4.1 Protocols and Platforms
How to sort any RWA protocol or platform by the function it performs rather than the label it uses, how BlackRock's BUIDL with Securitize, Franklin Templeton's BENJI, Ondo Finance, Centrifuge, Maple Finance, and Figure actually operate, what the 2022 credit-protocol failures changed, and where tokenized products go once issued.
BlackRock calls BUIDL a fund. Securitize calls itself a platform. Centrifuge calls itself a protocol. Ondo uses all three words. These labels describe marketing position, not function, and a reader who sorts protocols by self-description ends up comparing incomparable things. This section sorts by function.
Four operating models cover nearly everything live today. Regulated fund issuers put units of an existing fund on-chain and earn its management fee; BlackRock's BUIDL and Franklin Templeton's BENJI anchor this model. Tokenization platforms rent issuers the transfer agency, compliance, and multichain infrastructure they need, without managing the assets; Securitize is the clearest example. On-chain credit protocols pool stablecoins from DeFi lenders and route them to borrowers whose underwriting is delegated to a third party; Maple runs this today, Centrifuge ran it in its first years. Wrappers and distributors hold or reference someone else's product and repackage it for a different audience; Ondo is the clearest example. Figure, an originator that built its own ledger rather than renting one, fits none of the four cleanly and is profiled as the outlier.
This section covers who builds and operates these products and how each model works. Section 4.2 takes up the chains they chose. Section 4.3 covers the generic roles (issuers, custodians, SPVs, investors) recurring across every product here. Section 4.4 covers stablecoin settlement. Section 4.5 aggregates the market-wide numbers this section avoids summing.
This section takes no position on which protocol a reader should use. It applies, rather than repeats, Section 2.1's five-question test and Section 2.4's dependency chain to each protocol below.
Four Operating Models
Sorting a protocol by what it does, not what it calls itself, means asking who underwrites the asset, who keeps the authoritative record, and how the operator earns.
Regulated fund issuers put units of an existing fund on-chain; the token is a fund share. The asset manager underwrites the portfolio; custody, administration, and transfer agency sit with named providers; the register is usually off-chain-authoritative, per Section 2.1. Revenue is the management fee: BUIDL and BENJI anchor this category, the SEC staff's "issuer-sponsored" model1.
Tokenization platforms are infrastructure rented by issuers, not managers of the assets: transfer agency, broker-dealer and ATS licenses, compliance standards, multichain issuance, for a platform fee. Securitize, Centrifuge in its current form, and Franklin's own Benji Technology Platform fit here; a firm can occupy this model and the fund-issuer model at once, as Franklin Templeton does.
On-chain credit protocols are lending pools where stablecoin holders fund loans and a delegate or originator underwrites them; the token is a pool share over a loan book. Centrifuge's Tinlake pools ran this model in the protocol's early years, Maple runs it today, and Goldfinch ran it until winding down in June 20262. Where the collateral is crypto rather than a real-world asset, as in most of Maple's book, the real-world element is the borrower's obligation, not the collateral.
Wrappers and distributors neither manage nor originate the underlying asset; they structure a note or synthetic token over someone else's product for a different audience: Ondo's OUSG and USDY, Backed's xStocks, the SEC staff's "third-party-sponsored" model, split into custodial and synthetic structures1.
| Model | What the token represents | Who underwrites the underlying | Authoritative record | Typical holder | How the operator earns | Examples |
|---|---|---|---|---|---|---|
| Regulated fund issuer | Fund share | Asset manager | Off-chain fund register | Qualified purchaser | Management fee | BUIDL, BENJI |
| Tokenization platform | Infrastructure, not a claim | N/A | Platform transfer agency | Issuers renting it | Platform fee | Securitize, Benji Technology Platform |
| On-chain credit protocol | Pool share over a loan book | Delegate or originator | Contract plus originator records | Stablecoin lender | Protocol fee | Maple, Centrifuge (2020-23) |
| Wrapper or distributor | Note or synthetic token | The underlying issuer | Wrapper's off-chain register | Retail or non-US investor | Spread or fee | Ondo, xStocks |
The diagram reads top to bottom as the path a claim travels, not as the flow of money. A regulated issuer places the underlying asset in a fund, a tokenization platform puts the fund's shares on-chain, the token lives on one or more chains, a wrapper may repackage it for a different audience, and a venue is where it is finally traded, lent, or posted as collateral. BUIDL has taken every step: issued by BlackRock, operated on Securitize, held inside Ondo's OUSG, accepted as collateral at Binance, and traded on UniswapX. On-chain credit protocols sit on their own path because their real-world element is the borrower's obligation rather than a tokenized asset: loans flow into a pool and stablecoin lenders hold shares of it. Navy marks the infrastructure layers, green the product and market actors, and red the venue layer where permissions and counterparty exposure concentrate. The layering simplifies. A firm can occupy two layers at once, as Franklin Templeton does as both issuer and platform, and wrappers are issuers on chains in their own right. Each hop down the spine adds a party to the dependency chain in Section 2.4.
The Anchors
Six entities anchor this section: the two regulated funds that set the template, the platform-and-wrapper combination that moved fastest, the protocol that changed its risk model, the credit marketplace that survived its own blowup, and the originator built outside the DeFi stack. Each profile covers what the product is and when it started, its named roles, what the token represents and who may hold it, its scale as of a stated date, and a short application of the Section 2.1 test. None is a recommendation.
BlackRock BUIDL and Securitize: The Institutional Template
BUIDL launched on Ethereum on 20 March 2024 through Securitize. BNY Mellon is custodian and administrator; Securitize is transfer agent and tokenization platform; Securitize Markets is placement agent. The fund invests 100% of assets in cash, Treasury bills, and repo, targets a stable $1 token value, and accrues dividends daily, paid monthly as new tokens3. Only qualified purchasers may hold it, at a $5 million minimum and $250,000 minimum redemption; fees run 0.20% to 0.50% by share class4.
BUIDL now runs on more than eight networks, with a BNB Chain share class added in November 20255; Solana carried the largest single-network share of supply on 16 September 2026, a pattern Section 4.2 takes up4.
BUIDL's clearest evidence of institutional weight is where it is accepted, not the mint itself. Binance takes it as off-exchange collateral through tri-party banks and its custody partner Ceffu, from 14 November 20255, and since 11 February 2026 pre-qualified holders can trade it on UniswapX through whitelisted market makers, with BlackRock itself invested in the Uniswap ecosystem6.
Scale, dated: $2.68 billion and 107 holders on 16 September 2026 per rwa.xyz4, the largest tokenized Treasury product on the tracker's ranking that day7.
Securitize is now public. It began trading on the NYSE as SECZ on 2 July 2026 with, by its own account, more than $4 billion of assets brought on-chain and regulated US affiliates spanning a broker-dealer and ATS, a transfer agent, an exempt reporting adviser, and a fund administrator8. rwa.xyz ranked it the largest distributed platform on 16 September 2026, at $4.95 billion, about 14% of the distributed total9.
Applying the Section 2.1 test: the asset is fund shares over cash, bills, and repo; the claim is the fund's governing documents; the register is Securitize's transfer-agent record, with the chain as transfer and distribution layer; transferability extends to a widening set of whitelisted counterparties, 24/7. BUIDL shows that tokenization changed distribution and recordkeeping for an existing money-market product; the evidence is collateral acceptance and Securitize's own listing, not the mint's size. Section 2.3 walks the BUIDL lifecycle; this profile does not repeat it.
Franklin Templeton BENJI: The Registered Fund That Reached Retail
FOBXX, marketed on-chain as BENJI, launched on Stellar in 2021, described by Franklin and the Stellar Development Foundation as the first US-registered mutual fund to use a public blockchain as its official system of record10. Franklin's own summary prospectus settles the register question: "The Fund's transfer agent maintains the official record of share ownership via a proprietary blockchain-integrated system that utilizes features of traditional book-entry form and one or more public blockchain networks"11. The minimum is $20, at least 99.5% of assets sit in government securities and repo, expenses run 0.20% after waiver, and investors onboard through the Benji app11. The Benji Technology Platform is Franklin's own recordkeeping and transfer-agency stack10.
A separate institutional fund, iBENJI, held $1.70 billion and the retail token $677.57 million on rwa.xyz's 16 September 2026 ranking7; the combined suite reached $1.98 billion in April 2026, with cumulative peer-to-peer transfers above $211 million10.
Franklin is issuer and platform at once, where BlackRock rented Securitize. The two funds share an asset class and run opposite distribution models: a $20-minimum retail product against BUIDL's $5 million minimum and 107 holders.
Applying the Section 2.1 test: the asset is registered fund shares; the claim is the prospectus; the register is, by its own wording above, the transfer agent's blockchain-integrated system; transferability runs peer-to-peer between onboarded holders.
Ondo Finance: The Wrapper and Distribution Model
OUSG launched in January 2023 as a tokenized fund holding other issuers' tokenized money market funds rather than Treasuries directly12. As of 15 September 2026 its largest holding was State Street's Galaxy Sweep fund at 45.68%, then BUIDL at 30.74% and BENJI at 12.38%13. Eligibility requires accredited-investor and qualified-purchaser status, with a $5,000 minimum settled instantly in USDC against BUIDL's liquidity and Circle's standing bid1312. Ondo valued it at $330.70 million on 16 September 202613.
USDY is structured differently: debt issued by a bankruptcy-remote entity, secured by short-term Treasuries and bank deposits, with daily and monthly attestation reports and Ankura Trust and StoneX named for third-party oversight, offered to non-US individuals and organizations only14. It held $2.24 billion on 16 September 2026, Ondo's largest product and the third-largest tokenized Treasury product on rwa.xyz's ranking147.
Ondo Global Markets, now branded Ondo Stocks, is the largest tokenized-stock platform on rwa.xyz, at $837.4 million across 395 assets on 16 September 202615.
Ondo Chain, the permissioned layer 1 Ondo had announced, never launched. On 27 July 2026 Ondo replaced the plan with the enclave-based "Ondo Network"; its own announcement states "achieving our objectives doesn't require us to build a chain in the traditional sense at all"16.
Ondo manages none of the Treasuries inside OUSG and originates no credit. Its product is the wrapper, sorted by investor eligibility. Applying the Section 2.1 test to USDY: the asset is short-term Treasuries and deposits; the claim is the note against a bankruptcy-remote issuer; the register sits off-chain with the issuer and its oversight agents; transferability is restricted to non-US persons. OUSG differs in kind: fund shares in other funds, one layer further from the Treasuries than USDY's direct note. The token taxonomy paper's Section 7.5 covers Ondo's DeFi role further.
Centrifuge: From DeFi Credit Pools to Fund Infrastructure
Centrifuge's early Tinlake pools split each pool into a senior DROP tranche and a junior first-loss tranche, and MakerDAO funded several of them, including vaults for New Silver, ConsolFreight, Harbor Trade, Fortunafi, and BlockTower Credit17.
The pool era produced real losses. Harbor Trade's sole borrower defaulted in April 2023 on $2.1 million, the only asset behind Maker's $1.6 million senior position, leaving that position in a court-supervised workout that was still open in May 202418; Maker cut the pool's debt ceiling to zero that July17. ConsolFreight's largest borrower defaulted in August 2023 with Maker exposed for about 1.8 million DAI; Centrifuge's on-chain remedy was to pause the pool while Maker wound the vault down, and Fortunafi was put up for offboarding the same month after failing its covenants17.
Centrifuge rebuilt around that experience as a multi-chain EVM protocol. Its documentation describes a hub-and-spoke design in which one hub chain handles accounting, pricing, and investment requests while spoke chains tokenize and distribute, with ERC-20 share tokens, ERC-4626 synchronous vaults, and ERC-7540 asynchronous vaults, backed by "24+ security reviews" and live on 11 blockchains19.
Fund infrastructure is now the business. Janus Henderson's tokenized Treasury fund, JTRSY, issued through Centrifuge, held $710.8 million on 16 September 20267; JAAA, the tokenized Janus Henderson Anemoy AAA CLO fund, held $725.67 million across 36 holders on eight chains the same day, five months after its May 2025 inception20.
Distribution runs through DeFi too: JTRSY and JAAA were launch collateral on Aave Horizon on 26 August 202521. rwa.xyz put the Centrifuge platform at $1.53 billion on 16 September 20269.
The operating model migrated rather than merely grew. In its first years, Centrifuge was an originator marketplace: originators underwrote credit, DeFi lenders bore the risk, and several pools failed. Today, Centrifuge is infrastructure for regulated asset managers issuing fund shares: Janus Henderson runs the portfolios, Anemoy is the issuer, Centrifuge supplies the vaults and distribution. Applying the Section 2.1 test to a JTRSY or JAAA token: a fund share, governed by fund documents, transfer-restricted. A Tinlake DROP token was different: an SPV note over receivables, underwritten by the originator. The name stayed the same. The risk did not.
Maple Finance: Institutional Credit With Crypto Collateral
Maple was founded in 201922 and built its first years on undercollateralized loans to crypto-native trading firms, underwritten by third-party pool delegates23.
Late 2022 broke that model after Orthogonal Trading's default. CoinDesk tallied $36 million defaulted plus $18 million distressed, 66% of outstanding loans across Maple's four pools, with pool cover "mostly ... depleted" and active loans down from about $900 million in May 2022 to $82 million by December; the $54 million figure is defaulted-plus-distressed, not a realized loss23.
Maple then added a Treasury-bill Cash Management pool that lends to a single Room40 Capital SPV against T-bills and reverse repo24, and in September 2023 pivoted to secured lending with qualified custodians, restarting from about $15 million of TVL25. Today's book is described on Maple's own pool page as "Overcollateralized loans to institutional borrowers, transparently backed by liquid digital assets, held in qualified custody": collateral is "BTC, ETH and top alt-coins", lending is "strictly overcollateralized", and the Institutional pool's collateral ratio stood at 145.8% with loan-to-value at 68.60% on 16 September 2026; posted collateral may itself be staked26.
Maple reported $4.58 billion of assets under management and $25.52 billion borrowed since inception as of 16 September 202622.
Applying the Section 2.1 test honestly matters more here than anywhere else. Today's Maple lends to institutional borrowers against crypto collateral held by custodians; the enforceable element is the loan agreement, and the collateral is not a real-world asset. The Cash Management pool is the one clean real-world-asset line. rwa.xyz files Maple under tokenized credit at $986 million on 16 September 2026, a fraction of its own AUM figure9. Most of Maple today is on-chain credit to real-world institutions rather than tokenization of a real-world asset, carrying collateral volatility and liquidation risk rather than servicer and legal-title risk.
Figure and Provenance: The Asset-Backed Outlier
Figure originates home equity lines of credit and records them on Provenance Blockchain, described in its SEC filings as "an independent Layer 1 blockchain" that is "public and permissionless," with HASH as its gas token27. rwa.xyz classifies the Figure HELOC token as a Represented asset, a recordkeeping layer without on-chain investor transfer28, and lists Figure as the second-largest Represented platform after Broadridge's repo ledger, at $22.56 billion on 16 September 20269. What sits on-chain is wallet, balance, and ownership data, plus the DART lien and eNote registry that handled 91% of Figure's Q3 2025 originations; personal data stays off-chain27. Figure's IPO closed on 12 September 2025 at $25.00 a share and it trades on Nasdaq as FIGR27; Figure and its partners had originated "over $30 billion" of loans by August 2026, and its yield-bearing security YLDS had about $556 million in circulation at 30 June 202629.
Applying the Section 2.1 test: the asset is home equity lines of credit originated by Figure and its partners; the holder's claim is defined by Figure's loan documents and the DART lien and eNote registry, whose records participants recognize by assenting to uniform DART Participation Rules27. The register is Provenance, with DART transaction and ownership data on-chain and personal information and county lien filings off-chain27. Transferability follows the Represented classification above: no on-chain investor transfer, with liquidity instead running through Figure's own marketplace and weekly bid-wanted-in-competition auctions rather than DeFi venues2728.
Figure is an originator that built its own ledger rather than an asset manager renting a public chain, and it is the largest single tokenized credit asset by value on rwa.xyz9. That size and the chain's limited connection to DeFi point in different directions; rwa.xyz's own framework describes Figure as "working to make its broader portfolio of tokenized assets compatible with DeFi protocols"28. Section 4.2 takes up why chain choice matters this much. Section 1.2 and Section 2.1 already introduced the HELOC token; this profile updates its scale rather than re-explaining what a HELOC is.
The Rest of the Field
The six anchors do not exhaust the field. Circle's USYC is the second-largest tokenized Treasury product at $2.60 billion7. Bank-led rails carry the largest tokenized volumes anywhere: rwa.xyz's Represented ranking is led by Broadridge's Distributed Ledger Repo at $323.77 billion, ahead of Figure9, and JPMorgan's Kinexys Digital Assets appears among distributed platforms with a tokenized money market fund, JLTXX, at $810 million7. Sections 4.2 and 4.3 take up those rails in depth.
| Name | Model | Product | Scale and date |
|---|---|---|---|
| Circle USYC | 1 | Tokenized money market fund | $2.60B, 16 Sep 20267 |
| WisdomTree WTGXX | 1 | Tokenized Treasury money market fund | $1.23B, 16 Sep 20267 |
| JPMorgan JLTXX | 1 | Tokenized fund on Kinexys Digital Assets | $810M, 16 Sep 20267 |
| Superstate USTB | 1 | Short-duration government securities fund | $566.6M, 16 Sep 20267 |
| Apollo ACRED | 1 | Private credit fund usable as Morpho collateral | n/a30 |
| Backed xStocks | 4 | Tokenized stocks and ETFs | $344.0M, 16 Sep 202615 |
Where the Tokens Go: DeFi Venues and Exchange Collateral
Morpho hosts Apollo's ACRED as collateral in dedicated lending markets, the case Section 1.2 introduced30. Aave Horizon, launched 26 August 2025, lets qualified institutions post Superstate's USTB and USCC and Centrifuge's JTRSY and JAAA as collateral and borrow RLUSD, USDC, or GHO from anyone supplying it, with each issuer setting its own eligibility rules21.
Exchange collateral works the same way in each case: the token stays with a tri-party bank or custodian and only its value is mirrored on the exchange, as with Binance's acceptance of BUIDL in November 20255. BUIDL began trading on UniswapX through whitelisted market makers in February 20266.
Distribution is where the collateral mobility Section 2.3 describes becomes real, and every venue adds a party to Section 2.4's dependency chain. The cash leg is a stablecoin or tokenized deposit (Section 4.4); secondary liquidity outside these venues remains thin (Section 5.4).
What the Failures Teach
Maple, late 2022: $36 million defaulted and $18 million more distressed, 66% of outstanding loans, after uncollateralized lending to trading firms through pool delegates, with pool cover depleted23. Its survival strategy was to change model, to overcollateralized crypto-backed loans and a separate Treasury pool252624.
Centrifuge's Tinlake era, 2023: Harbor Trade's borrower defaulted on $2.1 million, putting Maker's $1.6 million senior position into a court-supervised workout that was still open in May 202418; ConsolFreight's largest borrower defaulted with Maker exposed for about 1.8 million DAI, and the pool was paused and wound down17. Its survival strategy, like Maple's, was to change model, toward fund shares managed by regulated asset managers207.
Goldfinch, 2021-2026, did not survive. Its legacy borrower pools remain in recovery, a 2025 pivot to Goldfinch Prime did not save it, and it wound Prime down in June 2026 because Prime "has not achieved the level of adoption needed," redeeming Prime investors in full; the original protocol had enabled about $100 million of loans in its lifetime2.
The pattern repeats: every loss came from undercollateralized lending to borrowers the lenders could not audit, underwritten by a delegated third party, with the protocol standing outside the eventual workout. The protocols that survived changed model, toward Treasuries, overcollateralization, and regulated fund shares; the one that did not is gone. Credit risk did not disappear on-chain; it moved to whoever chose the borrowers. Neither surviving model has faced a stress of its own: Maple's secured book dates only from its 2023 pivot25, and JAAA launched in May 202520. Section 5.3 takes up counterparty and credit risk directly.
How to Read Any Protocol
The six profiles above cover six entities. The market has dozens more, and new ones launch every month. The same five questions apply to any of them.
- Which operating model is it? Fund issuer, platform, credit protocol, or wrapper, per the four categories above, before any marketing language does.
- Who underwrites the underlying asset? A named asset manager, a pool delegate, an originator, or nobody, because the "asset" is a claim on the protocol's own counterparties.
- Who keeps the authoritative register? Section 2.1's source-of-truth question: an off-chain transfer agent or fund administrator, or the chain itself.
- Who may hold the token, and where can it travel? Qualified purchasers only, non-US persons only, or anyone, per the distributed-versus-represented distinction.
- What happens on redemption or default stress? A defined process with a named collateral agent, or an untested promise, per Section 2.4's dependency chain.
A protocol that answers all five clearly is not automatically safe. A reader who has not asked all five has not evaluated the protocol; they have read its homepage.
Bridge to Section 4.2
Every protocol profiled above made a chain choice, and none were accidental. BlackRock chose Ethereum first for BUIDL; Franklin Templeton chose Stellar first for BENJI; Centrifuge chose a multi-chain EVM design; Figure built Provenance rather than renting anyone else's ledger. Each choice decided who could reach the token on day one. Section 4.2 takes up why, and why so many protocols above ended up multichain.
- Sort any RWA protocol by function, not label. Four operating models cover nearly the whole market: regulated fund issuers (BUIDL, BENJI), tokenization platforms (Securitize), on-chain credit protocols (Maple), and wrappers (Ondo). Most tokens pass through more than one model on the way to a holder.
- BUIDL and BENJI are fund shares whose value shows up in where they are accepted, not just in AUM. BUIDL is off-exchange collateral at Binance and trades on UniswapX; BENJI is the retail-reachable registered fund with its official share register kept on a blockchain-integrated system.
- Ondo manages nothing and originates no credit. Its business is the wrapper, sorted by investor eligibility, one layer further from the underlying Treasuries than the funds it holds.
- Centrifuge's model migrated from an originator marketplace bearing real credit losses (2020-2023) to infrastructure for regulated asset managers issuing fund shares (2024 on). Maple survived a similar crisis by moving to overcollateralized crypto-backed lending; most of its book today is on-chain credit to institutions, not tokenization of a real-world asset.
- Every failure in this section shares one pattern: undercollateralized lending to borrowers the lenders could not audit, underwritten by a delegated third party, with the protocol outside the eventual workout. The models that survived changed shape; neither has yet faced a stress test of its own.