Why it matters
Almost every tokenized security in production is a permissioned instrument. Securities law does not care that a claim is recorded on a blockchain; it cares who may hold it, under which exemption, in which jurisdiction, and subject to what holding-period and investor-count limits. A bearer token that anyone can receive is incompatible with those constraints. The design question is therefore not whether transfers are restricted but where the restriction is enforced: in the token contract, at the venue, or on a transfer agent's books.
The answer determines what tokenization delivers. If eligibility is checked inside the contract, compliance travels with the asset and secondary transfers can occur without manual approval. If it is checked at the venue, the token is only as transferable as the venue's onboarding process.
How it works
The reference implementation is ERC-3643, the T-REX standard, created on 9 July 2021 and now at Final status. It layers two checks over an otherwise ordinary ERC-20 token. An identity registry maps wallet addresses to on-chain identity contracts and investor country codes using ISO-3166; a separate compliance contract holds offering-level rules such as caps on holdings per investor or per country.
A transfer succeeds only if both checks pass: isVerified confirms that the receiver holds the required claims from trusted claim issuers, and canTransfer confirms that token-level rules are satisfied. Because identity registry storage can be shared across token registries, one verified investor identity can serve many offerings, which is where the operating leverage sits.
The standard also includes powers a bearer instrument does not have: agents can execute forced transfers that bypass compliance checks, wallets can be frozen, and tokens can be recovered where an investor loses a private key. They replicate the corporate-registry functions (court-ordered transfers, lost certificates, sanctions freezes) that securities markets require.
Economic mechanism
Permissioning converts a variable compliance cost into a fixed engineering cost. In conventional private markets, every secondary transfer requires a bilateral eligibility check, legal opinion and register update, which is why private fund and private credit secondaries are slow and expensive. Encoding the rules once means the marginal cost of a compliant transfer approaches the cost of a blockchain transaction, while the fixed cost of maintaining the rule set rises.
That shifts the economics of illiquid asset classes in a specific way. It lowers transaction costs without expanding the buyer pool, because that pool is defined by law, not by friction. The gain shows up as tighter bid-offer spreads and shorter settlement within a fixed set of eligible holders, and as the ability to pledge the asset, since a pledgee can verify eligibility programmatically.
The countervailing economics are network effects on identity. A permissioned token is liquid only to the extent counterparties already hold verified credentials. Reusable identity infrastructure is a shared-cost problem with a coordination failure at its centre, and fragmentation of identity schemes across issuers is the main brake on secondary liquidity.
Participants
Issuers and their transfer agents define eligibility and hold the legal register. Claim issuers (regulated verification providers or the issuer's own compliance function) attest that an investor meets accreditation, jurisdiction and sanctions requirements. Platform operators such as Securitize and Tokeny supply the contract and identity infrastructure. Financial crime standard setters set the data requirements: the FATF's June 2025 update to Recommendation 16 revised the standards on originator and beneficiary information, and its targeted update of 26 June 2025 reported that 99 jurisdictions have passed or are passing travel rule legislation.
Examples
Tokenized Treasury and money market funds are the largest permissioned category in production. Fund shares are issued to whitelisted addresses under private-placement exemptions, with the transfer agent maintaining the authoritative register and the contract enforcing the whitelist, which is why these instruments are redeemed rather than sold on open venues.
Fiat-referenced stablecoins are a partial case. Their contracts are open to any address but retain issuer-level freeze functions, so eligibility is enforced after the fact rather than at transfer time. The FATF noted in June 2025 that most on-chain illicit activity now involves stablecoins, the empirical argument for pre-transfer screening.
Adoption claims for ERC-3643 come mainly from the vendor: Tokeny states that around $28bn to $32bn of assets have been tokenized using the standard. That figure is not reconciled to an independent register and should be treated as a vendor disclosure rather than a market statistic.
Risks and limitations
Permissioning creates privileged roles, and privileged roles create risk. Forced transfer, freeze and recovery powers are necessary for regulated assets, but they concentrate control in agents whose governance and key management are rarely disclosed to holders. A compromised agent key is a solvency event for the asset, not an operational incident.
Composability is the main casualty. A token that reverts on transfer to an unverified address cannot be used in permissionless lending pools, automated market makers or bearer collateral arrangements, so much of the DeFi-adjacent argument for tokenization does not apply to the instruments institutions actually issue.
Identity infrastructure carries its own exposures: on-chain registries can leak jurisdiction and holding information through transaction patterns, and off-chain credential providers become single points of failure. Encoded rules also go stale. Regulatory perimeters change faster than deployed contracts, and the upgrade mechanisms designed to keep compliance aligned are themselves an avenue for unilateral change to holders' rights.
Key metrics
Useful measures are the share of tokenized security value held in permissioned standards, the number of verified investor identities reusable across offerings, secondary transfer counts and turnover for permissioned instruments, and the number of jurisdictions with travel rule legislation in force, 99 in train as of the FATF's June 2025 update. Vendor-reported tokenized value should be kept separate from verifiable figures.
Related research
The ERC-3643 specification is the primary technical source. Chainalysis has published an accessible treatment of the standard's compliance architecture. The FATF's June 2025 targeted update and revised Recommendation 16 set out the transfer-information requirements permissioned designs are built to satisfy.