Every RWA investment carries five kinds of risk, and good due diligence is simply checking each one before you commit. The asset itself can lose value; the legal structure might not give you a real claim; the token might be hard to sell; the smart contract could have a flaw; and the platform or custodian could fail. None of these is a reason to avoid RWAs - they are the reasons to evaluate each deal properly. This guide maps the risks and gives you a method to assess them, so you invest on evidence rather than on a headline yield.

Key takeaways

• RWA risk comes in five layers: asset, legal/structural, liquidity, smart-contract, and counterparty - a sound deal addresses all five.
• The failure that breaks deals most often is the legal wrapper, not the asset or the code - verify your claim is real and enforceable.
• The backing must be verifiable: a trustworthy issuer shows proof of reserves, names the custodian, and discloses the structure.
• Most losses are avoidable with basic due diligence; the rest are the honest risks of investing, which you manage by sizing and diversifying.

The five layers of RWA risk

Think of risk as a stack. At the bottom is the underlying asset: a building can sit vacant, a borrower can default, a commodity's price can fall. This is the risk you are meant to take - the question is whether you are paid enough for it.

Above that sits structural risk: does the token actually give you an enforceable claim on the asset, through a sound legal entity and a named custodian? Then liquidity risk: can you sell when you want, or are you locked in or stuck without a buyer? Then smart-contract risk: is the code holding the tokens safe and audited? And finally counterparty risk: what happens if the platform, sponsor, or custodian fails?

Where investors actually get hurt

Not usually where they expect. Beginners fixate on the asset and the yield, but the most common serious losses come from the layers above it.

A weak legal wrapper - no real claim, an unnamed custodian, vague documentation - can leave you holding a token that points at nothing, even when the underlying property is fine. Outright fraud, including the rug pull where a team disappears with funds, lives in this layer too. And illiquidity traps investors who assumed "on-chain" meant "sellable anytime." The asset's own risk is real, but it is the one you can see; these are the ones that surprise people.

The due-diligence method

Work the stack top to bottom with evidence, not assurances. Confirm the legal structure and your claim; verify the backing with proof of reserves or audits and a named, regulated custodian; check the smart contract has been audited; map your liquidity and any lock-up; and assess the counterparties - who they are, whether they are regulated, and what happens to your assets if they fail.

A credible issuer answers all of this clearly. Vagueness on any layer is itself a finding - it tells you the risk is unmeasured, which is worse than a risk you can price.

Turning risk into decisions

Due diligence does not eliminate risk; it tells you which risks you are taking and whether the return pays for them. Once you have assessed a deal, manage what remains: size positions so one failure cannot hurt you badly, diversify across assets and issuers, respect lock-ups, and favor transparency over yield. The spokes in this cluster go deep on each layer - the checklist to run, how to verify backing, the red flags to spot, and the specific smart-contract, bankruptcy, and liquidity risks.

Where to go next

• Next: the RWA due-diligence checklist.
• The basics: the ways you can lose money.
• Glossary: due diligence.

Sources: rwa.xyz; U.S. SEC (sec.gov), as of 2026.