Risks of RWA Tokenisation

Why Risk Assessment Matters

RWA tokenisation offers exciting opportunities, but it also introduces risks that don't exist in traditional investing. A tokenised Treasury bill isn't just a T-bill — it's a T-bill wrapped in a smart contract, held by a custodian, managed by a platform, and regulated (or not) by a jurisdiction. Each layer adds risk. This guide breaks down the key risk categories and how to evaluate them.

1. Smart Contract Risk

Every RWA token is governed by smart contracts — code that manages issuance, transfers, yield distribution and redemptions. If that code has a bug, the consequences can be severe:

• Exploits and hacks: A vulnerability in the smart contract could allow an attacker to mint tokens, drain funds or freeze transfers. The DeFi space has seen over $10 billion in hacks since 2020
• Logic errors: A bug in the yield distribution mechanism could send yield to the wrong addresses or calculate it incorrectly
• Upgrade risk: Many RWA contracts are upgradeable (the issuer can change the code). If the upgrade key is compromised, the entire system is at risk
• Oracle manipulation: If the contract relies on an oracle for NAV or price data, manipulating the oracle could allow incorrect transactions

How to Assess:

• Check whether the smart contracts have been audited by reputable firms (CertiK, Trail of Bits, OpenZeppelin, Quantstamp)
• Look for public audit reports and bug bounty programmes
• Prefer contracts that are not upgradeable, or where upgrades require a time-locked multi-sig
• Review whether the protocol has a bug bounty on Immunefi (a smart contract bug bounty platform)

2. Custody Risk

RWA tokens are only as good as the assets backing them. If the custodian holding the underlying assets fails, is fraudulent, or is legally compromised, token holders may lose their claim:

• Custodian failure: If the bank or trust company holding the underlying T-bills or gold goes bankrupt, unwinding the assets could take years
• Fraud: The custodian could issue fake attestations, claiming to hold assets that don't exist. This is what happened with FTX — the exchange claimed to hold customer assets it didn't have
• Operational failure: Physical gold could be stolen from the vault; bonds could be mis-recorded
• Commingling: If the custodian mixes the issuer's assets with its own or other clients' assets, bankruptcy proceedings could treat them as part of the custodian's estate

How to Assess:

• Verify the custodian is a regulated, reputable institution (e.g., BNY Mellon, State Street, Brink's)
• Check whether assets are held in segregated accounts (not commingled)
• Look for regular, independent proof-of-reserve attestations
• Prefer structures where the legal claim on the asset is bankruptcy-remote from the custodian

3. Regulatory Risk

The regulatory landscape for RWA tokenisation is evolving rapidly and varies significantly by jurisdiction:

• Securities law: In the US, the SEC has taken the position that most tokenised securities are securities and must comply with existing securities laws. In the UK, the FCA has similar views
• Investor eligibility: Many RWA products are only available to accredited/qualified investors. Changes in who qualifies could restrict access
• Cross-border issues: A tokenised product legal in Switzerland may not be legal to sell in the UK. Holding it could create unexpected tax or legal obligations
• Stablecoin risk: Many RWA products interact with stablecoins (USDC, USDT). If a stablecoin loses its peg or faces regulatory action, the RWA products depending on it could be disrupted
• DeFi regulation: Using RWA tokens in DeFi protocols may trigger additional regulatory requirements (e.g., MiCA in the EU)

How to Assess:

• Check the regulatory status of the issuer and product in your jurisdiction
• Prefer products from regulated entities (NYDFS-approved, SEC-registered, FCA-authorised)
• Understand the legal structure: what exactly does the token represent? A share? A debt instrument? A beneficial interest?
• Consult a crypto-aware lawyer or accountant for significant investments

4. Liquidity Risk

• Secondary market thinness: Even if a token is tradeable on a DEX, the liquidity may be too thin to sell large amounts without significant slippage
• Redemption gates: Many RWA products have redemption windows (weekly or monthly) rather than instant redemption. During market stress, these may be suspended
• Flight to quality: During a crypto market crash, investors may dump RWA tokens alongside crypto, causing prices to fall below NAV
• Platform dependency: If the platform facilitating trading goes down, you may not be able to sell your tokens

5. Counterparty Risk

• Issuer risk: The company issuing the token could fail, commit fraud, or mismanage the underlying assets
• Platform risk: The platform you use to buy/hold the token could be hacked, go bankrupt, or freeze your account
• Oracle provider risk: If the oracle feeding data to the smart contract fails or is manipulated, incorrect actions could be executed
• Bridge risk: If you hold RWA tokens on a layer-2 via a bridge, the bridge itself is a risk vector. Bridge hacks have caused billions in losses

6. Key Management Risk

With self-custody, the biggest risk is often yourself:

• Lost keys: If you lose your seed phrase, your assets are permanently inaccessible. An estimated 20% of Bitcoin is lost this way
• Phishing: Fake websites and apps designed to steal your seed phrase are rampant. Always verify URLs and bookmark official sites
• Social engineering: Scammers may impersonate support staff, project teams or even friends to trick you into signing malicious transactions
• Physical security: If someone obtains your hardware wallet and PIN, they can drain your assets

How to Mitigate RWA Risks

• Diversify: Don't put more than 5–10% of your portfolio in RWA tokens. Spread across multiple products and issuers
• Use hardware wallets: Ledger or Trezor for any meaningful amount. Never keep large holdings on an exchange
• Stick to established products: BlackRock BUIDL, Ondo OUSG, PAX Gold, Franklin FOBXX have the deepest liquidity and strongest institutional backing
• Read the docs: Every legitimate RWA project publishes documentation explaining the legal structure, custody arrangement and audit reports. Read them
• Check proof-of-reserves: Verify that the issuer publishes regular, independent attestations of backing assets
• Start small: Test the full cycle — buy, hold, receive yield, sell — with a small amount before committing significant capital

The Bottom Line

RWA tokenisation is a genuine innovation that creates new investment opportunities, but it also creates new risks. Smart contract bugs, custody failures, regulatory shifts and liquidity crises are all real possibilities. The key is to understand each risk layer, do your due diligence, and never invest more than you can afford to lose. The most successful RWA investors will be those who combine enthusiasm for the technology with old-fashioned risk management.

Learn More

• How to Invest in RWA Tokenisation — practical UK guide
• RWA vs Traditional Investing — compare the risk profiles
• What Are Real-World Asset Tokenisation? — start here if you're new

Nothing on this site is financial advice. All content is for educational purposes only. Always do your own research and consult a qualified financial adviser before making investment decisions. Back to all guides