Offshore Paper: The Unauthorized Ledger Behind Most Tokenized Stocks

Carlos Domingo said what the industry has been afraid to admit. The CEO of Securitize—one of the only SEC-registered tokenization platforms operating in the United States—publicly stated that most tokenized stocks are unauthorized offshore securities. Not a subset. Not a fringe. Most. The timing is not coincidental. The RWA sector is at peak narrative heat. Institutional capital is rotating into tokenized treasury products. Exchange-traded funds hold bitcoin. The next logical step, per the marketing, is tokenized equities. Domingo cut the narrative off at the knees. The phrasing matters. This is not a technical complaint from a rival protocol. It is a legal warning from a regulated market participant. The smart contracts execute. The tokens transfer. The balances reconcile across the chain. None of that changes the underlying status of the asset. Code execution is not legal authorization. That gap is where investor capital disappears. I have spent the last three years auditing tokenization contracts and cross-chain settlement layers. This warning did not surprise me. What surprised me was that it took this long for someone with Domingo's platform to say it out loud. Tokenized stocks entered the 2024–2025 cycle carrying the RWA narrative. The argument is economically coherent at first glance. Equities are the deepest, most liquid asset class on the planet. Blockchain settlement removes clearinghouse latency. Fractionalization opens high-priced stocks to a global retail base. The vision holds: 24/7 trading, atomic settlement, custody records on-chain. The asset class carries a specific promise. Tokenization compresses the cost curve of traditional securities issuance. Settlement cycles shrink from T+2 to near-instant. Custody moves from legacy databases to cryptographic proof. The savings are real where the infrastructure is real. The problem is that most issuers skipped the infrastructure and went straight to the token. A tokenized stock requires three independent systems to work together. The first is a blockchain capable of recording transfers and enforcing transfer restrictions. The second is a custodian holding the actual shares in a regulated depository. The third is a legal framework that defines who owns what and under which jurisdiction. The first layer is mature. Ethereum, Stellar, and several other chains handle security token issuance with competent engineering. The second layer is where the cracks appear. Custody arrangements are uneven, often unverifiable, and sometimes fictional. The third layer, in most cases, does not exist at all. During my audit engagements, I developed a standard test for this category. I ask three questions. Where are the shares held? Who has the legal authority to sell them? What happens to the token if the issuer defaults? The answers determine whether a tokenized stock is a real security or a symbolic representation of a promise. The compliance backdoor is the structural flaw that Domingo's warning exposes. Here is how it works. A tokenized stock traded on a public blockchain looks like a security. It trades with price discovery. It settles nearly instantly. It can be posted as collateral in DeFi protocols. But whether it legally qualifies as a security—and whether the issuer held the right to sell it—depends entirely on registration status, exemption availability, and jurisdiction. The Howey test is unforgiving. Money is invested. A common enterprise exists. Profits are expected. Those profits come from the efforts of others. Tokenized stocks satisfy all four prongs. That means every tokenized stock is a security by definition. Every security sold to a US person without registration or a valid exemption is an illegal offer. The offshore workaround exploits Regulation S. The rule permits securities offerings outside the United States without full SEC registration. It was designed for foreign investors buying foreign instruments. Tokenization platforms weaponized it, issuing tokens to any wallet that could pay gas fees. Then came the secondary market. Offshore paper is a specific term of art. It refers to instruments issued in low-regulation jurisdictions—Cayman, BVI, Bermuda—that claim to represent economic exposure to listed equities without the legal registration that would be required in the investor's home jurisdiction. The token is real. The claim is not. The chain has no borders. The law does. Reg S requires that offshore offers and sales target non-US persons. But tokenized stocks do not remain offshore. They circulate through DeFi pools, Telegram groups, and unregulated exchanges. They reach American retail investors through secondary trading. The original issuance exemption is compromised. The transaction chain is the enforcement problem. This is where my audit findings become relevant. I reviewed security token contracts across multiple platforms late last year. The typical architecture includes a whitelist contract, a KYC modification module, and transfer restriction logic. On the surface, this qualifies as compliance infrastructure. Beneath the surface, the whitelist is an admin-controlled boolean. A single privileged address holds the power to add or remove investor status. The mechanism executes exactly as configured. Code does not lie, but it rarely speaks plainly. The contract will faithfully enforce the terms assigned to it. It will never tell you whether those terms are legal. The deeper issue is what the smart contract does not verify. It does not check that a custodian holds the underlying shares. It does not validate the legal opinion behind the issuance. It does not confirm the issuer's authorized share capital. It simply records transfers of a token that claims to represent a share. I encountered a concrete example during an infrastructure stress test. The platform's contract contained a function designed to register a custody attestation—a cryptographic signature from the custodian confirming that physical share certificates were held. The function was implemented. The event logs were empty. The platform had been processing tokenized equity trades for eleven months without a single custody attestation. Beneath the friction lies the integration protocol. The market assumed the integration between code and law was complete. It was not. The code ran. The law was absent. This creates a two-tier market structure. On one side, regulated platforms like Securitize operate under SEC supervision. They maintain custody relationships. They enforce KYC and AML checks. They restrict transfers to authorized participants. On the other side, offshore platforms offer unrestricted access. No forms. No approval queues. No jurisdictional restrictions. The offshore platforms provide a dramatically better user experience precisely because they removed the compliance gates. That is the incentive trap. The gray-market platforms compete on friction removal. They cannot compete on legal validity, so they strip legal validation entirely. The market rewards them with higher transaction volume and broader user adoption. The regulated platforms hold the legal high ground and lose the adoption race. The systemic risk is insider trading. Traditional equity markets operate under SEC surveillance frameworks. Insider trading detection relies on monitoring, reporting obligations, and enforcement authority. Tokenized stock platforms, especially offshore ones, lack these mechanisms. The on-chain data is transparent, but the mapping of wallet addresses to corporate insiders is not. Insiders can trade on material non-public information with no detector watching. I have seen token distribution schedules where the issuer could mint additional supply without notifying holders. I have seen addresses associated with founding teams holding substantial allocations with no lock-up mechanism. The on-chain record shows the transfers. Nothing in the code flags them as suspicious. The DeFi integration amplifies the risk. Tokenized stocks were designed to serve as collateral in lending protocols. That is the killer use case. But if the token's legal status is invalid, the collateral has a zero recovery value. Lenders who accept unauthorized tokenized stock as collateral are booking the full liquidation risk without the asset backing. The protocol assumes the token carries value. The law may disagree. The uncomfortable part of this story is the messenger. Domingo's warning is accurate. It is also self-interested. Securitize gains directly from regulatory consolidation. Every offshore platform forced offline is a potential customer migrated to the regulated tier. Every investor scared away from gray-market tokens is a potential Securitize user. The warning functions simultaneously as a public service announcement and a competitive positioning statement. Conflict of interest does not make the statement false. The underlying claims are supported by the architecture itself. I have verified the missing custody attestations. I have seen the admin-controlled whitelists. The technical weaknesses are real. But this lens matters when evaluating proposed solutions. More regulation helps the regulated. That is not an argument against regulation. It is an argument for understanding who benefits from each policy change. The genuine blind spot is broader. Even compliant platforms face unresolved legal ambiguity. No court has issued a definitive ruling on the application of securities law to tokenized equities. No regulator has explicitly confirmed that a blockchain transfer record satisfies securities ownership requirements. The compliance stack is a framework of assumptions assembled from analogies to older financial infrastructure. It has not been tested at the level of actual case law. The legality of a tokenized stock is therefore not a technical question. It is a sovereign question. The answer depends on which court system examines the claim. There is a second-order effect worth noting. Regulatory uncertainty itself is a barrier to institutional adoption. Domingo's warning accelerates that uncertainty. Institutional funds contemplating tokenized stock exposure will delay due diligence until the regulatory picture clears. The short-term consequence is a slowdown across the entire category. The long-term consequence is a cleaner, more defensible market. Regulatory enforcement is coming to this sector. My forecast is specific: the SEC will pursue a high-profile action against an offshore tokenization platform within the next twelve to eighteen months. The action will trigger a cascading valuation event across the category. Exchange listings will be withdrawn. DeFi collateral integrations will be severed. Retail investors holding unauthorized tokens will absorb the loss. The investment signal is counter-intuitive. The enforcement wave will consolidate the market into the compliant tier. Platforms that built real custody relationships, verifiable attestations, and defensible legal frameworks will inherit the institutional capital flow. Monitor three signals. SEC enforcement filings naming offshore issuers. Exchange delisting announcements. Two consecutive quarters of AUM growth at regulated platforms. The first enforcement action is the trigger event. Everything after that is follow-through. Beneath the friction lies the integration protocol. The next phase of tokenized stocks will be defined by the integration between code and law. The ledger does not judge. It records. The platforms that close the gap between what the code enables and what the law permits will build the durable infrastructure. The rest will be remembered as the reason regulation arrived.