The first two parts treated tokenisation as a technical and operational matter. This part is the legal interface. Three questions sit on top of every institutional tokenisation programme: when does a transfer become irrevocable in the eyes of national law, what duties does the custodian holding the token take on, and by what statutory or common-law mechanism does the chain entry actually become operative property at all. The answers vary by jurisdiction, and an issuer running identical smart-contract behaviour in four places is running four different legal instruments.
Settlement finality
Settlement finality is the moment, defined under specific national law, at which a transfer can no longer be reversed by an insolvency, a court order, or a counterparty repudiation. In English law, finality for designated payment systems flows from the Settlement Finality Regulations, which trace back to the EU Settlement Finality Directive. In Hong Kong, finality for designated systems is governed by the Payment Systems and Stored Value Facilities Ordinance, with the HKMA as designating authority. In Singapore, the Payment Services Act and the Securities and Futures Act allocate finality across payment and securities settlement systems respectively.
Tokenisation does not automatically grant finality. A transfer between two wallets on Ethereum is, in the eyes of Hong Kong contract law, an instruction to make a transfer. Whether the transfer is final depends on whether the system the wallets sit in has been designated, whether the parties have agreed in advance to treat the chain entry as final, and whether the relevant insolvency regime would respect that agreement against a liquidator. Chapter IV picks this apart in detail. The headline is that legal finality and block-level finality are separate concepts that need to be aligned by designation rather than assumed to coincide.
This is why so much of what looks like over-engineering on permissioned tokenisation platforms (rulebooks, designation, central bank operator roles) is load-bearing. Without it you do not have settlement, you have a series of irrevocable-looking promises that may unwind in a stress event.
Custodial liability
Custodial liability is the second pillar of the legal interface. When a bank custodies tokenized assets for a client, the bank takes on duties under its custody agreement and under the prudential rules that apply to custody. The Basel SCO60 standard sets the prudential treatment of bank exposures to crypto-assets more broadly, classifying tokenized traditional assets that meet the standard's classification conditions as Group 1a and unbacked crypto as Group 2, with sharply different capital treatment (Basel SCO60).
Group 1a treatment requires that the bank be able to demonstrate, on demand, that the on-chain holdings reconcile to the underlying, that the legal claim is enforceable, and that operational risk capital has been set aside against the chain itself. The token does not, by virtue of being a token, reduce custodial liability. It tends to increase it, at least at first, because the bank now also bears the operational risk of running or relying on the chain.
Legal control of tokenized records, by jurisdiction
Parts 1 and 2 insisted on the legal-versus-technical split without naming the actual legal mechanism by which a chain entry becomes operative. That mechanism is jurisdiction-specific. The four major financial jurisdictions for institutional tokenisation are converging on a "control" or "possession-equivalent" test, but the timing and the level of codification are not aligned.
In the United States, the relevant plumbing is the Uniform Commercial Code (UCC). Article 8 has long governed investment property and the indirect holding system that runs through securities intermediaries, which is how almost every US-listed security is actually held. What Article 8 did not contemplate was a digital record that itself carries rights, transferable peer-to-peer without an intermediary on the other side. The 2022 UCC amendments fixed this by adding Article 12, which creates a new property category called controllable electronic records (CERs) (Uniform Law Commission). Article 12 has been enacted by most US states across 2024 and 2025. The key concept is control, which functions as the digital analogue of physical possession for a paper bearer instrument. If a party has control of the CER under the statutory test, the transfer is good against third parties and the chain entry is operative for property-law purposes. This is the actual answer to "why does the on-chain record govern" in the US, and any US tokenisation counsel will be reasoning from it.
English law has taken a different route, courts first and statute second. The Law Commission's June 2023 final report on Digital Assets recommended recognising crypto-tokens as a distinct property category, a "third category of personal property" sitting outside the traditional split between things in possession and things in action. The Property (Digital Assets etc) Bill was introduced to put some of these recommendations on a statutory footing. Practically, English courts had already been receptive to treating crypto as property in injunction and proprietary-claim contexts, so the legislation is consolidating a direction the case law was already moving in.
Singapore has not enacted a UCC Article 12 equivalent, but the substantive position is close. The Securities and Futures Act recognises electronic securities, and the Personal Property Securities framework together with trust law gives a workable overlay. The Monetary Authority of Singapore (MAS) and the Singapore Academy of Law have published extensively on tokenisation, and Project Guardian has been the testing ground (MAS Project Guardian). The legal test for control is similar to the US one in substance, even where the statutory architecture differs.
Hong Kong is the least codified of the four. There is no statutory CER analogue, and reliance falls on the Personal Property Securities Ordinance, common-law trust principles, and contractual designation. The Stablecoins Ordinance addresses one slice of the digital-asset stack but does not extend to securities generally, so for tokenized securities the legal characterisation is still being argued case by case (HKMA stablecoin regime commencement).
The convergence pattern is clear. Every major financial jurisdiction is moving toward a "control" or "possession-equivalent" test for digital records, but the timing and codification are not aligned. An issuer running identical smart-contract behaviour across all four can find that the underlying property characterisation differs in each, and any cross-border programme has to budget legal opinions accordingly.