Which Ledger Are You Actually Tokenizing?

A framework for securities tokenization and the secondary markets it requires

Philip Filhol  ·  21X AG  ·  April 2026

The word “tokenization” has become the most overloaded term in financial markets. It is used simultaneously to describe what DTCC is doing in its December 2025 pilot, what Ondo Finance is requesting SEC clearance for in its April 2026 no-action letter, what xStocks is doing with Kraken and what a DeFi protocol does when it wraps a synthetic exposure against no underlying at all.

These are not the same thing. They operate on different ledger layers, create different legal rights, attract different participants, and require fundamentally different secondary market infrastructure.

The confusion has direct consequences for how market participants evaluate products, and how trading venues position themselves in a market fragmenting faster than anyone has mapped it. This piece attempts that map.

Let us start with an investment account transfer

Every institutional reader has either executed or advised on an investment account transfer between brokers. It is a useful entry point because it makes visible something most market participants take for granted.

When you move your portfolio from Charles Schwab to Interactive Brokers, your shares do not move. They sit at the CSD (Clearstream or DTC) in an omnibus position that does not change. What moves is the entry on Charles Schwab’s internal ledger: Charles Schwab debits your account, Interactive Brokers credits it, and the two brokers reconcile against the CSD’s position. Your “share” never went anywhere. What changed was the chain of contractual entitlements recording your claim to it.

You do not own a share. You own a claim against your broker, who owns a claim against a custodian, who owns a claim against a CSD, who holds the registered position in the name of a nominee.

Tokenization does not replace this multi-ledger structure. It inherits it. The question that actually matters is: which ledger in the stack are you putting on-chain, and what does that layer’s token look like?

The four-layer custody stack

To answer that question requires a clear map of the layers:

The layers are not interchangeable. Moving one layer on-chain does not move the others. This is the point that most commentary on the DTCC pilot misses entirely. Even if DTC tokenizes their entitlements to Interactive Brokers it does not mean that IB-customers have a wallet or receive a token.

Layer 0: Tokenizing the issuer register itself

Before the DTCC pilot, before any broker-dealer ledger, and before any SPV-issued token, there is Layer 0; the issuer’s own share register. In the traditional US structure, this layer is largely invisible to investors: Cede & Co. sits as the single registered holder of virtually all publicly traded securities, and the issuer’s register reflects that one entry. Beneficial owners  do not appear here at all. The register is a legal anchor, not an operational market.

Tokenization opens a fundamentally different path at this layer. Companies like Securitize and Superstate are building SEC-registered transfer agent infrastructure that maintains the official shareholder register directly on a distributed ledger. In this model, the token is not a representation of an entitlement recorded somewhere in the custody stack. It is the share itself, issued and recorded at source by the company’s own transfer agent. There is no Cede & Co. nominee, no DTC omnibus position, no broker-dealer book-entry sitting between the investor and the legal record of ownership. The DLT record is the register.

This is the architecturally cleanest form of tokenization. It does not improve the existing intermediation stack, instead it removes most of it. A company that tokenizes at Layer 0 gives investors a direct legal claim recorded in the issuer’s own books, rather than a chain of entitlements stretching from a wallet through an SPV, through a broker, through DTC, to Cede & Co. The investor relationship with the company becomes direct and transparent in a way that the current system structurally prevents. However, a company tokenizing at Layer 0 faces immediate questions about how those shares interact with exchange trading, how corporate actions are administered at scale, and how broker-dealers maintain regulatory compliance when the security lives outside the DTC perimeter. These are solvable problems, but they require a regulatory architecture that does not yet fully exist in the US market.

Layer 1: the DTCC pilot – institutional infrastructure, institutional limits

The SEC’s December 2025 no-action letter for DTC’s tokenization pilot is a genuine milestone. It permits DTC to record participant security entitlements using distributed ledger technology, mint tokens representing those entitlements, and allow them to move between registered wallets on approved blockchains without DTC intermediating each transfer individually.

But the constraints built into the pilot define exactly what it is and is not. Token holders are DTC participants: regulated broker-dealers and banks. Tokens are transferable only between registered wallets belonging to those participants. Retail investors do not receive tokens. DeFi protocols cannot hold them. The tokens cannot be moved to a non-custodial wallet. And as is widely cited but insufficiently understood the tokenized entitlements carry no collateral or settlement value for DTC’s own risk management. They cannot be used to satisfy margin calls, net debit caps, or default-management controls.

This is not a criticism of the pilot. It is a deliberately conservative design. But it means something important: the DTCC pilot, even if perfectly successful, it does not immediately change the experience for the end investor. Your securities account at Charles Schwab looks identical the day after DTC goes live as the day before. The ledger between you and your broker (Layer 2) remains a traditional database.

What it does change, however, is the foundation. By upgrading the underlying market infrastructure (Layer 1), the pilot establishes the technical and operational groundwork on which user-facing tokenization can eventually be built, without disrupting existing client interfaces today.

Layer 2: the Ondo no-action letter – one layer deeper

Ondo Finance’s April 2026 no-action filing with the SEC’s Division of Trading and Markets is one of the most interesting regulatory documents in the tokenization space right now.

Ondo is proposing to tokenize OGM Limited’s security entitlements on Ethereum Mainnet. OGM Limited is the BVI SPV that issues Ondo Global Markets tracker certificates to non-US investors. It holds its underlying equities through Alpaca as broker-dealer. Ondo is asking the SEC to confirm it would not recommend enforcement action if Oasis Pro TA Ondo’s SEC-registered transfer agent mints ERC-20 tokens on Ethereum representing OGM Limited’s book-entry entitlement as recorded in Alpaca’s internal ledger.

This is Layer 2 tokenization. The token holder is OGM Limited not an individual investor. The token serves as an operational and collateral-monitoring tool, not a directly tradeable retail instrument. Alpaca’s off-chain records remain the official books and records throughout.

Could Layer 2 tokenization eventually make the Layer 3 debt wrapper unnecessary?

The debt structure of instruments like OGM tracker certificates does not exist primarily because the Layer 2 record is a traditional database rather than a blockchain. Instead, it exists because this structure offers regulatory flexibility in enabling on-chain securities that can function like stablecoins, remain compatible with DeFi and be distributed globally.

However, a plausible evolution exists: if Ondo’s NAL is approved by the SEC and Layer 2 entitlement tokens became directly transferable to end-investor wallets under an extended regulatory framework, the SPV intermediation could eventually be eliminated.

Additionally, even if these tokens were freely transferable, a critical question is whether they would be fungible with other Layer 2 tokens of the same type. A tokenized entitlement against Charles Schwab would most likely be implemented differently than one on Interactive Brokers – the result being non-fungible instruments that cannot be netted or traded against each other. This fragmentation would fundamentally limit the depth of any secondary market at this layer.

Layer 3: three instruments, not one

Layer 3 is where the popular understanding of tokenization lives and where that understanding is most confused. It’s the layer retail investors interact with. And there is no single “tokenized Tesla stock.” There are at least three distinct instrument types at this layer, each conferring different rights and requiring different legal treatment.

This distinction matters enormously for the secondary market analysis that follows, since different token types are tailored to different participant types.

Secondary markets: the right structure at the right layer

Layer 0 and Layer 1: the case for institutional trading venues

If the DTCC pilot produces tokens that trade, the structural match for that trading is a regulated trading venue running a central limit order book, not a DEX, not an AMM, not a bilateral OTC market. DTC participant counterparties are regulated institutions already operating within permissioned frameworks. The onboarding cost of permissioning is effectively zero relative to what these institutions already maintain. Block sizes are large. Pre-trade transparency obligations, best execution requirements, and market surveillance are ATS/MTF-native functions that neither DeFi venues nor bilateral OTC desks can perform. Settlement must reconcile against DTC positions, a process requiring a regulated infrastructure which can onboard with the DTC to instruct settlements.

This is the NASDAQ-equivalent argument for tokenized Layer 1 securities. Today, DTC-participant equity trading happens on trading venues that are permissioned, surveillance-capable, and institutionally structured. Tokenizing the underlying entitlement does not change the institutional character of the participant set or the regulatory requirements of their trading activity.

The strategic growth frontier for regulated trading venue therefore is Layer 1: building the infrastructure that does not yet exist for the upcoming tokenized DTC participant ecosystem, before that ecosystem crystallizes around a venue architecture. The DTCC pilot will produce institutional-grade tokens held by the same participants who trade on NASDAQ and NYSE today. When those participants want to trade their tokenized entitlements, they will need a venue that is permissioned, surveillance-capable, and capable of settling DTC positions. That venue does not yet exist. The window to build it is open now.

Layer 0 tokenization, where the issuer’s share register itself moves on-chain, could be argued as the architecturally most disruptive form of tokenization. Companies like Securitize and Superstate are building SEC-registered transfer agent infrastructure that records the official shareholder register directly on a distributed ledger. The token is not a representation of an entitlement buried several layers into the custody stack; it is the share itself.

This also explains why regulated trading venues are the natural match at this layer, and not AMMs or permissionless DEXs. A token that constitutes the legal share of a public company cannot move freely to any wallet without issuer oversight: transfer restrictions, shareholder record obligations, and securities law compliance follow the instrument regardless of which ledger it lives on. The transfer agent cannot allow token transfers to unknown or unverified wallets; every transfer is, in legal terms, a change in the shareholder register. That requirement maps directly onto a permissioned trading venue with KYC-verified participants, pre-trade compliance checks, and regulated settlement; not onto a liquidity pool where anyone with a wallet can interact. The permissioned nature of Layer 0 is not a limitation to be engineered around; it is a feature of how equity ownership works.

Layer 2: institutional settlement, not a trading market

Of all the layers in the custody stack, Layer 2 is where secondary market ambition is lowest. No major initiative today is building toward an active trading market for broker-dealer-to-client security entitlements. The tokens that Ondo proposes to mint at this layer are operational instruments: they track collateral positions, support mint and burn flows for OGM products, and improve reconciliation. They are not designed to be traded between counterparties.

It is worth asking why. A tradeable Layer 2 entitlement token, one that a client could transfer directly to another client, would solve a real problem: SPV issuer risk. Investors bear a layer of credit and operational risk on the issuing vehicle that they would not bear if they held the entitlement directly. If Layer 2 tokens became freely transferable between counterparties, the SPV wrapper could be eliminated entirely. Investors would hold a direct tokenized entitlement against a regulated broker-dealer rather than a debt claim against a BVI special purpose vehicle. The legal quality of the claim would improve, and the intermediation cost of the SPV structure would disappear.

The challenges, however, are significant and explain why no one has yet built this market. First, a tradeable Layer 2 entitlement token raises immediate questions under broker-dealer recordkeeping rules: if the token can move between wallets, which party’s books and records are authoritative? The Ondo NAL explicitly preserves Alpaca’s off-chain records as the official record precisely because making the on-chain token the definitive record of title would require a much more fundamental regulatory intervention. Second, the participant set at Layer 2 is today defined by broker-dealer relationships. Moving tokens freely between counterparties would require each recipient to have an established relationship with the originating broker or a framework for transferring the entitlement between brokers without the security passing through DTC settlement. Layer 2 tokenization is therefore best understood as prerequisite infrastructure for a future where these questions get answered – not as a trading market in itself.

Layer 3: Retail facing tokens in permissionless DeFi

Layer 3 tokens will find their natural secondary market liquidity in AMM pools, decentralised lending protocols and offshore trading venues operated by crypto exchanges. The structural advantages of DeFi are real: 24/7 operation, permissionless access, low minimum ticket sizes, atomic settlement. A permissioned regulated trading venue competing for this segment faces a structural cost disadvantage that is difficult to offset for small tickets and retail flow.

However, if we assume that institutional capital and regulated brokers will also be accessing Layer 3 tokens they will face constraints that AMMs cannot solve. A permissioned venue providing institutional trading to Layer 3 with proper KYC, trade reporting, and best execution documentation could serve a real need that AMMs and offshore exchanges are structurally incapable of meeting.

The opportunity for regulated trading venues on this ledger will be limited to specific regions and regulated participants. Consider a European-based platform that wants to offer permissionless tokenized stocks to retail clients. This would trigger MiFID obligations, forcing the broker to execute orders on a European trading venue. In this specific use case, a trading venue like a DLT-MTF for Layer 3 tokens becomes necessary.

Nasdaq, xStocks, and the logic of “bridging” ledgers

On March 9, 2026, Nasdaq announced a partnership with Payward, the parent company of Kraken and the infrastructure layer behind xStocks, to build what it calls an “equities transformation gateway.”

Practically, this allows investors to hold xStocks tokens in self-custodial wallets, use them in permissionless AMMs or lending protocols, and then bridge them back into Nasdaq’s regulated perimeter for institutional trading. The significance is substantial: it introduces a controlled bridge between traditional capital markets and permissionless DeFi.

By contrast, the DTCC pilot takes a deliberately conservative approach. Tokens issued within this framework are designed to remain inside the institutional perimeter, without direct access to permissionless markets. However, this is best understood as a design choice rather than a limitation. In effect, it builds a trusted foundation for tokenized securities within the regulated system. This foundation is critical, as it enables concrete use cases such as 24/7 trading, more efficient cross-border settlement, real-time or near real-time collateral mobility, and the ability to use securities as programmable collateral across venues.

From that perspective, Nasdaq’s gateway model and the DTCC approach are complementary rather than competing. One enables extension into permissionless environments, while the other ensures that the institutional backbone is robust, compliant, and broadly adoptable. The likely end-state is a hybrid model: issuer-sponsored (Layer 0) or DTC-led (Layer 1) tokenization at the core, combined with regulated gateways that enable movement between permissioned and permissionless markets, similar to what xStocks and Nasdaq are building. Beyond that, the market is likely to evolve into multiple layers of DLT-based capital markets, each with distinct participant groups, regulatory frameworks, and degrees of openness, rather than a single unified system.

Not one venue to rule them all, but the right venue at each layer

The word “tokenization” is doing too much work in current regulatory and market discourse. It describes instruments that are legally, structurally, and operationally as different from each other as a repo agreement is from a retail ETF.

One cannot apply a single regulatory framework uniformly across the four ledger layers as it would systematically mis-fit most of them. It will either over-restrict Layer 3 permissionless instruments where DeFi-native market structure is genuinely appropriate or under-protect Layer 1 institutional tokens, where systemic risk management and regulated venue oversight are essential.

Therefore, the path forward as a trading venue requires understanding layer-specific regulation, different investor access frameworks, and the viability of a regulated trading venue for each token type. The infrastructure for each layer is not the same. The participants are not the same. The trading venues will not be the same.