Building RWA Compliance Infrastructure: What Developers Actually Need
Your users want their money to earn. They want yield-bearing tokenized fixed income, along with US stocks and other real-world assets, inside the app they already use. The screens are the easy part. The hard part is everything behind them: who is allowed to buy what, from where, and what has to be checked before and after each transaction.
This post breaks down the compliance layer a platform needs to distribute tokenized assets, and how Passage by CoinList takes it off your roadmap.
What does distributing tokenized assets require?
Tokenized assets are not one product with one rulebook. Each issuer sets requirements for each offering, and those requirements vary by asset and by jurisdiction. To offer them, a platform needs five things working together:
- Identity verification. Every user who invests has to be verified, and some offerings ask for more than others.
- AML screening. Users are screened before they transact.
- Investor eligibility. Some offerings are open only to certain investors, such as eligible non-US persons or accredited investors. Each user has to be checked against the specific offering they want, not a generic profile.
- Jurisdiction rules. Where a user lives decides what they can see and buy.
- Wallet requirements. Some issuers require wallets to be allowlisted, and some require those wallets to be screened on an ongoing basis after the purchase.
Then multiply that by each issuer you want to offer, each with its own requirements. Five issuers can mean five onboarding flows, five sets of eligibility rules, and five rulebooks that change on their own schedules. Each new asset you list adds to the pile, and each rule change lands on your team's backlog.
What happens if you build it yourself?
You end up running a compliance program instead of shipping a feature. Your team integrates each issuer's onboarding separately, maps its eligibility rules to your users, keeps up with every change, and monitors wallets afterwards. Your users feel it too: separate sign-ups, repeated verification, and redirects to third-party sites.
How does Passage handle compliance?
Passage sits between your app and the issuers. Issuers set the requirements for each offering, and Passage implements them.
Verify once, invest across issuers. Users go through Passage KYC and AML screening during onboarding, and that verified identity carries across issuers and offerings.
Eligibility checked per offering. Before a user can invest, Passage checks them against the requirements of that specific offering, including jurisdiction restrictions. Ineligible or restricted users are screened out before the transaction completes.
Ongoing monitoring where it is required. Some issuers, Superstate among them, require ongoing screening of allowlisted wallets, and Passage runs that monitoring. Where an offering calls for post-distribution checks, Passage handles those too.
A dedicated compliance team. Passage's compliance team covers KYC, KYB, accreditation checks, and jurisdiction-specific workflows.
No custody, no redirects. Passage never takes custody of your users' funds or assets. Tokens go to a wallet the user controls, and users stay inside your product the whole way through.
What does your team still own?
Your app's interface and user experience, including the wallet connection. You build on Passage's API or its white-labeled SDK components. Your own licensing obligations depend on your jurisdiction and existing regulatory status, so talk to us early. If you already verify your users' identity, tell us, and we will look at the options for your setup.
Why Passage?
Build the product, not the rulebook. One integration gives your app 400+ tokenized assets across equities, fixed income, and commodities, backed by CoinList's experience with 12M+ verified investors in 150+ countries.
Tell us about your users and where they are, and we will map out what you can offer them.
Disclosures
This content is for informational purposes only and is not investment, legal, or tax advice. Availability of tokenized assets depends on each user's jurisdiction and eligibility and on each issuer's requirements. Certain tokenized assets are offered only to eligible non-US persons and are not available to US persons. Holding a tokenized asset is not the same as holding the underlying security, and the rights attached depend on each issuer's terms. Platforms should get their own legal advice on licensing obligations.