Compliance is not a one-time filing - it is an ongoing operation. Running a tokenized offering means verifying every investor (KYC/AML), controlling who can hold the token (whitelisting), safekeeping the asset (custody), tracking ownership (cap table), and meeting reporting duties. The exemption sets the rules; compliance operations are how you actually keep them, deal after deal.

This pillar maps that work end to end. The spokes go deep on each function - onboarding, whitelist management, custody, cap table and transfer agent, reporting, and screening for US persons behind entities.

Key takeaways

• Compliance is continuous: onboarding, monitoring, and reporting run for the asset's whole life.
• KYC/AML verifies who your investors are; the on-chain whitelist enforces who can hold the token.
• A regulated custodian and an accurate cap table are core, not optional extras.
• Most failures are operational - a missed check or stale record - not gaps in the law.

Why compliance is an operation, not an event

Qualifying for an exemption gets you to launch. Staying compliant is daily work: new investors to verify, a whitelist to keep current, distributions to record, and filings to make on time.

Treat it as a standing function with clear owners and records. Regulators and investors both expect a paper trail, and the time to build it is before the raise, not during an inquiry.

The core functions

Five functions carry most of the load. Investor onboarding runs KYC/AML and sanctions screening. The whitelist enforces eligibility on-chain. A qualified custodian safekeeps the asset. The cap table and transfer agent track ownership. And reporting meets your filing duties.

Each gets its own spoke. Together they are the machine that keeps a tokenized security inside the law after launch.

Who does this work

You can run compliance in-house, outsource to specialist providers, or - most commonly - split it: a transfer agent and custodian handle their parts, a KYC vendor handles onboarding, and you own coordination and records.

Whatever the mix, someone must own each function and the audit trail. Gaps between vendors are where compliance quietly breaks, so define the handoffs explicitly.

Where most issuers slip

The common failures are operational, not legal: letting the whitelist drift out of sync with who actually passed KYC, weak records when a regulator asks, missed ongoing filings, or thin screening that misses a restricted party.

None require a novel legal theory to avoid - just disciplined process. The investor sees the front of this in what this looks like for investors; your job is the back office that makes it true.

Where to go next

• Next: running KYC/AML for your offering.
• The investor's view: what this looks like for investors.
• Glossary: KYC.

Sources: U.S. SEC (sec.gov); FinCEN (fincen.gov), as of 2026.