SKIP TO CONTENT
TOKENIZATION6 minStandards That Ship / Ep. 2 · Stage 2-1

ERC-3643, ERC-1400 or CMTAT: Which Token Rules to Pick?

Who decides whether a share token may move to Bob: an identity list, the share’s tranche, or a rule module?

XIN
Pixel-art illustration of one token coin with a single socket and three interchangeable compliance cores (a shield chip, a tranche stack, a puzzle hook) ready to slot in.

IN 30 SECONDS

ERC-3643, ERC-1400 and CMTAT are three ways to build a security token: a token for an asset like a share, where the law can limit who holds it. They differ in where each transfer gets checked. This stage shows the three places and how to pick one.

KEY TAKEAWAYS · 3

  • Don’t ask which standard is best. Ask where the check on each transfer should live.
  • ERC-3643 checks verified identity, ERC-1400 checks slices of the balance, CMTAT checks modules and rules you configure.
  • If you can’t write your transfer rule in one sentence, no standard will fix it.
On this page

The problem: a choice you live with for years

IN SHORT The standard you pick decides who may hold your asset and who can stop a transfer, for as long as the asset exists.

You can’t swap a Security token A token that stands for a security, like a share, a bond or a fund unit. The law often limits who may hold it. See the glossary standard next sprint like a code library. Sign-up, transfers, recovery and later tools all build on it. Change it later and you may have to move a live list of holders.

These three stages only compare how transfers get checked. Custody, governance, legal rights and operations matter too.

THE FIVE-YEAR VIEW
1

Month 0: you pick

A vendor ships one standard and you say yes.

2

Integration: the choice hardens

Wallets, custody and your transfer agent (keeper of the official register of holders) build on it.

3

First audit

Auditors follow your transfer path, so a visible check is easier to review.

4

A regulator asks: freeze or prove

You learn whether compliance lives where the token can act.

5

Year 5: migrate, or not

Either the asset outlived your first assumption, or it didn’t.

One decision at five moments. Only month 0 looks like a code choice.

Getting ERC-3643 accepted took years of work: how an Ethereum standard really gets accepted.

Words to know

IN SHORT A security token is the asset. The other words name the parts that decide whether it may move, and to whom.

WORDS TO KNOW

Security token
A token that stands for a security, like a share, a bond or a fund unit. The law often limits who may hold it.
Compliance check
The test a transfer must pass first: may this person receive this asset, and is this move allowed now?
Identity registry
The on-chain list ERC-3643 uses to link each investor’s wallet to an identity the token checks.

IN PLAIN WORDS

An ERC is a written Ethereum standard that contracts can follow. “Final” means the spec reached its last, stable status. It doesn’t mean audited, legally approved or safe to deploy.

What are ERC-3643, ERC-1400 and CMTAT?

IN SHORT ERC-3643 is a Final ERC built on verified identity, ERC-1400 a proposal built on balance slices, CMTAT an open-source framework built on modules.

ERC-3643 (T-REX)
A Final ERC
ERC-20 plus a required on-chain identity registry
ERC-1400
A proposal, published as a GitHub issue
One balance split into named partitions, an optional controller, no identity system prescribed
CMTAT
An open-source framework from the CMTA, a Swiss association
An ERC-20 core, modules that vary by version and variant, an optional rule engine; its README lists ERC-3643, without on-chain identity

All three start from or stay close to ERC-20, the common token format.

$32B+

tokenized on ERC-3643

Source: erc3643.org.

I give no figures for the other two: what I say about them comes from their public specs. At Tokeny, I built ERC-3643’s compliant token suite and the OnchainID identity layer.

The difference: where the check lives

IN SHORT All three ask the same question on every ordinary transfer, and each answers it in a different place.

The question is the Compliance check The test a transfer must pass first: may this person receive this asset, and is this move allowed now? See the glossary: may this person receive this asset, right now?

STEP BY STEP

Flow diagram: 3 stepsFlow diagram: 3 steps. A transfer is requested, then Who checks it?. Who checks it? branches into 3: If ERC-3643, then The identity registry. If ERC-1400, then The partition’s rules. If CMTAT, then Modules and rule engine. Both paths continue to It settles or it reverts.ERC-3643ERC-1400CMTAT1A transfer is requested2Who checks it?The identity registryThe partition’s rulesModules and rule engine3It settles or it reverts
The place that answers “may this transfer go through?”. Each standard puts it somewhere else.

Step 1. A transfer is requested. Alice asks to send tokens to Bob.

Pick a step to see it move
  1. A transfer is requested Alice asks to send tokens to Bob.
  2. ERC-3643 The token asks the identity registry whether Bob holds the claims it requires.
  3. ERC-1400 The rules of the partition being moved decide. A controller, if enabled, can also force a move.
  4. CMTAT Your variant’s built-in modules decide, then a rule engine if you configured one.
  5. Settle or revert Yes: balances change. No: the transfer reverts, meaning it’s cancelled and nothing moves.
One ordinary transfer, three places the answer can come from. In this simplified picture, only the middle step changes.

ERC-3643 asks an Identity registry The on-chain list ERC-3643 uses to link each investor’s wallet to an identity the token checks. See the glossary. That one choice drives the rest: what data must exist on-chain and what it may reveal, what a regulator has to trust, and how hard a freeze is.

Coming up next: So which of the three fits your asset?

So which one should you pick?

IN SHORT Match the standard to the shape of your transfer rule, not to the one your vendor already ships.

PICK ONE
Decide: Which standard fits your transfer rule?Decision tree: Which standard fits your transfer rule? If The regulator cares who holds the token, and eligibility can change, then ERC-3643. If The asset has tranches, lockups or lifecycle events that move balances, then ERC-1400. If You want an ERC-20 core with one clear place to add rules, then CMTAT. If You can’t describe your transfer rule in one sentence, then None yet.DECIDEWhich standard fits yourtransfer rule?If the regulator cares whoholds the token, andeligibility can changeERC-3643You run the identity systembehind it, and must trustits issuers and admins.If the asset has tranches,lockups or lifecycle eventsthat move balancesERC-1400It brings no identity ofits own.If you want an ERC-20 corewith one clear place to addrulesCMTATCheck your exact versionand variant; ERC-20 toolsmay not handle itsrestrictions.If you can’t describe yourtransfer rule in onesentenceNone yetThe standard isn’t yourproblem. Your compliancepolicy isn’t defined yet.
Four outcomes. A starting point: then review the privileged paths and test what you deploy.

ITEM GET

Pick by where the check lives

Where your rule must be checked points you to a standard.

Sources: ERC-3643, ERC-1400 proposal, CMTAT versions and variants, erc3643.org.

STAGE CLEAR

What you now know

  • Every ordinary transfer is checked before it settles, and each standard checks in a different place.
  • What each one asks: is the receiver verified, what do the partition’s rules say, what do the modules allow?

Check yourself

Tap or click a question to see the answer.

A fund wants only verified investors to hold its units, and who qualifies can change. Where should the check live?

In verified identity: ERC-3643. The token asks the identity registry on every ordinary transfer, so a change applies to the next one.

Next stage:How does an ERC-3643 transfer get checked, and when is it refused?6 min
Adam Boudjemaa
Adam Boudjemaa

Web3 x AI engineer, former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft.

Have a project to ship or a role to fill?

Discuss your project or role

My work at the web3 x AI intersectionOpen-source tools I build

LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.