Risk and due diligence for RWA tokens

An RWA token combines two sets of risks: those of the underlying asset and its legal wrapper, which are as old as finance, and those of the token, its smart contract and its chain, which are new. Due diligence fails most often at the joint between the two, where nobody owns the question. This lesson walks through each risk area and ends with a checklist that can be used for an investment, a collateral acceptance or a custody onboarding decision.

The underlying asset and its custodian

Start with the asset, not the token. Ask what exactly backs each token, where it is held, and who confirms that it exists.

• Existence and ownership. For a fund, the evidence is audited financial statements, the custodian bank's holdings report and the administrator's NAV calculation. For a commodity token, it is a bar list with serial numbers, vault location and an independent inspection. For a loan pool, it is the loan tape (the list of loans with borrower, amount, maturity and status) and the servicer's reports.
• Segregation. Is the asset held in the name of the fund, trust or SPV, separate from the sponsor and from the custodian's own assets? This decides what holders recover in an insolvency, as discussed in the lesson Legal structures for tokenized assets.
• Reconciliation. Does someone reconcile, at least daily, the number of tokens in circulation with the shares on the fund register and the assets at the custodian? Who is responsible if they disagree, and what happens to the token in that case?

A monthly attestation by an accounting firm confirms balances at a point in time; it is not an audit of controls or of the full financial statements. The lesson Counterparty risk and proof of reserves explains why a point-in-time check does not prove solvency.

NAV, pricing and oracles

A smart contract does not know what a token is worth. The value reaches the chain through an oracle, a service that publishes off-chain data on-chain. For RWA tokens the key data point is usually the net asset value (NAV) per token, calculated by the fund administrator.

Three questions matter:

1. How often is NAV struck? A money-market fund strikes NAV daily. A private credit or real estate fund may do it monthly or quarterly. Between two strikes, the on-chain price is stale by design.
2. Who publishes it on-chain, and can it be wrong? If the issuer itself pushes the NAV, there is no independent check. If a third-party oracle network is used, check its sources, update rules and what happens when the feed stops.
3. What uses the price? If a lending protocol accepts the token as collateral at its NAV, a stale or wrong NAV can allow over-borrowing.

A worked example: a private credit token has a NAV of $1.00, published monthly. A lending protocol accepts it at a 20% haircut, so a holder of 10,000,000 tokens can borrow $8 million. On day 5 of the month, a borrower in the pool defaults and the true value falls to $0.85. Until the next NAV strike, the oracle still shows $1.00. The collateral is really worth $8.5 million against an $8 million loan, so only 6% of cover remains instead of the 20% the haircut was meant to give, and nobody can see it on-chain. If the true value falls below $0.80, the loan is under-collateralized while still looking healthy. A sound integration uses conservative haircuts for infrequently priced assets, caps exposure and requires the issuer to report credit events immediately.

Redemption terms and gates

Most RWA tokens are worth their NAV only because holders can redeem them with the issuer. The redemption terms, not the token mechanics, are the real liquidity profile.

The classic failure is a liquidity mismatch: a token that trades or promises redemption daily, backed by assets that can only be sold over months. In normal times this works. Under stress, the gate closes and secondary prices fall well below NAV.

Smart-contract and admin-key risk

The token contract is software, and RWA tokens deliberately give the issuer strong powers: minting, burning, pausing, freezing addresses and forcing transfers. These powers are needed for legal compliance (court orders, lost keys, sanctions), but whoever controls them controls the asset.

Check:

• Upgradeability. Many token contracts sit behind a proxy that lets the issuer replace the code. Who can upgrade, with what approval, and is there a timelock (a delay before changes take effect) that gives holders time to react?
• Key management for admin roles. Is the minting key held in a multisig or MPC setup with several independent approvers, or by one person? Are roles separated (minting, pausing, upgrading)? The controls described in the lesson Wallet tiers, transaction policy and signing workflows apply here.
• Audits. Which firm audited which version of the code, and were findings fixed? An audit of an earlier version says nothing about the code deployed today.
• Chain and bridge risk. Products issued on several chains either mint natively on each one or use a bridge. A bridge adds the risk of a hack that creates unbacked tokens on one chain, as the bridge failures discussed in the lesson Assessing DeFi risk showed.

Permissioning and secondary liquidity

Permissioning protects the issuer's legal position but has consequences for the holder. A wallet removed from the allowlist, because a KYC refresh failed or because of a sanctions screening hit, may be unable to transfer or redeem until the issue is fixed. Tokens sent by mistake to an address that is not allowlisted can be stuck until the transfer agent intervenes.

Secondary markets for most RWA tokens are thin. Only eligible holders can buy, few venues list the tokens, and market makers are scarce. Expect wide spreads and possible discounts to NAV, especially in stress. Liquidity metrics on a token page (holders, transfers) often count internal movements between the issuer's own wallets and overstate real trading.

Legal enforceability

Finally, confirm that the token gives the holder an enforceable right:

• Who is the counterparty? The fund, an SPV, a trust, or an operating company?
• What is the claim? Ownership, a beneficial interest, a debt claim, or only a contractual promise to redeem?
• Which law governs the token and the link to the asset, and where would a dispute be heard?
• Regulatory status. Is the product a registered or exempt security, a fund, an e-money token? Is the issuer authorized where it is sold to you?
• Tax and accounting treatment of the token, its income model and its redemption.

Due diligence checklist

Exam focus: start with the underlying asset and its custodian (existence, segregation, daily reconciliation of tokens with register and assets); attestation versus audit; NAV frequency, oracle design and how a stale NAV can leave collateral under-covered; redemption terms (who can redeem, cut-off, gates, suspension) and the liquidity mismatch failure; admin powers, upgradeability, timelocks and key management for admin roles; bridge risk for multi-chain issuance; allowlist removal and thin secondary markets; legal enforceability questions; the structure of a due diligence checklist and the evidence to request for each area.