Ledger finality and legal completion

A ledger can have rules for finalizing or confirming transactions. Those rules determine whether a network accepts a transaction and reports a resulting state. They do not automatically determine whether all legal and operational conditions for a securities transfer, settlement, or corporate action have been met.

Delivery-versus-payment is a useful example. A token transfer may complete on a network while the cash leg remains pending, a required custodian posting has not occurred, or the workflow has failed an eligibility condition. A complete institutional process should define the state of each leg, the evidence necessary for completion, and the party responsible for addressing a break. The same discipline applies to corporate actions: a token snapshot can be relevant evidence, while a designated record-date servicing record and event terms determine allocation.

From conflict to resolution

When related records disagree, the response should be structured rather than improvised.

The first step is detection. Reconciliation controls compare the relevant positions, events, wallet status, and lifecycle states. The second step is classification: determine whether the break relates to the token, underlying position, entitlement, account posting, eligibility, or servicing event. The third step identifies the record that governs that fact under the applicable arrangement.

The team then preserves the evidence, contains the affected workflow where appropriate, and routes the matter to the owner who is authorized to make a correction. A correction might involve an account posting, a custody adjustment, a restriction or wallet-status change, a token cancellation or reissue where permitted, or a corporate-action adjustment. Each action should be linked to the initial evidence and reconciled across affected records.

This process avoids a common error: treating reconciliation as proof of authority. Reconciliation shows that sources align or do not align. It cannot decide which source controls an unresolved disagreement. That decision arises from the security structure and the governing rules.

An authority matrix for each instrument

Institutions benefit from maintaining a practical authority matrix for each tokenized instrument or programme. The matrix should identify the rights represented, the responsible entities, the controlling record for each fact, the permitted network and wallet model, the conversion rules, lifecycle data sources, reconciliation frequency, exception owners, and escalation route.

It should also record the boundaries. If a wallet is technically capable of a transfer but the holder is no longer eligible, the compliance or account authority record may govern the disposition. If an onchain representation has been retired but the conventional position has not been re-credited, the conversion is incomplete until the designated custody or depository record is updated. If a network event conflicts with a corporate-action snapshot, the event terms and record-date process need to determine the allocation.

This is the operational meaning of interoperability in tokenized securities: systems do not merely exchange messages. They preserve the connection between a financial right, a responsible party, a governing record, and the evidence of each lifecycle state.