ESMA puts tokenization and AI on the examiner's desk

The European Securities and Markets Authority has made artificial intelligence and tokenization a supervisory priority from 2027, and the instrument it picked matters more than the two topics on the list: Europe's securities examiners, not its legislators, will spend the years after that deciding how tokenized products and AI-driven services get built inside regulated firms.

The program is called “Innovation with investor safeguards,” and its scope is broad by design: ESMA and national regulators across the European Union will examine how regulated firms use AI and tokenized products in their core activities rather than only in back-office operations. The stated aims are to build supervisors' own capacity to oversee new technology and to make sure firms have proper governance, reliable data and client-aligned outcomes.

The report released Wednesday frames the reason as distribution: firms are “increasingly using AI and tokenized products in day-to-day financial services to gain market share,” ESMA wrote, explaining why it is starting with these two areas, and it added that innovation “brings benefits but also risks.” That is a supervisory argument about where a product ends up, not a curiosity about how it is built.

The bloc's crypto rulemaking has been running for years, and MiCA, the Markets in Crypto-Assets regulation, came into effect on July 1. What ESMA is describing now is the phase after that, in which the EU shifts from setting rules for crypto assets to examining how tokenized finance and AI are being used across the broader securities industry; on the licensing question Europe has largely written its answer, and on the evidence question it is only now starting to ask.

Next year, ESMA and national authorities will map where financial firms already use, or plan to use, AI and tokenization in products and processes that directly affect customers, then begin initial checks on a subset of the most affected firms and identify where tokenization is emerging in practice. The report does not say how large that subset is or name the firms on it, and a priority list is not a rule: this initiative announces attention, and attention arrives as questions rather than as a new obligation.

“Proper governance, reliable data and client-aligned outcomes” are exam-room terms, and they translate into four questions a firm has to answer about a product it is already selling: who is the client, what were they told, where did the data behind the model or the token come from, and which entity in the group owns the risk? A tokenized fund share class distributed through a partner platform tends to produce awkward answers to all four, because the wrapper usually arrived before the controls did.

The bet worth making is that in 2027 the binding constraint on European tokenization will be documentation: the firms most likely to be pulled into the first round of checks are those that treated tokenization as a distribution upgrade — a new wrapper for existing clients through a new venue — rather than as a control rebuild. ESMA has now put that exposure on the record without writing a single new rule, which is the cheaper way for a regulator to raise the cost of being unready.

The AI half of the program carries the same logic: models that sit inside client-facing services have to be explained to an examiner in terms of the data they consume and the outcomes they produce, and the gap between a marketing description of an AI feature and the operating reality of it is exactly the kind of thing a supervisory check surfaces quickly.

The European Central Bank has been moving in the same direction from a different seat, saying it plans to invest a small portion of its reserves in tokenized securities, giving it direct exposure to blockchain-based financial markets. That followed the debut of Pontes, its wholesale platform connecting digital ledger technology market infrastructure to its traditional payment infrastructure, which as this publication has argued puts central-bank money in the cash leg of tokenized trades. Read with the reserve announcement, the ECB moving to the buy side of tokenized paper gives the venue an anchor buyer rather than an experiment. Pontes is separate from the retail digital euro pilot planned for 2027.

The ECB and the bloc's 27 member-country central banks have also called for a wider ban on crypto platforms' ability to offer stablecoin yields, rewards or returns, arguing that fiat-pegged digital assets are money rather than savings accounts. Put the two positions side by side and Europe's stance is coherent: route central-bank money into tokenized settlement, and refuse to let a tokenized dollar behave like a deposit.

ESMA's program is where that distinction gets audited rather than argued: a stablecoin marketed with a yield is a client-facing product for which examiners will want a governance trail, and the question of whether such a token is a product or a deposit is the kind that lands in a supervisory letter long before it lands in a statute. The central banks' push for a stablecoin-yield ban, if it advances, would need national authorities to make it bite, and “Innovation with investor safeguards” is one of the few EU mechanisms built to do that work.

Next year's exercise will show where tokenized products actually sit in client-facing distribution rather than in pilots, and the subset of firms picked for initial checks will read as the regulators' own ranking of which business lines carry the most client risk. For firms that spent the past two years building the products, another legal opinion on MiCA will not help; what helps is a dated, complete file answering those four questions for every tokenized and AI-assisted product already in a customer's hands.