ERC-3643 — T-REX Regulated Token

Back to Token Standards

ERC-3643: T-REX (Token for Regulated EXchanges)

ERC-3643 is the de-facto compliance framework for tokenised securities, real-world assets, and any token that has to enforce regulatory restrictions on transfer (KYC, accreditation, jurisdiction limits, issuance caps, lock-up periods). It composes four contracts:

1. Token — extends ERC-20 with forcedTransfer, freezePartialTokens, recoveryAddress, and a compliance hook that runs on every transfer.
2. Identity Registry — maps holder addresses to ERC-734/735 identity contracts that hold the holder's KYC claims.
3. Compliance Module(s) — pluggable contracts that enforce transfer-eligibility rules (max holders, country whitelist, per-investor balance cap, …).
4. Trusted Issuers Registry — list of issuers whose claims the token accepts.

Tokeny Solutions originated T-REX; the standard now underpins regulated deployments at Société Générale, Archax, and Polymath / Polymesh's Polymath 2.0. It's the largest compliance-framework standard with real on-chain volume.

Required Interface (token side, abridged)

interface IERC3643Token {
    event UpdatedTokenInformation(string newName, string newSymbol, uint8 newDecimals,
                                  string newVersion, address newOnchainID);
    event IdentityRegistryAdded(address indexed identityRegistry);
    event ComplianceAdded(address indexed compliance);
    event RecoverySuccess(address indexed lostWallet, address indexed newWallet, address indexed investorOnchainID);

    function transfer(address to, uint256 amount) external returns (bool);  // gated by compliance
    function forcedTransfer(address from, address to, uint256 amount) external returns (bool);
    function freezePartialTokens(address user, uint256 amount) external;
    function unfreezePartialTokens(address user, uint256 amount) external;
    function recoveryAddress(address lostWallet, address newWallet, address investorOnchainID) external returns (bool);

    function identityRegistry() external view returns (address);
    function compliance() external view returns (address);
    function setIdentityRegistry(address) external;
    function setCompliance(address) external;
}

Neo Equivalent: NEP-17 + Identity Registry + Compliance Hooks

T-REX maps cleanly to a NEP-17 base plus a separate identity-registry contract and one or more compliance-module contracts. Neo's Runtime.CheckWitness + manifest-permission model gives the issuer unambiguous control over the privileged ops (forcedTransfer, freezePartialTokens, recoveryAddress); the compliance hook fires inside the NEP-17 transfer override before mutating balances.

T-REX Component	Neo Equivalent	Notes
IERC3643Token	NEP-17 with transfer override calling Compliance.CanTransfer(from, to, amount)	Compliance hook is the only override needed for the read-path
forcedTransfer(from, to, amount)	ForcedTransfer(from, to, amount) gated by CheckWitness(issuerAdmin)	Issuer-only operation
freezePartialTokens(user, amount)	FreezePartial(user, amount) storing per-user frozen balance	Frozen amount subtracted from BalanceOf for transfer eligibility
recoveryAddress(lost, new, identity)	Recover(lost, new, identity) migrating balance + frozen + identity link	Issuer-attested recovery
Identity Registry	Separate Neo contract: (account → identityContract) mapping	Lookup before every transfer
Compliance Modules	Separate Neo contracts implementing CanTransfer(from, to, amount) → bool	Pluggable; Token holds the active module hash
Trusted Issuers Registry	Separate Neo contract listing approved issuer pubkeys	Identity contracts honour only these issuers' claims

What Gets Easier on Neo

• Witness scopes make the issuer-admin checks one-liners (CheckWitness(IssuerAdmin)), no role-bitmask mess.
• Manifest permissions restrict which contracts the token can call out to (the active Compliance contract); reduces the attack surface.
• NEP-22 update lets the issuer hot-swap compliance modules without redeploying the token — the same pattern T-REX uses on Ethereum (compliance module is a separate address, not embedded).

What Stays Hard

• Identity provisioning — the identity registry needs trusted issuers' signatures over claims (KYC verified, accredited investor status, jurisdiction). The same off-chain attestation flow as Ethereum T-REX; the on-chain side is just signature verification via CryptoLib.VerifyWithECDsa.
• Cross-jurisdiction transfers — encoding country whitelists and allowed-pair tables is the same on-chain storage problem as Ethereum. Pluggable compliance modules carry the burden.

Migration Notes

For T-REX deployments porting to Neo:

1. Token → NEP-17 contract with transfer override calling out to compliance.
2. Identity contracts (ERC-734/735) → port to Neo C# (or use a simpler claims-mapping if your issuers re-attest on Neo).
3. Compliance modules → port one-by-one; each module is independent. Start with the holder-cap and country-whitelist modules.
4. Trusted Issuers Registry → small contract; usually 5–20 issuer pubkeys.

The Neo port has fewer roles to maintain (no per-role bitmask — witness scopes do the gating) but the same fundamental shape. Production deployments should go through a full audit of every compliance module since these enforce regulatory requirements.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface ICompliance {
    function canTransfer(address from, address to, uint256 amount) external view returns (bool);
}

interface IIdentityRegistry {
    function isVerified(address account) external view returns (bool);
}

contract T_REX is IERC20 {
    address public issuerAdmin;
    IIdentityRegistry public identityRegistry;
    ICompliance       public compliance;
    mapping(address => uint256) public balanceOf;
    mapping(address => uint256) public frozenTokens;

    modifier onlyIssuer() { require(msg.sender == issuerAdmin, "issuer only"); _; }

    function transfer(address to, uint256 amount) external returns (bool) {
        require(identityRegistry.isVerified(msg.sender), "sender not verified");
        require(identityRegistry.isVerified(to),         "recipient not verified");
        require(compliance.canTransfer(msg.sender, to, amount), "compliance rejected");
        require(balanceOf[msg.sender] - frozenTokens[msg.sender] >= amount, "insufficient unfrozen");

        balanceOf[msg.sender] -= amount;
        balanceOf[to]         += amount;
        emit Transfer(msg.sender, to, amount);
        return true;
    }

    function forcedTransfer(address from, address to, uint256 amount) external onlyIssuer returns (bool) {
        balanceOf[from] -= amount;
        balanceOf[to]   += amount;
        emit Transfer(from, to, amount);
        return true;
    }

    function freezePartialTokens(address user, uint256 amount) external onlyIssuer {
        frozenTokens[user] += amount;
    }
    // ... unfreeze, recovery, setCompliance, setIdentityRegistry omitted ...
}

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("RegulatedToken")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep17)]
public class RegulatedToken : Nep17Token
{
    public override string Symbol  => "REG";
    public override byte   Decimals => 8;

    private const byte Prefix_Frozen      = 0x30;
    private const byte Prefix_IdentityReg = 0x31;
    private const byte Prefix_Compliance  = 0x32;
    private const byte Prefix_Issuer      = 0x33;

    [DisplayName("_deploy")]
    public static void Deploy(object data, bool update)
    {
        if (update) return;
        var args = (object[])data;
        Storage.Put(Storage.CurrentContext, new byte[] { Prefix_Issuer },      (UInt160)args[0]);
        Storage.Put(Storage.CurrentContext, new byte[] { Prefix_IdentityReg }, (UInt160)args[1]);
        Storage.Put(Storage.CurrentContext, new byte[] { Prefix_Compliance },  (UInt160)args[2]);
    }

    private static UInt160 Issuer()         => (UInt160)Storage.Get(Storage.CurrentContext, new byte[] { Prefix_Issuer });
    private static UInt160 IdentityReg()    => (UInt160)Storage.Get(Storage.CurrentContext, new byte[] { Prefix_IdentityReg });
    private static UInt160 ComplianceAddr() => (UInt160)Storage.Get(Storage.CurrentContext, new byte[] { Prefix_Compliance });

    public new static bool Transfer(UInt160 from, UInt160 to, BigInteger amount, object data)
    {
        if (!(bool)Contract.Call(IdentityReg(), "isVerified", CallFlags.ReadOnly, from))
            throw new Exception("T-REX:SenderNotVerified");
        if (!(bool)Contract.Call(IdentityReg(), "isVerified", CallFlags.ReadOnly, to))
            throw new Exception("T-REX:RecipientNotVerified");
        if (!(bool)Contract.Call(ComplianceAddr(), "canTransfer", CallFlags.ReadOnly, new object[] { from, to, amount }))
            throw new Exception("T-REX:ComplianceRejected");

        var frozen = FrozenOf(from);
        if (BalanceOf(from) - frozen < amount)
            throw new Exception("T-REX:InsufficientUnfrozen");

        return Nep17Token.Transfer(from, to, amount, data);
    }

    public static void ForcedTransfer(UInt160 from, UInt160 to, BigInteger amount)
    {
        if (!Runtime.CheckWitness(Issuer())) throw new Exception("T-REX:NotIssuer");
        // Bypasses compliance & frozen checks; issuer must justify off-chain.
        Nep17Token.Transfer(from, to, amount, null);
    }

    public static void FreezePartial(UInt160 user, BigInteger amount)
    {
        if (!Runtime.CheckWitness(Issuer())) throw new Exception("T-REX:NotIssuer");
        var key = new byte[] { Prefix_Frozen }.Concat(user);
        var prev = (BigInteger)(Storage.Get(Storage.CurrentContext, key) ?? ByteString.Empty);
        Storage.Put(Storage.CurrentContext, key, prev + amount);
    }

    public static BigInteger FrozenOf(UInt160 user)
        => (BigInteger)(Storage.Get(Storage.CurrentContext, new byte[] { Prefix_Frozen }.Concat(user)) ?? ByteString.Empty);

    public static void SetCompliance(UInt160 newCompliance)
    {
        if (!Runtime.CheckWitness(Issuer())) throw new Exception("T-REX:NotIssuer");
        Storage.Put(Storage.CurrentContext, new byte[] { Prefix_Compliance }, newCompliance);
    }
}

Compliance Module Example: Country Whitelist

[DisplayName("CountryWhitelistCompliance")]
public class CountryWhitelistCompliance : SmartContract
{
    private const byte Prefix_Allowed = 0x40;

    public static bool CanTransfer(UInt160 from, UInt160 to, BigInteger amount)
    {
        // Look up the (jurisdiction) of from + to from the identity registry,
        // check both are in the allowed-set. Implementation elided.
        return true;
    }
}

Why This Mirror Page Matters

Regulated tokenisation is the largest pipeline of "real money" coming on-chain in 2026. Every team building tokenised funds, secondary trading platforms, or RWA-backed stablecoins ships some variant of T-REX. Having the migration story documented for Neo lowers the bar for these teams to evaluate Neo as a deployment target.