PART TWO
Same Routes, New Risks
The caravanserai is now a custody platform. The qadi is now five regulators at once. What it takes to be the infrastructure layer that holds when everything else is in motion.
The technology’s precision exposes the imprecision of everything built around it. That is not a flaw. It is a mirror.
When a smart contract executes, it enforces the logic written into its code. But it cannot enforce the legal claim written into the underlying documentation unless those two things are precisely, deliberately aligned. That alignment does not happen automatically. It requires legal structuring, custody architecture, and governance design to be built as a single coherent system rather than assembled in layers after the fact.
A bill drawn in Venice and presented in Constantinople was only as good as the bilateral treaty between the two powers, the local court’s willingness to recognise it, and the broker community’s ability to translate between the two legal cultures. Remove any one element and the bill became, at best, a polite request.
A tokenised real-estate asset issued under English law, distributed through a Singapore-regulated platform, with custody held in the UAE presents the same challenge in modern form. The token may represent a fractional claim. The smart contract may execute without error. But if the local legal structure does not recognise the token as a valid title instrument, or if custodial responsibility is ambiguous at the moment of stress, the chain of enforceability breaks. Technology made the instrument more precise. The imprecision it reveals was always there.
Imagine a tokenised infrastructure bond issued in one jurisdiction, distributed in another, custodied in a third, and used as collateral in a fourth. The smart contract executes exactly as designed. The operational question begins only afterwards: who recognises the transfer, who has authority to freeze the asset if sanctions change, who bears liability if the issuer becomes insolvent, and which court has jurisdiction when those answers diverge? Infrastructure exists to answer those questions before markets are forced to.
This is no longer a theoretical architecture. MAS Project Guardian has run live institutional tokenisation experiments across fixed income, foreign exchange, and asset management — and its published findings have been more honest about failure modes than any comparable programme. The failure modes it identified were not technical. They were the same legal, jurisdictional, and operational questions this article has spent its first half building toward.
The Geographic Dimension
India
India is a market where regulatory aspiration and operational clarity are still being negotiated in real time. SEBI’s evolving framework for securities-backed tokens, the IFSCA sandbox at GIFT City, and the RBI’s cautious stance on digital asset settlement operate as distinct layers, where the same transaction can attract different interpretations depending on which regulator has jurisdiction over which part of the chain.
The hundi system worked because it lived in the spaces between formal oversight, governed by community norms rather than statute. Tokenisation platforms that try to inherit that informality will fail. The commercial appetite in India is genuine and growing, but compliance architecture must be built to the same standard as the ambition, moving together rather than catching up afterward.
GIFT City offers the most tractable entry point: a regulatory environment closer to international norms, with cross-border settlement questions that are more workable than on the mainland. The institutions that move there first with rigorous structure will set the template for what follows.
UAE and The Gulf
The Gulf’s defining feature is regulatory plurality, and it is both the market’s greatest strength and its sharpest operational trap. VARA in mainland Dubai, DIFC under common law, and ADGM with its own Financial Services Regulatory Authority each represent distinct frameworks — and alongside them, the CMA (formerly the Securities and Commodities Authority) operates as the primary mainland UAE regulator for securities and commodities, with an evolving digital assets framework that intersects with tokenised instruments in ways that are still being clarified. These four bodies present different treatment of digital assets, different AML requirements, and different assumptions about who bears custodial responsibility.
Choosing the wrong framework for a given asset class is not a minor inconvenience. It is a structural liability that surfaces under pressure, usually mid-transaction and at the worst possible time.
The karimi of the Mamluk era thrived because they understood all the jurisdictions well enough to advise which one to use for which purpose. That remains the differentiating capability in the Gulf today: not merely “we can operate here” but “here is why this structure in this jurisdiction is the right one for this asset and this investor base.” Saudi Arabia extends the calculus further, as Vision 2030 has created genuine institutional appetite for tokenised real estate, project finance, and sovereign sukuk. The AML and sanctions surface area in cross-border transactions involving the Kingdom requires exceptional operational discipline. The consequences of inadequacy are not measured in fines. They are measured in programme termination.
The Mamluk broker who misread a tariff schedule lost his licence. The modern infrastructure provider who misreads a sanctions list loses something considerably larger. The function has not changed.
Europe
Consider a tokenised corporate bond issued under German law. The token itself may move seamlessly between wallets, and the smart contract may execute settlement without error. But ownership transfer, investor disclosures, custody obligations, and insolvency treatment may still sit under different legal frameworks. The technical settlement succeeds. The legal settlement may remain contested for months.
That scenario is not hypothetical. MiCA simplifies some things and complicates others. Treating its passage as a resolution rather than a beginning is the most common and most costly misreading of the European landscape right now. MiCA provides a passport mechanism for crypto-asset service providers and a classification framework for certain token types. But security tokens that meet the definition of financial instruments under MiFID II fall largely outside MiCA’s primary scope — though the classification boundary remains actively contested and unresolved for hybrid instruments. That uncertainty is itself a risk: an asset that crosses the classification line mid-lifecycle may find its regulatory treatment has shifted beneath it.
The practical result is a landscape where a tokenised bond issued in Frankfurt, distributed through Amsterdam, settled in Luxembourg, and held in custody in Dublin may involve four separate regulatory interpretations of the same instrument, under frameworks that do not consistently map onto each other.
DORA, in force since January 2025, adds a distinct operational resilience layer covering ICT risk management, incident reporting, third-party service provider oversight, and operational testing. Every smart contract dependency, every TSP relationship, every custody integration sits inside DORA’s scope. The practical failure mode is not non-compliance on paper — it is the discovery, mid-incident, that the contractual chain of responsibility between token issuer, distributor, custodian, and smart contract auditor has a gap that no single entity owns. Treating DORA as a checkbox rather than an operating standard is the modern equivalent of the Antwerp merchant banks of the 16th century: coherent on paper, brittle under stress, and catastrophically exposed the moment the system encountered real pressure.
Europe is more legible than other regions. It is not simple. Legibility without precision is its own kind of risk.
Latin America
Latin America is not one market, and the institutional error of treating it as such has derailed more expansion strategies than any single regulatory obstacle. Brazil is the clear leader. The Banco Central do Brasil’s Drex initiative — a wholesale CBDC in advanced pilot, built with tokenised asset interoperability as a design goal rather than an afterthought — is one of the most architecturally serious digital currency programmes running anywhere in the world. The domestic capital market is sophisticated: Brazil’s CVM has engaged seriously with security token frameworks through Resolution 88 (2022), and the infrastructure for tokenised real estate, agricultural commodities, and infrastructure debt is maturing faster than most international observers appreciate. These are near-term opportunities.
Mexico is the second most material market. The CNBV’s fintech law framework provides a regulatory entry point, though the gap between the law’s ambition and the pace of licensing implementation is wider than it appears from outside. The depth of the institutional investor base is underestimated by platforms approaching the region from a retail-first perspective. Cross-border settlement between Mexico and the United States introduces OFAC considerations and Bank Secrecy Act obligations on the US side that must be addressed in custody and distribution architecture before the first transaction, not after.
Chile, Colombia, and Peru have active institutional communities and frameworks at earlier stages of development, with varying degrees of conviction behind them.
Three fault lines run across the region. Capital control histories in several jurisdictions can affect the enforceability of cross-border claims in ways that standard token documentation does not anticipate. The sanctions and AML surface area is significant and demands rigorous investor onboarding. And judicial enforceability of smart contract outcomes remains genuinely uncertain in most jurisdictions: the legal structuring layer beneath the token is load-bearing from day one.
The silver miners of Potosí moved enormous value across multiple colonial administrative zones, each with its own toll, tariff, and enforcement regime. They survived by knowing exactly where each link could fail. That discipline is still the entry requirement.
Southeast Asia and Taiwan
MAS is among the most sophisticated digital asset regulators operating anywhere in the world — a judgement supported by the design depth of Project Guardian relative to comparable programmes, and by its unusually honest published treatment of what the pilots did not resolve. But MAS sophistication does not mean MAS simplicity. Its expectations around custody segregation, investor eligibility, and cross-border distribution are detailed and demanding. The MAS does not penalise complexity. It penalises imprecision, and the distinction matters enormously.
Across the wider region the picture fragments quickly. Indonesia has an active OJK-led development process with uneven enforcement. Thailand’s SEC has engaged seriously with digital securities but the institutional-grade RWA framework is still maturing. Vietnam is at an earlier stage. A pan-ASEAN tokenisation platform is a multi-year institutional build, not a launch event.
Taiwan sits apart from the ASEAN picture. The FSC’s framework carries distinct treatment of securities tokens, custodial rules that do not translate cleanly to international practice, and a geopolitical context that imposes business continuity obligations most platform risk frameworks have not formally addressed — specifically, the need for documented operational continuity plans that do not depend on cross-strait infrastructure or personnel access. It is not a market to approach with a regional template.
The great trading houses of Guangzhou and Malacca did not operate one model across all of Southeast Asia. They operated locally fluent versions of the same underlying discipline. That remains the only viable approach.
The Infrastructure Layer
The caravanserais along the Silk Route did not own the goods they housed. They did not adjudicate disputes or issue letters of credit. They provided the secure resting point, the local knowledge, and the web of relationships that made the onward journey possible. A merchant who left and then made poor decisions, carried fraudulent documents, or violated the laws ahead was not the caravanserai’s failure. But a caravanserai that was poorly run or that sheltered bad actors was everyone’s problem, because the routes depended on the infrastructure being trustworthy. Its integrity was not a feature of the service. It was the condition that made all other services mean anything.
The providers that will earn a durable position in the RWA tokenisation stack are those operating at the infrastructure layer in exactly that spirit: not issuing tokens, not taking legal title to underlying assets, not advising on investment, but providing custody infrastructure, key management architecture, and the operational continuity that allows the broader system to function with institutional confidence.
That positioning is honest, defensible under pressure, and consistent across jurisdictions precisely because it does not depend on a particular regulatory outcome in any single market. It depends on the same thing the karimi, the hawaladars, and the hundi brokers depended on: the trust of counterparties across long distances and long time horizons, maintained through operational discipline and absolute clarity about where responsibility sits.
The future of tokenisation will not be decided by the sophistication of the instruments. It will be decided by the credibility of the institutions, jurisdictions, and infrastructure providers willing to stand behind those instruments when the system encounters its first serious stress. That moment is closer than most participants in this space currently believe. The civilisations that built the first trust architectures knew something the digital asset industry is still learning: the token is never the hard part. The hard part is everything that makes the token worth honouring.
Also Read: The Architecture of Trust: What 4,000 Years of Trade Teach Us About RWA Tokenisation
