RWA Tokenization on Stellar: Why Issuers Keep Choosing It

Trustlines: opt-in by default

On Stellar you cannot send someone an asset they have not agreed to hold. The recipient must first establish a trustline to that specific asset from that specific issuer. No trustline, no transfer — the operation simply fails.

Most chains work the other way: anyone can push any token to any address, which is why wallets fill with unsolicited tokens and scams. For consumer crypto that is an annoyance. For a regulated instrument it is a compliance problem, because an issuer can end up with holders it never approved and cannot identify.

Trustlines make the holder set explicit and bounded by construction. The issuer always knows exactly who holds the asset, because holding required an affirmative on-chain act. That is a useful starting position for any instrument with eligibility rules attached.

Authorization flags

On top of opt-in, the issuer can set flags governing what a trustline can do:

• AUTH_REQUIRED — a trustline exists but is inert until the issuer authorises it. This is the hook for KYC: the investor opens a trustline, passes verification off-chain, and the issuer authorises. Until then they hold nothing.
• AUTH_REVOCABLE — the issuer can deauthorize a trustline later, freezing that holder's balance. Necessary for sanctions screening, court orders, or an investor who loses eligibility.
• AUTH_IMMUTABLE — the opposite guarantee: flags can never change again. For an asset that intends to be credibly uncontrolled, this is how you prove it.

The structural point is that these are disclosed. Anyone can read an issuer's flags from the ledger and know precisely what powers exist over their holding. On a chain where the same functionality lives in contract code, the holder has to read that code — and most do not. Our KYC and KYB explainer covers the verification side that sits behind AUTH_REQUIRED.

Clawback, and its one-way door

With AUTH_CLAWBACK_ENABLED, an issuer can recover its asset from a holder. Regulated issuers often need this — for fraud, court orders, or a mistaken issuance — and building it credibly in contract code is fiddly.

There is a specific limitation worth stating plainly, because it surprises issuers after the fact. Under CAP-0035, clawback applies only to trustlines created while the flag was already set on the issuer. Enabling it later does not reach back to existing holders — their trustlines were established under different terms and keep them. An issuer who distributes first and decides clawback is needed afterwards will find that the tokens already out in the world cannot be recovered this way.

Anchors and the cash edge

The unglamorous half of any RWA project is moving money between a bank and a ledger. Stellar's anchor model addresses this directly: regulated entities that accept a local currency and issue a corresponding asset on Stellar, with standardised interoperability protocols (the SEP specifications) covering deposit, withdrawal, KYC exchange and quoting.

This matters more than it sounds. Plenty of tokenisation projects have a perfectly good token and no practical way for a normal investor to fund or exit a position. A network of licensed on and off ramps with common interfaces is infrastructure that does not need rebuilding per project, and it is a genuine reason issuers choose Stellar over chains with larger DeFi ecosystems. The same rails carry stablecoins on Stellar.

Where Stellar is the wrong choice

Three honest limits:

• Smaller DeFi ecosystem. If the asset needs to be collateral across many lending markets, structured products and aggregators, Ethereum has more to compose with. Stellar's DeFi is real and growing — Soroban made that possible — but it is not the same depth.
• Rigid controls. Protocol-level flags are exactly as flexible as they are, and no more. Transfer restrictions by jurisdiction, holding limits, lock-up schedules — anything past the built-in shape needs a Soroban contract, at which point some of the simplicity advantage is spent.
• The chain is never the hard part. Custody of the underlying, investor eligibility, cross-border transfer rules, a legal claim that survives the issuer's insolvency — none of that is solved by a ledger feature. Stellar makes the on-chain half cleaner; the off-chain half remains the majority of the work. See RWA tokenization explained for that side.

The summary

Stellar's pitch for RWA is not performance. It is that the specific things a regulated issuer must be able to do — restrict holders, freeze, in some cases recover, and connect to licensed cash rails — are native, standardised and publicly auditable. For an issuer whose main risk is regulatory rather than technical, that is the relevant kind of advantage.