Where we are in the series
We started by showing how a real-world asset becomes a token: an off-chain legal wrapper paired with an on-chain claim (Part 1). Part 2 looked at tokenised Treasuries — BUIDL, USDY, OUSG, FOBXX — and the fund structures behind them (Part 2). Part 3 covered private credit on Centrifuge, Maple and Goldfinch. Part 4 took apart tokenised equities and commodities.
In each case we kept reaching the same uncomfortable point: the token is the easy part. The redemption is the hard part. This article maps the chain of counterparties that sits between your wallet and the underlying asset, and shows where redemption can break.
The token is a pointer, not the asset
A tokenised Treasury fund share, a private credit pool token, or a tokenised stock is a digital pointer to a position recorded somewhere off-chain. Holding the token in a self-custody wallet means you control the pointer. It does not mean you control the asset.
Behind the token there are typically five layers:
- Issuer / sponsor — the legal entity that owns or sponsors the underlying assets (BlackRock for BUIDL, Ondo Finance for USDY, Franklin Templeton for FOBXX, Backed Finance for bTokens).
- Transfer agent — the regulated entity that maintains the official register of holders. For BUIDL, USDY and OUSG that is Securitize Transfer Agent LLC.
- Custodian — the bank or trust company holding the off-chain assets. BNY Mellon for BUIDL, State Street for FOBXX, Ankura Trust for USDY collateral, Bank Frick for several Backed bTokens.
- Sub-custodian / fund administrator — Apex, Trident Trust, Pershing, Circle (as the BUIDL USDC redeemer counterparty), Alpaca Securities and InCore Bank for Backed.
- Smart contract — the on-chain code that mints, burns, transfers and (almost always) lets the issuer freeze or reissue tokens via admin keys.
A failure at any one of these layers can break redemption, even if the other four are working perfectly. This is the counterparty waterfall.
Layer one and two: issuer and transfer agent
BUIDL launched on Ethereum on 20 March 2024 with a $5M minimum, structured under Regulation D 506(c) and Section 3(c)(7) of the Investment Company Act. BNY Mellon is custodian. Securitize is the transfer agent. In April 2024, Circle launched a smart-contract redeemer that lets BUIDL holders redeem to USDC 24/7 on-chain; standard fund redemptions still flow T+0 through Securitize and the cash leg of the bank.
That sounds neat — and it mostly is — but it pulls in a stack of separate Securitize entities: Markets LLC (broker-dealer and ATS), Transfer Agent LLC, Capital LLC (Exempt Reporting Adviser) and Fund Services LLC. Each is a distinct legal entity with its own regulatory perimeter. If Securitize Transfer Agent LLC suffered an operational failure, the on-chain whitelist would temporarily stop processing transfers, but the books and records would migrate to a successor agent under SEC oversight. You would not lose your claim, but you would lose access to it for a window.
If BlackRock itself failed, the fund is structured to be bankruptcy-remote: a BVI feeder fund with BNY Mellon custody. The fund's assets are not on BlackRock's balance sheet. That is the entire point of the wrapper.
USDY uses a different mechanism. Ankura Trust acts as both collateral agent and verification agent, and holds a first-priority security interest in the deposits and Treasury holdings backing the token. If Ondo USDY LLC failed, Ankura has standing to take control of the collateral and repay tokenholders directly. That is a stronger structural promise than "we will probably get sorted out in bankruptcy."
Layer three and four: custodian and sub-custodian
The custodian is where most retail mental models stop. "BNY Mellon holds the Treasuries, so I'm fine." In practice the custodian sits in a chain. Cash legs settle through correspondent banks. Securities sit in DTC or Euroclear. Stablecoin legs touch Circle, which itself depends on its own bank partners.
For European-domiciled wrappers like Backed Assets (JE) Limited — a Jersey subsidiary of Backed Finance issuing bTokens under EU Prospectus Regulation 2017/1129 — the custody chain runs through Alpaca Securities for US equities, InCore Bank in Switzerland, and Maerki Baumann. Redemption is restricted to qualified investors and registered market makers. Retail holders only ever access secondary on-chain liquidity. If a market maker withdraws, the on-chain price can detach from net asset value even though the underlying assets are unaffected.
If a custodian like Bank Frick failed, Liechtenstein's TVTG Article 25 segregates client crypto from the bank estate, and the EU Deposit Guarantee Scheme covers €100k of cash deposits per depositor — not securities. US bank failure regimes are different again: the FDIC covers $250k of cash, not custodied securities, which sit in segregated accounts and pass through.
None of this looks like the FDIC sticker on a checking account.
Layer five: the smart contract and its admin keys
Most RWA tokens have a permissioned ERC-20 contract. The issuer can pause transfers, freeze specific addresses, burn tokens, and reissue them to a replacement address. This is not a bug — for a Reg D security, it is a regulatory requirement so that the transfer agent's on-chain register matches the official record.
It does mean self-custody of an RWA token is structurally different from self-custody of ETH or BTC. The issuer retains a kill switch. If you read the contract, you will usually find a freeze(address) or forceTransfer(from, to, amount) function gated to a transfer-agent role. We covered the general approval and signing surface in the DeFi security guide.
BUIDL is also live on nine chains via Wormhole's Native Token Transfer framework, which uses lock-and-mint or burn-and-mint to keep supply consistent. Bridges are their own counterparty layer: Wormhole was hacked for $325M in February 2022, before NTT existed. NTT is a tighter design, but bridge risk is now part of the redemption stack for any multichain RWA.
What can actually go wrong: case studies
The theoretical waterfall is one thing. The track record of the last three years is more concrete.
- Maple, December 2022. Orthogonal Trading defaulted on roughly $36M and Auros missed a ~$2.9M wETH payment in the wake of FTX. Pool depositors took the loss. The smart contract worked. The credit underwriting did not.
- Goldfinch, 2023. A $20M Stratos loan was written down by about $7M in October 2023. Tugende's $5M facility defaulted in June 2023. Backers and senior tranche took different recoveries depending on pool structure.
- Centrifuge, 2023. A BlockTower-backed pool put $1.84M of MakerDAO collateral at risk in August. The Harbor Trade pool saw $2.1M sour in July. These are real-world legal recoveries playing out at the speed of court systems, not blocks.
- Linqto, 2025–2026. Filed Chapter 11 on 8 July 2025; plan confirmed 6 February 2026. The SEC and FINRA found customers may not have legally owned the pre-IPO shares the platform sold them. The token, the account statement and the legal title were three different things.
In private credit, redemption is also gated by mechanics. Centrifuge runs epoch-based redemption windows of 24 hours or longer; senior tranches are paid first; if pool liquidity is thin, the window extends. Maple's Cash Management products run weekly withdrawal cycles, with a dynamic instant-liquidity buffer added in April 2025 for syrupUSDC and syrupUSDT. None of these behave like "sell to a stablecoin in one block."
And composability magnifies the blast radius. Aave's Horizon market launched August 2025 and grew past $440M in net deposits, with collateral including Superstate USTB and USCC, Centrifuge JTRSY and JAAA, and VanEck VBILL. A redemption gate or admin freeze on any of those tokens cascades into Aave liquidations. We covered the broader pattern in the composability and systemic risk article.
What protections actually apply
The SEC's Division of Trading and Markets published staff FAQs on 15 May 2025 clarifying that SIPC protection only applies to SEC-registered tokenised securities held at SIPC-member broker-dealers, with the standard limits of $500k total and a $250k cash sublimit. Most RWA tokens you can hold today — Reg D 506(c) offerings like BUIDL, foreign-issued bTokens, private credit pool tokens — are not in scope. FDIC covers cash at insured banks, not custodied securities. The EU DGS covers cash, not crypto. TVTG covers segregation, not loss.
The practical answer for retail self-custody is: assume no statutory backstop unless the issuer's disclosure document explicitly names one and you can verify it. Treat exchange-held versions of these tokens with the same scepticism we built up in the not-your-keys article.
A pre-buy checklist
Before you take a position in any RWA token, work through these eight questions:
- Legal wrapper and jurisdiction. Delaware LLC? Cayman? BVI? Jersey? Liechtenstein? Read the offering document.
- Custodian and bankruptcy-remoteness. Who holds the assets, and is the issuing vehicle structured so the custodied assets are not part of the sponsor's estate?
- Transfer agent. Is it SEC-registered? Is the on-chain whitelist its only register, or is there a parallel official record?
- Redemption schedule, currency and eligibility. T+0, T+1, weekly, monthly? USD, EUR, USDC? Retail or qualified investors only?
- Admin key powers. Can the issuer freeze, burn, or reissue? Under what circumstances? Who controls those keys?
- Bridge security. If the token is multichain, what bridge? What is its track record and admin model?
- SIPC, FDIC, DGS applicability. Read the actual disclosure, not the marketing page.
- Disclosure quality. Audited financials, monthly attestations, real-time proof of reserves, or none of the above?
If you cannot answer most of these in five minutes, the issuer has not made disclosure easy enough — and that is itself a data point.
Coming up in Part 6
Part 6 is the operational capstone: how to actually hold RWA tokens in self-custody, what to check at signing time, how to think about admin keys versus your own keys, and where wallet hygiene lines up with this counterparty stack. The token has a kill switch. Your job is to know when, why, and by whom it can be pulled — and to make sure the rest of your operational setup does not add a second one.
