India's Asset Tokenisation Bill, 2026: What Founders, CISOs and Compliance Heads Need to Do Now
A practitioner's analysis for corporates, fintechs, PSPs, exchanges, banks, NBFCs, tokenisation platforms and asset managers
The Asset Tokenisation (Regulation) Bill, 2026 was introduced in the Rajya Sabha on 14 March 2026 by Member of Parliament Raghav Chadha as a Private Member's Bill. The proposed legislation seeks to establish a legal and regulatory framework for the tokenisation of real-world assets (RWAs) in India by providing clarity on the issuance, ownership, transfer, custody, and regulation of tokenised assets. While Private Member's Bills are not introduced by the Government and seldom become law in their present form, the Bill reflects the growing need for a comprehensive regulatory framework governing digital representations of real-world assets in India's evolving digital economy.
What the Bill actually does
Legal recognition without disturbing property law. An "asset token" is a cryptographically secured digital representation of rights in an underlying asset. Critically, issuing a token does not automatically transfer ownership of the underlying asset unless the arrangement expressly says so. This layers a digital-representation framework on top of existing property, companies and depository law rather than replacing it.
The Bill does not replace existing laws relating to property, companies, or securities. Instead, it adds a legal framework for the digital representation (tokenisation) of these assets. This means that the original ownership documents will continue to remain the primary legal record, and the terms governing the token must clearly specify whether transferring a token also transfers the legal ownership of the underlying asset.
The Bill covers a wide range of assets that can be tokenised, including real estate, infrastructure, commodities, securities, receivables, carbon credits, intellectual property, and other assets that the Government may notify in the future. As a result, its impact extends far beyond cryptocurrency businesses and could benefit organisations across multiple industries.
Rather than creating a single regulator, the Bill follows a sector-specific regulatory approach. Depending on the type of asset being tokenised, regulators such as SEBI, the RBI, or other sectoral authorities will oversee compliance. Businesses dealing with different categories of tokenised assets may therefore need to comply with the requirements of multiple regulators simultaneously.
The Bill also regulates the entire lifecycle of a tokenised asset by separately governing issuers, custodians, and trading platforms. Similar to the securities market, each participant has distinct roles and responsibilities. Businesses currently performing all these functions under one entity may need to revisit their operating structure if the proposed framework is implemented.
Finally, the Bill proposes stringent penalties for non-compliance, including imprisonment of up to ten years and monetary penalties of up to ₹25 crore or three times the unlawful gain, whichever is higher. These significant enforcement provisions highlight the importance of strong legal, compliance, and governance frameworks for businesses operating in the tokenisation ecosystem.
Contractual implications
Every material contract touching a tokenised asset needs rework:
Issuance documents must state plainly whether the token confers a proprietary interest or is merely evidentiary — ambiguity here is currently common market practice and becomes a direct compliance risk.
Custody agreements need clear loss-allocation for key compromise, smart-contract failure, or custodian insolvency.
Platform terms need clear governing law, dispute resolution, and a waterfall for token holders' rights on platform insolvency or licence cancellation.
Smart contract documentation should be paired with version-controlled plain-language legal specifications, since courts will increasingly read code as part of the contractual matrix.
Cross-border arrangements need FEMA analysis layered on top, since the Bill doesn't override exchange control law.
Practical step: inventory existing contracts now and flag every clause assuming token transfer equals asset transfer the most common latent defect in current documentation.
Governance
Board-level ownership, not just a CTO's roadmap item directors face personal exposure given the Bill's criminal liability provisions.
Licensing gap analysis mapping every activity (issuance, custody, trading, settlement) against the Bill's separated roles, flagging where your structure conflates functions that may need splitting.
Coordinated regulatory affairs, not ad hoc management of SEBI and RBI separately by different product teams.
Sandbox positioning early IFSCA or RBI sandbox participation strengthens your position under any eventual transitional provision.
Payment security and financial regulation
Tokens touching payment rails, stable-value instruments or deposit-like arrangements pull in RBI's Payment and Settlement Systems Act and PPI directions directly:
Stablecoin-adjacent structures should assume banking-grade governance now reserve segregation, daily reconciliation, independent attestation ahead of any stablecoin-specific rule.
Settlement finality for tokenised securities needs reconciliation with existing depository/clearing infrastructure; don't assume on-chain finality is legally equivalent without an explicit carve-out.
Existing PSP/NBFC licensees adding tokenisation features should treat this as a material change requiring prior regulatory intimation, not a routine update.
AML/CFT: the PMLA overlay isn't optional
Most Indian tokenisation businesses underestimate this. If your platform provides exchange, transfer or custody services for asset tokens, you are almost certainly already a VDA Service Provider under PMLA, regardless of whether tokenisation-specific licensing exists yet. That means FIU-IND registration, full KYC/beneficial-ownership checks, STR filing (watch for structuring via many small fractional purchases aggregating to a large position), and record-keeping built to survive both a PMLA audit and a sectoral inspection — since the Bill has no harmonisation provision with existing PMLA law. Build to the higher standard now rather than waiting for harmonisation.
Cybersecurity
Tokenised platforms combine a securities exchange's attack surface (custody, settlement finality) with a crypto exchange's (key management, smart contract exploits, bridge risk). CISOs should:
Map CERT-In's six-hour incident reporting mandate to token-specific incident types (smart contract exploit, oracle manipulation, key compromise, node compromise) now.
Treat SOC 2/ISO 27001, HSM-based key management, and independent smart-contract audits as baseline, anticipating RBI-style cyber resilience expectations extending to custodians and platforms.
Demonstrate segregation of duties between developers who can modify contract logic and personnel who authorise transactions.
Build blockchain forensics and law-enforcement liaison relationships before, not during, an incident.
Data protection
DPDP Act obligations run in parallel with any tokenisation regime:
Map data flows across on-chain and off-chain systems separately — data written to a ledger is very hard to "erase" for a consent-withdrawal request, so privacy input is needed at architecture stage.
Cross-border transfers to foreign custodians or cloud infrastructure need DPDP-compliant mechanisms alongside any RBI data-localisation requirements.
Clarify each entity's role (issuer, custodian, platform) as separate or joint data fiduciary for shared KYC data.
Corporate risk
The proposed penalty framework significantly increases the legal and governance responsibilities of companies and their boards. To mitigate these risks, businesses should consider the following measures:
Obtain legal opinions before launching tokenised products: Each new tokenised offering should be legally assessed to determine its regulatory classification and identify the applicable regulator, much like the legal due diligence undertaken before issuing a new financial instrument.
Review Directors' and Officers' (D&O) insurance coverage: Organisations should examine whether their existing policies adequately cover regulatory actions relating to tokenised assets, particularly since many policies exclude claims arising from unlicensed or unauthorised activities.
Maintain a robust record of compliance efforts: Businesses should document the steps taken to comply with applicable laws, such as obtaining legal advice, participating in regulatory sandbox initiatives, implementing AML and KYC controls, and maintaining governance records. Demonstrating a proactive and good-faith approach to compliance can significantly strengthen a company's position as the regulatory framework evolves.
Readiness checklist
Commission a legal characterisation opinion for every token product, identifying the likely regulator under the look-through model.
Register voluntarily as a PMLA reporting entity if you plausibly meet the VDA Service Provider definition today.
Rebuild issuance, custody and platform contracts to state clearly when token transfer effects legal transfer.
Elevate tokenisation governance to board level with a named risk owner and quarterly gap analysis.
Align cyber, privacy and consumer protection controls to the higher of current sectoral expectations and securities-market-grade rigor.
Conclusion
This Bill may never be enacted as drafted. But it has named India's regulatory gap precisely, at a moment when capital and talent are already leaving for Singapore, the UAE and the EU, which have closed equivalent gaps through MAS, VARA and MiCA respectively. The sensible posture for Indian businesses is to build to the standard this Bill implies legal recognition discipline, lifecycle-segregated licensing readiness, PMLA compliance, financial-market-grade cyber and privacy controls, and board-level governance rather than waiting for the statute that eventually mandates it. Firms that do this will be best positioned for whatever framework emerges, and the ones regulators and institutional counterparties trust enough to work with in the meantime.
At Fathom Legal, we work with businesses navigating emerging technologies by helping them build legally compliant, commercially viable, and future-ready digital ecosystems. Whether it is structuring tokenisation platforms, drafting technology and commercial contracts, ensuring regulatory compliance, or advising on privacy, AML, and cybersecurity obligations, our focus is on enabling innovation while effectively managing legal and regulatory risk.
This article is for general information only and does not constitute legal advice. The Asset Tokenisation (Regulation) Bill, 2026 is a Private Member's Bill introduced in the Rajya Sabha on 14 March 2026 and has not been enacted. Seek specific advice before structuring or launching tokenisation products.