Lock-ups, holding periods, jurisdictional limits, and eligibility are compiled into the token itself. A restricted transfer does not get flagged after the fact — it never settles.
Each instrument carries a set of transfer conditions that must all pass for a movement to be admitted.
Every tokenized instrument carries its own restriction set — who may send, who may receive, when, and in what size. Two instruments on the same ledger can enforce entirely different rules.
Restrictions are expressed as discrete conditions that combine: whitelist status, holding period, jurisdiction, holder cap, and lot size can all apply to a single transfer at once.
A transfer is admitted only if every applicable condition explicitly passes. Anything not permitted is refused, so an omitted rule fails closed rather than leaking an unrestricted path.
Given the same holders, amount, and ledger state, the restriction outcome is identical every time. There is no operator judgment inside the settlement path.
Time-based restrictions bind units to a schedule that cannot be shortened by moving them.
Units issued under a lock-up cannot be transferred until the defined period elapses. The constraint travels with the units, so an early sale attempt is rejected at validation.
Distinct tranches can carry distinct holding periods. A later-acquired lot remains locked even while an earlier lot from the same holder becomes transferable.
Release can follow a schedule — cliffs then graded unlocks — with each release governed by the ledger rather than a manual off-chain instruction.
Where a holding period must survive a permitted move, the clock is tied to the units, not the address. Re-lock or carry-forward rules prevent laundering a lock-up through an intermediary.
Jurisdictional and holder-scope limits keep an instrument inside the population it was authorized for.
Transfers can be limited by the residency or domicile attested to a holder, so units cannot flow into a market where the instrument is not authorized to be held.
An instrument can cap the number of holders or holders of a given class, and the cap is checked at transfer time so an admission that would breach it is refused.
Maximum position size per holder can be enforced, blocking a transfer that would push a recipient above the permitted share of the outstanding supply.
Restrictions can require that both sender and receiver belong to compatible classes — for example, keeping a qualified-investor instrument within qualified-investor addresses across every hop.
Restriction sets include the controls a regulated issuer needs, exercised under the owner's keys and recorded as evidence.
An address or specific holding can be frozen in response to a legal order or a lapsed verification, halting outbound and inbound movement until the condition is resolved.
Where law requires it — court order, error correction, estate transfer — a governed forced move can be executed under the issuer's authority, itself signed and hash-chained.
Changing a restriction rule is a governed, signed action written to the ledger. The rule history is auditable, so an auditor can see which rule was in force when a given transfer cleared.
All intervention runs under the sovereign or issuer keys. The infrastructure operator cannot freeze, force, or re-rule an instrument, preserving non-custodial control.