For an issuer evaluating how to bring an asset on-chain, tokenization is often pitched as a one-click mint. The mechanics that matter sit elsewhere: in how the ledger settles, how compliance rules are enforced, and how privacy is preserved. This article walks through the issuance pipeline step by step, using the Liquid Network and Blockstream's AMP issuance stack as the worked example. It is educational and is not legal or investment advice; tokenizing a regulated asset should be done with qualified counsel.
What tokenization actually changes
A traditional security lives across a stack of intermediaries. A transfer agent holds the register of owners, a custodian holds the certificates, a clearing house nets the trades, and a settlement system moves the cash and the title on different timelines. Each layer keeps its own copy of who owns what, and reconciliation between those copies is most of the operational cost.
Tokenization collapses the register and the settlement instrument into one object. The token is the ownership record. Sending the token is the transfer of ownership, and it settles atomically: either the whole transaction confirms or none of it does. There is no separate clearing step to reconcile, because there is only one ledger and one copy of the record.
That shift produces the benefits issuers care about. Settlement moves from a multi-day cycle to minutes. Assets become divisible to whatever precision the token allows, which makes fractional ownership practical. Transfers run continuously rather than on banking hours. And because the rules can travel with the token, a compliant transfer either satisfies them or never confirms.
None of this removes the legal asset underneath. A tokenized bond is still a bond, subject to the same securities law, the same investor eligibility rules, and the same disclosure obligations. Tokenization changes the plumbing of ownership and transfer. It does not change what the asset is or who is allowed to hold it. An issuer who treats the token as a way around those obligations builds a legal liability for itself. The same point applies to equities specifically, covered in What are tokenized securities?
The issuance pipeline, step by step
The mechanics of tokenization are the same whether the asset is a fund share, a unit of private credit, or a tokenized deposit. The work breaks into six steps.
Step 1: Choose the ledger
The ledger decides what is possible for the rest of the asset's life, so it is the first and most consequential choice. An issuer is selecting four things at once: the settlement guarantees the ledger gives, the privacy model available to holders, the way compliance rules can be enforced, and the security the ledger inherits.
Two ledger architectures dominate. Account-based ledgers track balances against addresses, the way a bank tracks balances against accounts. UTXO-based ledgers track discrete, individually spendable outputs, called unspent transaction outputs, the way physical cash tracks discrete notes and coins. The distinction matters for an issuer because a UTXO model makes each unit independently auditable and makes confidential amounts tractable without a global account state that an observer can probe.
The Liquid Network is a Bitcoin layer-2 sidechain built on the UTXO model, secured by the Liquid Federation since its 2018 launch. It settles in roughly one to two minutes, carries Confidential Transactions natively, and is the rail underneath the worked example used throughout this article. Issued assets live directly on Liquid alongside LBTC, which is bitcoin pegged one-to-one onto the network.
Step 2: Define the asset
Defining the asset is filling in its on-chain identity. The fields are few and each one is a decision the issuer cannot casually revise later.
| Field | What it sets | Decision the issuer makes |
|---|---|---|
| Issue amount | The initial supply minted at issuance | How many units exist on day one |
| Reissuance token | Whether supply can grow, and who controls it | Fixed supply, or a token that confers minting authority |
| Ticker | The short symbol holders and venues see | A unique, recognizable identifier |
| Name and domain | Human-readable metadata bound to the asset | Issuer identity and the domain that anchors it |
| Precision | Decimal places, from 0 to 8 | The smallest fraction a holder can own |
Precision is permanent for the asset, so it has to match the smallest position the issuer ever intends to support. An asset with precision 0 is indivisible, one token is one whole unit, which suits a share class that cannot be fractionalized. An asset with precision 8 divides down to one hundred-millionth of a unit, which suits a fund that wants fine-grained fractional ownership.
The reissuance token is the most important field and the least obvious. Setting the reissuance amount to zero creates a fixed-supply asset: the initial issuance is all that will ever exist. Setting it to a positive value mints a separate reissuance token whose holder can create more of the asset later. On the Liquid Network, that token is the minting authority. Whoever holds the reissuance token can reissue; moving the token moves the authority. Treating it as the most sensitive key in the system is the correct posture, because losing it can mean an asset that can never expand, and leaking it can mean an asset whose supply is no longer controlled.
Step 3: Embed transfer restrictions and compliance
A token that anyone can send to anyone is fine for a bearer instrument and unacceptable for a regulated one. Most tokenized assets need to restrict who may receive them: accredited investors only, holders in permitted jurisdictions, addresses that have cleared the issuer's onboarding. The question is where those rules are enforced.
The weak model enforces restrictions in the application layer. The issuer's software checks a whitelist before it builds a transaction, but the ledger itself accepts any valid transfer. A holder who bypasses the application, or a bug that skips the check, can move the asset to an ineligible party, and the transfer confirms because the ledger never knew the rule existed.
The strong model enforces restrictions in the protocol layer, so the ledger refuses a non-compliant transfer regardless of what software constructed it. Blockstream's AMP2 implements this with a cosigning architecture. Each issued-asset wallet is a two-of-two: the holder signs, and an isolated hardware security module (HSM) holds the second key and cosigns only if the transfer satisfies the asset's restriction rules. Restrictions are defined per asset and per wallet: a whitelist of allowed destination wallets, a flag for whether a given group may burn the asset, and locks that freeze movement entirely. When a holder submits a partially signed transaction, the HSM validates the inputs and outputs against those rules and cosigns through secp256k1 only if the transfer is compliant. If the destination is not whitelisted, or the transaction tries to burn an asset a wallet is not permitted to burn, the HSM refuses to cosign and the transfer cannot be broadcast.
The difference is enforcement that does not depend on trusting the sender's software. A whitelist checked in an application is a policy. A whitelist enforced at cosigning time is a constraint the holder cannot route around.
Step 4: Distribute
Distribution moves the asset from the issuer to its first holders. On Liquid, a distribution is a transfer that follows the same restriction model as every other transfer: the issuer sends to recipient wallets or addresses, and the cosigner enforces the whitelist on the way out. An issuer can send to multiple recipients in a single transaction, which makes a primary allocation across many investors one atomic operation rather than a batch of separate sends to reconcile.
Recipients fall into two types. An internal recipient is another wallet the issuer's system already knows. An external recipient is a Liquid address belonging to a holder who manages their own keys. The restriction rules apply to both, so an external holder still has to be on the whitelist for the transfer to confirm.
Step 5: Manage the lifecycle
A tokenized asset changes over its life, and a compliant issuance platform supports four lifecycle operations as first-class transactions.
| Operation | What it does | Authority required |
|---|---|---|
| Issue | Mints the initial supply | Issuer keys at asset creation |
| Distribute | Transfers the asset to holders | Issuer keys, subject to restrictions |
| Burn | Permanently destroys units, reducing supply | A wallet group permitted to burn |
| Reissue | Mints additional supply of an existing asset | Holder of the reissuance token |
Burning handles redemptions and retirements: when a fund share is redeemed or a credit unit is repaid, the corresponding token is destroyed so that on-chain supply tracks the real outstanding amount. Reissuing handles supply that is meant to grow, an open-ended fund taking new subscriptions, for example. On AMP2 both are PSET operations enforced by the same cosigner: a burn only succeeds if the wallet's restriction group permits burning, and a reissue only succeeds for the holder of the reissuance token. Supply is never silently editable. Every change to it is a transaction that the protocol either authorizes or refuses. Because the lifecycle runs on-chain, a holder or auditor can check outstanding supply against the ledger directly, the same verification discipline covered in What is proof of reserves?
Step 6: Settle with the right privacy
Settlement is the moment a transfer becomes final, and for most institutional assets it carries a privacy requirement that public ledgers do not satisfy by default. A fully transparent ledger exposes every holder's balance and every transfer amount to anyone watching, which leaks position sizes, counterparties, and trading activity to competitors.
The Liquid Network's Confidential Transactions address this at the protocol level. Confidential Transactions hide both the amount and the asset type of a transfer from outside observers while still letting the network verify that no value was created or destroyed. The amounts are cryptographically committed rather than published, so a chain observer sees that a valid transfer occurred without seeing what moved or how much. Selective disclosure keeps this auditable: the issuer, an auditor, or a regulator can be given the keys to view the specific transactions they are entitled to see, so confidentiality from the public does not mean opacity to the parties who have a right to the records.
For an institutional issuer, that combination is the point. The asset settles in minutes, the holder register and transfer amounts stay private from competitors, and the parties with a legal right to inspect can still verify everything.
Where issuers get it wrong
Three mistakes recur, and all of them come from treating tokenization as a minting problem rather than a rules problem.
The first is enforcing compliance off-chain. An issuer builds a clean application that checks every whitelist, ships it, and assumes the asset is now compliant. The moment a holder interacts with the asset through any other tool, the application's checks are gone and the ledger waves the transfer through. Enforcement has to live where the asset lives.
The second is mishandling the reissuance token. Because it confers minting authority and nothing visually distinguishes it from an ordinary balance, issuers store it the way they store the asset itself. It deserves the custody treatment of a master key: isolated, access-controlled, and ideally behind the same multi-party governance as any other critical authority.
The third is choosing precision and supply parameters without thinking through the asset's full life. These fields are set at issuance and effectively permanent. An issuer who picks precision 0 and later needs fractional units, or who sets a fixed supply and later needs to grow it, is rebuilding the asset rather than amending it.
How Blockstream's stack maps to the pipeline
Blockstream does not issue tokenized assets. It provides the rails an issuer runs the pipeline on, and the worked example throughout this article is that stack.
The Liquid Network is the ledger: a UTXO-based Bitcoin layer-2 with roughly one-to-two-minute settlement, native Confidential Transactions, and security provided by the Liquid Federation, on technology Blockstream has built and maintained since 2018. AMP2 is the issuance and compliance layer: it defines the asset, holds the cosigning key in an isolated HSM, and enforces per-asset transfer restrictions cryptographically by refusing to cosign a non-compliant transfer. For an institutional issuer that also needs custody and governance around its own keys, Blockstream Enterprise pairs accounts with independently managed signers, segregated accounts, and policy-based approval workflows. Regulated custody itself sits with partners: Komainu is the regulated institutional custodian Blockstream has invested in and is integrating Liquid and AMP with, and STOKR is the tokenized-securities platform partner that does the securities issuing.
The division of labor is deliberate. Blockstream builds the settlement and issuance infrastructure. Issuers and regulated partners issue, distribute, and service the assets that run on it. The same rail carries adjacent on-chain instruments: for the cash leg that settles against a tokenized asset, see How do businesses use stablecoins on Liquid?
Frequently Asked Questions
How does asset tokenization work?
Asset tokenization works by recording ownership of an asset as a token on a distributed ledger, so that transferring ownership means transferring the token. An issuer chooses a ledger, defines the asset's supply, ticker, and precision, embeds the rules governing who may hold or receive it, distributes the tokens to eligible holders, and manages the asset's lifecycle of issuance, distribution, burning, and reissuance. The transfer settles on the ledger in one step, with the compliance rules enforced by the protocol rather than reconstructed off-chain.
What is the difference between a token and the underlying asset?
The token is the on-chain record of ownership; the underlying asset is the legal instrument the token represents. A tokenized bond is still a bond, governed by the same securities law and investor eligibility rules as a paper bond. Tokenization changes how ownership is recorded and transferred. It does not change the legal nature of the asset or who is permitted to hold it.
Can transfer restrictions be enforced on a public ledger?
Yes, when the ledger enforces them at the protocol level rather than the application level. On Blockstream's AMP2, each issued-asset wallet is a two-of-two where an isolated HSM holds the second key and cosigns a transfer only if it satisfies the asset's restriction rules. If a destination is not whitelisted, the HSM refuses to cosign, so a non-compliant transfer can never be broadcast regardless of what software built it.
What is a reissuance token?
A reissuance token is a separate token that grants the authority to mint additional supply of an existing asset. An issuer that wants a fixed supply sets the reissuance amount to zero, so the initial issuance is permanent. An issuer that wants supply to grow holds the reissuance token, and whoever holds that token can reissue. Moving the token moves the minting authority, which is why it requires the custody treatment of a master key.
How is privacy handled when amounts are recorded on a ledger?
Through Confidential Transactions, a protocol feature of the Liquid Network that hides both the amount and the asset type of a transfer from outside observers while still letting the network verify the transaction is valid. Selective disclosure lets an issuer, auditor, or regulator be granted the keys to view the specific transactions they are entitled to inspect, so the records stay private from competitors without being opaque to the parties who have a right to them.
Does Blockstream issue tokenized assets?
No. Blockstream provides the infrastructure: the Liquid Network as the settlement ledger, AMP2 for compliant issuance and transfer enforcement, and Blockstream Enterprise for custody and governance. Issuers and regulated partners such as STOKR do the actual issuing, distributing, and servicing of the assets. Blockstream provides the settlement and issuance rails those parties build on.