Legal Wrappers, KYC, and Why Most RWAs Are Permissioned

ERC-3643, Polymesh, KYC providers (Sumsub, Onfido, Persona), and the legal plumbing that makes "permissionless" RWA mostly a marketing line.

25 min · advanced · part of Tokenized Real-World Assets (RWA)

Why Almost Every Real RWA Is Permissioned

When a newcomer hears "tokenized treasuries on Ethereum," the natural mental model is "ERC-20 token, transferable to anyone, just like USDC or UNI." That intuition is almost always wrong. Open up the BUIDL contract, the OUSG contract, or virtually any other major regulated RWA token, and you will find that **transfers are gated**. Only addresses on an allowlist — addresses tied to KYC-verified investors who meet the relevant securities-law eligibility — can hold or move the token. This is the central tension at the heart of RWA. Crypto's pitch has always been permissionless innovation: anyone with a wallet can transact with anyone else, the protocol does not care who you are. Securities law's pitch is the opposite: identity matters, eligibility matters, transfers must be tracked, sanctions screening is mandatory. To bring real-world assets on-chain while remaining compliant with securities law, AML regulations, and tax reporting requirements, RWA products have had to invent technical and legal patterns that look more like traditional finance with on-chain settlement than like classic DeFi. This lesson covers those patterns: the permissioned token standards (ERC-3643 most importantly), the institutional chains designed around them (Polymesh, Avalanche subnets), the KYC providers that gate access (Sumsub, Onfido, Persona, Jumio), and the legal structures (SPVs, fund wrappers, Delaware trusts, Cayman entities) that determine whether a token actually represents a legally enforceable claim. By the end you should understand why "permissionless RWA" is a contradiction in terms for almost any product touching U.S. or European securities law — and what trade-offs that creates.

Also in this lesson

ERC-3643 (T-REX): The Permissioned Token Standard
Polymesh and Purpose-Built Institutional Chains
KYC Providers: Sumsub, Onfido, Persona, Jumio
SPVs, Funds, and the Legal Structure That Actually Backs the Token
The "Permissionless RWA" Marketing vs. Reality

Key terms

ERC-3643 (T-REX): The dominant permissioned token standard on EVM chains, originally developed by Tokeny as T-REX and standardized as ERC-3643 in 2023. Combines an identity registry, compliance contract, and claim issuers to gate every transfer of a security token.
Identity registry: An on-chain registry mapping allowed wallet addresses to KYC-verified identities, used by ERC-3643 tokens to determine whether a given holder is eligible. Often implemented via ERC-734/ERC-735 identity contracts.
Compliance contract: The component of an ERC-3643 deployment that encodes transfer rules (jurisdictional restrictions, holding limits, lockups, sanctions screening). Every transfer is checked against the compliance contract before executing.
Agent (in ERC-3643): The administrative role within an ERC-3643 token that can mint, burn, freeze, and force-transfer tokens — required by securities law for lost-key recovery, corporate actions, and court orders.
Polymesh: A purpose-built proof-of-stake L1 for security tokens where every node and account is KYC-verified at the protocol layer, with compliance enforced at the chain level rather than only the token level.
KYC provider: A specialist firm (Sumsub, Onfido, Persona, Jumio) that performs identity verification, document checking, sanctions screening, and ongoing monitoring on behalf of RWA issuers and crypto businesses.
Delaware Statutory Trust (DST): A common U.S. legal wrapper for tokenized real estate and certain fund structures. Provides limited liability, clean transferability, and 1031-exchange eligibility for real estate.
Rule 506(c) private placement: The U.S. securities-law exemption used by most institutional-only RWA products (including BlackRock BUIDL). Restricts holders to verified accredited investors but allows general solicitation.
Regulation S: The U.S. securities-law safe harbor for offshore offerings to non-U.S. investors, allowing issuers to reach global markets without SEC registration. Many tokenized products use Reg S for non-U.S. distribution.
Bankruptcy-remote SPV: A legal entity structured so that the assets it holds are separated from the parent issuer's general creditors in a bankruptcy. Essential for ensuring that RWA token holders have a genuine claim on the underlying.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.