White Paper

RWA Vault is an institutional-grade Real-World Asset (RWA) tokenization protocol. Only a KYB-passed institution or asset owner of record may cause a Factory mint specification. Settlement is Arc Network. In this interface, Factory minting records a local specification bound to Arc — not an on-chain contract deployment.

At the core of the protocol is the Howey Converter — a structured, multi-factor assessment and conversion engine that evaluates proposed instruments and generates utility-conversion designs intended to reduce securities-law risk under current SEC guidance. The Converter produces comparative residual-risk scores, Legal-Rationale memoranda, and machine-readable mint specifications for a controlled Factory.

The native utility token is RWAV: one supply of 369,000,000,000, preminted, no further mint after TGE. Factory ratio is 1,000 RWAV = 1 RWA token. Of each 1,000, 50% is buy & burned and 50% is permanently locked as RWAV/USDC liquidity. Issuers set unit value and may issue as many RWA tokens as they can buy RWAV for. A non-refundable USDC platform fee, bracketed from $1,000.00 to $50,000.00, is paid to the Treasury wallet on each lot. The dollar fee rises with notional. The marginal rate falls. The schedule is in Tokenomics.

Zero-Proof seals personal fields and proves the four gates without putting the file on the asset page. The Rating Syndicate is a USDC book. It calls capital only into names the Vault scale rates from AAA+ through BBB. Both are described in full below. Neither is a Groth16 deployment, and neither is an NRSRO rating.

Global RWA tokenization has moved from experiment to infrastructure. Yet three gaps persist: platforms force a binary choice between full registration and informal utility claims; compliance remains human-operated and unauditable; and many tokens lack a systematic conversion methodology.

RWA Vault attacks the classification bottleneck directly: a repeatable, documented conversion pipeline rather than a questionnaire that rubber-stamps a mint. The RWAV constitution is consumptive (mint fuel, access bonds, desk pair) and is not a claim on any RWA’s cashflows, NAV, or appreciation.

RWAV settles on Arc Network (chain 5042, RPC https://rpc.mainnet.arc.io, explorer explorer.arc.io). Arc is Circle’s USDC-native L1: USDC gas, sub-second finality. That is the settlement environment in this interface.

Arc’s native gas is USDC. Factory platform fees are the same USDC unit. Circle’s USDC ERC-20 on Arc is 0x3600000000000000000000000000000000000000. That is a network fact, not an affiliation. RWA Vault is not affiliated with or endorsed by Circle or Arc Network.

A verified Factory deployment on Arc is a separate step. Until that deployment, this interface records the mint specification locally. Selecting Arc does not itself broadcast a transaction.

• Issuer KYB Layer — institution or asset owner of record; officer roster; Program Review before any mint.
• Custody Layer — asset instance, title evidence, custodian KYB, and a 90-day valuation/oracle refresh.
• Settlement Layer — Arc Network (chain 5042). USDC gas. Factory platform fees in USDC.
• Tokenization Layer — RWA Factory: 1,000 RWAV = 1 RWA; 50/50 burn and permanent LP lock; issuer-set value; no RWA supply cap; $1,000–$50,000 USDC platform fee to the Treasury wallet; officer authorization.
• Utility Layer — redeem/burn catalog the token is actually used for, not wrapper labels alone.
• Liquidity Layer — official RWA/USDC quote at 10% of outstanding value; RWA/RWAV access book at the same 10%; both locked until unwind, then USDC and RWAV return to the issuer and unsold RWA is burned; primary subscription at the issuer unit value; protocol LP from the Factory 50% permanently locked.
• Privacy & Compliance Layer — holder allowlist, freeze, and audit-ready local records. These are interface controls, not a registered transfer agent.
• Governance & Treasury Layer — immutable RWAV cap and Factory economics after launch; no DAO over another issuer’s RWA.

This section restates the Tokenomics constitution. It is not an offering of RWAV, not a prospectus, and not an on-chain TGE.

Supply. One supply. Maximum 369,000,000,000 RWAV, 18 decimals, preminted. No further RWAV mint after TGE. Circulating supply only falls (Factory buy & burn) or locks (issuer/officer bonds and permanent LP).

Factory mint. 1,000 RWAV = 1 RWA token. Of each 1,000: 50% is buy & burned (500 destroyed), 50% is permanently locked as protocol RWAV/USDC liquidity (500 plus matching USDC). Protocol LP cannot be withdrawn. RWAV spent is a fee — redeem or issuer burn does not return it.

Issuer-set value. No RWA supply cap. The issuer sets the unit USD value at mint and may issue as many tokens as they can buy RWAV for. Each lot pays a non-refundable USDC platform fee to the Treasury wallet. The fee is calculated on that lot’s notional (units × unit value) in declining marginal brackets, then held to a $1,000.00 floor and a $50,000.00 cap. It is never returned. It is not a placement commission and not a claim on the asset.

A lot under $50,000.00 pays the $1,000.00 floor, because 2% of a small lot would not cover review. A $250,000.00 lot pays $4,000.00 (1.60%). A $1,000,000.00 lot pays $11,500.00 (1.15%). A $5,000,000.00 lot pays $31,500.00 (0.63%). A $10,000,000.00 lot pays $44,000.00 (0.44%). The cap of $50,000.00 is reached at $12,400,000.00 and does not rise after that. Splitting one large lot into several smaller lots costs more, because each lot restarts at the higher brackets.

Why this band. A private-placement agent commonly charges several percent of proceeds, often in a 3–7% range on a smaller raise, and that charge is for selling the securities. This fee is not that. It does not place the tokens. An ATS secondary tape, where published, is on the order of 1% of notional per trade, or a buyer and seller commission near 1.5% plus a small network fee. One factory charge of 1.15% on a $1,000,000.00 lot is in that neighborhood once, then it stops. A tokenization vendor’s setup quote commonly sits in the same $10,000.00–$50,000.00 band as this cap; below about $5,000,000.00 the brackets are inside that band rather than a flat $50,000.00 on every issuer. A DEX fee of a few basis points is not the comparable. It does not include KYB, custody attestation, or a register. The floor is $1,000.00 so a file is covered. On a lot below $50,000.00 that floor is more than 2% of notional, and on a lot below $1,000.00 it is larger than the lot. The cap stops a large lot from being charged like a placement.

Allocation. Dev team 15% is unlocked at TGE — not vested, not locked. Only liquidity is permanently locked: the 20% liquidity allocation plus the Factory mint’s 50% LP lock. Treasury 25% is programmatic. Community 40% is grants and issuer-access support, not a staking-reward pool.

Access bonds. First mint of an instrument locks issuer 10,000,000 + officer 1,000,000 RWAV for as long as any other unit of that RWA is outstanding. No yield. Freeze does not forfeit. Officer forfeiture, or issuer suspension, burns 100% of locked RWAV. A clean unwind does not. The bond returns to the issuer Desk that locked it. The protocol does not sell it, and it is not paid to liquidity providers. The issuer may sell it. See What unwind returns.

Desk fee. 1.00 USDC is charged to the taker on each matched official RWA/USDC fill. It is not a farm and it is not an emission. When the $1 is charged, how the dollar is split, and the liquidity share calculation are in Liquidity.

Issuer mint and burn. After the initial Factory specification, the issuer of record may mint additional RWA without a protocol supply cap (Desk RWAV and the USDC platform fee still apply), and may burn issuer-held inventory. Holder redeem is the consumptive path. An RWA cannot mint RWAV.

Governance. Cap fixed. No further RWAV mint, no upgrade proxy, no Operator pause of RWAV, no DAO over another issuer’s RWA. Issuer controls remain: freeze, allowlist, issuer mint, issuer burn, redeem, bond forfeiture.

RWAV is not a claim on any RWA’s cashflows, NAV, or appreciation, and is not marketed as an investment contract. Tokenomics (in force as local records).

Liquidity is inventory and cash posted on a book so an allowlisted holder can buy or sell the token without waiting for a private buyer. It is not a yield. It is not a reserve that pays out the underlying asset. It is not a redemption fund. The only cash a poster can receive is the taker fee defined below, and only when that poster’s depth is the depth taken. Redeem still burns a unit against the utility catalog. A Desk trade only moves the token.

It is required because a token with no standing bid and no standing offer cannot be shown to a counterparty as tradable. The issuer must leave part of the issue, and the cash against it, in the book, and must not be able to pull that quote the day after mint. Ten percent is the minimum that stays. It is not a promise that every holder can exit at once.

An RWA has two markets, and the protocol has a third lock that is not either of them. They are not the same price, and they are not interchangeable.

Primary subscription. An allowlisted holder buys from issuer float at the issuer’s unit USD value. The fill does not cross the bin book and does not set the secondary price. USDC paid is issuer proceeds. The allocation is written to the register ID on the asset profile, in the buyer’s name. That register is the reconciliation between the token and the off-chain book. Primary inventory is not liquidity.

Official quote. RWA/USDC is the only institutional quote. At every mint, including later lots, displayed depth on that book is brought to at least 10% of outstanding value, defined as units issued times the issuer unit USD value. The RWA units that fund the book come out of the lot, so they are not also in the float the issuer can sell. The USDC is the issuer’s cash, posted against those units. A blank field posts the 10% still due. A typed amount below that due is refused. The issuer may post more than 10%. The 10% floor cannot be withdrawn while any other unit of this RWA is outstanding. Unwind is the only release. Extra above that floor can be withdrawn while the floor remains.

On a mint of 1,000 units at $100, outstanding value is $100,000. The USDC book must hold at least 100 units and $10,000. The access book must hold another 100 units and $10,000 of RWAV. Two hundred units leave the float. Eight hundred remain for primary subscription or issuer inventory.

What a trade does. A secondary buy pays USDC into the book and takes RWA units out of it. A secondary sell does the reverse. The mix changes. The position does not unlock. A buy that would leave fewer RWA units in the USDC book than 10% of units outstanding is refused. A sell that would leave less USDC in that book than 10% of outstanding value is refused. In the example, the book cannot be taken below 100 units or below $10,000. If displayed depth is already short, a fill that would take it lower is refused until the issuer, the liquidity provider named at mint, or a passed holder of that issuer restores it. Passed holders may post extra RWA/USDC above that floor. Extra may be withdrawn only while the official book remains at or above 10%. The public cannot post. The 10% issuer lock cannot be withdrawn while any other unit is outstanding.

NAV collar. A secondary fill on RWA/USDC more than 2% away from the issuer unit value is refused. The last trade is not a new NAV. NAV is the issuer unit value, refreshed through the custody oracle. A trade cannot reprice the asset.

Access book. RWA/RWAV carries the same 10% of outstanding value, posted in RWAV, and the same lock until unwind. It exists so the protocol token is paired with the asset and a holder can move between RWAV and the RWA without using the official quote. It is not the official quote and it is not the NAV. The same floor applies: a fill cannot take that book through 10%.

Later lots, redeem, and burn. A later mint raises outstanding value, so the floor rises with it. The new lot must top both books back to 10% of the new total. The earlier position is not released to make room. Holder redeem burns that holder’s unit against a delivery the custodian has filed. The issuer opens the delivery with a label and a quantity. The issuer does not upload the file. The custodian uploads the meter file under a separate seat. The SHA-256 is computed from the file. Nobody types a hash. The holder selects that filed delivery and burns up to the quantity on it. Issuer burn retires issuer-held inventory and does not use the meter file. Neither returns the posted RWA, the posted USDC, the posted RWAV, or the 1,000 RWAV paid to mint. Unwind is refused while issuer inventory, a holder unit, an open order, or an extra liquidity position remains, and the refusal names which. Extra above the floor is withdrawn by its owner. It is not paid to the issuer. When only the issuer’s locked books remain, unwind burns the RWA still in those books and returns the posted USDC and the posted RWAV to the issuer Desk. The access bond returns in that same step. It is not burned. Protocol liquidity is not part of that return.

Protocol liquidity. Of each 1,000 RWAV paid to mint one RWA, 50% is buy & burned and 50% is permanently locked as RWAV/USDC protocol liquidity. That lock is the cost of using RWAV as mint fuel. It is recorded as permanent protocol liquidity. It is not the RWA quote, it does not hold the RWA units, and it is not returned on redeem. The 20% RWAV allocation locked at TGE is the same kind of lock: protocol liquidity, not an issuer’s RWA book. The $1 taker fee and the liquidity share are calculated in the notes below. A fill against a resting order, with no bin notional, pays the dollar to Treasury. Primary subscription does not pay it. Maker $0. The native RWAV/USDC book and the RWA/RWAV access book charge nothing.

Not a yield farm. There is no emission schedule, no staking reward, no RWAV rebate, and no compounding vault. The provider does not receive rent, a coupon, redeem proceeds, or a share of issuer revenue. The 50% RWAV lock at mint is protocol liquidity. It is not an LP account and it pays no one. The access bond pays nothing. A syndicate call buys units at the issuer’s unit value. It is not this fee. Calling the taker credit a yield, an APR, or a farm is incorrect. It is a one-dollar matching charge, paid only when that provider’s inventory is used.

Settlement in this interface is the local book until the Factory, the locker, and the register are deployed on Arc. The rules in this section are the rules of that book.

The Howey Converter performs a structured pipeline:

• Baseline multi-prong Howey assessment
• Generation of candidate utility-conversion wrappers
• Class record on every asset class: the unit the Consumptive Credit wrapper accepts, the identifier, and a confirmation that the holder takes no rent, coupon, dividend, or royalty
• Production of a Legal-Rationale Memorandum
• Output of a machine-readable mint specification for the RWA Factory, including the RWAV mint fee and USDC platform fee
• Market readiness record: issuer narrative, classification lock, register ID, and SHA-256 hashes of the evidence pack

Mint Gate refuses an issuance that has no market record. The record is what a counterparty can check without asking the Vault to approve the asset.

Utility mint only. The factory authorizes a consumptive utility. It does not authorize a security. If all four Howey prongs are Yes, or the residual score is above 0.58, the mint stops. Counsel cannot waive either stop. A counsel memorandum may sit in the evidence pack. It does not clear the gate.

Security is a different instrument. The classification lock can be set to Security so the record shows what the issuer claimed. That choice does not mint. A security would require SEC-approved offering documents and a different venue. Uploading a file on this factory is not that approval. On the Trade Desk and on the asset page, a utility RWA is marked as a consumptive credit. A security classification is marked in a different color, and the book states that SEC-approved documents would be required and that this factory did not authorize the mint.

Delivery is a file, not a typed hash. The issuer opens a delivery with a work-order label and a quantity. The custodian, signed in on a separate seat, uploads the meter file. The SHA-256 is computed from the bytes. The holder redeems by selecting that filed delivery. The issuer cannot upload the file, and nobody types a hash.

Separate seats. A classification reviewer who is not an issuing officer confirms that the business is the unit on the class record. The mint stops until that confirmation is on the record. Valuation is filed by the valuator. Title and the asset-title opinion are filed by the title firm. The classification opinion is filed by classification counsel. The custody agreement and the meter file are filed by the custodian. Insurance is filed by the insurer. The factory audit is filed by the auditor. The officer can read the hash, the name, and the date. The officer cannot upload those files.

LEI and GLEIF. An LEI is a Legal Entity Identifier. It is a 20-character code for a legal entity, issued under ISO 17442 and recorded by a local operating unit. GLEIF, the Global Legal Entity Identifier Foundation, publishes the record. The seat does not open unless that record is ISSUED and the firm name on the seat is the legal name GLEIF returns. A person’s typed firm name is not accepted. The lookup proves the entity exists. It does not, by itself, prove that the person at the keyboard works there.

The signing key. When the seat opens, this device generates a P-256 key. The public key is stored with the LEI. Each file the seat files is signed over its SHA-256. A hash with no signature is refused. The private key stays on this device. The protocol operator then countersigns that public key. Until the countersignature is on the seat, the record reads: LEI matched, file signed, operator has not countersigned. After it, the record reads that the operator countersigned.

The meter. The custodian’s key signs the reading. If the custodian registers a meter public key, a later reading must also carry that meter’s signature, and the custodian signature alone is refused. Until a meter key is registered, the proof stops at the custodian. This page does not generate the meter key and does not read the device.

Counsel and KYB. Classification counsel must enter a bar number and a jurisdiction before that seat can sign. Both are displayed. There is no single public bar roll this protocol can query, so the bar number is not marked as an admission. It does not authorize a mint. An issuer does not pass Program Review on a checksum. The LEI is read from GLEIF. The entity must be ACTIVE, the registration ISSUED, and the legal name is set to the GLEIF name. The home-registry number and the corroboration level are stored with it. The 9-digit D-U-N-S number is required and is bound to that confirmed entity. Dun & Bradstreet does not publish a public match of the nine-digit number, so the D-U-N-S field is not a D&B confirmation. Names on the packet are screened against the public OFAC SDN list. A hit blocks the review. That screen is not a licensed sanctions vendor. The vendor signature on Adoption remains a separate contracted key. A seat opened here cannot create it.

Operator countersignature. The operator private key is held on the server. It is not in the seat and it is not in this browser. Countersign asks for the operator code. A firm seat does not have that code. A filing and a unit confirmation are refused until the server signature verifies.

• Issuer narrative: jurisdiction, owner of record, asset location, servicing agent, redeem mechanics, and the insolvency waterline.
• Classification lock: consumptive utility with no residual claim. A Security lock is recorded and then refused.
• Evidence pack, hashed, not dumped into the mint event: title, custody agreement, valuation, classification opinion, asset-title opinion, and a Factory audit. Physical assets also require insurance or a warehouse receipt.
• Each hash is attested by a named role — officer, custodian, counsel, valuator, or auditor. The Vault does not underwrite.
• File bytes stay in the issuer vault under the SHA-256. The Factory record stores the hash, role, name, date, and a record hash of the pack. A live Arc deployment emits that tuple.
• Valuation hashes older than 90 days, or opinion and audit hashes older than 365 days, freeze Desk matching the same way a stale NAV does.
• The symbol is bound to a register ID so the on-chain token can be reconciled to the off-chain book.

The Converter is a risk-mitigation and design system. It does not constitute legal advice and does not create a registration exemption or safe harbor. See the Regulatory Notice, Risk Disclosures, and Legal index.

The default instrument is a fungible supply with a use. Identical units trade on the Desk for as long as the asset is live. A holder may sell a unit without redeeming it. Only the unit that is redeemed or consumed burns. The rest of the supply stays outstanding and keeps trading, subject to the allowlist, the 10% floor, and the 2% collar. A unique object is the exception and is issued as a single unit. Across commodities, recorded mineral rights, property and equipment, trade settlement, environmental credits, delivered energy, infrastructure capacity, counted licenses, healthcare, and decentralized physical networks, 36 patterns meet that test. Treasuries, fund interests, private equity, and private-credit pools do not. Here are some examples below. Every example still passes the Converter, the market-readiness record, and the Mint Gate. The Vault does not approve the asset.

Without a repeatable, auditable conversion methodology, institutional capital either stays in traditional wrappers or takes unnecessary securities-law risk. The Converter is the design and documentation layer between raw asset economics and on-chain utility structures. Pairing it with a consumptive RWAV mint (1,000 RWAV per token, burn and permanent LP lock, issuer-set value, no protocol supply cap) is intended to keep protocol economics from looking like a claim on the underlying asset. The industry frame for that distinction is Section 17.

KYB-passed issuer of record, with identity sealed and a credential proof, → attested custody instance → asset template → core data bound to that issuer → representation and rights mapping → Howey assessment, wrappers, and operational utility catalog → holder-allowlist policy → Legal-Rationale memorandum → rostered-officer authorization → market readiness record (narrative, classification lock, register ID, named liquidity provider, SHA-256 evidence pack) → controlled Factory mint (1,000 RWAV = 1 RWA; 50/50 burn and permanent protocol LP; issuer RWA/USDC and RWA/RWAV books at 10% of outstanding value, permanent; issuer-set value; USDC platform fee to the Treasury wallet; issuer/officer bonds locked while the RWA is live; refused without KYB, custody, utility, allowlist, the market record, the 10% books, fresh valuation, fresh opinion hashes, Legal Documents consent, and Desk RWAV + USDC) → primary subscription at the unit value onto the register → secondary RWA/USDC quote, collared within 2% of that value, which cannot be traded through the 10% floor → Asset Profile shows the hashes, the Vault rating, and the factor list → a USDC syndicate may call capital only if that rating is BBB or better → subsequent issuer mint tops the floor back to 10% → holder onboarding → freeze if NAV, custody, an opinion hash, or the liquidity floor fails. Howey assessment is not blocked on Desk balances; Mint Gate is.

RWA Vault differentiates through (1) issuer KYB as a hard mint precondition, (2) instance-level chain of custody with oracle freshness, (3) operational utility (redeem/burn) rather than wrapper labels, (4) a holder allowlist and freeze that actually block the Desk, (5) a formal Howey conversion engine, (6) controlled Factory issuance bound to a rostered officer, (7) a market readiness record of SHA-256 evidence with named attestors and a classification lock, (8) RWAV constitution (1,000 RWAV = 1 RWA, issuer-set value, no protocol supply cap, 15% team unlocked, only liquidity permanently locked as unwithdrawable LP, bonds locked while the RWA is live, forfeiture burns, no yield), (9) settlement on Arc Network, (10) Zero-Proof on the holder, officer, and custody gates, and (11) a Vault investment-grade scale from AAA+ to BBB with a USDC Rating Syndicate that calls capital only into those names. These are product controls, not a legal clearance. The Vault scale is not an S&P, Moody’s, or Fitch rating. The Vault does not approve the underlying asset.

Status is tracked on the Roadmap: green lamps are complete, orange lamps are in progress, unlit lamps are planned. There are no launch dates.

Complete in this interface: RWA MINT with the market readiness record, KYB, Zero-Proof, custody, allowlist, freeze, Factory economics, Desk, the Vault rating, the USDC Rating Syndicate, Legal clickwrap, and the Arc selector (mainnet chain 5042). In progress: RWAV TGE on Arc Network (source in Operator custody; verified deploy is not). See Tokenomics. Planned: verified Factory deploy on Arc, an Arc Groth16 verifier for the same Zero-Proof statements, institutional login, and agentic integrations on Arc (Archie, ERC-8004 / ERC-8183, Loop, Arc docs MCP). A rostered officer still authorizes mint. Agents do not mint.

Will not: RWAV yield, further RWAV mint, upgrade proxy, a DAO over another issuer’s RWA, a protocol RWA supply cap, Local Anvil as a product network, a canonical bridge, or Agents MCP as a Desk path.

Tokenomics constants in this White Paper are the launch constitution; the off-chain interface may still be restyled.

Zero-Proof is the local privacy layer. It answers four questions and hides the file that produced them: did this issuer pass review, may this officer mint, is this wallet a passed holder of that issuer, and is the custody valuation inside 90 days. The tax identifier, registered address, officer email, officer nationality, beneficial-owner name, and holder legal name are not inputs to those proofs and are not shown on the asset page.

Encryption and proof are separate. AES-256-GCM seals the personal fields before the record is stored. The key stays in the browser vault, apart from the packet. The issuer’s legal name and LEI stay public, because a counterparty has to know who issued the asset. Ciphertext is not written onto the asset profile and is not an event. The issuer of that asset can still open its own file. Other issuers cannot.

A pass then issues a Schnorr proof of knowledge, BIP-340. The gate checks that the credential key matches one statement, and only that statement:

• Passed holder: this wallet holds an unexpired passed credential for this issuer.
• Mint officer: this officer of this issuer has mint authority, and the issuer credential is passed. The officer’s name is not an input.
• Fresh custody: the packet hash is bound to a clear freshness bit. The valuation date is checked on the packet. It is not an input to the flag proof.

Allowlist membership is a second proof, and it is the one that hides the row. Each passed holder is a Pedersen commitment. The public record is a Merkle root of those commitments, not a list of names. The buyer proves knowledge of one opening in that set with a 1-of-n discrete-log proof. The proof is bound to the buyer’s wallet. It does not carry the row number. A jurisdiction flag proves the code is one of the published set without putting the code in the proof. A not-PEP flag proves the review bit is clear. The issuer of that asset still holds the sealed file, including the row.

Custody freshness stays two checks. This interface still refuses a valuation older than 90 days by reading the packet. The flag proof’s public inputs are the packet id and a clear bit. Program Review still does the screening. None of these proofs reads a passport, parses a PDF, or replaces a sanctions screen.

A normal allowlist proves inside a 200 millisecond budget. The gate refuses a proof that misses that budget. Suspension or amendment clears the credential. This is selective disclosure, not anonymity. Primary subscription and the register still open for the issuer of that asset. Balances, lots, the 10% floor, and fills stay public. These are discrete-log proofs. This interface does not ship a Groth16 circuit or an Arc pairing verifier. That verifier, for these same statements, is a later Arc deployment.

Every Factory RWA receives a Vault rating on its Asset Profile. The scale is investment grade only: AAA+, AAA, AA+, AA, AA−, A+, A, A−, BBB+, BBB. Anything that misses a hard gate is NR. The Rating Syndicate calls USDC only into BBB or better. NR is not callable. The mark, the outlook, and the factor scores are on the profile and on the asset list. Outlook is Stable, Watch, or Negative.

The score is 100 points, then caps. Issuer KYB, officer credential, attested custody inside 90 days, clear title, the 10% liquidity floor, a set unit value, Howey residual, operating utility, the holder allowlist, the evidence pack, and a locked access bond are the factors. A failed KYB, a custody packet that is not attested, a freeze or a stale valuation, a missing unit value, or a Howey residual on the block line forces NR regardless of the other points. A short liquidity floor caps the name at A− and sets a Negative outlook. A disclosed lien caps it at A. An unlocked bond caps it at A+. Elevated residual risk caps it at AA− or BBB+. BBB itself is Watch.

The syndicate is a USDC book, separate from RWAV. A limited partner commits at least $10,000 USDC from the Desk balance. The commitment leaves the Desk and sits as dry powder until it is called or released. The mandate is one asset class, or all classes. The rating floor is a notch on the Vault scale: the call is refused if the name is weaker than that floor, or if the class is outside the mandate. The pool board shows funded USDC, dry powder, and capital already called for All classes, Traditional RWA, Finance & Credit, DePIN, Healthcare, and a multi-strategy sleeve. A class filter shows that class’s pool, and shared multi-strategy dry powder that is allowed to be called there.

A call buys whole units at the issuer’s unit value. It does not print a price and it does not cross the secondary book. If the LP wallet is a passed holder of that issuer, the units are recorded on the register. That register is local until Arc addresses and a deploy transaction are on file. The USDC was already reserved, so the local record does not charge the Desk a second time. If the wallet is not a passed holder, the capital stays reserved and the screen states the missing credential. Units are not placed on the register. Dry powder that has not been called can be released back to the Desk.

This scale is internal. It is not an S&P, Moody’s, or Fitch rating, and it is not an NRSRO opinion. It does not approve the underlying asset, clear the Howey file, or waive the allowlist. The book, the unit value, and the fills stay public.

Four checks sit in front of a production claim. Arc settlement is bytecode at the Factory, RWAV, and RWA addresses plus a deploy receipt whose status is 0x1, read from Arc. A pasted address or a pasted hash is not that confirmation. Until Read Arc returns that proof, every subscription and every syndicate call is a local register. This client will not send an empty transaction and then move the local Desk.

A passed issuer and each passed holder carry a sanctions-vendor signature over the vendor name, reference, date, and pass. The signature must match the vendor public key on Adoption. A typed Pass is not a screen. The screening file is not stored. The review expires after 365 days. A custody packet carries the custodian’s signature over the title statement, matching the signing key on the custodian issuer, plus unexpired insurance and a 64-character title hash. An appraiser signature is a different key. Without it the Vault rating caps at BBB. A lost holder wallet is rotated, the old address is kept as prior, and the vendor screen is cleared so the allowlist root changes. If Factory root() is readable and differs from that root, the Desk refuses the match.

A valuation signed only by the issuer caps the Vault rating at BBB. A named appraiser is required before a higher notch. The monthly pack lists symbol, rating, outlook, units, and unit value. It does not list holder names. Office access is Section 16. Bond forfeiture still burns RWAV. It does not pay holders. None of this is a broker-dealer, a transfer agent, or an NRSRO rating.

The office is not the holder of a token. A wallet still settles, matches, and sits on the allowlist. The office is the issuer’s private door: who may submit, who may only read, and what was done. Readers, holders, and liquidity providers do not get a password.

A seat is stored on the server, not in the browser. The session cookie is HttpOnly. The role, the issuer, and the roster officer id are sealed inside that cookie. Editing storage in the browser does not change the role. The cookie goes idle after 15 minutes and ends after 8 hours. Sign-out clears it.

The first seat for an issuer must be an officer already on that issuer’s roster with mint authority. A later seat is opened only while that officer is signed in. Counsel is a roster email that can read the pipeline report and the office log. Counsel cannot submit, mint, or rotate a wallet. The passphrase is at least 12 characters and is stored as scrypt with a unique salt at N=131072, r=8, p=1. It is not stored in plaintext.

Opening a seat shows a confirmation code once. This deployment does not send mail, so the code proves possession of that code, not control of an inbox. It expires in 30 minutes. An officer then enrolls an RFC 6238 authenticator. The shared secret is shown once. Each code can be used once. Sign-in for an officer is the passphrase plus the current authenticator code. Five failures pause the seat for 15 minutes. A missing email and a wrong passphrase return the same sentence.

Mint and wallet rotation ask for the authenticator again. Submit rides the sign-in check for 15 minutes, then asks again. Recovery uses one 128-bit code, stored as its own scrypt hash, and either this seat’s authenticator or a different signed-in officer’s authenticator. A second-officer reset rotates the authenticator secret and shows the new secret once. Recovery replaces the passphrase. It does not rotate a holder wallet and it does not move units.

The office log records the seat being opened, confirmation, authenticator enrollment, sign-in, failure, pause, sign-out, recovery, step-up, submit, mint, and rotation. Counsel can read it. The pipeline report is the same door. It is not a holding statement. Passphrases, recovery codes, and authenticator secrets are not in the log.

This is the office control on the shipped client. It is not Arc settlement, not a bank login, and not a claim that a rewritten browser cannot edit a local draft. Submit, mint, and rotation in this client stop when the sealed session refuses. Zero-Proof still seals the file. The sanctions vendor signature, the custodian signature, and the appraiser signature are unchanged.

Consumptive utility structures: the missing layer of real-world tokenization. Industry research prepared for this protocol, September 2026. It is not an offering and not an investment contract. The public RWA market has priced title. This protocol mints the unit a productive asset actually sells. The condensed report is below.

RWA Vault is a primary issuance protocol for real-world assets on Arc. An issuer passes KYB, a custodian attests title, and an allowlisted holder receives units at the issuer’s unit value. The Howey engine classifies the instrument before Factory mint. The evidence file is sealed. The four public proofs — issuer review, officer authority, holder allowlist, and a custody valuation inside 90 days — are what the book can see. Tax identifiers, addresses, and legal names stay off the asset page.

Factory economics are fixed. One RWA token costs 1,000 RWAV. Half of that RWAV is bought and burned. Half is permanently locked as protocol liquidity. The issuer sets the supply. There is no protocol cap on that supply. The platform fee is $1,000 to $50,000 USDC, paid to the Treasury wallet, and it is not refunded. The access bond stays locked while any other unit of the RWA is outstanding. Forfeiture burns RWAV. A clean unwind returns the bond to the issuer Desk. It does not pay holders or liquidity providers. Locked USDC and RWAV come back on that unwind. Unsold RWA still in those books is burned. Outstanding value must keep an RWA/USDC quote of at least 10 percent, with a matching RWA/RWAV access book. The secondary book cannot print through that floor or outside 2 percent of the unit value. A passed holder may post extra liquidity. The only payment is the $1 USDC taker fee when that depth is hit. The split is the liquidity share calculation in Section 6. It is not a yield farm, not an emission, and not a claim on the asset.

Each name carries an internal Vault rating from AAA+ through BBB, or NR when a hard cap applies. The Rating Syndicate calls USDC only into names that clear the mandate and the rating floor. The scale is not an NRSRO opinion. Arc settlement is accepted only when Factory bytecode and a successful deploy receipt are read from Arc. Until then the register is local and is labeled as local. A Desk match is refused when the local allowlist root does not match a readable Factory root.

Holders, liquidity providers, and the Desk use a wallet. The issuer office is a separate sealed session. Counsel can read the pipeline report and the office log. Only an officer can submit, mint, or rotate a lost wallet, and mint and rotation ask for the authenticator again. Recovery replaces the office passphrase. It does not move a unit. Section 17 states the industry split this protocol is built for: settlement of use, not packaging of a residual claim. None of this is a broker-dealer, a transfer agent, or a public offering.