Tokenised property in the DIFC: how the DFSA's Investment Token rules work

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

Dubai has more than one rulebook for a token that gives its holder a stake in a building. Which one applies depends first on a matter of geography and law: whether the activity is carried on in or from the Dubai International Financial Centre, the DIFC. Inside that perimeter the regulator is the Dubai Financial Services Authority, the DFSA, and the DFSA has its own vocabulary for tokens, its own conduct rules and, since March 2025, a sandbox reserved for tokenised investments.

This guide sets out that DIFC regime as the DFSA's own pages describe it: what makes a token an Investment Token, who the rules reach, what a trading venue, a custodian and a firm selling to clients must do, how the Tokenisation Regulatory Sandbox and the Innovation Testing Licence work, and where units in property funds entered the picture. It also says plainly what the published material leaves open. It describes rules; it does not weigh whether a tokenised product suits anyone.

Dubai Financial Services Authority: Tokenisation Regulatory Sandbox Guide, March 2025, and release of 16 June 2025. The day count is computed from the two dates, both included.

A regulator defined by a perimeter

The DFSA describes itself as the independent regulator of financial services conducted in or from the DIFC, and as a body established under Dubai law for that purpose. It describes the DIFC as a purpose-built financial free zone in Dubai. Those two phrases carry most of the weight in this subject. The DFSA's authority is not attached to a kind of asset, a kind of technology or a kind of customer. It is attached to a place and to the activities carried on in or from it.

The remit the DFSA lists is broad: asset management, banking and credit services, securities, collective investment funds, custody and trust services, commodities futures trading, Islamic finance and insurance, together with an international equities exchange and an international commodities derivatives exchange. The authority also says it supervises and enforces the anti-money laundering and counter-terrorist financing requirements that apply in the DIFC.

Three items in that list are the ones this guide returns to for property: securities, collective investment funds and custody. As a law firm's note of November 2021, cited below, describes it, the DFSA's token rules were added to its existing regime for Investments and were not written as a separate regime.

The words "in or from" also deserve attention. The DFSA's sandbox guide says that the first thing the authority checks when a firm comes forward is whether the proposed activity is permissible in or from the DIFC and whether it falls within the DFSA's regulatory remit. A project that fails that test is not a DFSA matter at all, however it is structured.

What makes a token an Investment Token

The DFSA launched its regulatory framework for Investment Tokens on 25 October 2021. Its release of that date gives the core definition in one line: an Investment Token is either a Security Token or a Derivative Token. In the DFSA's description, that means a Security or a Derivative in cryptographically secured digital form that is issued, transferred and stored using distributed ledger technology, or DLT, or a similar technology, or a token with substantially similar rights or purpose.

A client note published by the law firm Gibson Dunn on 15 November 2021 places the definition in the General Module of the DFSA Rulebook, at A.2.1.1, and breaks it into two limbs. The table below follows that reading.

The first limb is the simple case: an instrument that would be a share or a debenture on paper stays one when it is recorded on a ledger. The second limb looks through the label. A token does not have to be called a share to be treated like one. If the rights and obligations it carries are substantially similar to those of a security or a derivative, or if its purpose or effect is substantially similar, it is an Investment Token.

For property, the consequence follows from the wording and not from any special property rule. The test is applied to the rights the token gives. A token that represents a share in a company holding a building, a debt instrument secured on rental income or a unit in a fund falls to be assessed against the definitions of a security, and the sandbox material confirms that the DFSA counts collective investment fund units among tokenised investments. What a token conferring some other kind of right over a building would be is a question the pages read for this guide do not answer, and it depends on the terms of the token in each case.

Gibson Dunn's note of 15 November 2021 makes a further point about method. On its account, the DFSA did not write a stand-alone regime for these tokens. It brought them inside its existing regime for Investments and then added requirements on top. On that reading, a firm that deals in Investment Tokens is dealing in Investments, with the token-specific layer described below added on top. The note is five years old and was not checked against the current rulebook.

What sits outside: Crypto Tokens

The Investment Token regime was never meant to cover every digital asset. In its October 2021 release the DFSA said that it was still drafting proposals for tokens outside the framework, which it listed as exchange tokens, also called cryptocurrencies, utility tokens and certain asset-backed tokens, or stablecoins. Gibson Dunn's note of 15 November 2021 recorded that Bitcoin, Ethereum and Tether were not captured by the Investment Token rules at that time.

The second regime followed. The DFSA's innovation page states that its Crypto Token regulatory framework came into force in 2022. A DFSA release of 16 June 2025 dates one round of amendments to June 2024, including streamlined criteria for recognising tokens and the first approvals of stablecoins.

Who the rules reach

The DFSA's 2021 release names two groups. The first is any person interested in marketing, issuing, trading or holding Investment Tokens in or from the DIFC. The second is the Authorised Firm, the DFSA's term for a firm it has licensed, that undertakes Financial Services relating to Investment Tokens. The release lists those services: dealing in the tokens, advising on them, arranging transactions in them, and managing discretionary portfolios or collective investment funds that invest in them.

The framework came out of a formal consultation. The DFSA says it reflects the proposals of its Consultation Paper 138, issued in March 2021. The release quotes Peter Smith, the DFSA's Managing Director and Head of Strategy, Policy and Risk, on the launch.

According to Gibson Dunn's note of 15 November 2021, the added requirements for firms providing financial services on Investment Tokens sit in Chapter 14 of the DFSA's Conduct of Business Module. The next three sections follow that note's description of the chapter as it stood in November 2021, read together with the list of requirements in the DFSA's own sandbox guide of March 2025. The rulebook itself could not be read for this guide, so each statement drawn from the note is marked as such and carries its date.

Trading venues and direct access

Gibson Dunn's note of 15 November 2021 calls a venue on which Investment Tokens trade a facility, and reports two technology requirements for its operator. The DLT applications the facility uses must operate on a permissioned-access basis, so that the operator controls who can reach the ledger. And the operator must have regard to industry best practice in the design of its DLT and in its technology governance.

The same note of November 2021 describes a further feature: direct access. Under the DFSA's rules as the note sets them out, a facility for Investment Tokens may offer direct access to retail clients who meet requirements such as sufficient competence and experience.

As the note reports it, direct access comes with conditions on the operator. Its operating rules must set out three things: the duties the operator owes to the direct access member, the duties the member owes to the operator, and the redress mechanisms open to investors. The operator must make risk disclosures. It must also maintain systems and controls for market integrity, for anti-money laundering and for investor protection. All of this is the position the note recorded in November 2021.

Custody and digital wallets

For the firms that provide digital wallets, Gibson Dunn's note of 15 November 2021 reports two groups of requirements. The DLT used for custody must be resilient, reliable and compatible with any relevant trading or clearing facility. And the provider must have adequate security measures, cyber security among them, for the storage and the transmission of data.

The DFSA's sandbox guide adds its own list of what it expects around Investment Tokens. It names the technology design; a description of the custody arrangements; controls against unauthorised or fraudulent transactions; systems for handling security incidents and complaints; independent technology audits; and restrictions on financial promotions. The guide gives these as headings only; the rules behind them were not read.

The Key Features Document

The disclosure document at the centre of the regime is the Key Features Document. The DFSA's sandbox guide lists it as a requirement for Security Tokens. Gibson Dunn's note of 15 November 2021 describes its timing and content: the firm must give it to the client in good time before the service is provided.

As that 2021 note sets it out, the document covers four matters:

1. The risks and the essential characteristics of the Investment Token.
2. Whether the token is, or will be, admitted to trading, with the details of any admission.
3. How the client may exercise the rights the token confers, such as voting.
4. Any other information that would reasonably help the client to understand the product and the technology and to make informed decisions.

The pages read for this guide do not set out how the Key Features Document relates to a prospectus where tokens are offered to the public. That point is left open here.

The Tokenisation Regulatory Sandbox in two stages

The DFSA opened its Tokenisation Regulatory Sandbox in March 2025. The guide published that month defines the subject: tokenisation is the digital representation of rights and obligations in relation to an asset on a programmable platform, such as a DLT. The guide also records the groundwork, noting industry roundtables at the Dubai FinTech Summit in May 2024 and again in January 2025.

The sandbox has two stages. The first was an expression of interest. The DFSA took submissions from 17 March 2025 to 24 April 2025, a window of 39 days counting both dates, and charged nothing for them. Firms were eligible if they ran a tokenisation business model, which the guide describes as issuing, trading, holding or settling tokenised investments or assets such as equities, bonds, sukuk, collective investment fund units and real-world assets. Existing Authorised Firms wishing to expand into tokenisation could also come forward. The guide asked for two further things: an understanding of the applicable legal and regulatory requirements, and products or services ready for market testing.

The DFSA then made a preliminary assessment of eligibility, including the perimeter check described earlier, and could meet a firm. Successful applicants were invited to the second stage, the Innovation Testing Licence Tokenisation Cohort.

That second stage is not an exemption from licensing. The guide states that entry requires a DFSA Licence, so a firm must apply and go through an authorisation process. What changes is the content of the licence: certain prudential, capital and other relevant requirements are waived or modified for the testing period. The guide gives estimated timeframes.

A worked example shows what those estimates add up to. Assume a firm submits its application on day one and every step runs to the guide's estimate, with the review of 3 to 6 weeks falling inside the 2 months to authorisation. At the short end, 2 months to the licence, 6 months of testing and 1 month to graduate give 9 months from submission to a full licence. At the long end, 2 months, 12 months and 2 months give 16 months. These are sums of the DFSA's estimates under the stated assumption, not a timetable the authority has promised.

The sandbox page on the DFSA's site now states that applications are closed and that the next steps of the initiative will be shared.

Who came forward and what they proposed

The DFSA reported on the first stage in a release dated 16 June 2025, 53 days after the window closed. It had received 96 expressions of interest. The release names where they came from: the United Arab Emirates, the United Kingdom, the European Union, Canada, Singapore and Hong Kong.

It also says what firms wanted to tokenise. The proposals covered bonds, including Islamic bonds, or sukuk; units in funds, including money market funds and property funds; and the trading and safe custody of those assets. That mention of property funds is the only reference to real estate in the DFSA material read for this guide. The sandbox guide itself does not use the words real estate or property; it speaks of collective investment fund units and of real-world assets.

The release describes what happened next. The DFSA reviewed each submission in detail, assessing the business model, the clarity of the use case and the firm's readiness to test. Firms were then sorted into two groups. Some were invited into the sandbox for live testing under the Innovation Testing Licence. Others were judged suitable to apply for full authorisation under the existing rules, with no sandbox stage. The DFSA said it would develop bespoke testing plans together with the selected firms, that trials would begin in a controlled environment in the following weeks, and that the outcomes would inform its policy.

What the release does not give is a number or a list. It does not say how many firms were invited into the cohort, and it names none of them. The release names Charlotte Robins, the DFSA's Managing Director for Policy and Legal, who spoke at the authority's Policy and Legal Roundtable.

The same release places the sandbox in a sequence of DFSA measures.

Inside the Innovation Testing Licence

The licence that carries the tokenisation cohort is older than the sandbox and has rules of its own. The DFSA's innovation page calls it the authority's version of a regulatory sandbox and stresses that it is a licensed one: an applicant goes through authorisation like any other firm.

The page sets four conditions of eligibility. The applicant must offer a new product or service, or apply innovative technology to an existing one. Its activity must be one that would be a Financial Service in or from the DIFC. It must be ready to begin live testing with customers. And it must intend to roll the business out more broadly in or from the DIFC once testing is over.

Beyond those, the DFSA expects an applicant to show sufficient funding to meet minimum capital requirements, at least 2 to 3 years of operational management experience in the relevant sector, and knowledge of DFSA and DIFC rules. It must also meet the requirements of chapter 7 of the General Module, which the page summarises as adequate resources, being fit and proper, and having adequate compliance arrangements. The page adds two boundary markers. A proposal that is still conceptual and not ready for testing is unlikely to need a licence. A firm that is already fully operational is directed to conventional authorisation.

The route in has four steps on the DFSA's page: a pre-application form; a review after which only firms meeting the criteria are invited to apply, with no guarantee of a licence; the application form itself; and the DFSA's assessment and decision. The applicant must also prepare a test plan.

During testing the holder may receive a temporary relaxation of a limited set of requirements, which ends when testing does. In return its activities are restricted. The DFSA's example is a limit on the number of clients and on the volume and value of transactions.

On duration the two DFSA documents differ. The innovation page says testing typically runs for 12 months. The tokenisation sandbox guide gives 6 to 12 months for its cohort. The exit is the same in both: at the end of the period the holder either applies to have its restrictions removed, which requires it to show that it meets every requirement for an unrestricted licence, or applies to withdraw its licence. If the DFSA rejects the application to exit, the holder must apply to withdraw.

Property funds, and what stays open

For a reader whose interest is buildings, the DFSA material leaves four points open.

The first is the fund rulebook itself. The DFSA's rules on collective investment funds, including whatever they provide for property funds and real estate investment trusts, could not be read for this guide, and no borrowing limit, distribution requirement or listing rule is stated here for that reason.

The second is the cohort. The DFSA has not said, in the pages read, how many firms entered live testing, who they are, or whether any property fund proposal was among those selected.

The third is the currency of the rule references. The placement of the definition in the General Module and of the conduct requirements in Chapter 14 of the Conduct of Business Module comes from a law firm's note written in November 2021, as does the detail given above on trading venues, direct access, digital wallets and the Key Features Document. The DFSA's March 2025 guide lists the requirements at heading level only, and the rulebook itself could not be read, so none of that detail was confirmed against the rules in force in 2026.

The fourth is the other side of the perimeter. Nothing in the DFSA's material describes the rules that apply to a property token offered in Dubai outside the DIFC, and this guide does not either. What the DFSA pages establish is narrower and firmer: the authority's test is whether the activity is carried on in or from the DIFC, and a project outside that perimeter is not within its remit.

In the DIFC the question is never whether a building has been tokenised. It is what rights the token gives, and whether they are those of a security.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →