Whitelist / Allow-list

A whitelist - also called an allow-list - is the set of wallet addresses that a token permits to hold or receive it. Any address not on the list is blocked. For regulated real-world assets, the whitelist is the core mechanism that keeps a security token among approved, eligible investors instead of circulating freely to anyone.

It works at the contract level. Before a transfer executes, the token checks whether both the sender and the recipient are on the whitelist; if either is not, the transfer reverts. This turns a compliance requirement into something the code enforces automatically, rather than a rule a back office has to police after the fact. Standards like ERC-3643 build this check in as a central feature.

An address usually earns its place on the whitelist by passing off-chain checks - KYC identity verification, eligibility such as accredited investor status, and a jurisdiction screen - after which the issuer or its agent adds the address. When an investor sets up a self-custody wallet to receive a tokenized security, it is that wallet's address that gets whitelisted.

The whitelist is closely related to a transfer restriction, but they are not identical. The whitelist answers "who is allowed to hold this at all," while transfer restrictions add further rules like lock-up periods, holder caps, or jurisdiction limits on top.

A practical consequence for investors: you cannot freely send a whitelisted security token to any address the way you would a stablecoin. The recipient must already be approved, which is exactly the point - it is what makes a compliant secondary transfer possible rather than a loophole around the rules.

Source: ERC-3643 Association (erc3643.org), as of 2026.