Entities providing tokenization tech have a limited track record and may contribute to increased risk, a new report by analysts at the credit-rating agency says.