Skip to main content
The document provides an issuer-facing checklist of the key architecture, compliance, custody, infrastructure and integration decisions that should be considered before launching an asset on Stellar. It is a decision framework, not an exhaustive provider directory and not an implementation guide.

Section 1. The primary token architecture design decision

This decision precedes every other item in this document and should be settled before technical work begins. It determines the liquidity venues available to the asset, the breadth of wallet and custodian support, and the range of compliance logic that can be expressed.

How to approach the decision

A classic Stellar asset is the faster and simpler route to issuance, but the choice rests with the issuer. A classic asset is settled at protocol level, requires no bespoke code, is tradeable on the built-in order book and liquidity pools*, and is generally supported across a broader, pre-existing set of wallets, exchanges, custodians, and other integrations without additional integration work. A contract token offers materially greater flexibility, at the cost of a longer build, an audit requirement, and narrower ecosystem support (support for contract tokens is expanding currently). A frequent misconception is that a custom contract token is necessary in order to use smart contracts, but it is not. A classic Stellar asset accessed through the Stellar Asset Contract is automatically compliant with the SEP-41 token interface and operates inside Smart contracts. The underlying classic Stellar Asset and its SAC are the same asset: G-address balances remain trustline balances, while C-address balances are held in SAC contract storage. Before selecting a contract token, also consider extensions available to a Stellar Asset. SEP-8 can add off-chain, per-transaction approval for regulated transfers, and a custom SAC administrator can delegate privileged SAC actions to a G- or C-address while issuer-account authority remains a separate control path. A SEP-41 contract token is appropriate when the token itself needs custom behavior that the SAC cannot express; SEP-57/T-REX is a standardized SEP-41-based framework for permissioned RWAs with pluggable identity and compliance. The consideration that most often points towards a contract token is a compliance rule that the four issuer flags cannot express: a maximum holder count, a jurisdiction-conditional transfer restriction, a lockup period, or on-chain identity attestation. Where none of these apply, the classic route will generally reach production sooner and with fewer dependencies. Four pathways are shown below for decision-making, but they are not four independent token types. A and B are two interaction paths for the same Stellar Asset; anyone can deploy the asset’s reserved SAC later, so native issuance does not close the smart-contract path. SEP-8 and custom SAC administration can be layered onto a Stellar Asset where needed. C is a general SEP-41 contract-token model, while D (SEP-57/T-REX) extends SEP-41 with a regulated-asset framework. See Assets Overview and Comparison for the maintained side-by-side comparison:
  • A. Stellar asset (account issued, G…). Behavior enforced at protocol level by the four issuer flags ( Authorization Required controls who may hold the asset; Authorization Revocable allows authorization to be withdrawn/frozen; Clawback Enabled permits eligible balances to be reclaimed; Authorization Immutable permanently restricts future changes to authorization settings), holders opt in through a trustline, no bespoke code. Fits payments, remittances, fiat-backed stablecoins, and any regulated instrument whose transfer rules are a static approve or reject decision. Broadest ecosystem support.
  • B. Stellar asset with the Stellar Asset Contract. The same asset as A, made callable from Soroban contracts through the protocol-maintained SAC, and automatically satisfying the SEP-41 interface. Fits any option A asset that also needs to be used inside smart contracts, for example as DeFi collateral. This is the default wherever composability was the only reason a contract token was being considered.
  • C. Contract token on the SEP-41 interface (C…). Balances in contract storage, no trustline, typically built on the audited OpenZeppelin fungible token. Fits Custom token behavior beyond SAC capabilities, without requiring the full SEP-57 identity and compliance framework: a transfer fee, a supply cap enforced in code, token factory logic. Support is secured through integration by integration.
  • D. Contract token on SEP-57 / T-REX. A permissioned security token, per SEP-57, with identity registry, trusted claim issuers and modular compliance. Reference implementation: the OpenZeppelin RWA token suite and RWA Wizard. Fits compliance rules the issuer flags cannot express: maximum holder count, jurisdiction-conditional restrictions, lockup periods, holding limits, on-chain identity attestation.

What each capability actually applies to

Capabilities are frequently described as properties of Stellar when they are properties of one architecture. The matrix below states, for each control, which option provides it and by what mechanism.
Notes: * Built-in order book and liquidity pools: Stellar includes protocol-level liquidity primitives: a shared decentralized order book (SDEX), liquidity pools for automated market making, and path payments that can route conversions through available order books and liquidity pools. Applications and wallets can access these shared liquidity venues without deploying a separate exchange contract, subject to the asset’s authorization and trustline requirements. See Liquidity on Stellar. ** Path payment. An operation in which the sender pays in one asset and the recipient receives another, with the conversion executed atomically through Stellar’s order books and/or liquidity pools. Path payments can route through multiple intermediary assets and are commonly used for cross-asset payments and settlement. See Path payments.

Section 2. Decisions that cannot be reversed after launch

Some Stellar Asset settings are non-retroactive, and some administration choices can permanently constrain future control paths. Treat the items below as a pre-launch checklist: document the intended holder model, issuer flags, SAC administration and migration path, then rehearse them on Testnet before Mainnet.

Clawback must be enabled before any trustline exists

On options A and B, the clawback-enabled flag applies only to trustlines created after the flag is set, and it requires authorization revocable to be enabled as well. That does not change an existing trustline. If settings and holder cooperation permit, a holder can empty and remove an existing trustline and recreate it after clawback is enabled. Otherwise, migration may require reissuance/token swap. Clawback should therefore be decided before distribution whenever it may be required. Separately, authorization immutable permanently locks the remaining flags and prevents the issuing account from being merged. See Control asset access and Clawbacks.

Migration between asset models is not a configuration change

Changing architecture after launch may require issuing a new asset, migrating every holder and executing a token swap or redemption and reissuance. Before architecture selection, obtain confirmation from the wallets, exchanges and custodians expected in the distribution chain that they support the exact Stellar Asset or contract-token model and required control flows. Network support for XLM does not imply support for a given asset, and support for Stellar assets does not imply support for contract tokens.

Section 3. The integration stack

Seven layers. Not every issuer requires every component. Section 4 sets out the requirements by asset type.

Layer 1. Asset and issuance

Layer 2. Keys, custody and account control

Layer 3. Custody and safekeeping

Layer 4. Compliance and identity

Layer 5. Data, oracles and attestation

Layer 6. Distribution and liquidity

Layer 7. Assurance and visibility

Section 4. Requirements by asset type

Requirements vary by jurisdiction and by the method of distribution. This table represents the starting position for a scoping discussion and does not constitute a compliance opinion. Issuer authority should be designed for the chosen architecture. Highly recommended, to be planned from the outset. Recommended, expected by most counterparties. Situational, dependent on distribution and jurisdiction. Rarely required. Note on issuer key controls. Multisig is not mandated by the Stellar protocol and a single master key is technically sufficient. What is required in practice is a deliberate key-control scheme for the accounts holding issuance authority. On the classic path this is implemented through weighted signers and operation thresholds at account level. On the contract token path, minting authority rests with the contract administrator, which may itself be an account or a further contract, and control is exercised through the contract’s administrator or role model.

Section 5. Reference documentation

The materials below constitute the recommended reading for an issuing partner’s technical and compliance teams. Specifications marked Draft may change and should be confirmed before development work is committed against them. Start here Issuance and asset controls Contract tokens Metadata, compliance and standards Infrastructure, data and tooling Distribution, security and onboarding Provider names are illustrative examples of firms with documented Stellar support as at November 2026. The lists are neither exhaustive nor an endorsement or recommendation, and support for the network does not guarantee support for a specific asset. Issuers should confirm directly with any provider that it will support the relevant asset code and establish the required trustline. This document does not constitute legal, regulatory or investment advice.