An RWA token that anyone can send to anyone is a liability.
The first transfer to an unapproved wallet breaks your holder register.
Token-2022 gives you mint-level controls for that problem, but only if you pick them before the mint exists.
Below are 5 jobs an RWA token must do and the extension for each.
You'll also see what still needs lawyers and KYC. Save it as your mint design checklist.
The 5 jobs and the extensions that cover them
Token-2022, also called Token Extensions, adds optional features to a mint or token account.
The Solana extensions docs note that most can't be added after an account is set up. You choose them once, at creation.
A workable map is:
- Transfer restrictions: Transfer Hook, paired with Default Account State.
- Confidential amounts: Confidential Transfer.
- Asset metadata: Metadata Pointer plus Token Metadata.
- Recovery and forced moves: Permanent Delegate.
- Yield display: Interest-Bearing Config.
Each one enforces a technical rule. None of them makes an asset legal to issue or trade. Our real-world asset tokenization page makes the same split. Counsel defines the rules, and the program enforces and records them.
If Token-2022 is new to you, start with our Token-2022 getting started guide. It covers the basics this post builds on.
Jobs 1 and 2: transfer limits and private amounts
Transfer restrictions: Transfer Hook and Default Account State
A transfer hook runs your program on every transfer of the mint. If your hook returns an error, the whole transfer fails. That's where an allowlist check, a holding period, or a per-wallet cap can live.
The hook gets the transfer's accounts as read-only, so it can't use the sender's signature. Plan your own authority, such as a PDA you control. Our transfer hooks guide walks through the build.
Default Account State closes the gap a hook leaves. The Token-2022 extensions guide shows it forcing every new token account to start frozen.
A holder can't receive or send until your service thaws the account after an eligibility check. A common flow is:
- Open: a wallet opens a token account, and it starts frozen.
- Check: the holder passes KYC with your identity provider.
- Thaw: your service, holding the freeze authority, thaws that one account.
- Enforce: the transfer hook checks the allowlist on every later transfer.
If a holder loses eligibility, the same service freezes the account again. Log each freeze and thaw with the reason, so the holder register and the chain tell the same story.
Confidential amounts: Confidential Transfer
The Confidential Transfer docs state that only transfer amounts and balances are private. Token account addresses stay public, so this hides how much someone holds, not who holds it.
A mint can set an auditor key. Its holder can decrypt transfer amounts for that mint, which gives a regulator or fund admin read access without making amounts public.
Jobs 3 to 5: metadata, recovery, and yield display
Asset metadata: Metadata Pointer and Token Metadata
The metadata docs show how Token Metadata stores a name, symbol, URI, and custom key-value fields on the mint. The Metadata Pointer says which account holds that data. Custom fields can carry an ISIN, a share class, or a link to the offering documents.
Two details bite in production. Clients must check that the mint and the metadata point to each other. If metadata grows later, you must top up the mint's SOL balance before the resize, so size it up front.
Recovery and forced moves: Permanent Delegate
A permanent delegate can transfer or burn tokens from any token account of the mint. Holders can't revoke it. That's how you handle a court order, a lost key reissue, or a redemption burn.
It's also the most powerful key in the system. Put it behind a multi-signature wallet, log every use, and write down when it may be used. It can't touch tokens held in a confidential balance, per the extensions guide.
Yield display: Interest-Bearing Config
The interest-bearing docs are clear: it changes only the UI amount. No new tokens are minted, and supply stays the same. For example, a 5% rate makes a wallet show a growing balance while the raw amount never moves.
That's useful for a yield product's display. It is not a payout. Real distributions still need a mint, a transfer, or an off-chain payment.
A minimal mint setup
Here's a starting mint for a permissioned RWA token, using flags from the Token-2022 extensions guide. Check the CLI help for your installed version before you run it.
# Token-2022 program ID
T22=TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb
# 1. Create the mint with every extension it will ever need
spl-token --program-id $T22 create-token \
--enable-freeze \
--default-account-state frozen \
--enable-permanent-delegate \
--transfer-hook <YOUR_HOOK_PROGRAM_ID> \
--enable-metadata
# 2. Write on-mint metadata, with a separate update authority
spl-token initialize-metadata <MINT> "Fund A Class B" FUNDB \
https://example.com/fund-b.json \
--update-authority <METADATA_AUTHORITY>Run this on a test network first. Closing and reopening a mint with different extensions causes problems, per the same guide, so lock the list in review.
Split the authorities before launch
A permissioned mint has four keys that can change holder outcomes. Give each its own owner and approval rule:
- Mint authority: issues new units after a subscription settles.
- Freeze authority: thaws approved holders and freezes revoked ones.
- Permanent delegate: forced transfers and redemption burns, behind the strictest approval.
- Metadata update authority: edits fields like the share class or document link.
Rehearse key loss and rotation for each one in staging. A single hot wallet holding all four turns one leaked key into a full loss of control.
What still lives off chain, and the limits
Legal rights and KYC stay off chain
The token is not the legal right. Counsel decides what a holder owns, who may hold it, and in which places. KYC and eligibility checks run with your identity provider, and the chain gets only a small yes or no, such as a thawed account or an allowlist entry.
Keep personal data out of public accounts. Plan for expired checks, revoked holders, and an identity provider outage.
Settlement and the holder register
Cash, custody, and redemption also sit off chain. Decide whether the chain or an off-chain register is the master record, because that choice sets how corrections and disputes work. Then map each step of a subscription, such as payment received and tokens minted, as one state machine with a named owner.
Test the awkward cases before launch. What happens when cash settles but the mint fails? What happens when a token moves while the register is down? Write the fix for each case as an acceptance test.
Limits and wallet support
- Self-transfers skip the hook. The extensions guide says the hook isn't called when a wallet sends to itself.
- Wallets vary. Test each target wallet, explorer, custodian, and exchange with your exact extension set. The Solana docs point integrators to a separate guide for confidential balances, so expect gaps there.
- Some pairs clash. The solana.com extensions page names Non-Transferable with Transfer Fee as a pair you can't combine. The program itself doesn't reject that pair, so your own setup has to avoid it.
- Hooks add accounts. Each transfer must include the hook's extra accounts, so test with every client you plan to support.
FAQ
Do Token-2022 extensions make an RWA token compliant?
Extensions alone don't make a token compliant; they enforce rules your legal team has already defined. An extension can block a transfer or freeze an account, but it can't decide who is allowed to hold the asset. Counsel sets the policy, and the program records and enforces it.
Can I add a transfer hook to an existing SPL token?
You can't add one to a classic SPL token, because those mints use the original token program. You'd need a new Token-2022 mint and a migration plan for current holders. Most extensions also have to be chosen when the mint is created, so plan the whole list early.
Can confidential transfers hide who holds an RWA token?
Confidential transfers hide amounts and balances, not owners. Token account addresses stay public on chain. If you need to limit who can see holders, that has to be handled off chain or by design choices outside the token.
Who should hold the permanent delegate key?
A multi-signature wallet run by the party legally allowed to force transfers, such as the issuer or transfer agent. Every use should leave an audit trail tied to a written reason. Never leave it on a single hot wallet.
Start with the rights, then pick the extensions
Choose the extensions after counsel defines the rights, not before. The mint is hard to change once it's live, so that order saves a costly reissue.
Our historical ticketing build for TicketSensei paired an on-chain ticketing contract with a full backend and was shown live at an NFT event in LA. For production Solana programs and integrations, see our Solana development service.
Ready to map your asset to a mint? Join a call about your RWA token.
