AML (Anti-Money Laundering) and CFT (Countering the Financing of Terrorism) are the regulatory frameworks that financial institutions and Virtual Asset Service Providers (VASPs) must comply with, requiring customer identity verification (KYC), suspicious transaction monitoring, filing Suspicious Activity Reports (SARs) with authorities, and refusing to facilitate money laundering or terrorism financing. Tokenized asset issuers (Ondo, Franklin Templeton) and exchanges (BitoEX) all operate under <a href="/en/glossary/compliance-legal/aml-cft-framework/" target="_blank">AML/CFT Framework</a> constraints.

A 'Beneficial Owner' is the real natural person who actually enjoys asset income and control rights, which may differ from the asset's 'nominal/legal owner.' In AML/CFT compliance, institutions must identify the ultimate natural person who holds 25%+ shares or controls a company — preventing money launderers from hiding fund sources through shell companies. In tokenized RWA, KYC requirements confirm that <a href="https://claude-me.com/en/glossary/core-concepts/token/">Token</a> beneficial owners are genuine, verified natural persons.

CARF (Crypto-Asset Reporting Framework) is the OECD's 2022 crypto-asset tax information automatic exchange framework, requiring Crypto-Asset Service Providers (CASPs) to report users' crypto-asset transaction information to their home country's tax authorities, with countries then exchanging this information under CRS (Common Reporting Standard) — the goal is enabling global tax authorities to track individuals' overseas crypto-asset income and prevent tax evasion. RWA assets Taiwan investors hold at Ondo Finance, BitoEX, and similar platforms will be automatically reported to local tax authorities after CARF fully takes effect (most countries expect 2027).

KYC (Know Your Customer) is the process of verifying users' real identities; AML (Anti-Money Laundering) is the regulatory requirement to prevent illegal funds from being laundered through financial systems. In RWA, KYC/AML is a prerequisite that any compliant tokenized platform must implement — also the point where the ideals of 'decentralization' and 'accessibility' are most frequently constrained.

<a href="https://crypto-bible.com/en/glossary/trading-concepts/mica/" target="_blank">MiCA (Markets in Crypto-Assets Regulation)</a> is the EU's comprehensive crypto asset regulatory framework passed in 2023 and fully effective since June 2024 — globally the most complete unified crypto asset regulation to date. MiCA classifies crypto assets into three categories (Asset-Referenced Tokens, E-Money Tokens, and other crypto-assets), setting capital requirements, disclosure obligations, and consumer protection rules for issuers and service providers. The classification of tokenized Treasuries (PAXG, OUSG) under MiCA remains disputed — may be classified as 'Asset-Referenced Token (ART)' or 'financial instruments.'

US securities law requires all 'securities' offerings to register with the SEC, but two important exemptions exist: Reg D (private placement exemption for US accredited investors) and Reg S (offshore offering exemption for non-US persons). Ondo Finance's OUSG uses a Reg D 506(c) + Reg S dual-exemption structure — OUSG applies Reg D for US accredited investors ($100K minimum) and Reg S for non-US investors. This is the most common legal structure for compliant US issuance of tokenized securities.

A regulatory sandbox is a controlled experimental environment created by regulators, allowing fintech firms (including RWA tokenization issuers) to test innovative products and services under limited conditions with temporary regulatory exemptions or special permissions, without needing to fully comply with existing frameworks. Sandboxes aim to help regulators and firms jointly understand the real risks and potential of innovative technologies (such as blockchain asset issuance) before comprehensive legislation. The most relevant RWA sandbox frameworks include: Singapore MAS's Project Guardian (launched 2022, cross-border pilots in tokenized bonds, FX, and funds), Hong Kong HKMA's Project Ensemble (tokenized asset cross-border settlement), EU DLT Pilot Regime (effective March 2023, permitting DLT-based equity and bond issuance and trading up to €6B per operator), and the UK FCA Digital Securities Sandbox (DSS). For RWA issuers: sandbox eligibility typically provides a clear compliance path during the sandbox period, allowing product testing and business model validation before formal regulations exist, but participants must obtain formal licenses or cease service when the sandbox ends.

A legally independent entity created to hold a specific asset. In RWA tokenization, the SPV serves as the legal bridge between the real-world asset and on-chain tokens, giving token holders enforceable ownership rights.

FATF Recommendation 16, requiring crypto asset transfers above specific thresholds (US: $3,000; most countries: $1,000) to carry identity information (name, address, account info) between sending and receiving Virtual Asset Service Providers (VASPs). For RWA tokens, the Travel Rule makes large <a href="https://claude-me.com/en/glossary/core-concepts/token/">Token</a> transfers automatically carry both parties' KYC data — one of the compliance foundations for ERC-3643's whitelist mechanism.

A mechanism that only allows pre-approved addresses (whitelisted addresses) to hold or transfer specific tokens. In RWA <a href="/en/glossary/tokenization/tokenization/">Tokenization</a>, <a href="/en/glossary/compliance-legal/whitelist-gating/" target="_blank">Whitelist Gating</a> is implemented through compliant <a href="https://claude-me.com/en/glossary/core-concepts/token/">Token</a> standards like ERC-3643, ensuring only addresses that have completed KYC verification and meet regulatory qualifications (like Reg S non-US investors) can receive tokens. This embeds traditional finance's 'accredited investor qualification review' directly into the token's <a href="/en/glossary/tokenization/smart-contract/">Smart Contract</a> layer.