Who Reconciles the Ledger? Custody for Tokenized RWAs

As of September 2026 the New York Department of Financial Services lists 12 limited purpose trust companies chartered for virtual currency activity, up from a handful three years ago (NYDFS). Since September 2025, registered advisers have been able to treat state-chartered trust companies as banks for custody purposes, and since December 2025 broker-dealers have a staff roadmap for "physical possession" of crypto asset securities. Key custody, in other words, has an answer. What still has no answer is the question that matters more for real-world assets: when the on-chain record and the off-chain registry disagree, whose number is right, and who is obliged to fix it.

Every tokenized RWA has two custodians

A tokenized real-world asset always sits on two custody layers. The digital-asset custodian controls the private keys that move the token. Beneath it, a completely different institution controls the thing the token represents. That second layer is not the same across asset classes, and treating it as one generic "custodian" is where most diligence goes wrong.

For gold, the underlying custodian is a vault operator holding allocated bars against a serialized bar list. The token supply should never exceed the fine-ounce total on that list, and the list is a document the vault produces, not the chain.

For carbon credits, the underlying custodian is the registry. A verified credit exists only as an entry in a registry account, and retirement happens only there. A token that claims to represent a credit is really a claim on a registry account someone else controls, which is why registry fragmentation is such a persistent problem for on-chain carbon.

For oil and gas royalties, the "custodian" is the operator's revenue accounting and the county record where the interest is filed. The division order sets the net revenue interest that actually gets paid, and that figure lives in the operator's pay deck, not in any token contract.

For commercial real estate, the token almost always represents a membership interest in a special purpose vehicle, not the deed. Title sits with the county recorder, and the SPV's own ownership ledger sits with a transfer agent or the manager. The digital custodian secures a key. It verifies none of this. That layering is the reason proof of reserve for real-world assets is harder than proof of reserve for a stablecoin, a point the pillar piece on what proof of reserve means for RWAs works through in detail.

What regulators have actually settled

Three staff actions in the past 18 months resolved the key-custody layer, and it is worth being precise about how narrow each one is.

On May 15, 2025, SEC staff issued FAQs confirming that a registered transfer agent may use a distributed ledger as its official master securityholder file, provided records stay accurate, current and producible to the Commission (Morgan Lewis summary). This is the most consequential of the three for RWAs, because it allows the chain to become the legal register of the security itself.

On September 30, 2025, the Division of Investment Management issued a no-action letter allowing advisers and registered funds to treat certain state-chartered trust companies as "banks" for purposes of the custody rule (Sidley Austin). That is what makes the NYDFS charter list commercially relevant to fund allocators.

On December 17, 2025, the Division of Trading and Markets described five circumstances under which a broker-dealer may deem itself to have physical possession of a crypto asset security: access and transfer capability, an assessment of the ledger, monitoring for security problems, private-key protection, and safeguards against disruption (SEC). The statement says in its own text that its view is limited to one paragraph of one rule and does not address any other obligation a broker-dealer may have.

Read together, the three actions define who may hold the key and where the security's register may live. None of them mentions the vault, the registry, the operator or the title. The SEC's regulatory agenda targets an October 2026 proposal to modernize the adviser custody rule, and whether that proposal reaches the underlying-asset layer is the thing to watch.

When the two records disagree

Breaks between the chain and the underlying ledger are not hypothetical. They are the ordinary operating condition of any two systems maintained by different institutions on different cadences. A few concrete forms:

In each case, four parties could plausibly be said to own the fix, and in most offering documents today none of them clearly does. The digital custodian holds keys and will say, correctly, that its duty ends there. The transfer agent, if the chain is its master file, owes accuracy for the securities register, but the securities register is the SPV interest, not the bar or the credit. The oracle or attestation provider reports a number on a schedule and is contractually not liable for correcting it. That leaves the issuer or SPV manager, who usually does hold the duty in substance but rarely in a written, dated, auditable form.

The practical position is that the reconciliation duty has to be assigned by name in the offering documents, with a cadence, an exception process, and a defined action when a break is unresolved. The strongest version ties the token contract to the outcome: minting pauses when the attestation is stale and transfers can be paused when a break exceeds a stated threshold. The argument that issuance controls should gate the mint, rather than report on it afterward, is made at length in why the mint is the attack surface. The same logic applies to reconciliation. A break that only produces a footnote is a break nobody is obliged to close.

What an allocation committee should ask

The questions below are short enough to put in a term sheet and specific enough to get a real answer.

  1. Who is the underlying-asset custodian, in what legal capacity, and what document does it produce that the token supply is checked against?
  2. Which party is named as owing the reconciliation between that document and the on-chain supply, and how often does it run?
  3. What happens on-chain when the reconciliation fails or the attestation is older than its stated maximum age?
  4. Is the chain the transfer agent's official master securityholder file, or is a separate off-chain register still the legal one?
  5. If the digital custodian or the attestation provider is replaced, what continuity arrangement keeps the reconciliation running through the transition?

The fifth question is the one most often skipped, and the reasons are covered in the piece on custodian continuity risk in tokenized assets. Commertize's position as a marketplace across gold, carbon, energy, digital infrastructure and commercial real estate is that the reconciliation owner should be visible to every holder, in the same place they see the asset data, rather than buried in a services agreement. Investors who can see who owns the break are the ones who will trust the number.

The custody question for tokenized RWAs has moved. It is no longer whether a regulated institution can hold the key. It is whether anyone is contractually obliged to make the chain agree with the vault, the registry, the operator and the county, and to say so when it does not. Issuers who answer that in writing will find the institutional conversation shorter.

Have an asset you're thinking about tokenizing? See how the platform works and start at commertize.com/tokenize, or contact the team and tell us what the asset is — if it isn't a fit, that is a useful answer to get in one conversation rather than three.

Have an asset you're evaluating for tokenization? Send the offering memo to deals@commertize.com or start at commertize.com/tokenize, and we will return a written tokenizability and capital-structure memo within 48 hours — free, no obligation.

Confidential review. No cost, no commitment, no calls unless it is a fit.