Cross-Border RWA Compliance: Why Your Tokenized Asset Is Legal in Dubai but Illegal in NY

The Cross-Border Reality

A tokenized commercial real estate fund launches in March 2026. The structure is clean: a Cayman SPV holds the asset, a Dubai-licensed CASP issues the token, KYC is via Sumsub, and the smart contracts are audited. The team has lawyers in three jurisdictions.

Six weeks after launch:

• Their EU MiCA-licensed venue partner has onboarded 4,200 retail investors across France, Germany, and the Netherlands
• Their UAE marketing is targeting accredited and qualified investors with no friction
• Singapore institutional buyers are coming on through the Project Guardian-affiliated venue partner
• Their attempt to onboard US accredited investors via Reg D 506(c) is in week-five of accreditation verification with maybe 18 actual closes
• New York Department of Financial Services has sent a letter asking why the token was offered to a New York-resident user the team's geofencing missed

Same token. Five wildly different regulatory experiences. None of this is a hypothetical — it is the typical 2026 cross-border RWA launch profile.

This piece walks through the four major regimes (EU MiCA, US SEC, UAE VARA, Singapore MAS), explains where they diverge, and gives you a framework for choosing your launch jurisdiction and structuring cross-border flows.

Important disclaimer up front: this is informational content, not legal advice. RWA structuring is jurisdiction-specific, fact-specific, and changes as regulations evolve. Engage qualified counsel in every jurisdiction you intend to operate in before making structuring decisions. Nothing here should be relied on as a substitute for that engagement.

EU: MiCA, the World's First Comprehensive Crypto Regime

MiCA — Markets in Crypto-Assets regulation — entered full application in December 2024 after a phased rollout. It is the first jurisdiction-wide comprehensive crypto regulation in any major economy, and as of 2026 it is the operating environment for any RWA token offered to EU retail or institutional buyers.

Three token categories. MiCA distinguishes:

• Asset-Referenced Tokens (ARTs) — value referenced to a basket of assets (commodities, currencies, other crypto-assets). Most fractional RWAs fall here.
• E-Money Tokens (EMTs) — value referenced to a single fiat currency. Stablecoins and tokenized money market funds.
• Other crypto-assets — utility tokens and unregulated NFTs.

Issuer requirements. ART and EMT issuers need explicit authorization from an EU national competent authority. Authorization includes capital requirements (minimum 350,000 EUR own funds or 2% of reserve assets, whichever higher for ARTs), reserve management rules, marketing communications standards, and white paper publication. Authorization is passportable — once granted by one member state, it is valid across all 27.

Service provider requirements. Anyone providing a "crypto-asset service" — operating a trading venue, providing custody, executing orders — needs a Crypto-Asset Service Provider (CASP) license. Existing MiFID-licensed firms can passport into CASP activities under simplified procedures.

Retail access. This is where MiCA shines compared to the US. EU retail can buy MiCA-compliant ARTs and EMTs directly from CASPs without accreditation gates. Disclosure rules are strict but the access is broad.

Limits. Significant ARTs (those with large reserves or wide adoption) get extra prudential requirements. EMT issuers must be either credit institutions or e-money institutions. Algorithmic stablecoins are effectively banned for the ART/EMT categories.

In 2026, MiCA has driven a wave of formal authorizations and a cleanup of the prior unlicensed era. Several large global issuers have set up EU-authorized entities specifically to address the European retail market. Smaller issuers find authorization expensive — typical timelines run 6–12 months and cost six figures to seven figures depending on the category.

US: Howey, Atkins, and the 506(c)/Reg S/Reg A+ Path Stack

The US under chair Paul Atkins (post-Gensler) has been more publicly accommodating to digital assets than the previous administration, but the underlying legal framework has not been replaced. The Howey test (from 1946's SEC v. W.J. Howey Co.) still governs whether an instrument is a security: an investment of money, in a common enterprise, with an expectation of profit, derived predominantly from the efforts of others.

Most tokenized RWAs satisfy that test cleanly. Tokenized real estate fractional interests, tokenized credit, tokenized equity, tokenized funds — all are securities under Howey. Tokenized non-investment commodities (a digital warehouse receipt for physical gold held by the buyer) might not be, but those are edge cases.

That means RWA issuers offering to US persons need either Securities Act registration (rare and expensive) or a registration exemption. The three dominant exemptions:

Regulation D, Rule 506(c). Allows general solicitation (advertising) but limits purchasers to verified accredited investors. No offering size cap. Verification is paper-trail-heavy: tax returns, broker statements, or third-party verification letters. This is the workhorse exemption for institutional and high-net-worth RWA distribution. Form D is filed with the SEC.

Regulation S. Exempts offerings made entirely to non-US persons in offshore transactions. Requires no directed selling efforts in the US and (typically) restrictions on resale to US persons for a 40-day or one-year distribution compliance period depending on the asset class. Reg S is the standard structure for an offshore launch that wants to rigorously exclude US persons.

Regulation A+. A "mini-IPO" path allowing public offerings up to $75 million per 12 months with full SEC review and ongoing disclosure obligations. Reg A+ admits unaccredited US retail at primary issuance — the only SEC-compliant path that does. Tier 1 (≤$20M) is reviewed at the state level; Tier 2 (≤$75M) preempts state review. Disclosure quality is comparable to a small public registration statement.

Many 2026 RWA structures combine these: Reg D 506(c) for accredited US, Reg S for non-US, with US retail intentionally not addressed (or addressed via Reg A+ for projects that have the appetite and budget for full retail compliance).

Secondary markets. US secondary trading is hard. Reg D securities are restricted; resale generally requires another exemption (Rule 144 after holding periods, or Section 4(a)(7)). Alternative Trading Systems (ATSs) under Reg ATS provide regulated secondary venues — tZERO, INX, Securitize Markets — but liquidity is thin compared to MiCA-licensed European venues.

Enforcement. The 2024 SEC actions against several tokenization platforms established that "we incorporated offshore" is not a defense when US persons are reachable. Geofencing alone is not enough if marketing was directed at US users; the totality-of-circumstances analysis the SEC applies looks at directed selling efforts, KYC effectiveness, and the issuer's awareness of US flow.

UAE: VARA, ADGM, and the Friendly Regulator Story

VARA — the Virtual Assets Regulatory Authority — launched in March 2022 as a Dubai-specific virtual asset regulator. It runs a license-based regime covering issuance, exchange, custody, broker-dealer, lending, and management activities. ADGM (Abu Dhabi Global Market) operates a separate but compatible regime under the Financial Services Regulatory Authority (FSRA), focused more on institutional and capital markets.

Why it has become popular.

• Faster licensing timelines than EU or US equivalents (often 3–6 months end-to-end versus 6–18 months for MiCA authorization)
• English-language regulators with crypto-native staff
• Most structures pay no income tax
• Strong banking access through UAE-domiciled banks that are accustomed to virtual asset clients
• Free zones (DMCC, DIFC, ADGM) provide additional structuring flexibility

Practical model. A typical VARA-licensed RWA issuer obtains the appropriate license category (Issuance Services for primary, Broker-Dealer for distribution, Custody for safekeeping), works with a VARA-licensed venue for secondary trading, and sets up KYC tiering that respects each end-customer jurisdiction.

Limits. VARA is friendly but not lax. AML compliance is enforced rigorously, fit-and-proper testing for senior personnel is real, and capital requirements are non-trivial. The 2025 license revocations of several early holders for AML deficiencies served as a clear signal that licensing is not a rubber stamp. ADGM's regime is closer to traditional capital markets and tends to attract institutional issuers.

UAE jurisdictions are excellent for the issuer's home regime but do not solve cross-border distribution. A VARA-licensed token sold to a US accredited investor still needs a US securities exemption; sold to an EU retail buyer, it still needs MiCA-compliant intermediaries.

For diligence on operators in the UAE space, our guide to vetting RWA tokenization firms walks through what to look for in license verification, audit history, and reserve management.

Singapore: MAS, Project Guardian, and the Institutional Path

The Monetary Authority of Singapore regulates digital assets primarily under the Payment Services Act 2019 (for payment-token activities) and the Securities and Futures Act (for security-token activities). Project Guardian is MAS's industry sandbox, launched in 2022, that tests asset tokenization use cases with major financial institutions including JPMorgan, DBS, Deutsche Bank, Standard Chartered, and HSBC.

License options.

• Capital Markets Services (CMS) license under the SFA — for security tokens. Requires substantial capital, fit-and-proper directors, ongoing reporting.
• Major Payment Institution (MPI) license under the PSA — for payment-token activities and stablecoins.
• Recognised Market Operator (RMO) — for venues operating organized markets.

Why institutional issuers like it.

• Strong rule-of-law environment with predictable enforcement
• Sophisticated banking infrastructure with long crypto experience
• Project Guardian credibility — being a participant signals serious institutional grade
• Clear path for tokenized funds (the Variable Capital Company structure pairs well with tokenization)

Why retail-focused issuers find it harder.

• Slower licensing timelines than UAE
• More rigorous capital and operational requirements
• Singapore retail is small as a market compared to EU retail
• MAS has historically been cautious about crypto retail marketing

Pattern. Singapore tends to attract issuers targeting institutional and high-net-worth flows, particularly across the broader Asia-Pacific region. Many large 2026 tokenized fund structures have a Singapore CMS-licensed manager and a Project Guardian affiliation alongside a parallel UAE or EU presence.

For background on the underlying legal vehicles, our SPVs and tokenization guide covers how Cayman, BVI, Delaware, and Singapore SPV structures interact with each of these regimes.

A Comparison Table

This is a generalization — every actual structuring decision depends on the specific instrument, the target investor base, and the issuer's existing footprint.

Cross-Border Investor Flows

A few practical patterns recur in 2026:

EU retail issuers do not address the US. The cost-benefit of adding Reg D plus geofencing infrastructure to a MiCA-compliant retail token usually does not pencil out for issuers whose primary market is European. They rely on geofencing, KYC checks for US tax residency, and clear jurisdiction restrictions in their offering documents.

US-launched RWAs use Reg S for non-US distribution. A US issuer that wants global reach typically pairs Reg D 506(c) for US accredited with Reg S for non-US, layering MiCA-compliant venue partnerships for EU access.

UAE issuers run a hub-and-spoke model. A VARA-licensed entity issues, with venue partners in MiCA jurisdictions for EU retail, ATS partners for US accredited, and Singapore-licensed partners for institutional Asia.

Tax overlays matter. US persons are taxed on worldwide income. EU residents face wealth and capital gains regimes that vary by member state. UAE residents pay no personal income tax in most structures but UAE-domiciled corporate income may be taxed under recent corporate tax reforms. Singapore taxes capital gains lightly but income from token activity may be taxable. Always engage tax counsel.

Choosing a Launch Jurisdiction: A Decision Framework

The honest answer: most serious 2026 RWA projects need at least two jurisdictions, often three. A single-jurisdiction launch is feasible only for narrow target markets.

A rough decision framework:

• Primary target is EU retail? → MiCA-compliant issuance, EU-authorized issuer entity, CASP venue partners
• Primary target is US accredited / institutional? → Reg D 506(c), Delaware or Cayman SPV, ATS for secondary
• Primary target is global retail with regulator-friendly home? → VARA or ADGM in the UAE, with venue partners in destination jurisdictions
• Primary target is institutional, especially Asia-Pacific? → Singapore CMS license, Project Guardian affiliation, parallel UAE or EU presence

Layer on jurisdictions for distribution that are not your home base, with each addition adding operational complexity and legal cost. The decision is almost always "what is the marginal cost of adding jurisdiction X versus the marginal market access it provides." Our RWA tokenization pillar guide covers the practical decisions issuers face when scoping and launching.

Recent Enforcement: What 2024–2025 Taught the Market

A few patterns from recent enforcement worth internalizing:

• Offshore is not a defense when US persons are reachable. SEC actions against multiple platforms in 2024 made this explicit. Geofencing alone is necessary but not sufficient if marketing was US-directed.
• MiCA authorization does not exempt issuers from disclosure enforcement. A 2025 EU action against an authorized ART issuer for misleading reserve disclosures showed authorization is permission to operate, not a free pass.
• AML failures revoke licenses. VARA's 2025 revocations of early licenses for AML deficiencies signal that licensing in friendly jurisdictions is not a rubber stamp.
• Singapore enforces the SFA actively. MAS has taken action against unlicensed activity and unsubstantiated marketing claims; Project Guardian participation does not insulate from enforcement on unrelated activities.

Final Thoughts and Disclaimer

Cross-border RWA compliance in 2026 is genuinely complex, and the complexity is not an artifact — it is a real reflection of regulators having different views on retail access, disclosure, and crypto-native instruments. The mature playbook is multi-jurisdictional structuring with explicit geofencing, KYC tiering, and clear disclosures.

The "single global token launch" pitch is, in most cases, regulatory naivete or marketing. The "we will figure it out as we go" approach is how recent enforcement actions started.

This article is informational, not legal, financial, or tax advice. Regulatory frameworks change, jurisdiction-specific facts matter, and the differences between similar structures can be material. Engage qualified counsel in every jurisdiction you intend to operate in before making structuring or distribution decisions. Tokenized assets carry investment risk including total loss; cross-border tax implications can be significant; and regulatory enforcement risk is real even for compliant-feeling structures. Do not rely on this content as a substitute for jurisdiction-specific legal and tax advice.

For the broader RWA tokenization landscape and where compliance fits, see our pillar guide: [Real World Asset Tokenization Guide 2026](/blog/real-world-asset-tokenization-guide-2026).