Skip to main content
Request a demo
Physical assets

Gold Tokenization

Allocated bullion held in a vault, represented as fungible units, with serial-level records and independent attestation.

Standards, ordered by control over a transferFour token standards as rungs, from one where anyone may hold up to one where a transfer can be refused by the contract itself.ERC-20anyone may holdERC-1155batched, still openERC-4626a vault around oneERC-3643a transfer can be refused

Definition

Gold tokenization issues units representing a claim on physical gold held in a vault. The distinction that matters is allocated versus unallocated: allocated gold is specific, identified bars held for the holder, and unallocated is a claim against the issuer’s balance sheet. Only the first is really a claim on metal.

What it solves

  1. Storage and accessOwning physical gold means arranging vaulting, insurance and eventually transport. A claim on vaulted metal removes all three from the holder.
  2. DivisibilityA 400-ounce good delivery bar is indivisible physically and trivially divisible as a register entry.
  3. VerificationHolders of paper gold rarely know what backs it. Serial-level records and independent attestation make the backing checkable.

How it works

  1. Bars are acquired and vaultedMetal is bought, assayed, and lodged with a vault operator in the vehicle’s name.
  2. Bars are recorded individuallySerial number, refiner, fineness and weight, so the holding is identified rather than notional.
  3. Units are issued against metal heldIssuance is constrained by what has actually been vaulted.
  4. Redemption returns metal or cashDepending on the terms and the size of the holding, since a bar cannot be split physically.

Architecture

A vault operator holding allocated metal; a bar register with serial-level detail; an attestation cadence with an independent party; a fungible permissioned token; and a redemption path that distinguishes cash settlement from physical delivery.

How the platform is arrangedFour stages — asset, compliance, offering and register — connected left to right, all enclosed by a single transaction boundary that rests on a double-entry ledger.AssetStructured and documentedCompliancePolicy in forceOfferingA book that is derivedRegisterHolders of recordOne transaction boundaryA movement and the entries behind it commit together, or neither doesDouble-entry ledgerEvery movement, both sides, in minor unitsBalanced at COMMIT
Four stages inside one transaction boundary, on one ledger. A register that disagrees with the cash is not a state the software can reach.

Tokenization lifecycle

  1. Acquire and vaultMetal purchased, assayed, allocated and insured.
  2. AttestIndependent verification of holdings against the register.
  3. IssueUnits issued against confirmed allocated metal.
  4. Hold and re-attestPeriodic verification and publication.
  5. RedeemCash settlement, or physical delivery where the holding and the terms permit.

Supported token model

Permissioned fungible token. Gold of a given fineness is interchangeable by weight, which is what fungibility means. The bars themselves are individually recorded for attestation, but a holder’s claim is to weight rather than to a named bar.

Asset requirements

What must be true before this can responsibly be tokenized at all.

  • Allocated storage in a named vault, in the vehicle’s name, segregated from the operator’s own metal.
  • A bar list with serial numbers, refiner, fineness and weight.
  • Insurance covering full replacement value.
  • An independent attestation cadence, published.
  • A redemption policy that is explicit about minimum size for physical delivery.

Compliance considerations

  • Responsible-sourcing obligations: refiner accreditation and chain of custody are increasingly required, not optional.
  • The instrument’s classification varies — a commodity claim in some jurisdictions, a security in others.
  • AML rules for precious metals are stricter than for many financial instruments.
  • Storage jurisdiction determines seizure and insolvency risk, and must be disclosed.
A compliance policy as ordered rulesRules are evaluated in sequence and the first match decides. A subject matching no rule is denied, and a fact the platform does not know never satisfies a rule.Subjectan investor's facts#1Screening hit is openreject#2Country in the blocked listreject#3Professional or institutional, verifiedallowMatched no ruledenyFirst matchdecides. A laterallow cannot undoan earlier reject.Eligibility comesfrom a rule saying so.
Rules are data, evaluated in sequence, and the first match decides. A subject matching nothing is denied — eligibility comes from a rule saying so, never from no rule objecting.

Investor workflow

  • Verify identity.
  • Subscribe and fund by reference.
  • Receive units representing a weight of allocated metal.
  • Check published attestations against the bar list.
  • Redeem for cash, or for metal where the holding meets the minimum.

Issuer workflow

  • Establish vaulting, insurance and the attestation arrangement.
  • Record the bar list and keep it current.
  • Issue units only against metal confirmed as held.
  • Publish attestations on the stated cadence.
  • Process redemptions, arranging delivery where elected.

Payments

Subscriptions are held as an investor liability until allocation settles. Redemption for cash recognises a payable at the moment units are burned. Storage and insurance fees accrue against the vehicle and are disclosed rather than netted invisibly from the holding.

The payment railMoney is matched to a subscription by its reference and no other attribute, then screened and settled. Provider adapters for card and crypto rails are not built, and are drawn as an absent component.ReferencechecksummedFunds arrivebank or custodyReconcilereference or nothingScreenAMLSettlesecond authoriserSuspense (2900)unidentified, and visibleNo reference matchProvider adaptersCard, local rail, stablecoinNot built — the registry ships empty
A reference is the only thing that matches money to a payment. Everything else is an exception for a person, and unidentified credits post to suspense where they stay visible.

Lifecycle servicing

Servicing is attestation and fee accrual. There is no income: gold does not pay, so a product implying yield on bullion is doing something else — lending it — and that must be disclosed as a distinct risk.

How a distribution is splitA funded pool is divided among holders of record as at the record date using largest-remainder allocation, then withholding is deducted from each holder's gross rather than from the pool.Funded poolone exact amountRegister as atthe record dateRebuilt from confirmedmovements, not today’sbalancesNet to the holderWithheld, from that holder’s grossThe lines sum to exactly what was fundedLargest-remainder allocation, so no minor unit is created or lost. Rounding each slice independently leaves the issuer a few units out every cycle.There is no per-jurisdiction withholding matrix in this build — one rate is entered per run.
Holders of record as at the record date, split by largest remainder so the lines sum exactly, with withholding taken from each holder’s gross rather than off the top of the pool.

Secondary transfer

Transfers between eligible holders are straightforward because the units are fungible and carry no income entitlement. The transfer gate and jurisdiction rules still apply.

The transfer gateA transfer request passes through eight compliance checks. Any single failure refuses the transfer; the same gate is evaluated off-chain and on-chain.Senderholds unitscanTransfer( )Sender holds the unitsNeither party frozenLockup expiredRecipient eligible under policyJurisdiction permittedInvestor type permittedHolding limit not breachedSanctions screening clearRecipientunits move, or none doOne implementation. The Solidity module and the register evaluate the same rules.
One implementation of the gate, not two. The function the register calls is the same one that mirrors the Solidity compliance module check for check, so an off-chain gate and an on-chain gate cannot drift.

Risks

Named plainly. An instrument whose risks are only in a footnote has been mis-sold before it has been issued.

  1. Custodian and jurisdiction riskThe metal sits somewhere, under someone’s control, under some legal system. All three are concentrations.
  2. Attestation is a snapshotIt evidences what an attestor observed on a date. It is a real control and it is not continuous.
  3. Allocated versus unallocatedIf the claim is unallocated, the holder is an unsecured creditor of the issuer, which is a completely different risk.
  4. Redemption frictionPhysical delivery has minimums, costs and logistics, and most holders will settle in cash.
  5. Price riskGold is volatile and pays nothing.

How we support it

  • Proof-of-reserve records held against the asset with a stated attestor and date.
  • A register that can be rebuilt from its movement history and reconciled against chain balances, with any holding lacking a linked wallet reported as unchecked rather than counted as agreeing.
  • Redemption that burns units and recognises the obligation in one transaction, so metal is never released against units that still exist.

Questions

Is the gold allocated to me specifically?

Your claim is to a weight of metal held in allocated form for the vehicle. Specific bars are recorded for attestation; the claim is by weight.

Can I take delivery?

Where the terms permit and the holding meets the minimum, since a bar cannot be divided physically. Costs and logistics fall to the holder.

What if the vault fails?

Allocated, segregated, insured metal should not form part of the operator’s estate — which is exactly why those three words matter and why the storage jurisdiction is disclosed.

Does it earn anything?

No. Any yield on gold comes from lending it out, which is a different product with counterparty risk that must be disclosed separately.

Next steps

Bring an instrument you are actually considering. Structuring something real is the only way to judge whether the model fits.

Request Enterprise DemoAll tokenization topics