Tokenized Securities Transfers Under the UCC: What the PEB’s New Report Means for Market Participants

The Permanent Editorial Board (PEB) for the Uniform Commercial Code (UCC) has issued a report addressing an increasingly important question for digital-asset and securities markets: Can existing US commercial law accommodate the use of blockchain-based or other digital tokens to transfer securities?

The PEB’s answer is largely yes. More precisely, the report concludes that existing rules in Article 8 of the UCC permit an issuer to use a digital token as the mechanism by which a holder instructs the issuer to transfer the registered ownership of an uncertificated security—a security not represented by a physical certificate.

The same mechanism can also be used to establish a “control agreement” that gives a purchaser, including a secured lender, control of the security for UCC purposes. The result can provide a similarly functional equivalent to tokenization of the security without treating the token as the security.

KEY DISTINCTION: TOKENIZING THE TRANSFER, NOT NECESSARILY THE SECURITY

The report’s most important conceptual point is the distinction between a security and the digital token associated with it.

Article 8 governs the registered ownership and transfer of securities. For an uncertificated security, registered ownership is reflected on the issuer’s (or its transfer agent’s) books and records rather than represented by a physical certificate. The report calls this the “direct-holding” system. By contrast, investors frequently hold securities indirectly through a broker, bank, or other securities intermediary. In that case, the intermediary is the direct or indirect holder of the underlying securities, while its customer has what Article 8 calls a “security entitlement.”

The PEB principally focuses on the direct-holding system. Under its model, the token itself is not the Article 8 security. Instead, the token is an electronic record that serves as part of the issuer’s infrastructure for administering the security. Control of the token gives its holder the practical ability to cause specified actions relating to the associated security.

That distinction matters because transferring a token does not, merely by virtue of the token’s existence, transfer ownership of whatever real-world asset is associated with it. The legal effect of transferring the token depends on the law governing the associated asset and the contractual and operational arrangements linking the token to that asset. For securities that are covered by the report, Article 8 supplies the relevant legal architecture.

HOW A TOKEN CAN TRANSFER REGISTERED OWNERSHIP

Article 8 already contains a mechanism for transferring an uncertificated security. An issuer (or its transfer agent) generally must register a transfer when it is presented with an effective “instruction” from the appropriate person and the other statutory conditions are satisfied. An instruction is essentially a communication directing the issuer (or its transfer agent) to register a transfer.

For tokenization, Article 8 permits information to be communicated by a mechanism agreed upon by the sender and recipient. The PEB builds its tokenization model on those provisions.

Suppose Sally is the registered owner of shares of Alpha Corporation, which are uncertificated securities. Alpha creates a digital “Alpha Token” associated with those shares and establishes its platform so that transferring control of the token is the exclusive method for instructing Alpha to change the securities’ registered ownership. Sally controls the token in her digital wallet.

If Sally sells the shares to Bill, she transfers control of the token to Bill. Under Alpha’s arrangements, that transfer constitutes Sally’s instruction to Alpha (or its transfer agent) to register Bill as the owner of the associated shares. Alpha (or its transfer agent) then records Bill as the registered owner.

The token therefore performs a function analogous to an electronic transfer instruction. The underlying legal right to instruct the issuer (or its transfer agent) comes from Article 8 and Sally’s status as registered owner—not simply from Sally’s possession or “ownership” of the token.

This distinction also explains why the PEB does not need to resolve the ownership of the token. In the analyzed structure, property rights concerning the token are irrelevant. It is control of the token, and the consequences that the issuer (or its transfer agent) has agreed will follow the transfer of control, that matter.

Importantly, the UCC uses “control” in two distinct senses. Readers should take caution in differentiating the two.

First, the token can be subject to factual “control” of the type described in Article 12, the UCC article added as part of the 2022 amendments governing certain digital assets. Broadly speaking, a person controls such an electronic record if the person can obtain substantially all of its benefits, exclude others from doing so, transfer that control to another person, and be identified as having those powers.

Second, Article 8 has its own concept of “control” of an uncertificated security. Among other methods, a purchaser obtains Article 8 control if the issuer (including through its transfer agent) agrees to comply with the purchaser’s instructions without further consent from the registered owner.

The report demonstrates how the first kind of control can be used operationally to create the second.

TOKENS CAN ALSO ESTABLISH ARTICLE 8 CONTROL AGREEMENTS

Instead of using the transfer of the token to change registered ownership immediately, an issuer can design the system so that transferring control of the token establishes a control agreement.

For example, Sally could remain the registered owner of the shares but transfer control of the token to Bill under an arrangement pursuant to which Alpha (or its transfer agent) agrees that it will thereafter comply with Bill’s instructions concerning the shares without needing further consent from Sally. Bill would then have Article 8 control of the shares even though Sally remains their registered owner.

That mechanism is particularly significant for secured lending. Suppose Bill lends money to Sally and takes a security interest in her Alpha shares. Sally can transfer control of the token to Bill in a manner that creates an issuer control agreement. Bill thereby obtains Article 8 control of the shares.

Under Article 9 of the UCC, Bill’s security interest can consequently be perfected by control and will generally have priority over a competing security interest perfected only by filing, even if the filing occurred earlier. Thus, the tokenized infrastructure has the potential to not only automate transfers of registered ownership but also facilitate securities-backed financing.

PROTECTED PURCHASERS AND THE IMPORTANCE OF SETTLEMENT TIMING

Article 8 gives important protection to a “protected purchaser.” Essentially, a purchaser who gives value, lacks notice of adverse claims and obtains Article 8 control of a security generally acquires its interest free of adverse claims.

For an outright buyer of uncertificated securities, one way to obtain control is through “delivery,” which occurs when the issuer (or its transfer agent) registers the buyer as the owner. This creates a potentially important timing issue.

If control of the token passes to the buyer before the issuer (or its transfer agent) actually updates its ownership records, there may be a period during which the buyer has received the token but has not yet obtained Article 8 control of the security. Therefore, the buyer cannot yet qualify as a protected purchaser until control is obtained. During that interval, an adverse claim, stop-transfer demand, or legal process could intervene.

The PEB identifies two ways to reduce this “gap period” risk.

The issuer (or its transfer agent) could design the platform so that transfer of control of the token and registration of the buyer as owner occur simultaneously or nearly simultaneously.

Alternatively, the token transfer could first establish an Article 8 control agreement in favor of the buyer, potentially allowing the buyer to secure protected-purchaser status before the subsequent registration of ownership.

This is one of the report’s most practically significant observations: The legal effectiveness of tokenized settlement depends not merely on moving a token quickly but on closely integrating that movement with the Article 8 events that determine rights in the underlying security.

ARTICLE 12 IS NOT DOING THE HEAVY LIFTING

While the report uses Article 12’s concept of control to describe the digital token, its central conclusions do not depend on a jurisdiction having enacted the UCC’s 2022 amendments. The security remains an Article 8 asset, and the purchaser’s rights in the security, including protected-purchaser status, are governed by Article 8. Rights in the token itself generally do not determine rights in the associated shares. The report therefore concludes that its Article 8 analysis remains substantially the same whether or not Article 12 is in effect.

INDIRECT HOLDINGS REMAIN WITHIN THE FAMILIAR ARTICLE 8 FRAMEWORK

The report also considers investors that hold securities through brokers or other intermediaries rather than directly on the issuer’s books.

Tokenization does not eliminate that structure. For example, the token could be transferred so that the issuer (or its transfer agent) registers a broker as the owner of the underlying shares. The broker could then credit those shares to its customer’s securities account. The customer would have a “security entitlement” under Article 8, just as in the conventional intermediated securities system. Tokenized issuer infrastructure and the existing intermediated holding system need not be competing models; they can operate together.

TOKENIZATION DOES NOT ELIMINATE OPERATIONAL AND LEGAL RISK

The report deliberately does not provide a blueprint for designing a tokenized securities platform. It does not address in detail securities regulation, know-your-customer/anti-money laundering and sanctions requirements, tax, privacy, corporate law, transfer restrictions, cybersecurity, or the technological design of blockchain systems. Its narrower objective is to establish that Article 8 itself is not an impediment to the described tokenization model.

Cybersecurity also has significant commercial-law consequences. The report considers a hacker who obtains control of a seller’s token and causes shares to be transferred to an innocent buyer. If the legitimate owner intervenes before registration, the owner may be able to stop the transfer. But if the innocent buyer first becomes the registered owner and qualifies as an Article 8 protected purchaser, the buyer may take the shares free of the original owner’s adverse claim.

The PEB emphasizes the importance of establishing appropriate safeguards to combat unauthorized token transfers during any implementation.

TAKEAWAY

The PEB’s central message is less that the UCC has created a new legal category of “tokenized security” and more that Article 8 already contains the legal machinery needed to integrate digital tokens into securities settlements. A properly structured token can serve as the agreed mechanism for delivering instructions to an issuer and for establishing control agreements concerning uncertificated securities.

If the technology and the issuer’s (or its transfer agent’s) records are sufficiently integrated, movement of the token can produce near-simultaneous changes in the legally significant status of the underlying security.

That conclusion potentially provides an important commercial-law foundation for issuer-sponsored tokenization. But it also underscores a recurring theme in digital-asset law: Control of a token and ownership of the asset associated with that token are not necessarily synonymous. The legal consequences ultimately depend on the rules governing the underlying asset—in this case Article 8—and on how the technology, contractual arrangements, and issuer records are designed to achieve the intended legal result of the transfer.