Most EU compliance writing is organised one regulation at a time. That is the right shape for a lawyer and the wrong shape for a build, because the contracts do not divide that way. The document-anchoring contract answers the Prospectus Regulation, the fund regime and the market-abuse regime at once. The identity layer answers anti-money-laundering, digital-identity and investor-classification duties simultaneously. Read regulation by regulation, you write the same module down four times and still cannot tell how many contracts you are building.<\/p>\n\n\n\n
So this article follows the way the system’s shape \u2014\u00a0organized<\/strong> by architecture layer, with regimes attaching to whichever layer governs them.<\/strong>\u00a0A layer exists because something has to be built, not because a Regulation has a name.<\/p>\n\n\n\n Scope: the issuer lane.<\/strong> The entity issuing and administering a tokenized security \u2014 including the moment it has the token admitted to trading on someone else’s venue, which is when the market-integrity layer switches on and not before. Venue operators and own-account dealers carry a larger obligation set not covered here.<\/p>\n\n\n\n Before any module, one test. It removes more work than it creates.<\/p>\n\n\n\n An on-chain record earns its place only when an on-chain function gates on it.<\/strong> Some The rule of thumb that “a rule goes on-chain when the contract holds every input” is necessary and not sufficient, and the gap is where over-building lives. A notification threshold is the clean example: give a contract a price feed and it can aggregate a running total perfectly. It still does not belong on-chain, because crossing the threshold makes a transaction notifiable, never unlawful<\/strong>. Nothing gates. The contract could only emit an alert an indexer would raise anyway \u2014 pricing worse, unable to count business days, unable to correct an immutable total after a bad feed.<\/p>\n\n\n\n “The contract could decide this”<\/em> and “a contract must decide this”<\/em> are different claims. Only the second buys on-chain state.<\/p>\n\n\n\n An event surface no contract reads is how off-chain surveillance and regulatory reporting receive ledger facts; market-abuse monitoring is unbuildable without it. The test bars\u00a0state<\/em>\u00a0nothing reads, not events nothing reads.\u00a0The carve-out inverts for personal data.<\/strong>\u00a0Storage can be deleted; an event log cannot. So where an event describes a natural person it carries the wallet and an opaque hash and nothing else \u2014 tier, jurisdiction, person type, claim outcomes and declared covenants stay in storage, where deletion actually works. <\/p>\n\n\n\n The sharpest case is the internal person identifier that ties an investor’s wallets together: in storage, one erasure call removes every wallet under it; in a log, it states permanently that those addresses are one human. An event says\u00a0that<\/em>\u00a0something happened to a wallet; storage says\u00a0what<\/em>. And the indexer loses nothing, because the operator minted that identifier and holds the wallet-to-person table in its own database \u2014 the one copy of the linkage the operator can delete, which is why it is the copy that holds it.<\/p>\n\n\n\n That gives three honest categories, and naming the third is part of the design:<\/p>\n\n\n\n <\/p>\n\n\n\n A design that claims everything is on-chain is not more compliant. It is less honest about where the failure modes are.<\/p>\n\n\n\n Whether to build on the ERC-1400 family or ERC-3643 (T-REX) is the wrong question to start with, and it is not a compliance question.<\/strong> Every obligation here is satisfiable under either. The choice turns on the operator’s existing stack, vendor relationships, auditor familiarity and interoperability commitments \u2014 it changes which capabilities arrive pre-built and which are custom, and therefore the audit surface. It does not change the rulebook.<\/p>\n\n\n\n So this section specifies the architecture is specified as a\u00a0required capability set<\/strong>, then binds it to whichever standard you chosen:<\/p>\n\n\n\n <\/p>\n\n\n\n The third runs one direction: a third party attests something\u00a0about<\/em>\u00a0the investor. The seventh runs the other: the investor attests something themselves \u2014\u00a0I received this document, I am a declared person.<\/em>\u00a0The third is time-based and expires. The seventh binds to a\u00a0document version hash<\/strong>, so revising the document invalidates every outstanding acknowledgement the moment the new version is anchored \u2014 no sweep, no configuration, no chance to forget.<\/p>\n\n\n\n <\/p>\n\n\n\n Two properties of that table are where the page count goes when you organise by regulation instead.<\/p>\n\n\n\n A retail key-information duty touches\u00a0 Which obligations an issuer owes is a scoping decision: anti-money-laundering rules bind\u00a0obliged entities<\/em>\u00a0\u2014 investment firms, fund managers, payment institutions \u2014 and a bare securities issuer is not one until it holds a licence. A client owing less does not unwire the compliance engine; the reference is mandatory at construction and never null. They\u00a0empty the rule set<\/strong>\u00a0\u2014 one removal per Article, each logged. A nullable reference cannot tell\u00a0“nobody wired it”<\/em>\u00a0from\u00a0“not owed”<\/em>, and a half-finished deployment then waves every transfer through. <\/p>\n\n\n\n Targeted sanctions are the exception – they bind regardless of licence, which is why the token reads the wallet-stop store directly, above the removable module list, and not only through a module governance can drop with one call.\u00a0That read runs on every path that moves units, the agent-operated forced transfer included.<\/strong>\u00a0A control that binds irrespective of client type must not be reachable only through a list one\u00a0 The list above says which modules exist, not how many instances you deploy<\/strong>. For a platform running more than one asset that is the more expensive question. Some of it regulation decides; some is a genuine choice whose cost lands somewhere unexpected.<\/p>\n\n\n\n One instance, platform-wide \u2014 regulation decides this:<\/strong><\/p>\n\n\n\n <\/p>\n\n\n\n<\/span>1. The rule that decides what goes on-chain<\/strong><\/span><\/h2>\n\n\n\n
require<\/code>, revert<\/code> or branch has to read it and decide something. Holding every input needed to compute an answer is not a reason to compute it on-chain \u2014 only permission to, if something reads the result.<\/p>\n\n\n\n<\/span>The carve-out: emitting an event is not storing state.<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
<\/td> What it Means<\/strong><\/td> Example<\/strong><\/td><\/tr> On-chain<\/strong><\/td> The contract holds every input and a function reverts on it<\/td> Transfer eligibility; subscription ceilings; the denominator, timers and breach-state machine of a fund limit<\/td><\/tr> Partial<\/strong><\/td> The decision is on-chain, an input is fed in<\/td> Valuation figures and what the fund holds \u2014 the numerator of the same limit; working-day calendars; per-jurisdiction thresholds<\/td><\/tr> Off-chain<\/strong><\/td> Procedural, human, or addressed to the firm rather than the transfer<\/td> Customer due diligence itself; regulator filings; policy documents<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n<\/div>\n\n\n\n <\/span>2. Seven capabilities, before any token standard<\/strong><\/span><\/h2>\n\n\n\n
#<\/th> Capability<\/th> What forces it<\/th><\/tr><\/thead> 1<\/td> Pre-validation transfer gate<\/strong> \u2014 every movement checked before it executes, with an opaque refusal reason, and every reason a wallet may not move held in one store under one flag<\/strong><\/td> Eligibility rules across every regime. Disclosing that a block was AML-driven is a criminal offence, so the revert stays generic \u2014 and a generic revert is decoration if a sanctions listing, a lapsed record and a suspicion block sit in three readable storage slots. One store makes the classes indistinguishable by construction<\/td><\/tr> 2<\/td> Investor identity and classification record<\/strong> \u2014 wallet resolved to a person<\/strong>, and the person to a verified record carrying tier and jurisdiction<\/td> Investor classification, customer due diligence, digital-identity claims. Two hops, not one, and that is regulation talking:<\/strong> the prospectus exemptions count people<\/em> per Member State and the right to erasure erases a person<\/em>, so attributes stored per wallet let one human hold two jurisdictions and two classifications \u2014 and let an “erased” investor keep trading through a wallet the delete never reached<\/td><\/tr> 3<\/td> Trusted attestation issuers, with revocable claims<\/strong> \u2014 third-party attestations revocable with immediate effect on transferability<\/td> Qualified trust-service and electronic-attestation regimes; periodic AML re-screening<\/td><\/tr> 4<\/td> Rule modularity<\/strong> \u2014 rules added, removed and upgraded individually, each mappable to one Article<\/td> Fund limits change on their own schedule; the audit needs a one-to-one Article-to-function map<\/td><\/tr> 5<\/td> Freeze, forced transfer and recovery<\/strong> \u2014 parcel-level freezes, forced transfers, lost-key recovery<\/td> Circuit-breakers, regulator-ordered remediation, seizure and transfer-to-estate orders. Wallet-level stops are not here<\/strong> \u2014 sanctions, suspicion, probate and court attachments live in the single store from capability 1, because a stop distinguishable by where<\/em> it is stored discloses its class<\/td><\/tr> 6<\/td> Partition and tranche segmentation<\/strong> \u2014 sub-balances with independent transfer rules<\/td> Side pockets, per-tranche lock-ups, the pending state a subscription sits in before it settles<\/td><\/tr> 7<\/td> Investor covenants<\/strong> \u2014 what the investor themselves<\/em> stated or acknowledged, bound to the hash of the document version it was given against, checkable at mint, send or receive independently<\/td> Key-information delivery, long-life fund warnings, declared-person registers, retail-access acknowledgements<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/span>Capabilities 3 and 7 look like one capability and are not.<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
<\/span>3. The layers, and what lives in each<\/strong><\/span><\/h2>\n\n\n\n
Layer<\/th> Modules<\/th> Principal regimes<\/th><\/tr><\/thead> Token and identity base<\/strong><\/td> SecurityToken<\/code> \u00b7 IdentityRegistry<\/code> \u00b7 TrustedIssuersRegistry<\/code> \/ ClaimTopicsRegistry<\/code><\/td>Investor classification \u00b7 anti-money-laundering \u00b7 digital identity<\/td><\/tr> Identity and eligibility<\/strong><\/td> ModularCompliance<\/code> and its rule modules \u00b7 RestrictedPartyRegistry<\/code> \/ RestrictedPartyGate<\/code> \u2014 the single wallet-stop store, read by the token and the payout path directly as well as through the gate \u00b7 CovenantRegistry<\/code><\/td>Anti-money-laundering \u00b7 targeted sanctions \u00b7 key-information delivery \u00b7 declared-person registers<\/td><\/tr> Fund-structure enforcement<\/strong><\/td> EltifConcentration<\/code> \u00b7 UcitsFiveTenForty<\/code> \u00b7 NavBorrowingCap<\/code> \u00b7 LmtGate<\/code> \u00b7 HoldingPeriodLock<\/code> \u00b7 ValuationOracle<\/code><\/td>Alternative-fund, UCITS and long-term-fund regimes<\/td><\/tr> Investor economics<\/strong><\/td> DistributionAgent<\/code> \u00b7 CouponSchedule<\/code> \u00b7 DistributionWaterfall<\/code> \u00b7 BuybackAgent<\/code><\/td>Market-abuse safe harbours \u00b7 fund distribution rules<\/td><\/tr> Market integrity<\/strong><\/td> PdmrClosedPeriodFreeze<\/code> \u00b7 PdmrRegister<\/code> \u00b7 MarketEventSchema<\/code> (the event surface, not the reporting bridge)<\/em><\/td>Market Abuse Regulation<\/td><\/tr> Disclosure and document registry<\/strong><\/td> DocumentRegistry<\/code> \u00b7 SubscriptionEscrow<\/code><\/td>Prospectus Regulation<\/strong> \u00b7 fund prospectus regimes \u00b7 key information documents \u00b7 market-abuse disclosure<\/td><\/tr> Governance and upgrade control<\/strong><\/td> Stock multisig \u2192 TimelockController<\/code> \u2192 ProxyAdmin<\/code> \u2192 proxy, deployed unmodified, the disclosure document’s hash carried in the timelock salt so change and document are bound on-chain \u00b7 DoraGovernor<\/code> \u2014 a protocol pause, an incident log and a key-rotation register, and nothing else. No custom contract sits on the upgrade path.<\/strong> The pause is read where it has to bite \u2014 the token’s holder-initiated transfers and mints, the fund modules’ acquisition paths, payouts and buy-back purchases \u2014 and deliberately not by forced transfer, recovery, repayments, disposals or refunds. A pause nothing reads is an event with a different name<\/td>Prospectus supplement discipline \u2014 see \u00a7 4<\/td><\/tr> Data protection<\/strong><\/td> Almost no module. The constraint runs through all of them \u2014 minimise personal data on-chain, justify every field that remains, keep it out of event logs entirely \u2014 plus one contract<\/strong>: a PersonErasure<\/code> coordinator that answers an erasure request in a single call, fanning out to every store holding residue about a person and erasing the identity registry last. Complete as to storage, silent as to history<\/td>General Data Protection Regulation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/span>One module usually answers several regimes.<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
DocumentRegistry<\/code>\u00a0anchors an offer prospectus, a fund prospectus and annual report, market-abuse disclosures and a retail key information document. Scoped from any one regime it is under-built for the other three.\u00a0IdentityRegistry<\/code>\u00a0is the same story.<\/p>\n\n\n\n<\/span>One regime usually spans several modules.<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
DocumentRegistry<\/code>\u00a0for anchoring,\u00a0CovenantRegistry<\/code>\u00a0for delivery acknowledgement, and is a fund-regime line item as well. There is no single place to read it.<\/p>\n\n\n\n<\/span>Every obligation here is removable except one, and\u00a0how<\/em>\u00a0it is removed is a design rule.<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
removeModule<\/code>\u00a0call empties: with the module gone, an agent key would otherwise be able to place units on a listed person and call it a seizure.<\/p>\n\n\n\n<\/span>4. How many of each \u2014 the question that decides your topology<\/strong><\/span><\/h2>\n\n\n\n
Module<\/th> What forces it<\/th><\/tr><\/thead> IdentityRegistry<\/code> and its due-diligence claims<\/td>The anti-money-laundering trigger is the business relationship<\/strong>, not the product, and the refresh cadence is per-customer. Per-asset identity puts one investor on several refresh clocks and lets a lapse on one asset coexist with trading on another<\/td><\/tr> Investor classification claim<\/td> Classification is per-client. One classification service, many regimes<\/td><\/tr> TrustedIssuersRegistry<\/code> \/ ClaimTopicsRegistry<\/code><\/td>Revocation of a qualified attestation is final and must kill transferability everywhere at once<\/strong><\/td><\/tr> RestrictedPartyRegistry<\/code><\/td>A listing is against a person<\/strong>. Per-asset, one list hit is several writes with a window between them in which the person is stopped on one asset and exiting through another. Probate holds and court attachments in the same store are person-scoped too: an estate is not per-asset<\/td><\/tr> DoraGovernor<\/code>, the register of information, incident classification<\/td>Entity-level duties<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/span>One instance per asset \u2014 because the parameters are that asset’s:<\/strong><\/span><\/h3>\n\n\n\n
SecurityToken<\/code> and its ModularCompliance<\/code> instance \u00b7 the fund limit set (EltifConcentration<\/code>, UcitsFiveTenForty<\/code>, NavBorrowingCap<\/code>, LmtGate<\/code>, HoldingPeriodLock<\/code>) \u00b7 SubscriptionEscrow<\/code>, per offer<\/em> including its validity date \u00b7 prospectus, final terms and key-information entries \u00b7 PdmrClosedPeriodFreeze<\/code>, keyed to that issuer’s reporting calendar \u00b7 the distribution modules.<\/p>\n\n\n\n<\/span>Genuinely a choice \u2014 decide it, do not default into it:<\/strong>\u00a0<\/span><\/h3>\n\n\n\n
DocumentRegistry<\/code>\u00a0(one namespaced registry, or one per asset) and the valuation feed.\u00a0CovenantRegistry<\/code>\u00a0straddles by construction<\/strong>: each entry carries its own scope, and evaluating one reads a platform-wide investor tier\u00a0and<\/em>\u00a0a per-asset offer configuration in the same check. It cannot sit on either side of the line.<\/p>\n\n\n\n