​
Risks addressed

  • A restricted investor keeps acting.
  • A problem asset keeps issuing, redeeming or paying.
  • Units are moved without authority.

​
Controls

  • One person at the venue freezes an investor, or limits it to leaving, and the venue refuses the investor’s acts at once. Lifting takes two approvers, and lifting one reason never lifts another. The register keeper blocks a frozen investor on the registry, following the venue’s freezes.
  • A hold stops the venue’s distributions, redemptions and new issues of an asset until two approvers release it. A reserve short of its cover holds its backed instrument’s new mints. Stopping a backed instrument’s mints or redemptions on the ledger is the register keeper’s own supply term.
  • Forced transfer and recovery move only the units of an investor that consented in advance, at admission, under the register keeper’s standing agreement. Each cites its grounds by reference and document hash (an order for a forced transfer, the evidence for a recovery) and needs two approvers at the venue.
  • The investor sees only a stable code and reason on the act that was refused, never the restriction record.

​
Evidence

  • Restrictions, with their reason, cited order and time; the approvals that lifted them; the register keeper’s block-list changes.
  • Holds and releases, with the finding behind each; control events.
  • The register keeper’s agreement, and each forced transfer or recovery’s transaction, with its grounds’ reference and document hash, and its approvals.
Matrix rows CTL-10 to CTL-12: see the control matrix.
  • A restriction is either a freeze or liquidate-only. A freeze refuses every act of the investor; liquidate-only lets it redeem, retire a product and renew its admission, and takes no subscription and no transfer.
  • Its reason comes from a closed list (sanctions, court order, regulator order, lapsed KYC, lapsed credential, investigation, deceased, key loss, other), with a rationale.
  • A court or regulator order must be cited, with its reference and the document’s hash.
  • A restriction can cover one asset only, and can carry a time at which it lapses.
  • Every path at the venue checks for restrictions: an admission, an order, a settlement and again before it commits, a redemption, and a distribution’s lines. A frozen holder is left out of a distribution, and what it is owed stays on its record: the first distribution after the freeze is lifted pays it, once. The venue’s plan is what leaves it out: the register keeper pays the plan’s lines.
  • A freeze on every asset reaches the registry through the register keeper. Its own systems read the venue’s freezes (GET /v1/block-list, under the registrar role), and it lists each frozen investor’s party on the registry’s block list, so the registry refuses its transfers wherever they start. It takes the party off once the venue lifts the freeze. A freeze on one asset, and liquidate-only, stay at the venue.
  • A hold is the venue’s record. It stops the venue’s distributions, redemptions and new issues of an asset. Reconciliation places one on a blocking finding; risk can place one by hand. Release takes risk’s request and two approvers.
  • A backed instrument has no gate at the venue. Its mints and redemptions run only through its reserve on the ledger, charged to the register keeper’s supply terms, which can stop mints (liquidate-only) or pause redemptions. A reserve short of its cover is a blocking finding: it holds the backed instrument, so the venue takes no new mint, while redemptions go on.
  • The pause is one call by risk: a hold on the asset. The venue’s API then reports the asset as paused to wallets and other venues that read it. Stopping transfers on the registry itself is the register keeper’s act: it archives the asset’s configuration.
  • Both need consent given in advance. The register keeper signs a standing agreement once, and ends it in one act. Each investor’s custodian signs a consent for the asset at admission; without it, the investor’s units move only through its own custodian.
  • A forced transfer cites an order, and delivers only to an investor that is eligible and holds its own credential.
  • A recovery moves every unit of a lost or compromised account to its registered successor.
  • Each move is asked for at the venue under the compliance role, and decided by two approvers besides that maker. The venue then submits it alone, under the register keeper’s agreement; the register keeper does not sign the move itself. Where the holder is on the block list, the move takes it off and lists it again in the same transaction, with the authority the agreement carries, and a recovery lists the successor too.
  • Income follows the units: accrued income up to the move stays with the party that held them.
  • Afterwards, reconciliation matches every move to the operation that approved it.
Related: Holds, freezes and issuer powers · Eligibility · Duties and governance