Custody Models for Physical-Backed RWA: Vaults, Registries, and Verification

Physical-backed RWA tokens depend entirely on how the underlying asset is actually held, and that arrangement generally falls into one of three models: vaulted custody, where a custodian physically stores the asset; registry-based ownership, where a legal or administrative record establishes the claim rather than physical possession; or a smart-contract-enforced claim, where the token's rules attempt to encode the ownership arrangement directly. Each model answers "who holds the asset" and "how do I verify my claim" differently, and each fails differently if the custodian, registry operator, or issuer runs into trouble. Understanding which model a product uses matters more than the "backed by real assets" label on its own.

This article compares the three custody models, explains typical verification cadence, and covers what happens to a token holder's claim if the custodian fails.

Vaulted Custody: Physical Possession by a Third Party

Vaulted custody is the model most people picture when they hear "backed by gold" or "backed by a physical asset": a custodian physically holds the asset — commonly in a vault, warehouse, or secure facility — on behalf of the issuer, who then issues tokens representing claims on that stored asset.

This is the model covered in more depth for gold specifically in how gold-backed tokens are redeemed and audited. The core elements:

• A named custodian, ideally one that follows recognized industry standards for the asset type (for gold, standards referenced by bodies like the London Bullion Market Association).
• Segregation or allocation. Some custody arrangements hold specific, identifiable units for each token holder (allocated); others pool assets together without assigning specific units to specific holders (unallocated), which changes what happens if the custodian becomes insolvent.
• Insurance, which may or may not cover the full value of stored assets, and may exclude certain events.

Vaulted custody works well for assets that are physically storable, fungible, and have established grading standards — gold is the clearest example. It works less well for assets that are consumed, degrade, or cannot be practically centralized in one location, such as most energy commodities, discussed in energy and real asset tokenization beyond real estate and gold.

Registry-Based Ownership: A Record, Not Physical Possession

Registry-based custody does not rely on one party physically holding the asset. Instead, ownership is established and tracked through a legal or administrative registry — for example, a land registry for real estate, a company share registry for equity, or a specialized asset registry for other property types. The token is meant to represent, or link to, an entry in that registry.

This model differs from vaulted custody in a fundamental way: there is no single physical location to inspect. Verification instead depends on whether the registry entry is legally binding, whether it is updated when the token changes hands, and whether the legal system backing the registry actually recognizes the token holder's claim. This is closely tied to the questions covered in what is an SPV structure behind RWA products, since many registry-based structures route ownership through a special purpose vehicle that holds the underlying registered asset, with the token representing an interest in that vehicle rather than the asset directly.

Registry-based custody is common for real estate tokenization and other titled property, where physical vaulting makes no sense but a legal ownership record already exists independent of any token. The main risk shifts from "is the vault secure" to "does the token's claim actually match what the registry and the legal structure recognize, and in which jurisdiction."

Smart-Contract-Enforced Claims: Rules Encoded on Chain

The third model attempts to encode custody or ownership rules directly into a smart contract — self-executing code on a blockchain that governs how tokens can be minted, transferred, or redeemed. In its purest form, this model tries to reduce reliance on a human custodian or registry operator by having the contract enforce rules automatically.

In practice, smart-contract enforcement rarely replaces the other two models entirely — it usually sits on top of one of them. A smart contract can enforce that only a verified custodian can mint new tokens after confirming a vault deposit, or that a token cannot be transferred without meeting certain compliance checks, but the contract itself does not make the underlying physical asset or legal claim more real. If the custodian misreports holdings, or the registry entry is invalid, the smart contract will faithfully enforce rules built on inaccurate information.

The practical takeaway: "on-chain" or "smart-contract-verified" is not, by itself, a substitute for vaulted custody or a valid registry claim. It can add transparency to how tokens are issued and transferred, but the question of what actually backs the token still comes down to a vault, a registry, or some combination of both underneath the contract layer.

Comparing the Three Models

Many real products combine elements of more than one model — for example, an SPV holding a registered real estate asset, with tokens representing shares in the SPV, transfer rules enforced by a smart contract, and periodic audits confirming the registry entry still matches. Reading the product documents to identify which combination applies is more useful than relying on marketing language like "fully on-chain" or "vault-verified."

Verification Cadence: How Often, and by Whom

Regardless of the custody model, the strength of the claim depends heavily on how often it is verified and by whom.

A product that discloses its custody model, names its custodian or registry, and publishes verification results on a stated schedule gives you meaningfully more to evaluate than one that only claims to be "backed by real assets" or "verified on-chain" without specifics. This same discipline applies across RWA more broadly, covered in audit, attestation, and proof of assets in RWA.

What Happens If the Custodian Fails

Custodian or registry-operator failure is one of the risks that physical-backed RWA products need to disclose clearly, and the outcome depends heavily on the custody model and the legal structure behind it.

• Allocated vaulted custody with a clear legal claim to specific, identified units generally gives token holders a stronger position in an insolvency, since the assets may be treated as held on the token holders' behalf rather than as part of the custodian's general estate — but this depends entirely on the jurisdiction and the specific legal documents, not on the existence of a vault alone.
• Unallocated or pooled custody can leave token holders as general creditors of the custodian in an insolvency, meaning recovery depends on the custodian's overall financial condition and the claims of other creditors ahead of them.
• Registry-based claims depend on whether the registry itself, and the legal structure connecting the token to it, survive the operator's failure independently — a well-designed SPV structure can insulate the underlying asset from the issuer's own insolvency, while a poorly designed one may not.
• Smart-contract-enforced claims do not change any of the above; the contract can only enforce what the underlying legal and custodial arrangement actually supports.

None of the three models eliminates custodian or operator failure risk entirely. The practical response is to read the product's specific disclosures on legal structure, insolvency treatment, and insurance before assuming any physical-backed token is protected simply because an asset exists somewhere. You can review custody, verification, and legal structure disclosures for physical-backed RWA products on Bifu RWA.

FAQ

Which RWA custody model is safest?

None of the three models is inherently safest — each carries different risks depending on execution. Allocated vaulted custody with strong legal segregation, a well-verified registry claim, or a properly designed SPV structure can each provide meaningful protection, while poorly executed versions of any model can leave token holders exposed; the specific documentation matters more than the model category.

Does a smart contract guarantee my RWA token is backed by a real asset?

No. A smart contract can enforce transfer and issuance rules automatically, but it cannot independently verify off-chain facts like whether a vault actually holds the stated gold or whether a registry entry is accurate. The underlying custody or registry arrangement still needs to be verified separately.

What is the difference between allocated and unallocated custody?

Allocated custody means specific, identifiable units of the asset are held for each holder, which can offer stronger protection in a custodian insolvency. Unallocated custody pools assets together without assigning specific units, which can leave token holders as general creditors of the custodian if it fails.

How often should a custodian verify holdings for a physical-backed RWA token?

There is no universal standard, but more frequent, independent verification is generally stronger than infrequent or self-reported checks. Look for the specific cadence and the identity of the verifying party in the product's own documents rather than assuming a default schedule applies.

This content is for educational purposes only and does not constitute financial, investment, legal, tax, or trading advice. RWA products involve risk, including possible loss of principal. Always review product documents and risk disclosures before participating.

Related Reading

• New to this? Start with what RWA is.
• On the verification layer specifically: audit, attestation, and proof of assets in RWA.
• On the broader category this custody question sits inside: energy and real asset tokenization beyond real estate and gold.