SKIP TO CONTENT
TOKENIZATION6 minStandards That Ship / Ep. 2 · Stage 2-3

ERC-1400 and CMTAT: Where Their Transfer Rules Live

Your shares unlock after 12 months and may only go to verified investors. Which standard can express that?

XIN
Pixel-art illustration of one token coin with a single socket and three interchangeable compliance cores (a shield chip, a tranche stack, a puzzle hook) ready to slot in.

IN 30 SECONDS

ERC-1400 is a security token proposal that splits each balance into partitions with their own rules. CMTAT is an open-source ERC-20 framework that hands extra rules to an optional rule engine.

KEY TAKEAWAYS · 3

  • ERC-1400 splits a balance into partitions with their own rules, plus a controller that, if enabled, can force moves. It doesn’t give you identity.
  • CMTAT pairs an ERC-20 core with modules and an optional rule engine. Compare the exact version and variant, not just the name.
  • Before launch, review the privileged paths and test the deployed version.
On this page

ERC-1400: when the balance comes in tranches

IN SHORT ERC-1400 assumes a security is rarely one flat balance, so it splits each holder’s balance into slices with their own rules.

WORDS TO KNOW

Partition
A named slice of one holder’s balance, such as locked or unlocked shares, with its own transfer rules.
Controller
An account that, if the token enables it, can force a transfer or a redemption (tokens taken back and destroyed).
Rule engine
A separate contract a CMTAT token asks whether a transfer is allowed. It holds the extra rules you set.

ERC-1400 is a proposal, published as a GitHub issue. Each slice is a Partition A named slice of one holder’s balance, such as locked or unlocked shares, with its own transfer rules. See the glossary: locked and unlocked shares, vested and unvested ones (earned or not yet, say by an employee), or Reg D and Reg S shares, sold under two US rules whose resale conditions can differ.

IN PLAIN WORDS

It fits assets that change over time: lockups (periods when shares can’t be sold) expire, share classes convert. “Restricted until date X, then free” maps onto a locked and an unlocked partition.

ADAM says: Partitions are rooms in one building, each with its own entry rule. But the building prescribes no ID check: that part is up to you.

A Controller An account that, if the token enables it, can force a transfer or a redemption (tokens taken back and destroyed). See the glossary can force a transfer or a redemption when the law says it must, if the token turns that power on. Those powers are separate, so review them on their own. And someone has to run the partitions and the controller role for the life of the asset.

Its canTransferByPartition function is a check you can run before sending. The transfer functions themselves enforce the restrictions.

WATCH OUT

ERC-1400 doesn’t give you identity. It assumes someone else already decided who may be on the list of holders. Add an allowlist (a list of approved addresses) or an identity layer and you get close to ERC-3643, with tranches on top.

CMTAT: a lean ERC-20 with modules

IN SHORT CMTAT gives you an ERC-20 core plus modules, and leaves extra transfer rules to a rule engine you configure.

CMTAT is open-source code from the CMTA, the Capital Markets and Technology Association, a Swiss association. It comes in several variants, some fixed, some upgradeable, and they don’t all offer the same controls. So pick a version and a variant first.

STEP BY STEP

Flow diagram: 4 stepsFlow diagram: 4 steps. A transfer is requested, then Built-in modules. Built-in modules, then Rule engine. Rule engine, then Balances change.1A transfer is requested2Built-in modules3Rule engine4Balances change
Modules such as pause, freeze and balance snapshots, depending on the variant.

Step 1. Request. Alice asks to send tokens to Bob.

Pick a step to see it move
  1. Request Alice asks to send tokens to Bob.
  2. Frozen: refused If the token is paused or an address is frozen, a built-in module refuses. Nothing moves.
  3. Your rules Otherwise, a rule engine, if configured, applies your extra rules, which may include identity checks.
  4. Settle Everything passes: balances change.
One ordinary CMTAT transfer: built-in checks run first, then your rules. Step 2 shows a refusal.

A Rule engine A separate contract a CMTAT token asks whether a transfer is allowed. It holds the extra rules you set. See the glossary can hold your own transfer rules.

The CMTAT README even lists ERC-3643 as a standard it implements, “without on-chain identity”. So the two aren’t rival camps.

A missing or permissive rule engine doesn’t switch off the built-in controls. It means the extra policy you intended may not be enforced.

ADAM says: Before you promise a regulator a freeze, check that the variant you deployed has one.

Being ERC-20 helps with tooling, but doesn’t guarantee that every wallet or DeFi app (a finance app on a blockchain) supports the restrictions. And name who keeps the rules correct over time.

Coming up next: So where do these checks break in real life?

Three ways this goes wrong in production

IN SHORT Each standard can fail in its own way, and in these three illustrative cases the cause is the process around the code, not the code.

ERC-3643
Claims expire, eligible transfers revert, support blames the chain. Nobody staffed the claims.
ERC-1400
Say every holder only ever has one default partition: a tranche engine for a plain balance, and every audit covers code you never run.
CMTAT
An empty or loose rule engine: the limits you planned may not apply. Built-in pause or freeze, where your variant has them, still work.

Whichever you pick, review the privileged paths before launch: forced transfer, recovery (moving tokens from a lost wallet), minting new tokens and admin actions. Then test the deployed version, not the standard’s name.

ITEM GET

Test what you deployed

The name promises nothing: what runs is the variant you deployed.

Sources: ERC-1400 proposal, CMTAT versions and variants.

FAQ

Neither is better in the abstract: ERC-3643 checks who receives the token, ERC-1400 splits a balance into tranches with their own rules. Choose by the problem you have.

You can borrow ideas, such as an identity check on an ERC-1400 token. But pick one model to own the transfer path. With two control layers, two systems can each veto a transfer: two to support, two to audit.

STAGE CLEAR

What you now know

  • ERC-1400 puts the rules on slices of a balance and leaves who may hold it to something else.
  • CMTAT puts built-in controls in modules, and your extra rules in a rule engine, depending on the variant.
  • How each one fails in production: unstaffed claims, unused partitions, an empty rule engine.

Check yourself

Tap or click a question to see the answer.

A fund’s units are locked for 12 months, then free between verified investors. Which standard expresses the lockup most directly, and what does it lack?

ERC-1400: a locked and an unlocked partition. It lacks identity, so “verified investors” needs an allowlist or identity layer beside it.

Your CMTAT token has no rule engine set. A regulator asks you to pause all ordinary transfers. Can you?

Yes, if your variant has the pause module and you hold the pause role: built-in controls still work. Only the extra rules you meant for the rule engine are missing.

Next episode:When an AI agent pays with x402, which records link the payment to the person who approved it?6 min
Adam Boudjemaa
Adam Boudjemaa

Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.

Have a project to ship or a role to fill?

Discuss your project or role
LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.