Programmable Native Assets: What Cardano's New Token Control Rules Mean for Decentralized Finance

The Cardano Foundation announced that CIP-0113, its programmable token standard, is live on Cardano mainnet, letting issuers of stablecoins, tokenised funds, bonds and other regulated assets embed KYC and AML checks, sanctions screening, transfer restrictions and freeze-and-seize powers into native assets that the ledger enforces on every transfer, mint and burn, with no hard fork required. Because Cardano's extended UTXO model allows several assets to sit in one output, a freeze on a CIP-0113 token can block the entire output and leave unrelated tokens and plain ADA inaccessible, even though neither is itself frozen. The Foundation's answer is a holder-driven process called unfracking that splits each policy into its own UTXO, and it requires both the holder's authorisation and the issuer's registered separation rules, which can demand an extra signature, impose script conditions, or refuse separation entirely. ADA itself cannot be frozen, and the controls apply only to tokens whose issuers adopt the standard. Switzerland's Capital Markets and Technology Association has recognised CIP-113 Programmable Asset Tokens as a smart contract equivalent to its CMTAT framework for certifying ledger-based equity securities. The architecture routes every spend through one of three delegate validators, holding execution costs flat regardless of input count. Cardano's entire DeFi ecosystem holds $69.12 million in total value locked, with Minswap at $18.05 million and Liqwid at $12.83 million.

 

 

Freezing a token is not new; Tether and Circle have both blacklisted addresses and frozen balances for years, and every holder of USDT or USDC already lives with that. What Cardano has built is different in kind: a ledger-level standard that any issuer can adopt, where the compliance rules travel with the asset and the network enforces them on every movement.

The Cardano Foundation put CIP-0113 on mainnet on October 6; Frederik Gregaard, the Foundation's chief executive, framed the design as compliance enforced by the network itself, and said the launch moves the conversation from what Cardano could do to what it does. Issuers of regulated assets can now write KYC checks, sanctions screening, transfer restrictions and seizure powers into a token that remains a native Cardano asset, visible to any wallet or explorer. The consequence that holders will feel first comes from Cardano's own ledger design. In the extended UTXO model, one output can carry several different assets at once, and a restriction on any one of them governs the whole output. A frozen compliance token sharing an output with unrelated tokens and plain ADA renders all of it unspendable until the holder separates them, and whether that separation is possible depends on rules the issuer wrote.

This article covers what the standard does, how it works on the ledger, the shared-output problem and the unfracking mechanism built to contain it, what freeze-capable collateral does to lending protocols and exchanges, what is genuinely new here against existing stablecoin blacklists, the Swiss recognition behind the institutional case, and the size of the ecosystem all of this has been built for.

 

 

 

The standard lets an issuer attach compliance logic to a token, and the Cardano ledger evaluates that logic on every transfer, mint and burn. The capabilities named at launch cover KYC and AML verification, sanctions screening, address whitelists and blacklists, transfer restrictions, and the administrative powers to freeze, unfreeze and forcibly transfer or seize holdings. Issuers choose from modular rule sets or write their own, and they can update those rules as regulation changes without altering the core standard. The target assets are stablecoins, tokenised funds, bonds and other regulated instruments, and the Foundation has said it plans a further securities module for regulated financial instruments.

Giovanni Gargiulo, a senior blockchain architect at the Foundation, described the central design property as the token remaining a native asset, so the surrounding ecosystem can work with it while the ledger checks the issuer's rules on every transaction. Eternl, GeroWallet, CardanoScan and BloxBean supported the launch. Phil di Sarro, chief executive of Anastasia Labs, worked on the Aiken implementation that reached mainnet. Two boundaries matter for anyone holding ADA. The standard required no hard fork, so nothing about the base protocol changed. And ADA itself cannot be frozen under it, because the controls apply only to tokens whose issuers deploy them.

 

The implementation is a set of Aiken smart contracts, migrated from an earlier Plutarch implementation of CIP-143, published by the Foundation under Apache 2.0. Programmable tokens are native Cardano assets held at a single shared script address, with ownership tracked through stake credentials so that standard wallets can still manage them. A registry, built as a sorted linked list of UTXOs marked with NFTs, records each registered token's policy ID alongside the script credentials governing its issuance, its transfers and third-party actions. Covering-node proofs let the system check registry membership in constant time.

When a token moves, the shared spending validator consults the registry, executes the token's transfer logic, and returns the tokens to the shared address under the new owner's stake credential. The base validator routes each spend to one of three delegate stake validators: transfer for ordinary movement, third_party for seizure, clawback and freeze enforcement, and unfracking for separating assets. Loading exactly one delegate per transaction is what keeps execution costs flat no matter how many inputs a transaction contains, which is the practical reason this design is usable at scale on an EUTXO chain. The freeze-and-seize substandard itself lives outside the core contracts as a stake validator in a separate platform repository, which is how the modularity is achieved.

 

Cardano's extended UTXO model permits a single output to hold multiple assets, so the standard's enforcement reaches past the token carrying it. A restricted CIP-0113 token sitting in the same output as an unrelated token and some ADA can block the entire output from being spent. The unrelated token and the ADA are never frozen in their own right, and they become inaccessible regardless, because the output cannot move while one asset inside it is restricted. A wallet balance can therefore overstate what a holder is actually able to spend, since value locked behind a blocked output still displays as held.

The issuer of the restricted token sets the rules that produce this outcome. The Foundation's position is that an issuer's control over its own asset confers no ownership of the other contents of an output, and the reference implementation is built to preserve unrelated balances during authorised third-party actions. That is a design intention, and how reliably it holds under adversarial conditions has not been demonstrated in production. Single-policy outputs, where each output holds one token policy and nothing else, are the construction the design prefers and the validator does not require them. Protection against the spillover therefore depends on how wallets and application developers choose to structure transactions, not on anything the protocol enforces.

 

The mechanism built to contain the spillover is called unfracking, and it is a holder-driven, same-owner process that restructures a holder's programmable token UTXOs so each policy ends up in its own output. It moves nothing between parties and involves no transfer logic, and the Foundation describes its purpose as containing the collateral damage of freezes.

The constraint sits in what unfracking requires. Separation needs both the holder's authorisation and the restricted token's registered separation rules, and those rules are written by the issuer. They can require an additional signature, attach further script conditions, or decline to permit separation at all. The holder therefore does not automatically control whether they can free their other assets from a blocked output. An issuer that has frozen its token can also have written separation rules that keep the output sealed, and in that configuration unrelated tokens and ADA stay immobilised for as long as the issuer chooses. Whether any issuer writes rules that restrictive is a question about commercial behaviour, and the standard permits it.

 

Freeze-capable collateral changes the risk calculation for every protocol that holds assets on a user's behalf. A lending market accepting a CIP-0113 token as collateral depends on being able to seize and sell that collateral when a position falls below its liquidation threshold. If the issuer freezes the token during a market decline, exactly when liquidations are needed most, the protocol may be unable to move the collateral at all. The position stays open and undersecured, the protocol carries the shortfall, and no amount of well-written liquidation logic helps, because the constraint is at the ledger and not in the contract.

Automated market makers face a related problem. A pool holding a restricted token can find that asset immobilised while the pool's other holdings sit in affected outputs, and liquidity providers who expected to withdraw at will discover the exit depends on an issuer's current rules.

The responses available to protocols are straightforward and each carries a cost. Segregating programmable tokens into single-policy outputs by default protects the rest of a user's balance and adds transaction complexity. Applying lower collateral factors to freeze-capable assets prices the risk and reduces capital efficiency. Tightening liquidation thresholds buys reaction time at the expense of borrower flexibility. Declining tokens whose freeze rules are uncertain is the cleanest answer and forfeits the institutional liquidity the standard was built to attract. None of these are established practice yet, because no regulated issuer has deployed at scale under the standard. The risk parameters that Cardano's lending markets eventually apply to these assets will be the first real measure of what the ecosystem thinks the freeze power is worth.

 

Circle can blacklist an address holding USDC and Tether can freeze USDT, and both have done so repeatedly at the request of law enforcement. Those are single-issuer tools implemented in each issuer's own contract, and a protocol integrating USDC accepts Circle's specific policy as a known quantity. CIP-0113 generalises the capability into protocol-level infrastructure available to any issuer, with the ledger performing the enforcement. The standard sets no universal authority over freezes and seizures, so each issuer's rules define who can act and under what conditions. A protocol integrating programmable tokens inherits a different counterparty risk from every issuer whose assets it accepts, and evaluating that risk means reading each token's registered rules individually. That is the substantive change for anyone building on Cardano. The question moves from whether a given stablecoin issuer might freeze an address to what powers each of a dozen issuers has written into assets a protocol holds, and whether those powers interact with the shared-output behaviour in ways that affect unrelated balances.

 

The credential behind the institutional pitch comes from Switzerland. The Capital Markets and Technology Association has recognised CIP-113 Programmable Asset Tokens as a smart contract equivalent to the CMTAT, the association's own token framework, for the purposes of its certification scheme.

The practical content of that recognition is specific; The tokens include the CMTAT's mandatory functions, and they may be used to certify compliance for ledger-based equity securities under Swiss law. The Foundation presents this as reducing the due diligence burden on issuers while keeping a chain-agnostic approach, and it is the sort of recognition that lets a Swiss issuer point to an existing framework instead of arguing a novel structure from first principles.

Gregaard's framing of the broader case is that regulators have been clear about what tokenised financial assets need, and the Foundation has cited work by the Bank for International Settlements and the International Monetary Fund identifying programmability as central to tokenised markets. The Foundation's announcement cites multiple independent security audits completed before launch. The implementation repository records an initial audit and a follow-up re-audit round with findings fixed on the main branch, and it does not name the auditors or publish the final report. The repository also carries production-readiness language of its own, noting that testing on the Preview testnet has been limited in scope and that existing wallets, explorers and decentralised exchanges would need integration work to support these tokens.

 

Cardano's entire DeFi sector holds $69.12 million in total value locked. Minswap leads at $18.05 million, up roughly 25% over thirty days, followed by Liqwid at $12.83 million, Dano Finance at $6.89 million, the Djed stablecoin at $6.23 million, SundaeSwap at $4.56 million, Indigo at $4.35 million, Surf Lending at $4.01 million and FluidTokens at $3.55 million. Stablecoins on the chain total $71.37 million, with USDC accounting for roughly 64% of that. Those are small numbers against the asset classes CIP-0113 targets. A tokenised bond programme or a regulated stablecoin of any size would arrive on a chain whose lending markets custody twelve million dollars, which means the integration risk runs in both directions: the DeFi protocols face freeze-capable collateral, and any serious institutional issuer faces liquidity venues that cannot absorb meaningful size. That is the strategic bet the Foundation has made. Building the compliance rails before the assets arrive is a defensible sequence, because an issuer evaluating chains in 2027 will choose one where the standard already exists and has been recognised by a European certification body, and the alternative is waiting for demand that never materialises because the rails were missing.

Four things will show whether it works. Whether any regulated issuer deploys at scale under the standard is the first and most decisive, and a reasonable test is whether one does so within two years, because without a live regulated issuer the freeze risks remain theoretical. Whether the Foundation publishes the final audit report and names the auditors is the second, since institutional issuers conduct their own diligence and will ask. How Cardano's lending markets set collateral parameters for programmable tokens is the third, as those numbers are the ecosystem's priced opinion of the freeze power. And whether wallets adopt single-policy outputs by default is the fourth, because that choice determines whether an ordinary holder ever discovers that a frozen token has taken their ADA along with it.

 

CIP-0113 is Cardano's programmable token standard, announced live on mainnet by the Cardano Foundation. It lets issuers of stablecoins, tokenised funds, bonds and other regulated assets embed compliance rules into native Cardano assets, with the ledger enforcing those rules on every transfer, mint and burn. Capabilities include KYC and AML checks, sanctions screening, address whitelists and blacklists, transfer restrictions, and powers to freeze, unfreeze and forcibly transfer or seize tokens.

ADA itself cannot be frozen under this standard, and the controls apply only to tokens whose issuers adopt it. ADA can still be caught indirectly: because Cardano's extended UTXO model lets one output hold several assets, a freeze on a CIP-0113 token in the same output blocks the whole output, leaving the ADA inside it unspendable until the assets are separated.

A holder-driven process that restructures a holder's programmable token UTXOs so each token policy sits in its own output, which the Foundation describes as containing the collateral damage of freezes. It transfers nothing between parties. It requires both the holder's authorisation and the restricted token's registered separation rules, and those issuer-written rules can demand an extra signature, impose script conditions, or block separation entirely.

No. The standard uses Cardano's existing native asset infrastructure and the extended UTXO model, implemented as Aiken smart contracts migrated from an earlier Plutarch implementation of CIP-143 and published under Apache 2.0. Nothing about the base protocol changed.

Programmable tokens live at a single shared script address with ownership tracked through stake credentials, and a registry built as a sorted linked list of NFT-marked UTXOs records each token's policy ID and its script credentials. A base validator routes every spend to exactly one of three delegate validators, handling transfers, third-party actions such as freeze and seizure, or unfracking. Loading one delegate per transaction holds execution costs flat regardless of how many inputs the transaction has.

Circle and Tether each implement blacklisting in their own contracts as single-issuer tools, so a protocol integrating USDC accepts one known policy. CIP-0113 makes the capability protocol-level infrastructure available to any issuer, enforced by the ledger, with no universal authority over who may freeze or seize. Each issuer writes its own rules, so a protocol holding several programmable tokens carries a different counterparty risk for each one.

Lending markets face the sharpest exposure, because a frozen token cannot be seized and sold to close an undersecured position, which can leave a protocol carrying the shortfall at precisely the moment liquidations are needed. Automated market makers face immobilised pool assets. Available responses include segregating programmable tokens into single-policy outputs, applying lower collateral factors, tightening liquidation thresholds, or declining tokens with uncertain freeze rules. None are established practice yet.

Switzerland's Capital Markets and Technology Association has recognised CIP-113 Programmable Asset Tokens as a smart contract equivalent to its own CMTAT framework for its certification scheme. The tokens include the CMTAT's mandatory functions and may be used to certify compliance for ledger-based equity securities, which lets a Swiss issuer rely on an established framework.