The RWA Regulatory Map: There Is No RWA Framework, and Here Is Exactly Where the Analogies Break

There is no RWA regulatory framework. Not in the United States, not in the EU, not in the UK, Singapore, Hong Kong or the UAE. What exists is securities law, fund law, custody law, transfer agency law and commodities law, written before tokenization, applied to tokenization by analogy. Six of the seven jurisdictions here have no purpose-built statute. Switzerland has one.

Three findings a practitioner cannot get elsewhere in one place:

The examination outlived the thing it was written to examine. Rule 17f-2 under the Investment Company Act requires an independent accountant to verify a fund's assets at least three times each fiscal year, at least twice unannounced. It was written for vaults and paper certificates. When the SEC staff granted relief on 12 August 2026 for a registered fund whose shares live on a public blockchain, it dropped the paragraphs that presuppose a vault and a certificate and kept the accountant.

In the largest onshore tokenized-equity program, the token is not the security. Under the Division of Trading and Markets no-action letter of 11 December 2025, the tokens are expressly not the securities and not security entitlements. They are an alternative method of instructing the depository to move entitlements on its own official books, and the registered owner remains the depository's nominee. The token is an instruction, not a title.

Everywhere except Switzerland, the on-chain register is a mirror. Swiss law, in force since 1 February 2021, creates register uncertificated securities that exist on entry in a compliant electronic register and can be transferred only through it. Nowhere else in this map does a statute make the ledger the record. And almost nothing, anywhere, examines whether the mirror matches.

How to use this map

This is a field guide, not a survey. It is built to be jumped into.

If you are structuring an offering, go to the grid, find your asset class, and read the offering and holder-gate rows. If you are the one who has to sign something, go to the assurance layer. If you are trying to work out who owns what when the systems disagree, go to the register of record. If you are opening a jurisdiction, go to the seven jurisdictions.

Every cell in the grid names the primary instrument it points to. Twelve of seventy-seven cells could not be verified in the session that produced this article; those cells say so, carry the searches that failed, and state the one thing that would settle them. That list is reproduced in full at the end.

One thing this map deliberately does not do is restate the stablecoin picture. Payment stablecoins have their own live frameworks in seven jurisdictions, and those are mapped separately in The Complete Stablecoin Regulatory Map. What belongs here rather than there is the yield-bearing token: the instrument that looks like a stablecoin, pays a return, and is therefore a security or a fund interest. That distinction is the first place practitioners go wrong, and it is where this map starts.

The seven layers

Any tokenized real-world asset can be taken apart into the same seven questions. The questions are old. Only the order in which they fail is new.

Offering and exemption. Under what authority is the thing sold, and to whom. This is the layer everyone starts with and the layer that causes the least trouble, because the answer is almost always the pre-tokenization answer.

Holder gates and enforcement. Who may hold it, and whether the transfer restriction actually enforces the gate. The exemption sets a condition about the investor. The token contract sets a condition about the wallet. Nothing requires those two conditions to be the same condition.

Custody. Who holds the underlying, under which custody rule. The rules were drafted around a bank holding certificates or a depository holding book entries. A private key is neither.

Transfer agency and the register of record. Which record is the register. This is the load-bearing question of the whole field and it gets its own section below.

Valuation. Who determines value under what rule, and what a continuously published on-chain price legally is. For anything holding illiquid assets, this is where the real exposure sits.

Reporting. What gets filed, with whom, how often. Determined entirely by the wrapper, never by the token.

Assurance. Who examines what, under which standard, and what is left unexamined. This is the spine of the article, and the layer where the map is emptiest.

The six asset classes

Tokenized treasuries and money market funds

The most mature corner of the field, and the one where the wrapper does all the work.

Three live legal paths exist, and none of them is a tokenization path. A registered money market fund under Investment Company Act Rule 2a-7, which is what the Franklin OnChain U.S. Government Money Fund is. A Section 3(c)(7) private fund sold to qualified purchasers in a Rule 506(c) offering, which is what BUIDL and OUSG are. Regulation S debt sold only outside the United States, which is what USDY is: a claim on an issuing entity secured by a portfolio of short-dated Treasuries and bank deposits, not a fund interest at all.

The practitioner consequence is that three products that look alike on a dashboard have three different investor protection regimes, three different reporting stacks, and three different answers to the question of what happens if the sponsor fails. A Reg S note holder is a creditor. A 3(c)(7) limited partner is an equity holder in a private fund. A registered fund shareholder has the whole 1940 Act behind them. The token does not tell you which one you are.

The custody answer splits the same way. BUIDL's underlying cash and securities sit with a bank custodian that is also the fund administrator. In the Franklin structure, the affiliated transfer agent holds the private keys, and the SEC staff addressed that directly rather than by pointing at an existing custody rule, because there was no existing custody rule to point at. That is the shape of this entire field: not prohibition, and not permission either, but a staff letter standing in for a rule.

Where the analogy breaks here: the holder gate. Rule 506(c) requires the issuer to take reasonable steps to verify accredited status. Regulation S requires the transaction to be offshore. Both conditions attach to a person. The enforcement mechanism attaches to a wallet address on an allowlist. No rule observed requires the allowlist to be a faithful representation of the verified investor set, and no engagement examines whether it is.

Tokenized private credit

The deepest section of this map, because it is where the mismatch between a quarterly legal reality and a continuous market reality is sharpest.

The structure to understand is the feeder. The Apollo Diversified Credit Securitize Fund tokenizes access to Apollo Diversified Credit Fund, which is registered under the Investment Company Act as a diversified closed-end management investment company operating as an interval fund. Interval funds hold illiquid assets, strike a net asset value on their own cycle, and offer to repurchase a set portion of shares at that value at fixed intervals, typically quarterly. Subscriptions run through a registered broker-dealer that is also the transfer agent and the fund administrator.

So the regulated object is a registered fund. The token is a wrapper around a feeder into it. Everything that follows comes from that sentence.

Valuation is governed by Rule 2a-5, and Rule 2a-5 says nothing about a token. The rule was adopted on 3 December 2020 in Release IC-34128 and became effective 8 March 2021. It places the good-faith determination of fair value on the fund's board, and permits the board to designate a valuation designee, which the board must continue to oversee, to perform those determinations. For a fund holding corporate direct lending, asset-backed lending and structured credit, that determination is a governed process with documented methodologies, pricing service oversight, and stale-mark procedures. It happens on the fund's schedule.

Now put a token on it. The token trades continuously. A lending protocol reads a price for it from an oracle and lends against it. That price updates far more often than the valuation designee determines anything.

Here is the precise legal question, and it does not have an answer: what is that oracle price? It is not a Rule 2a-5 fair value determination, because the valuation designee did not make it and the board did not oversee it. It is not a market quotation for the fund's shares, because the fund's shares are not listed. It is not the repurchase price, because the repurchase price is the next quarterly NAV. It is a number that a third party publishes about a registered fund's value, that other parties extend credit against, and that no provision of the Investment Company Act contemplates.

The practitioner exposures that follow are concrete. If the oracle price leads the NAV, a borrower can extract leverage against value that the valuation designee has not determined. If the oracle price lags a credit event, the protocol is under-collateralized against a mark the fund itself has already moved past. And if a holder wants out, the on-chain market is the only continuous exit, because the legal exit is quarterly and capped. That last point is worth stating plainly: the token creates a liquidity expectation that the fund structure is specifically designed not to honor. Interval funds exist precisely because the assets cannot be sold daily.

Where the analogy breaks here: Rule 2a-5 assumes that the fund's own determination is the operative number for everything the fund does. Tokenization creates a second number, published faster, used by parties the fund has no relationship with, for purposes the fund cannot control. The rule does not prohibit this. The rule simply does not see it.

The second break is concentration. The same entity is the broker-dealer through which investors subscribe, the transfer agent that keeps the register, and the fund administrator. Each of those roles is separately registered and separately regulated. Nothing observed addresses the combination, because nothing in the interval fund rules contemplates the combination arising.

Tokenized commodities

The clearest case of an asset class that no securities regime claims and no commodities regime reaches.

The two largest gold tokens are not securities offerings and not regulated commodity offerings. They are products of entity licences. PAX Gold is issued under a New York limited purpose trust charter, with each token representing an LBMA good-delivery bar in allocated storage at a vault in London, tied to a serial number. Tether Gold is issued by TG Commodities Limited under El Salvador's digital asset regime, with LBMA bars in a Swiss vault. In both cases the legal machinery holding the metal is trust law, bailment and a vault contract. There is no qualified custodian requirement, because there is no rule that says there should be.

Federal commodities regulation is moving toward this space from the collateral side rather than the asset side. The CFTC launched a tokenized collateral and stablecoins initiative on 23 September 2025, with public input requested by 20 October 2025, aimed at the use of tokenized non-cash collateral as regulatory margin, and followed with advisory letters. That is a consultation and an advisory. It is not a rule, it does not create an offering regime for a spot gold token, and a practitioner who describes it as one has made the most common mistake in this genre.

Where the analogy breaks here: the register question has no candidate answer at all. In every other asset class there is at least a contested pair of records. Here, the issuer publishes a bar allocation lookup, the chain records balances, and no instrument tells you which controls if they diverge. The lookup is a service, not a statutory register.

The assurance picture for these products is attestation rather than audit, and the difference between those two words is the subject of the Stablecoin Attestation Scorecard, which scores nine issuers and funds on eleven evidence dimensions with per-cell provenance. It is not restated here.

Tokenized equities

Two live shapes, and they are not variations on each other. They are opposites.

Onshore. The depository's tokenization pilot received no-action relief from the Division of Trading and Markets on 11 December 2025, with staff declining to recommend enforcement for three years from launch, covering security entitlements in highly liquid instruments including Treasury securities, large-cap equities and selected index-tracking ETFs, phased across 2026. Inside that program the ownership analysis is unchanged: the securities remain registered in the name of the depository's nominee, investor protections continue to rest on Article 8 of the Uniform Commercial Code, and the tokens are expressly not the securities and not security entitlements. They are an alternative method of instructing the depository. Tokens move only among registered wallets. Open permissionless circulation is not part of the design.

Offshore. Tokens tracking US equities issued by a Jersey vehicle, as contractual instruments carrying specified economic and governance rights against the issuer, backed by shares the issuer holds. The holder is not a shareholder of the underlying company. The holder is a counterparty of the issuer. Custody arrangements can be built to pass voting instructions through, and one program has done so, but the instrument remains a claim against an SPV rather than a share.

The SEC's declared position across both shapes was stated on 9 July 2025: tokenized securities are still securities, blockchain does not have magical abilities to transform the nature of the underlying asset, and market participants must adhere to the federal securities laws when transacting in these instruments.

Where the analogy breaks here: nothing connects the issuer of the equity to the token. A company whose shares are wrapped offshore has no relationship with the wrapper, no disclosure obligation arising from it, and no ability to stop it. The Exchange Act reporting a token holder relies on is reporting the issuer prepared for a shareholder base that does not include them.

The second break is finality. Settlement finality in the intermediated system is a defined moment on the depository's books. Finality on a chain is a probabilistic property of the chain. In the pilot these are reconciled by making the token an instruction rather than a title, which is an elegant answer and also an admission: the program works because the token is not doing the thing tokens are usually said to do.

Tokenized real estate

The asset class where the two-register problem is most visible to a non-lawyer, because one of the registers is a physical county office.

The structures are consistent even where the platforms differ. A special purpose entity takes title to the property. The token represents an interest in that entity, not in the land. Sold under Regulation D, Regulation S, or Regulation A+, depending on the sponsor's appetite for disclosure. A concrete example of a qualified offering in this shape is Landa App 2 LLC, Form 1-A file number 024-11648, qualified 2 December 2021, offering series interests each holding a residential rental property. Whether that particular program uses a blockchain was not verified for this article; it is cited as a filed series-property offering, not as a tokenized one. Platform structures vary in the entity chosen: a Delaware or Wyoming series LLC with the token as a membership interest in the series, or a Wyoming LLC that takes the deed once the raise closes.

The critical sentence for anyone building in this space: the deed remains in county land records under state property law, and a blockchain transfer does not update those records. No state recording statute was observed in this research that gives a ledger entry recording effect against the world. What the token can move cleanly is the entity interest. The land does not move at all, and the entity that owns it is unaffected by any token transfer.

Where the analogy breaks here: the reporting a holder gets is a function of an exemption the holder did not choose. Regulation A Tier 2 brings ongoing reports and audited financial statements of the issuing entity. Regulation D brings a Form D and then silence. Two tokens that look identical on the same marketplace can carry entirely different information rights, and the token does not say which.

The second break is the one no holder can check: whether token supply matches the entity's membership register. The deed is public. The county will tell you who owns the building. Nothing tells you whether the number of tokens outstanding equals the number of membership units issued.

Tokenized fund vehicles under the 1940 Act

Not an asset class so much as the wrapper the other classes keep landing in, and the place where the regulatory machinery is most specific and therefore most revealing.

There is no tokenized fund registration path. The wrapper decides everything. What has happened instead is that the existing rules have been examined one at a time to see which of their provisions assume paper.

Custody is Section 17(f) and Rule 17f-2. That rule is a museum piece in the best sense: it requires assets to be deposited in the safekeeping of a bank or a facility supervised by federal or state authority, limits access to a small number of designated officers or employees who must act jointly and document every deposit and withdrawal, and requires an independent accountant to verify the assets three times a year with at least two of those examinations unscheduled. Every one of those requirements makes sense if the assets are certificates in a drawer.

The 12 August 2026 relief runs to three paragraphs of that rule, reported as subparagraphs (b), (e) and (f), the ones that presuppose physical certificates: vault placement, physical segregation, notation stamped on certificates, and physical examination. What the staff put in their place is a set of conditions including separate wallets for each investing fund, daily transaction reconciliation, board oversight, authentication controls, and independent accountant verification at least three times each fiscal year with two of them unannounced.

Read that last condition again. The cadence survived the disappearance of the thing it was written to examine. Three times a year, two unannounced, is the exact rhythm of the paper rule. The staff did not decide that a blockchain is self-evidencing and needs no examination. The staff decided that the accountant should now examine something else.

That single fact is the most useful thing in this map for anyone building an assurance practice, because it is the first published indication of what a regulator thinks the examination of an on-chain fund should look like. It is a condition of relief for one fund complex, not a rule of general application, and it can be withdrawn. It is still the only observed assurance requirement aimed at a tokenized structure anywhere in these seventy-seven cells.

Registers are Exchange Act Section 17A and the transfer agent rules 17Ad-1 through 17Ad-23, under which the master securityholder file is the official list of individual securityholder accounts. The Commission has been circling the technology question since the Concept Release on Transfer Agent Regulations, Release 34-76743, published 31 December 2015. A registered transfer agent may keep that file using a distributed ledger. Nothing makes the ledger the file.

Which record is the register

Every hard question in this field reduces to one question with two candidate answers, and the answer differs by asset class and by country.

The register the law recognises, against the record on the chain, with the divergence each pairing permits and the record that governs when they disagree.

The reason this matters more than the securities-classification debate is that classification is settled in practice. Regulators on four continents have said the same thing in the same year: tokenizing an instrument does not change what the instrument is. Nobody serious is arguing otherwise anymore.

What is not settled is priority. Take the ordinary case. A holder's wallet shows a balance. The transfer agent's file shows a different number, because a corporate action was processed off-chain, or a mint failed silently, or a forced transfer was executed under an operator key. Which one is the holder's position?

In the United States the answer is the file, and the reasoning is straightforward: the transfer agent rules make the master securityholder file the official list, and nothing amends them. In the depository pilot the answer is even more explicit, because the token was defined as an instruction rather than as property, which forecloses the question by construction. In real estate the answer is the county recorder for the land and the entity's own books for the interest, and the token is at two removes from the thing anyone actually wants.

In Switzerland the question does not arise. Under Article 973d the security exists on entry in the register and can be transferred and asserted only via the register. There is no second record to disagree with.

This is the strongest argument for the Swiss approach and it has nothing to do with being crypto-friendly. It is that a legal system with one record has one answer, and a legal system with two records needs a rule for which one wins, and six of the seven jurisdictions here have not written that rule. They have instead written, in effect, that the old record still wins, which is coherent and which also means the chain is doing less work than its users believe.

Two smaller consequences follow, and both are practitioner problems rather than theory.

The reconciliation is nobody's job. In the intermediated world, reconciliation between a transfer agent and a depository is a defined process with defined breaks. Between a transfer agent's file and a token contract's state, no process was observed to be required by any instrument in this map. It happens because operators choose to do it.

Property law caught up to the token without touching the asset. By the end of 2025, thirty-three states had enacted the 2022 UCC amendments creating controllable electronic records, with control-based perfection and take-free protection for good-faith purchasers; New York enacted on 5 December 2025 effective 3 June 2026. That is a real and useful regime, and it governs the token as a thing. It does not make the token the register of the asset. A secured lender can now perfect cleanly in a token whose relationship to the underlying asset remains defined entirely by contract.

The assurance layer

This is the layer this whole article exists to reach, and the finding is that it is nearly empty.

Across seventy-seven mapped cells, exactly one assurance requirement aimed at a tokenized structure was observed: the independent accountant verification carried into the conditions of the Franklin no-action letter. Everything else is an audit of a wrapper, an attestation commissioned by an issuer, or nothing.

The pattern is consistent enough to state as a rule. Assurance attaches to the legal wrapper, and the legal wrapper is not the part that is new. A registered fund gets an annual financial statement audit by an accountant registered with and inspected by the PCAOB, because it is a registered fund. A private fund gets an audit because the Advisers Act custody rule makes an audited-financials route attractive to its adviser. A Regulation A Tier 2 real estate issuer gets audited financials because Tier 2 requires them. In every case the opinion covers financial statements of an entity.

None of those opinions covers the three things a practitioner in this field actually needs covered:

That tokens outstanding equal interests on the register. The single most basic control in the entire structure, and no observed engagement addresses it.

That the transfer restriction enforces the exemption. The allowlist is the compliance boundary for a Rule 506(c) or Regulation S offering. Nobody examines whether the addresses on it correspond to the investors who were verified.

That the price others rely on corresponds to the valuation the fund determined. For tokenized private credit this is the whole risk, and no engagement in the map touches it.

The gap is not that these are hard to examine. They are considerably easier to examine than a private credit portfolio. The gap is that no rule requires it, no standard scopes it, and no engagement letter names it, so it does not happen.

The Franklin conditions are interesting precisely because they are the first counterexample. Separate wallets per fund, daily reconciliation, board oversight, authentication controls, and an accountant three times a year with two visits unannounced. That is recognisably an internal control examination wearing the clothes of a 1940 Act custody verification. It is one fund complex and it is a staff position rather than a rule. It is also a template, and it is the only one.

The seven jurisdictions

The United States is covered above. Six others complete the picture, and the useful comparison is not who is friendliest. It is who has written down which record governs.

European Union. The most sophisticated architecture and the most deliberate gap. MiCA, Regulation (EU) 2023/1114, expressly does not apply to crypto-assets that qualify as financial instruments under MiFID II. A tokenized security therefore falls outside the comprehensive crypto framework and back into MiFID II, the Prospectus Regulation, CSDR and the market abuse regime, all of which predate it. The DLT Pilot Regime, Regulation (EU) 2022/858, amended the MiFID II definition of financial instruments to cover instruments issued by means of distributed ledger technology, which closes any argument that a tokenized security escapes MiFID II by being on a chain.

The pilot itself has been used almost not at all. It applied from 23 June 2022. ESMA declined to publish an interim report in 2024 because no market infrastructure had been authorised at all. Its report of 25 June 2025, ESMA75-117376770-460, records three authorised infrastructures with minimal live trading and proposes making the regime permanent and more attractive. Four years, three participants. That is the single most important data point about the EU approach, and it should be read as evidence about the design rather than about the market.

Gold tokens land in the asset-referenced token category under MiCA Title III, which carries white paper approval, own funds requirements, segregated reserves and redemption obligations. One source in this research reported zero approved applicants in that category for gold-backed tokens across two years, leaving a multi-billion market outside the framework built for it. That claim is single-sourced and is flagged as unverified below rather than asserted here.

United Kingdom. No purpose-built framework, by choice, and unusually explicit about it. The fund tokenisation Blueprint published on 24 November 2023 by the industry Technology Working Group sets out a baseline model that puts the unitholder register on a distributed ledger within existing law and requires no new legislation, with the regulator and market participants reporting no significant barriers under existing rules for authorised funds. The FCA consulted on progressing fund tokenisation in CP25/28 on 14 October 2025. Separately, the Digital Securities Sandbox opened on 30 September 2024 under joint policy statement PS24/12, running to December 2028 with the application window expected to close around March 2027. Which firms have been admitted was not verified for this article.

Singapore. The clearest statement of the analogy approach anywhere. MAS's Guide on the Tokenisation of Capital Markets Products, revised in November 2025, states that tokenised capital markets products are regulated under the Securities and Futures Act 2001 and the Financial Advisers Act 2001 in the same manner as their non-tokenised counterparts, on a same activity, same risk, same regulatory outcome basis. Offers may trigger prospectus requirements; intermediaries may need a capital markets services or financial adviser licence. Project Guardian, with its asset management and fixed income workstreams and a Fixed Income Framework published in November 2025, is an initiative rather than law. Pilots are evidence of intent, not of legal permission, and conflating the two is the second most common error in this genre.

Hong Kong. Two SFC circulars dated 2 November 2023, covering tokenisation of SFC-authorised investment products and the conduct of intermediaries in tokenised securities activities, on a same business, same risks, same rules basis. The prospectus regime and the offers of investments regime apply to public offers, so an offer that is neither authorised nor prospectus-compliant reaches professional investors only. Three of the five Hong Kong cells in this map are unverified, which is an honest reflection of what one session of secondary research could establish rather than a judgment about the regime.

Switzerland. The exception, and the reason this article has a key figure. The DLT Act's amendments to the Code of Obligations entered into force on 1 February 2021, creating register uncertificated securities at Articles 973d to 973i. The security is created by entry in an electronic register that meets statutory requirements for functional safety, integrity and transparency, and can be transferred and asserted only via that register. The legislative package also created a licence category for DLT trading facilities. Switzerland is the only jurisdiction here that answered the register question by legislating rather than by analogy.

The most valuable unverified cell in the entire map is Swiss. Article 973d imposes requirements on the register. Somebody must be able to say whether a given register meets them. Who performs that assessment, under what standard, and whether it is periodic, could not be established this session. That is the assurance question in its purest form, in the one place where examining the ledger would be examining the legal record itself.

United Arab Emirates. Multi-regulator and unusually explicit about real-world assets specifically. VARA's Virtual Asset Issuance Rulebook, in force 19 June 2025, defines an asset-referenced virtual asset broadly enough to cover tokenised real estate, commodities and revenue participations, including direct-ownership, fractionalised and wrapped forms, and requires a licence to place one in Dubai as a business. The DIFC Tokenisation Sandbox launched in 2025 under an Innovation Testing Licence supervised by the DFSA, for piloting tokenised equities, sukuk and fund units. What the UAE has that most of this map lacks is a definition that names the asset classes. What could not be verified is whether any authority there treats a ledger entry as the register of record.

Where the analogy breaks

The complete list, in the order a practitioner meets them. Each of these is a place where pre-tokenization law is being applied to a tokenized structure and does not fit. This list is the seed of the next article and it is offered as a list rather than a narrative on purpose.

1. The gate and its enforcement are different systems. The exemption conditions attach to a person. The allowlist attaches to an address. Nothing requires them to correspond and nothing checks.

2. A continuously published price for a periodically valued fund has no legal character. It is not a Rule 2a-5 determination, not a market quotation, and not the repurchase price. It is relied on anyway.

3. The token creates a liquidity expectation the wrapper is designed not to honor. Interval funds are illiquid by construction. Continuous secondary trading of a claim on one does not change the fund's cash flows, only the holder's beliefs.

4. Reconciliation between the register and the chain is nobody's stated duty. It happens by operator choice, not by rule, and no break-reporting standard exists.

5. Custody rules assume a custodian holds something on behalf of someone. A private key held by an affiliated transfer agent is a structure the rules did not contemplate, which is why it took a staff letter rather than a rule application.

6. Nothing connects an equity issuer to a wrapper of its shares. Disclosure obligations run to a shareholder base that offshore token holders are not part of.

7. Settlement finality is defined on books, not on chains. The onshore answer works by defining the token as an instruction, which resolves the conflict by removing the token from the ownership chain entirely.

8. The deed does not move. No recording statute observed gives a ledger entry effect against the world, so tokenized real estate moves an entity interest and describes it as property.

9. Information rights follow an exemption the holder never selected. Two visually identical tokens on one marketplace can carry Tier 2 ongoing reporting or a single Form D.

10. Token supply against issued interests is unexamined everywhere. The most elementary reconciliation in the field, and it appears in no engagement scope observed in this map.

11. Spot commodity tokens have no register candidate at all. Not two contested records, but zero. An issuer lookup and a chain, with no instrument allocating authority between them.

12. Attestation is being read as audit. The gap between a point-in-time report against issuer-set criteria and an opinion on financial statements is the field's most widely misread distinction, which is why it has its own scorecard.

13. Staff positions are being read as law. No-action relief is withdrawable, conditional, and specific to its addressee. Three of the most important facts in this map are staff positions, and a structure built on one is built on something that can be taken away.

What is unverified, and what would settle it

Twelve of seventy-seven cells could not be verified in the session that produced this article. They are listed in the dataset with their full search trails; here they are with the specific thing that would close each one.

| Cell | What would settle it | | --- | --- | | Tokenized private credit, custody | The master fund's registration statement or Form N-CEN, which names the custodian in a fixed field | | Tokenized real estate, holder gates | An offering circular's transfer restriction section read against the deployed token contract | | EU, assurance | The DLT Pilot Regime's operating conditions read alongside CSDR reconciliation requirements | | UK, assurance | CP25/28's proposed rules and the depositary oversight obligations they interact with | | Singapore, register | Companies Act and SFA register provisions read against the MAS Guide | | Singapore, assurance | The MAS Guide's technology risk and recordkeeping sections, in full | | Hong Kong, register | The two 2023 circulars on ownership recordkeeping, plus Companies Ordinance register provisions | | Hong Kong, venue | SFC licensing conditions for virtual asset trading platforms read against the circulars | | Hong Kong, assurance | The intermediaries circular's due diligence expectations, in full | | Switzerland, assurance | Article 973d's functional safety and integrity requirements, plus any guidance on how compliance is tested | | UAE, register | The Dubai Land Department's tokenisation arrangements and the VARA rulebook's recordkeeping provisions | | UAE, assurance | The VARA rulebook's reserve and reporting provisions for asset-referenced virtual assets |

Two further items are recorded as observed but weakly sourced, and should be treated as open. The identification of the specific Rule 17f-2 subparagraphs covered by the August 2026 relief, reported as (b), (e) and (f), appeared in one result and was not independently corroborated. The claim that no gold-backed token has been authorised as an asset-referenced token under MiCA appeared in a single secondary source.

Three claims in this article postdate the author's ordinary reference horizon and are flagged as such: the Franklin Templeton no-action letter of 12 August 2026 and its conditions, the depository tokenization no-action letter of 11 December 2025, and the New York enactment of the 2022 UCC amendments effective 3 June 2026. Each was corroborated across multiple independent results, and the first two carry regulator-domain URLs whose own path segments encode the dates.

How this was researched, and what that limits

Every regulator and statute domain attempted for this article was refused by the network the research ran on. No primary-source document was read in its original form. The research channel was web search alone.

That has a consequence this article will not paper over. Nothing here is document-verified. Each cell names the primary instrument it points to, names a search result that surfaced it, and states the finding in the author's words rather than the source's. There are no quotation marks around source text anywhere in the dataset, because presenting a search summary as a quotation from a statute would be exactly the failure this discipline exists to prevent. Where a claim could not be observed at all, the cell says unverified and carries the queries that failed.

A reader who needs a citation to hold weight in a filing or an opinion should pull the named instrument and read it. This map tells you which instrument to pull and what to expect in it. It is not a substitute for the instrument.

The machine-readable form, with per-cell source, date, channel and search trail, is at /research/data/rwa-regulatory-map.json. It is the authoritative form of every cell above and it will be newer than this article after the first revision.

What comes next

Two things follow from this map, and they are different in kind.

The first is that the assurance gap is now specified rather than asserted. Three engagements do not exist and could: supply against register, allowlist against verified investor set, and published price against determined value. The Franklin conditions are the first regulator-blessed sketch of what the first of those might look like. An RWA Assurance Map, scoring products the way the stablecoin scorecard scores issuers, is now buildable for the layers where evidence is published and is not buildable for the layers where nothing is published at all. This map says which is which.

The second is that the register question will be decided by whoever writes the rule first, and only one jurisdiction has written it. Everywhere else, the answer is inherited from a system designed for certificates and nominees, and it favors the book over the chain. That is a defensible answer. It is also an answer that most people building in this field have not read.

This is a personal research piece. It is informational only, is not investment advice, is not an assurance opinion, is not legal advice, and is not affiliated with or endorsed by any employer. It maps structure, not conduct: it grades no entity and predicts no entity's failure.