A linear view of the eight operational stages. Stage 9 (decommissioning) sits outside the steady-state loop.
Issuer compliance + KYC vendor
Institutional client (PSP, exchange, fintech, treasury desk) is onboarded before any token can be minted to their address.
Components
- KYC / KYB provider (Sumsub, Onfido, Veriff) with PEP & sanctions screening
- Travel-Rule messaging (TRP, Sygna, Notabene)
- Whitelisted withdrawal addresses tied to a verified entity
- Risk scoring & ongoing monitoring engine
Data flow
Client submits docs → KYC vendor returns risk score & PEP/sanctions hits → Issuer compliance approves → minter address whitelist updated on-chain or in policy database.
Primary failure mode
Mint requests from non-whitelisted addresses must be rejected at the policy layer before any reserve movement.
Estimated costs
- Setup
- $50K – $200K
- Annual
- $120K – $600K
- Per unit
- $2 – $12 per KYC check
Enterprise KYB + ongoing monitoring is the largest variable; retail-only is cheaper.
Reserve bank + treasury operations
Client wires fiat to a segregated reserve account; treasury allocates it across eligible reserve assets according to the investment policy.
Components
- Segregated client-money / bankruptcy-remote trust accounts at G-SIB banks
- Reserve composition engine: cash, overnight repo, T-Bills, qualifying MMFs
- Daily NAV reconciliation against tokens in circulation
- Liquidity bucket monitoring (T+0, T+1, T+7) for redemption stress
Data flow
SWIFT MT103 / SEPA / Fedwire credit → reconciliation engine matches reference to client → reserve ledger debits unallocated cash and credits the client's mint authorisation balance.
Primary failure mode
Mismatched reference or partial settlement: hold mint, alert ops, never mint against pending funds.
Estimated costs
- Setup
- $100K – $400K
- Annual
- $200K – $1.2M
- Per unit
- 0.10 – 0.35% AUM custody + admin
Banking fees scale with reserve size; trust-structure legal setup is front-loaded.
Minter service + smart contract
Once fiat is confirmed received and matched, the minter signs a transaction calling mint() on the token contract for the client's whitelisted address.
Components
- Minter signing service (HSM, MPC e.g. Fireblocks, Copper, BitGo)
- Token contract with role-based access: MINTER_ROLE, PAUSER_ROLE, BLACKLISTER_ROLE
- Multi-sig / threshold approval policy for amounts above limit
- Per-chain mint orchestrator (Ethereum, Solana, Tron, L2s)
Data flow
Reserve confirmed → minter API call → MPC quorum signs → transaction broadcast → block confirmed → token balance increases → internal ledger marks reserve as allocated to circulation.
Primary failure mode
Chain reorg, gas spike, or signer outage: queue mint, retry with replay protection, never double-mint after reorg depth threshold.
Estimated costs
- Setup
- $300K – $1.5M
- Annual
- $150K – $600K
- Per unit
- $0.50 – $5 per mint tx (gas + infra)
Smart-contract audit is the dominant one-time cost; MPC vendor fees scale with tx volume.
Exchanges, PSPs, wallets, market makers
Tokens flow from primary mint recipients out to exchanges, market makers, merchants and end-users; peg is maintained by arbitrage between primary mint/redeem and secondary markets.
Components
- Authorised participant (AP) program with daily mint/redeem windows
- Market-maker liquidity on CEX, DEX, and OTC desks
- Bridge integrations (native burn-and-mint where possible, e.g. CCTP)
- Real-time peg monitoring & deviation alerting
Data flow
AP mints at par → seeds CEX/DEX liquidity → retail buys at near-par → arbitrageurs close any deviation by minting (cheap secondary) or redeeming (expensive secondary).
Primary failure mode
Persistent depeg > X bps: throttle new mints, widen MM spreads, communicate, prepare emergency redemption.
Estimated costs
- Setup
- $150K – $500K
- Annual
- $200K – $2M+
- Per unit
- Liquidity incentives vary by venue
Ongoing cost is dominated by exchange listings, MM agreements and liquidity mining; can exceed $5M/year at scale.
Token contract + compliance oracle
Every transfer executes through the token contract, which enforces sanctions, blocklists, and (optionally) allowlist or per-address velocity limits.
Components
- ERC-20 / SPL / TRC-20 implementation with hook on _beforeTokenTransfer
- On-chain or off-chain blocklist (e.g. OFAC SDN addresses)
- Pause switch for emergency response
- Optional travel-rule attestation for VASP-to-VASP flows
Data flow
transfer() called → compliance hook checks from/to against blocklist → state updated → Transfer event emitted → indexers (subgraphs, analytics) update balances.
Primary failure mode
Sanctioned address attempts transfer: revert at contract level; freeze and report. Pause contract only as last resort — disrupts honest users.
Estimated costs
- Setup
- $80K – $300K
- Annual
- $60K – $250K
- Per unit
- $0.01 – $0.50 per compliance check
Blocklist oracle subscriptions (Chainalysis, TRM, Elliptic) are the main recurring cost.
Holder + redemption service
An authorised holder sends tokens to the redemption address (or signs an off-chain request) and instructs the issuer to wire the underlying fiat back.
Components
- Redemption portal with signed request (EIP-712 or off-chain auth)
- Settlement window (T+0 for institutional, T+1/T+2 for retail in some jurisdictions)
- Liquidity ladder: cash → repo unwind → bill sales
- AML re-screening at redemption (source-of-funds, sanctions delta)
Data flow
Holder signs redeem(amount) → tokens transferred to issuer's burn vault → ops confirms received → fiat wire scheduled from reserve bank → settlement reference returned to client.
Primary failure mode
Run scenario: many large redemptions in short window. Pre-defined gate / haircut policy and reserve liquidity ladder must absorb without forced asset sales below par.
Estimated costs
- Setup
- $50K – $200K
- Annual
- $100K – $400K
- Per unit
- $0.50 – $5 per redemption tx + wire fees
Wire fees (SWIFT ~$15-$50, SEPA ~€0.50) are passed through to clients or absorbed by issuer.
Burner service + smart contract
After fiat is settled to the redeeming client, tokens held in the burn vault are destroyed on-chain so total supply matches reserves.
Components
- Burner role on token contract (separate key from minter)
- Daily supply-vs-reserve reconciliation job
- Cross-chain supply aggregator (sum across every deployed chain)
- Audit trail: every burn tx hash linked to redemption ticket
Data flow
Fiat settled → burner signs burn(amount) → totalSupply decreases → reserve ledger releases allocated assets back to unallocated pool → reconciliation report updated.
Primary failure mode
Burn before fiat settlement risks client dispute; fiat sent before burn risks over-collateralised float drifting. Sequence is policy-critical.
Estimated costs
- Setup
- $40K – $150K
- Annual
- $60K – $200K
- Per unit
- $0.50 – $3 per burn tx
Shared infra with mint layer; marginal cost is mainly gas and reconciliation tooling.
Auditor + transparency portal
Independent attestation confirms that reserves ≥ circulating supply, published on a recurring cadence and increasingly verifiable on-chain.
Components
- Monthly third-party attestation (Big-4 or specialist like BDO, Grant Thornton)
- Annual financial-statement audit
- Transparency page with per-chain supply, reserve composition, custodians
- On-chain PoR oracle (Chainlink PoR) or cryptographic Merkle attestations
Data flow
Reserve custodian statements + on-chain supply snapshot → auditor reconciles → report signed → published → PoR oracle updates on-chain reference for integrators.
Primary failure mode
Stale or qualified attestation, or reserve < supply: regulatory disclosure, mint pause, recapitalisation plan.
Estimated costs
- Setup
- $100K – $400K
- Annual
- $250K – $1.5M
- Per unit
- Big-4 attestation ~$200K-$1M/year; on-chain PoR oracle ~$50K-$200K/year
Regulatory-grade audit is non-negotiable for MiCA EMT or US trust-charter issuers.
Issuer board + regulator
If the product is discontinued, an orderly wind-down ensures every outstanding token can be redeemed at par before the contract is retired.
Components
- Public notice & final-redemption window
- Mandatory burn-on-redeem-only mode (mint role revoked)
- Residual-reserve escrow for non-redeemed tokens
- Smart-contract sunset: pause, then renounce upgrade keys
Data flow
Board decision → regulator notified → mint disabled → redemption window communicated → reserves liquidated to cash → final redemptions processed → contract paused → escrow holds residual.
Primary failure mode
Lost-key holders cannot redeem: residual escrow must remain claimable per jurisdiction's unclaimed-property rules, not pocketed by issuer.
Estimated costs
- Setup
- $20K – $100K (planning & legal docs)
- Annual
- $50K – $300K during wind-down
- Per unit
- Escrow admin ~0.05 – 0.15% residual AUM/year
Most costs are legal and regulatory; escrow runs until statute of limitations on unclaimed property expires.
Battle-tested defaults seen across MiCA EMT issuers, US trust companies and Singapore MPI stablecoins.
| Area | Typical stack |
|---|---|
| Smart contracts | OpenZeppelin ERC-20 + AccessControl + Pausable + custom Blocklist hook; upgradeable via UUPS or transparent proxy behind a timelock + multisig. |
| Key management | MPC custody (Fireblocks, Copper, BitGo) or HSM-backed signing; role separation: minter, burner, blocklister, pauser, upgrader — never one key. |
| Off-chain orchestration | Idempotent job queue (e.g. Temporal, AWS SQS + Step Functions) for mint/burn pipelines; every action has a reconciliation counterpart. |
| Reserve ledger | Double-entry ledger (e.g. TigerBeetle, Modern Treasury, in-house) keeping fiat reserves, allocated balances and circulating supply in lockstep. |
| Observability | Per-chain supply oracle, peg-deviation monitor, redemption SLA tracker, reserve-coverage ratio, signer-health dashboards, on-call rotation. |
| Disclosure & PoR | Monthly attestations published as signed PDFs + machine-readable JSON; Chainlink PoR or Merkle attestations for on-chain consumers. |