A secondary transfer of a tokenized security is not a simple event. From the issuer's compliance perspective, a single transfer can trigger obligations in multiple states simultaneously: the state where the selling investor is domiciled, the state where the receiving investor is domiciled, the state under which the issuer is organized, and potentially the state where any intermediary facilitating the transfer maintains its principal place of business. Most issuers have mapped the federal requirements for secondary transfers. Fewer have mapped all of the state-level requirements that attach to each transfer in their specific investor population.
This checklist is designed for a compliance team that needs to audit its existing secondary transfer monitoring workflow against the state-level requirements that are most commonly missed. It is not an exhaustive survey of all 50 states. It is a structured review of the steps that separate a defensible transfer record from a problematic one.
Pre-Transfer Compliance Review
Before any secondary transfer of a tokenized security is approved, your compliance workflow should generate answers to the following questions:
Has the applicable holding period been satisfied? For a Reg D offering, the federal minimum under Rule 144 is one year from the date of the original purchase (or six months for reporting company issuers). The record should show the original purchase date, the calculation of the holding period, and any adjustments for tacking. If the holding period has not run, the transfer cannot proceed without registration or a separate exemption.
Has the receiving investor been verified as accredited? For 506(c) offerings, this means current verification, not a carry-forward of the original investor's status from the primary offering. The verification must meet the reasonable steps standard under Rule 506(c), which means documentation, not self-certification alone. If the offering is 506(b), the basis for believing the receiving investor qualifies needs to be documented, even if self-certification is acceptable.
Has the receiving investor received current offering disclosure? An investor who did not participate in the original offering needs to receive the same disclosure that primary investors received, updated to reflect any material changes. This obligation is commonly overlooked in secondary transfer workflows that treat the transfer as a purely administrative transaction rather than a re-offering to a new investor.
State-Level Notice Filing Requirements
Seventeen states require some form of notice filing or registration qualification for secondary resales of restricted securities that occur within their borders. The specific requirements vary, but the categories are consistent:
States requiring issuer or transfer agent notice filings for secondary resales. In these states, the issuer or its transfer agent must file a notice with the state securities administrator before or within a specified number of days of the transfer. The required form, fee schedule, and timing vary by state. This category currently includes several of the highest-volume investor states, meaning that a program with investors in these states will regularly encounter this filing requirement.
States requiring compliance with specific resale exemption conditions. Several states have codified resale exemptions that impose conditions beyond the federal Rule 144 requirements. An issuer whose transfer restriction program relies solely on federal compliance as the gating condition for secondary transfers may be approving transfers that do not satisfy the applicable state resale exemption. The consequence is an unregistered secondary offering in that state.
States that have adopted the Uniform Securities Act with specific secondary market provisions. Most states have adopted some version of the Uniform Securities Act. The specific provisions relating to secondary market resales vary materially between the 1956 Act, the 1985 Act, and the 2002 Act, and states have made non-uniform amendments that further complicate the analysis. A compliance program that assumes uniform treatment across Uniform Securities Act states has a gap worth closing.
Transfer Agent Instruction Requirements
Your transfer agent needs a written instruction for each secondary transfer. That instruction should document the basis for the transfer's compliance, including the exemptions relied upon at the federal and state level, the documentation reviewed, and the compliance conclusion. For tokenized securities, the transfer agent instruction needs to correspond to the on-chain transfer event in a way that creates a traceable record connecting the two.
The most common deficiency we find in secondary transfer documentation is not a missing transfer agent instruction. It is a transfer agent instruction that references the federal exemption but does not address the state-level compliance basis. When an examination request arrives and the examiner asks for the compliance basis for a specific transfer in Texas or California, "Rule 144 holding period satisfied" is a partial answer. The complete answer includes the state-level resale exemption applied and the documentation reviewed to confirm that the conditions are satisfied.
Smart Contract Transfer Restriction Verification
If your tokenized securities program uses a smart contract with embedded transfer restriction logic, your secondary transfer compliance workflow needs to verify that the on-chain restriction is consistent with the current legal compliance determination before the transfer is approved. Two specific checks should be part of every transfer review:
First, confirm that the smart contract's transfer conditions match the current legal requirements. Smart contract code does not automatically update when securities law changes. If the transfer restriction logic was written against a specific set of state requirements that have since been amended, the on-chain check may pass even though a legally required condition is no longer met.
Second, confirm that any manual override capability in the smart contract has not been used to facilitate transfers outside the documented compliance workflow. The compliance record should be able to account for every transfer event on-chain, including any that occurred through administrative or override functions.
Post-Transfer Record Maintenance
The secondary transfer compliance record is not complete at the moment the transfer is approved. Several post-transfer obligations attach:
Update the cap table and investor registry. The receiving investor's information, verification status, and current accreditation documentation need to be incorporated into the issuer's investor registry. For future secondary transfers initiated by this investor, the registry record is the starting point for the re-verification workflow.
Track state notice filing deadlines. For states with post-transfer notice filing requirements, the deadline for filing runs from the transfer date. In some states, a late filing creates its own compliance issue separate from the underlying transfer's compliance status. A calendar reminder attached to the transfer record is not a sufficient tracking system at any real volume. The tracking needs to be systematic and automated to be reliable.
Maintain the verification documentation for the retention period. State securities administrators and the SEC can request records going back five to seven years depending on the applicable retention obligation. The documents that supported the transfer's compliance determination need to be in a retrievable format throughout that period, not just in the immediate aftermath of the transfer.
Workflow Audit Triggers
We recommend that compliance teams conduct a structured audit of their secondary transfer monitoring workflow at two specific trigger points, in addition to any regular review cadence: when the investor registry expands to include investors in a new state not previously covered, and when a state updates its notice filing requirements or resale exemption conditions. Both events can change the compliance requirements for future transfers without any action by the issuer, and both are commonly discovered only when a transfer is pending rather than in advance.
A program that checks its state requirement mapping at intake of new investors, rather than only when a transfer is requested, is in a better position to manage the operational workload. The surprise that a California investor's transfer requires a specific notice filing is more manageable when discovered at investor onboarding than when the investor is under a time constraint to close a transfer.