Listing Tokenized Stocks: Exchange and Neobank Checklist

By Owen ThurmPublished November 15, 202611 min read

Quick answer. Check what the token legally is and who holds the shares, how custody and redemption work, who can mint, pause, block or upgrade on each chain, where prices come from, whether surveillance joins onchain and order data, and which permissions the instrument needs.

Watch: Listing Tokenized Stocks: Exchange and Neobank Checklist 1:49

Video transcript

Before listing a tokenized stock, check the issuer, custodian, contract and price source. Each can fail on its own.

Start with what the token legally is. Ask for holder terms, a bankruptcy analysis, custody agreements and redemption rules.

Custody stays your problem, however you source tokens. Treat a custody API as a signing path, with scoped credentials, approvals and logs.

Guardian's research found no issuer page naming who holds privileged roles. Read the deployed contracts on every chain, and map mint, pause, blocklist, upgrade and bridge powers.

A display price is not an execution price, and Ondo does not recommend its price API as an oracle. Require executable quotes, freshness limits and a fallback.

Dividends and splits change what one token represents. xStocks suggests pausing for about 15 minutes either side of a multiplier change.

In Guardian's public Bracket audit, a resolved Critical finding involved a rebasing token converting amounts to shares twice. Bracket is not a stock issuer, but test raw and displayed units separately.

Do not review onchain and order data separately. Join orders, wallet owners, onchain transfers, oracle prices and market maker quotes in one case view.

MiCA excludes crypto-assets that qualify as financial instruments. The SEC's temporary exemption covers qualifying U.S. venues only. This is not legal advice, so confirm with counsel.

Read the full checklist, or talk to Guardian about the Digital Asset Assurance Pilot.

Start With the Instrument

A tokenized stock puts an issuer, a custodian, a contract and a price source between your customer and a share. Each can fail on its own.

The SEC's temporary exemption for onchain venues trading tokenized NMS stocks runs from September 17, 2026 to September 17, 2031. U.S. Securities and Exchange Commission

For what holders own and who holds the keys on live tokens, read our tokenized stock risks guide.

SEC staff separate issuer-sponsored tokens from third-party custodial and synthetic ones. They warn that third-party holders may be exposed to that party's bankruptcy.

Ondo's tokens are structured notes from a bankruptcy-remote BVI SPV, backed 1:1 through a regulated custodial broker-dealer. Ondo Finance

A security agent holds a first-priority interest in the shares for holders. Holders get no voting or information rights.

Ondo also limits its offering to non-US persons under Regulation S. Your customer base has to fit each issuer's eligibility rules.

Ask each issuer for:

Holder terms that name the legal instrument
A bankruptcy-remoteness analysis and the security agent agreement
Custody agreements naming every custodian and sub-custodian
Reconciliation reports matching token supply to shares held
Redemption rules: who redeems, into what, at what cutoff and fee

Custody and Integration

First, decide how you source tokens. xStocks describes three routes: onboard with the issuer, delegate to an onboarded market maker, or buy on other venues. xStocks

Direct onboarding gives you primary issuance, redemption and full supply control. You complete the issuer's KYC and AML onboarding first.

Then decide how customers trade: an order book with market maker liquidity, or a quote-based buy and sell flow.

Using a partner? Our neobank crypto integration plan shows what each integration pattern leaves with you.

Custody stays your problem either way. The OCC, Fed and FDIC's July 2025 statement says banks offering safekeeping should address key, cybersecurity, governance and sub-custodian risk. OCC, Federal Reserve and FDIC

Treat a custody API as a signing path. Any endpoint that moves or redeems tokens needs scoped credentials, approvals and logs.

Get custody evidence on:

Key ceremony record, signing quorum and tested recovery
Segregated or omnibus wallets, reconciled daily to your ledger and the issuer's supply
Withdrawal and redemption cutoffs, including weekends and market holidays
Supported chains, and the chain on which you credit deposits
Notice duties for key compromise, pauses, blocks and reissues
An exit plan if the issuer stops redeeming or a custodian fails

Token Contract Powers

Issuer pages tend to skip privileged roles. In Guardian's November 10, 2026 research, none said who could mint, pause, block or upgrade. Guardian

So read the deployed contracts yourself, on every chain, at a recorded block. Then reconcile them to the issuer's documentation.

Audit match and supply checks are in our CEX listing security review. Mint caps and recovery are in our RWA tokenization security checklist.

For each role, record the holder, threshold, timelock, bypass path and last use.

Decide in advance what happens when a power fires. A pause, or a block on your omnibus address, can strand every customer balance.

Map these powers:

Mint and burn, with caps and a match to subscriptions
Pause and unpause, and whether different keys hold them
Blocklist or compliance checks, and which screening list applies today
Forced transfer or burn from a holder, and whether anyone holds it
Upgrades, including beacons shared across many tokens
Bridges, each one an extra minter

Pricing and Corporate Actions

A display price is not an execution price. Ondo's price API separates token and underlying market prices, and Ondo says it does not recommend them as an oracle. Ondo Finance

Ondo's soft quotes carry no signature or expiry and cannot be submitted onchain. Signed attestations authorize mints and redemptions, and expire after a limited window.

Ondo caches latest-price endpoints for one second, and OHLC data can lag by up to 11 seconds.

Ondo's terms promise no API uptime, so negotiate service levels before production.

Onchain, Chainlink launched tokenized-equity feeds with Ondo on February 11, 2026, on Ethereum Mainnet, with 24/5 pricing. Chainlink

Those feeds price total return: the share price times Ondo's multiplier. Large corporate actions trigger a pause scheduled at least 24 hours ahead, frozen at the last value for ten minutes or more.

Require executable quotes, freshness limits, deviation bounds against the underlying and a fallback. Add a rule for prices while the underlying market is shut.

Dividends and splits change what one token represents. On EVM chains, xStocks rebases balances, so balanceOf returns the adjusted amount. xStocks

On Solana and TON, the raw balance stays fixed and apps apply a multiplier from metadata.

The multiplier activates at 00:30 UTC on the day after the ex-date. xStocks suggests pausing interactions for about 15 minutes either side.

In Guardian's public Bracket audit, Critical finding C-02 was a rebasing token that converted amounts to shares twice, corrupting mint, burn and withdrawal accounting. Guardian

Bracket is not a stock issuer, and C-02 is marked resolved. Test raw units, displayed units and multiplier changes as separate invariants.

Deposits and withdrawals in flight across an activation
Ledger balances against raw and scaled chain amounts
Open orders, approvals and queued withdrawals at activation
Margin, lending and liquidation logic inside the window

Market Abuse Surveillance

ESMA says MAR applies where a crypto-asset qualifies as a financial instrument traded on an EU trading venue, including an MTF. European Securities and Markets Authority

MAR Article 16 requires trading venue operators, and firms professionally arranging or executing trades, to run effective detection systems. They report suspicious orders and transactions without delay.

Delegated Regulation (EU) 2016/957 sets out the arrangements, systems, procedures and notification templates.

The UK's onshored standards require electronic STOR templates and retention of reports and their analysis. Reports go in without delay once suspicion is reasonable. Financial Conduct Authority

In the US, a Tokenized Securities Venue's notice must describe any monitoring for spoofing, wash trading, front-running and pump-and-dump schemes, or state that it does none. U.S. Government Publishing Office, Federal Register, U.S. Securities and Exchange Commission

Write scenarios for spoofing, wash trades, front-running, pump-and-dump, insider dealing, oracle manipulation and cross-venue price gaps. Give each alert an owner and a path to a report.

Join these feeds in one case view:

Orders, quotes, cancellations and fills
Wallet and beneficial-owner data for every account
Onchain transfers, mints, burns and bridge events
Oracle updates and underlying exchange prices
Market maker quotes and inventory
Corporate action, earnings and halt calendars

Regulatory Permissions

MiCA is not the listing permission for most tokenized stocks. ESMA's Article 2 text excludes crypto-assets that qualify as financial instruments. European Securities and Markets Authority

xStocks leaves that assessment to each exchange. In the EU, it says an order book may need an MTF license, and a buy and sell flow broker-dealer or equivalent authorization. xStocks

The SEC exemption covers qualifying US venues running permissioned AMM pools for tokenized NMS stocks. It is not a license for every exchange or neobank. U.S. Securities and Exchange Commission, U.S. Government Publishing Office, Federal Register

Each token must give holders the same rights as the share, so synthetic tokens are excluded.

Its conditions include public, auditable contracts on a public permissionless ledger, disclosure of oracle and market data use, and a halt whenever the underlying stock halts.

The relief is conditional and the SEC can modify it. Anti-fraud and anti-manipulation rules still apply.

SEC staff's January 2026 statement has no legal force. This is not legal advice: confirm each product's path with counsel.

Pre-Listing Checklist

Use this as the listing file. Every row needs dated evidence before launch.

Check	Evidence to ask for	Red flag
Legal instrument	Holder terms, legal opinion, security agent and custody terms	Terms never name what the holder owns
Redemption	Eligibility, cutoffs, fees and redemption history	Customers can exit only by selling
Custody	Key ceremony, quorum, recovery test, sub-custodian file	Single key or untested recovery
Contract roles	Role map per chain at a recorded block	Single-key mint or upgrade with no delay
Code match	Bytecode matched to the audited commit on every chain	Upgrade since the last audit
Prices	Executable quotes, freshness limits, deviation bounds, service levels	Display price or soft quote used as an oracle
Corporate actions	Multiplier tests across an activation window	Raw and scaled units mixed in the ledger
Surveillance	Joined feeds, scenarios, alert-to-report runbook	Onchain and order data reviewed separately
Permissions	Classification memo and permissions per market	MiCA treated as the listing permission
Delisting	Halt, delisting and customer withdrawal procedures	No plan if the issuer stops redeeming

Frequently Asked Questions

Can a US Tokenized Securities Venue list a third-party tokenized stock without the company's consent?

Yes, unless the company objects. Under the SEC's order, the venue must send the company written notice and wait 30 calendar days before trading a third-party token. A written objection in that window bars it; silence lets trading proceed. U.S. Government Publishing Office, Federal Register, U.S. Securities and Exchange Commission

Can a Tokenized Securities Venue offer margin on tokenized stocks?

No. The order's no-leverage condition bars a venue from extending credit to buy tokenized NMS stock, borrowing securities or crypto assets on the venue, and hypothecating them or permitting hypothecation. The order is dated September 17, 2026 and was published September 22. U.S. Government Publishing Office, Federal Register

Why do tokenized stock balances differ between chains?

Issuers encode corporate actions per chain. xStocks uses Solana's Token-2022 Scaled UI Amount extension and TON's TEP-0526 Scaled UI Jettons: transactions use raw amounts, while wallets show scaled ones. Crediting the wrong unit misstates customer holdings. xStocks

What custody setup does a neobank need for tokenized equities?

xStocks says delegating issuance and redemption to an onboarded market maker reduces operational complexity, with no direct issuer onboarding. The neobank still answers for custody and reconciliation, in-house or through a sub-custodian, so contract for incident notice from the issuer, custodian and market maker. xStocks

Sources

Pressure-Test a Tokenized Stock Listing

Guardian's Digital Asset Assurance Pilot covers custody and key ceremonies, the privileged control surface, oracle and bridge routes, a smart contract audit and offchain pentests of the consoles and APIs that reach your keys.

Talk to Guardian Explore the service