Legal, asset, technology, counterparty and operational risk in tokenized assets, and a practical due-diligence checklist.
Legal and structural risk
- Is the right enforceable, and in which country?
- Is the SPV bankruptcy-remote, and who acts for holders?
- Do the documents and the smart contract agree?
Asset risk
- The underlying asset can fail, lose value or be mismanaged, whatever the wrapper.
- Check the valuation method, the valuer's independence and how often values are updated.
- Watch for concentration: one tenant, one borrower, one object.
Technology risk
- Smart contract bugs: ask for independent audits and how findings were fixed.
- Data feeds (oracles) that report prices or events can fail or be manipulated.
- Bridges between chains have been a frequent target of large hacks.
Counterparty and operational risk
- Issuer, custodian, administrator, registrar: what happens if each one fails?
- Is there a wind-down plan and a backup service provider?
- Who can use the admin keys, and under what controls?
A due-diligence checklist
- What right does the token carry, and against whom?
- Which rules apply, and is everyone involved properly licensed?
- Who values the asset, who holds it, who holds the keys, how do I exit, and what does it all cost per year?
Key takeaways
- Five lenses: legal, asset, technology, counterparty, operations.
- The asset's own risk does not go away because it is on-chain.
- If a question on the checklist has no clear answer, stop.
Sources
Educational content only, not legal, tax or investment advice. Based on EU and Swiss rules as of September 2026. Check the official texts before relying on anything here.