When a Tokenized Security Still Requires a Signature

When a Tokenized Security Still Requires a Signature

In its October 29, 2026 announcement on Kryptowertpapiere für Privatkunden, DZ BANK reported issuing a retail investment certificate with Volksbank eG – Die Gestalterbank in late October. Gestalterbank distributed it through subscription. A crypto-securities register replaced the physical security document.

That is digital issuance, not proof of end-to-end automation. Under section 4 eWpG, a Kryptowertpapier is an electronic security entered in a crypto-securities register. Buying the certificate is not buying Bitcoin.

The investor journey has five separate layers

A useful eWpG retail banking explanation separates five steps rather than calling everything “on-chain”.

1. Issuance establishes the instrument and its terms.
2. Registration records the security through an accountable register operator.
3. Distribution explains where and how the customer subscribes.
4. Custody explains who holds or administers the position.
5. Trading explains available selling routes and their conditions.

Under section 16 eWpG, the issuer names the register operator; otherwise, the issuer fills that role. Customer-facing education should identify the actual entity, not leave “the blockchain” as the answer.

Authorization friction is not automatically paper friction

DZ BANK’s account of the remaining constraints says exchange access prevents fully digital processing without intermediaries. It also describes written customer authorization for every transaction when custody dispenses with a central securities depository. This is a conditional operational example, not evidence that every tokenized security requires a handwritten signature.

The statutory wording is narrower. Section 5(1) DepotG requires express authorization in Textform for the alternative collective-custody arrangement, separately for each custody transaction and outside general terms. Section 126b BGB defines Textform through a readable declaration naming its maker on a durable medium—not necessarily signed paper. Product teams must verify the applicable workflow rather than turn the bank’s wording into a universal rule.

A short lesson belongs at the authorization handoff

The practical response is a proposed 90-second lesson before subscription or custody authorization. Tokenized securities education should explain the certificate’s rights, name the register operator and custodian, and mark which actions remain outside the blockchain. Any manual step should show who acts next and how the customer resumes.

Two realistic comprehension checks would test the distinction.

• “Does blockchain registration mean I own Bitcoin?” No—the purchase is a security with its own terms.
• “Can I sell instantly without further authorization?” Registration alone does not establish that; the answer depends on the product’s trading and custody arrangements.

App-Learning’s white-label, in-app academy can support this embedded investor education through contextual lessons and comprehension checks before activation. The content should explain the actual handoff, not repeat a generic blockchain glossary.

Completion and understanding need separate measures

A measurement plan should separate lesson completion, first-attempt comprehension and support contacts about custody or selling. Activation then becomes a downstream measure, not proof of understanding. Comparing these signals can help distinguish an explanation problem from a workflow problem. A lesson cannot remove an authorization step that the product still requires.

The product remains the source of truth

Learning must remain separate from mandatory disclosures and applicable investor assessments. For example, section 64 WpHG sets information and suitability duties for investment advice. An academy quiz is not a substitute for those processes.

Tokenization changes infrastructure. It does not, by itself, settle custody, liquidity or customer protection. The educational task is to make those boundaries visible before the investor commits—not to make an unfinished digital journey sound complete.