Tokenized Stocks Issuer Failure: Recovery Paths for xStocks, Ondo, and Dinari

TL;DR: Tokenized stocks issuers don’t fail like centralized exchanges do, and neither of the two most common framings of that failure is accurate: “fully backed 1:1” is not the end of the analysis, and “issuer gone, token worthless” is not automatic either. The real question is who controls the collateral when the issuer cannot act. Three self-custody-accessible issuers in 2026 — Backed Finance’s xStocks, Ondo Global Markets, and Dinari dShares — answer it through three distinct recovery paths. Two operate through offshore SPVs (Jersey, BVI) intended to be bankruptcy-remote, issuing Swiss-law-governed debt instruments with independent Security Agents over the collateral; the third (Dinari) operates through US transfer agent recordkeeping under SEC oversight, with broker-dealer activity in an affiliated entity. Self-custody changes which entity holds the token; it does not change which entity holds the collateral, or which legal procedure governs recovery. Tax, securities, and insolvency treatment varies by jurisdiction; holders should confirm specifics with a qualified adviser.

---

Opening

Tokenized stocks issuers don’t disappear in the same way a centralized exchange disappears.

When a CEX fails, holders face a custody dispute: assets may be frozen, restructured, or claimed across creditor classes that include the platform’s other customers. When a tokenized stock issuer fails, holders face a different problem — the token already sits in their own wallet, but the legal claim it represents depends on the issuer’s structuring documents, collateral control arrangements, the role of any security agent, and the jurisdictional procedure that governs the issuer entity. Two failures, two mental models.

The harder question is not whether the token is fully backed. It is who can act on the collateral when the issuer cannot.

This reference does not judge whether any specific issuer is safer than another, and it does not promise that recovery is guaranteed under any structure. What it does is map the three legal paths that token holders’ claims would follow if xStocks, Ondo Global Markets, or Dinari dShares issuers were to fail — and what each path would mean in practice for a self-custody holder. For the broader risk framing — including market, custodian, DEX/bridge, wallet, tax, and regulatory layers — see the On-chain Stocks for Self-Custody Wallet Users pillar.

Tokenized stocks issuer failure is a different question from CEX failure, and requires a different mental model.

---

Why this comparison matters

Public answers to “what if Backed goes bankrupt” tend to settle in one of two places. The first treats “fully backed 1:1” as the end of the analysis — if the underlying shares exist, the holder is safe. The second treats issuer failure as binary: the issuer is gone, the token is worthless. Neither is accurate.

Recovery in practice depends on five variables that differ across issuers: the legal form of the issuer entity, who controls the collateral, the role of any independent agent at the collateral layer, the governing law of the token instrument, and how holder records are maintained. Each variable produces a different answer to the same failure question.

Three self-custody-accessible issuers in 2026 — Backed Finance’s xStocks, Ondo Global Markets, and Dinari dShares — answer those questions through three distinct recovery paths. Two paths (xStocks, Ondo) operate through offshore SPVs intended to be bankruptcy-remote, issuing Swiss-law-governed debt instruments. The third (Dinari) operates through US transfer agent recordkeeping under SEC oversight, with broker-dealer activity in an affiliated entity. The differences sit inside a narrower design space than the surface labels suggest, but they remain consequential when an issuer cannot act.

Three issuers, three legal structures, three different answers to the same question.

---

Comparison: the five variables across three issuers

The table below compares the five variables that shape each issuer’s intended recovery path.

	xStocks (Backed)	Ondo Global Markets	Dinari dShares
Issuer entity	Backed Assets (JE) Limited — Jersey SPV intended to be bankruptcy-remote, fully owned by Backed Finance AG (Switzerland)	Ondo Global Markets (BVI) Limited — BVI SPV intended to be bankruptcy-remote, 90.01% owned by Flux Finance Inc.	Dinari, Inc. — SEC-registered transfer agent under Section 17A(c); affiliated broker-dealer registration through Dinari Securities, LLC (FINRA / SIPC member)
Token instrument	Tracker certificate (bearer debt instrument) under Liechtenstein FMA-approved prospectus; Swiss law applicable	Structured note (debt instrument) governed by Swiss law under the Issuer’s Sales Terms; sold under Regulation S	Tokenized US securities under Regulation S
Collateral custodian	Alpaca Securities LLC (US shares, FINRA-regulated, SIPC member); InCore Bank (cash leg); Lloyd’s of London $175M aggregate supplemental coverage	Alpaca Securities (US shares) + BitGo Bank & Trust (cash and stablecoin balances); 100.5% minimum collateralization	Alpaca appears in Dinari’s documented issuance/redemption flow; backing assets are described as held with brokers / third-party brokerage accounts
Independent agent	Security Agent under a three-party Account Control Agreement, with authority to take control of collateral accounts if token holders’ rights are not upheld	Ankura Trust Company — both Verification Agent (daily attestation) and Security Agent (first-priority perfected security interest)	Transfer agent recordkeeping function under SEC Section 17A(c) framework
Failure path (intended)	Security Agent takes control of segregated collateral accounts; proceeds distributed under prospectus terms; Jersey insolvency law applies to issuer entity	Under specified default procedures, token holders may be able to direct Ankura Trust to take possession of collateral, exchange it for cash, and distribute proceeds; BVI insolvency law applies to issuer entity	Transfer agent records maintained under SEC transfer-agent rules; underlying held with brokers; broker-dealer custody protections may become relevant at the broker-dealer layer, including SIPC only if the relevant statutory conditions are met
What this does not mean	Not a direct shareholder claim against the underlying companies; Lloyd’s $175M is aggregate, not per-holder retail protection	Not equivalent to direct US brokerage account ownership; Swiss-law debt instrument under BVI issuer is a claim on the SPV’s collateral, not on the underlying companies	Not automatically a direct broker-dealer customer relationship; SIPC at the broker-dealer layer is not the same as a token holder’s direct SIPC claim
Main unresolved risk	Timing and document interpretation in Jersey insolvency proceedings; coordination across Switzerland (Backed AG) and Jersey (issuer SPV)	BVI insolvency timing; enforcement coordination between Ankura, custodians, and any Swiss-law adjudication; collateral sufficiency under stress liquidation	Record reconciliation in stress conditions; Regulation S boundary in any redistribution scenario; cross-broker custody coordination

The “failure path” row is not a ranking of robustness. It describes three different legal mechanics. The “what this does not mean” row is where most public misreadings concentrate. The “main unresolved risk” row is what the structure cannot eliminate by design.

---

xStocks: the Jersey SPV path

In plain English, the xStocks path is a Security Agent path: the token holder does not directly hold the underlying share, but has a claim routed through the SPV, its collateral accounts, and the Security Agent’s control rights.

The issuer is Backed Assets (JE) Limited, a Jersey private limited company fully owned by Backed Finance AG (Switzerland). The SPV’s activities are narrow by design: issuance and redemption of xStocks, maintenance of its own bank and collateral accounts, AML onboarding under Jersey law. The structure is intended to be bankruptcy-remote, insulating the SPV’s collateral from any insolvency of Backed Finance AG or other group entities.

Underlying US shares are held by Alpaca Securities LLC (FINRA-regulated, SIPC member). InCore Bank serves as secondary custodian for the cash leg. A Lloyd’s of London policy provides supplemental coverage up to $175M in aggregate — a policy held at the issuer/custodian level, not a per-holder retail protection.

The agent layer is where the Jersey path becomes specific. A three-party Account Control Agreement involves the SPV, the custodian, and an independent Security Agent. Per Backed’s documentation, the Security Agent may take control of the collateral accounts if it determines that token holders’ rights under the prospectus are not being upheld. Kraken’s xStocks FAQ summarizes the intended outcome: token holders are designed to retain a claim against the underlying value held with Alpaca even in a Kraken or Backed insolvency.

What this path does not provide: a direct shareholder claim against the underlying companies; a per-holder retail SIPC protection; or any specific guarantee about Jersey insolvency timing.

---

Ondo Global Markets: the BVI SPV path

In plain English, the Ondo path is a secured-collateral path: token holders rely on the issuer’s collateral, Ankura’s security interest, and enforcement under the governing arrangements if the issuer cannot act.

The issuer is Ondo Global Markets (BVI) Limited, an SPV organized in the British Virgin Islands and 90.01% owned by Flux Finance Inc.; the structure is intended to be bankruptcy-remote. The legal form is structurally similar to xStocks: an offshore SPV issuing a Swiss-law-governed debt instrument. Ondo’s documentation describes the token as a “structured note” whose payoff tracks the underlying security including dividends and corporate actions. Tokens are sold under Regulation S to non-US persons only.

Collateral sits at Alpaca Securities (US shares) and BitGo Bank & Trust (cash and stablecoin balances), with 100.5% minimum overcollateralization at all times — a buffer above 1:1 backing.

Ankura Trust Company plays a dual role: Verification Agent (daily attestation that collateral matches outstanding tokens) and Security Agent (first-priority perfected security interest). Under specified default procedures — for example, inability to service redemptions or maintain full collateralization — token holders may be able to direct Ankura to take possession of the collateral, exchange it for cash, and distribute the proceeds. The two-job consolidation is distinctive: the entity that verifies daily is the entity that enforces in a failure.

What this path does not provide: equivalence to a US brokerage account. The token holder’s claim is against OGM BVI Limited under Swiss law, with Ankura’s security interest as the enforcement mechanism. BVI insolvency procedure and cross-border coordination with Swiss-law adjudication are real-world constraints on timing.

---

Dinari dShares: the SEC transfer agent path

In plain English, the Dinari path is a regulated-records path: the recovery question starts with transfer agent records, then moves to broker-dealer custody and US securities procedures.

Dinari is not another offshore SPV path; it is a transfer-agent-record path. There is no Jersey or BVI SPV. The structure uses two related US entities: Dinari, Inc. is registered with the SEC as a transfer agent under Section 17A(c) of the Exchange Act; Dinari Securities, LLC, an affiliated broker-dealer entity, is registered with the SEC as a broker-dealer and is a member of FINRA and SIPC. dShares are distributed under Regulation S to non-US investors. Dinari’s own documentation names Alpaca in the dShare issuance and redemption flow. Other public materials describe the backing assets as held with brokers or in third-party brokerage accounts, without consistently naming the full custody stack.

Transfer agent records — the registry of who holds what — are maintained under SEC transfer-agent rules. The backing assets are described as held with brokers or in third-party brokerage accounts. If Dinari were unable to act, the recovery path would likely follow US securities law procedures: transfer agent records maintained under SEC requirements, broker-dealer custody protections at the broker-dealer layer, and SIPC procedures only if the relevant statutory conditions are met. (The SIPC nuance for token holders is addressed in the next section.)

What this path does not provide: automatic equivalence to direct brokerage shareholding, or unrestricted redistribution given the Regulation S boundary. The SEC framework supplies a recordkeeping backbone the SPV paths do not have, but it does not, by itself, collapse the distinction between a tokenized security distributed under Regulation S and a directly held share.

---

What all three paths have in common

The SIPC misunderstanding. None of these structures should be simplified into “SIPC protects the tokenholder.” SIPC may become relevant at the broker-dealer layer in some structures — but only if the relevant statutory conditions are met, and even then the tokenholder’s recovery path is not the same as holding a normal brokerage account directly. This is the most common misreading in public discussion of tokenized stocks, and it survives across all three issuer models because the token holder is one structural layer removed from the broker-dealer customer relationship that SIPC protects.

Shared limits. Each structure defines its recovery mechanism in advance through documents — prospectus, security agent appointments, control agreements, transfer agent registrations — rather than ex-post negotiation. Each depends on jurisdictional procedure (Jersey courts, BVI insolvency, US securities law) that takes time and produces outcomes shaped by document interpretation. Each carries unresolved operational risk: whether the agent can actually act when needed.

Infrastructure concentration. Alpaca Securities appears in the documented infrastructure discussed above: explicitly as a custodian for xStocks and Ondo, and in Dinari’s issuance and redemption flow. The form of involvement differs across issuers, but the claim chain remains issuer-specific while the underlying broker-dealer infrastructure is less diverse than the issuer labels suggest.

The common feature is not guaranteed recovery. It is that each structure routes recovery through pre-defined legal and collateral arrangements.

---

What this means for a holder, in practice

The structural mapping above describes how the legal mechanics are designed to work. What it does not yet answer is the question most holders actually have: if the issuer of my tokens were to fail, what would I, as a holder of these tokens in my own wallet, actually experience?

The four practical dimensions below frame what a holder would face. These are hypothetical — no large tokenized-stock issuer of this type has gone through a real failure under public observation, so the description below reflects how the structures are designed to operate, not how they have been tested in practice. This section is not a prediction of how any court, regulator, security agent, transfer agent, broker-dealer, or insolvency official would act in a specific case.

1. Timing. Jersey insolvency proceedings, BVI insolvency proceedings, and SEC-supervised resolution processes should generally be expected to take longer than ordinary token redemption or exchange settlement. Depending on the facts, jurisdiction, agent action, and court involvement, the timeline could range from weeks to months or longer.

Separately from the legal recovery path, market access could also change during that window. Secondary market liquidity for the affected token may thin or disappear — DEX pools may drain as LPs withdraw, CEX listings may halt, and the on-chain token may continue to exist as a transferable asset whose price reflects uncertainty rather than reference NAV.

2. Action by the holder. In the intended design of all three paths, the relevant agent (Security Agent for xStocks, Ankura for Ondo, transfer agent function for Dinari) is expected to act on behalf of token holders collectively, rather than each holder independently enforcing against collateral from the start. In practice, holders may still need to complete identification, proof-of-holding, claims-submission, or distribution procedures adopted in the resolution. Self-custody preserves the wallet-address record; it does not by itself produce a holder identity in legal proceedings.

3. Form of recovery. Recovery should not be assumed to mean delivery of underlying shares to wallet holders. Depending on the structure and resolution process, recovery may take the form of cash, stablecoin-equivalent proceeds, or another distribution mechanism defined by the applicable documents. The Lloyd’s $175M aggregate coverage for xStocks is supplemental insurance at the issuer/custodian level, not a per-holder fund. Ondo’s 100.5% overcollateralization buffer is a backing margin, not an additional retail protection layer. Dinari’s broker-dealer SIPC exposure sits at the broker-dealer layer (Dinari Securities, LLC and underlying broker-dealer custodians), not directly at the token holder layer.

4. What is not guaranteed. Full 1:1 recovery in value. Fast resolution. A particular timeline. Any of these may be achieved in a well-functioning resolution; none is guaranteed by the structure. The collateral is intended to be there; the legal process to convert it into proceeds for token holders is what introduces variance.

The token in a self-custody wallet may serve as evidence of the holder’s claim, but it is not, on its own, the recovery mechanism.

---

What changes for self-custody holders specifically

Self-custody reduces platform-custody risk. It does not remove issuer-structure risk.

What self-custody changes: the token is in the holder’s own wallet, not held by an exchange that might itself become a counterparty in any failure scenario. If a CEX restricts withdrawals during stress, a self-custodied token is not trapped inside that exchange account. That does not mean the token is unaffected by issuer-level restrictions, transfer controls, liquidity loss, or recovery procedures. The holder’s address is the holder’s record on chain, which can support identification under any process that recognizes blockchain records.

What self-custody does not change: the documents and recordkeeping systems that govern recovery — SPV prospectuses, security agent appointments, transfer agent registrations — live off-chain, in legal systems that don’t read wallet addresses by themselves and don’t accelerate because the holder is self-custodied. Collateral sufficiency and procedure timing are determined by the same factors regardless of where the token is held.

For the broader framework on how this risk layer sits alongside the other six dimensions a tokenized stock holder faces, see our pillar reference: On-chain Stocks for Self-Custody Wallet Users.

---

Closing

The right question is not only whether tokenized stocks are fully backed, but who controls the backing, under what documents, and what happens if the issuer cannot act. Each of the three issuers covered here answers that question through a specific legal and collateral architecture. None of the three answers reduces to a single word — “safe,” “unsafe,” “protected,” “unprotected.”

This reference is intended to map the architecture, not to recommend any specific issuer or product. Tax, securities, and insolvency treatment of tokenized stocks varies by jurisdiction; holders should confirm specifics with a qualified adviser in their jurisdiction of residence.