Token-2022 (Token Extensions) is the Solana token program that adds optional features to a token, such as freezing new accounts, running a program on every transfer or recovering balances. With them you can reproduce much of ERC-3643, but not its investor identity registry: you build that separately.
This guide is for issuers and technical teams preparing a tokenized security on Solana. It covers each useful extension, what it does for compliance (KYC, freezing, recovery under a court order, dividends), how it compares with ERC-3643 and what is left out. Extensions are tools: the obligations come from the rules that govern the asset, which for a security means MiFID II and, in Spain, Law 6/2023 and its ERIR. No extension makes a token compliant on its own. The full issuance process is in how to tokenize real-world assets on Solana. If you are looking for the service, see our Solana development page.
What Token-2022 is and how it differs from the original SPL program
On Solana a token is not its own contract: it is a "mint" account of a token program that is already deployed. There are two main token programs, the original one and Token Extensions (Token-2022). The second adds optional features, called extensions, to the mint or to each holder's account (extensions documentation).
Three rules shape the whole design:
- They are chosen when the account is created. The documentation says most extensions cannot be added after initialization. A token already issued without the extension you need means issuing a new one.
- Some combinations are not allowed. For example, Scaled UI Amount cannot be combined with Interest-Bearing: the program rejects that combination when the mint is initialized.
- Regulated assets build on Token-2022. The official solana.com tokenization guide, with its delivery-versus-payment and fund NAV examples, is built on this program and its extensions.
The extensions that matter for a tokenized security
| Extension | What it does, per the documentation | What it is for in compliance |
|---|---|---|
| Default Account State | New accounts start frozen and cannot be used until the freeze authority thaws them | Onboarding investors only after KYC |
| Transfer Hook | Runs a custom program on every transfer; the documentation cites allowlists and blocklists of recipients | Transfer restrictions: investor lists, blocking sanctioned wallets, custom limits |
| Permanent Delegate | Authorizes transfers and burns from any account of the token; holders cannot revoke it | Executing a court order, recovering tokens after fraud or lost keys, reflecting an encumbrance |
| Pausable | Pauses transfers, mints and burns for the whole token | Trading suspension or a security incident |
| Freeze authority (base program) | Freezes a specific token account | Blocking an investor's wallet on an authority's order or for KYC reasons |
| Metadata Pointer and Token Metadata | Stores metadata on the mint itself, with additional fields | Linking the issue document; the official NAV guide stores net asset value there |
| Scaled UI Amount | Updatable multiplier for the displayed amount; creates no tokens | Stock splits, dividends or yield |
| Interest-Bearing | Stores an annual interest rate on the mint; only the displayed amount changes | Showing accrual on an interest-bearing instrument |
| Confidential Balances | Hides amounts and balances, not addresses; supports an auditor key | Confidentiality toward the public, with visibility for an auditor named by the issuer |
Account freezing is not an extension: the freeze authority already exists in the base program, and the solana.com guide to ERC-3643 presents it as a native feature that acts without contract logic.
KYC and investor lists: Default Account State, transfer hook and Token ACL
There are three documented ways to control who can hold the token:
- Default Account State. Every new account starts frozen, and the freeze authority thaws it once the investor passes KYC. It is simple and adds no logic to transfers, but onboarding is manual.
- Transfer Hook. The token calls your program on every transfer, and the whole operation reverts if the program returns an error. It has one limit: the transfer's accounts reach your program as read-only and without the sender's signature. It is a custom program, so it needs an audit and a policy on its upgrade authority.
- Token ACL (sRFC 37). The mint delegates its freeze authority to Token ACL, and investors thaw their own accounts if a "gate program" approves. The reference program supports an allowlist, a blocklist or both, and the blocklist takes precedence. You can write your own gate program, for example one integrated with an on-chain identity or KYC protocol.
The Token ACL documentation compares the last two: Token ACL only acts on freeze and thaw and leaves transfers standard; a hook acts on every transfer, costs compute and extra accounts, and "many protocols blacklist" such tokens in DeFi. They can be combined: Token ACL for who can hold the token, a hook for how it moves. As of October 16, 2026, the Token ACL program and its reference gate are already deployed on mainnet: the official repository, which publishes its audits, says so, and our own query to the public mainnet RPC on that date confirms it. One section of the documentation still says they are only on devnet.
Freezing, pausing and the permanent delegate: the issuer's powers
- Freezing an account. The freeze authority blocks a specific investor's account. It is the direct equivalent of freezing a wallet under ERC-3643.
- Pausing the token. With Pausable, the program rejects transfers, mints and burns for the whole mint until it is resumed.
- Permanent delegate. It can transfer or burn from any account of the token, holders cannot revoke it, and the delegate itself can hand the role to another key later. The solana.com guide to ERC-3643 presents it as the way to "comply with legal orders or reclaim tokens during fraud mitigation." For a Spanish security, it is the tool that keeps the on-chain register in line with what the ERIR records, since the ERIR handles corporate events, entries and encumbrances (art. 8.4 of Law 6/2023).
These powers cut both ways. For the issuer they are a compliance function; for the investor, a counterparty risk: someone can move or burn their balance. That is why they must be disclosed in the issuance documents, stating who holds each key and when it is used. The solana.com guide places the compliance admin in a PDA or in a multisig that owns the mint, not in a single key.
Dividends, coupons and corporate actions
Scaled UI Amount applies a multiplier to the amount wallets display. The documentation frames it for real-world assets, such as a stock split or a dividend, and also for distributing yield. The multiplier can change immediately or be scheduled for a future time. It creates no tokens: the balance stored in each account stays the same, and only the displayed amount changes.
Interest-Bearing stores an annual interest rate on the mint and also changes only what is displayed. The two extensions are incompatible with each other, so you have to choose before issuing.
A practical point: neither of them pays anything. A coupon in euros or in a stablecoin is a separate payment, and the ERIR's register has to reflect the event. Also, the official delivery-versus-payment guide warns that the DvP program maintained by the Solana Foundation rejects mints with Scaled UI Amount; for those mints it suggests the delegation pattern.
Confidential transfers: what they hide and what happened in 2025 and 2026
Confidential Balances encrypts amounts and balances, but addresses remain public. The mint can store a global auditor key: whoever holds it can decrypt transfer amounts for that token. The Solana Foundation says address hiding is in development.
The history matters for a risk committee:
- June 11, 2025: the Token-2022 program was updated to disable confidential transfers after a responsibly disclosed bug (the Foundation's post-mortem).
- June 19, 2025: the ZK ElGamal proof program they depend on was disabled on mainnet at the start of epoch 805.
- June 4, 2026: the feature that turns it back on ("Re-enables zk-elgamal-proof program") activated on mainnet at the start of epoch 982. This comes from our own query to the public mainnet RPC on October 16, 2026.
- June 17, 2026: version 11.0.0 of the Token-2022 program was deployed on mainnet; its release notes say it re-enables confidential transfers. We checked this in the same query: the date of the last deployment and the binary hash.
- Today: the Foundation presents it as live on mainnet and enabled "when a token is created." Since most extensions cannot be added later, a token already issued without it cannot turn it on.
For a tokenized security, the auditor key is what lets you combine privacy toward the public with visibility for whoever needs to see the amounts.
How Token-2022 maps to ERC-3643 (T-REX)
ERC-3643 is a final-status Ethereum standard for security tokens. It defines the token plus five components: two identity registries (Identity Registry and Identity Registry Storage), a compliance contract (Compliance), a registry of authorized claim issuers and a registry of required claim types (Claim Topics Registry). Its requirements include a recovery system if an investor loses their key, freezing tokens "partially or totally," pausing, forced transfers from an agent and batch operations. We explain it in ERC-3643: the technical standard for security tokens.
| Function | In ERC-3643 | On Solana (Token-2022) | The difference that matters |
|---|---|---|---|
| Verifying the recipient | Identity Registry and isVerified(): on-chain identity with claims signed by authorized issuers | Custom transfer hook or Token ACL gate program | Token-2022 has no standard identity registry: you design it |
| Compliance rules (country, number of investors) | Compliance contract and canTransfer() | Transfer hook logic | The hook receives the transfer's accounts as read-only; Token ACL only acts on freeze and thaw |
| Freezing a wallet | setAddressFrozen() | Freeze authority (base program) | Equivalent |
| Partial freeze | freezePartialTokens() | Not in the official solana.com map | Needs custom logic |
| Pause | pause() and unpause() | Pausable | Pausable also blocks mints and burns |
| Forced transfer | forcedTransfer(), which requires a verified recipient | Permanent delegate | What is checked about the recipient depends on your hook and on the state of their account |
| Recovering a lost wallet | recoveryAddress(), with the lost wallet, the new wallet and the investor's identity | Permanent delegate to the new account | Not in the official map; identity is handled elsewhere |
| Roles | Owner and Agent | Mint authorities (mint, freeze, pause, delegate) in a PDA or multisig | Each authority is a separate key |
| Batch operations | batchTransfer(), batchForcedTransfer() and others | Several instructions in one atomic transaction | Limit of 1.4 million compute units per transaction |
The solana.com guide publishes its own map: KYC whitelist → transfer-hook program; account freeze → freeze_authority; forced transfer → permanent_delegate; on-transfer logic → hook callback; compliance admin → PDA or multisig. That map does not cover wallet recovery or partial freezes.
If you would rather use ERC-3643 on a Spanish EVM network, the documentation of Spain's blockchain services infrastructure (ISBE) offers an ERC-3643 template; we cover it in tokenized securities on ISBE.
What Token-2022 does not cover on its own
- Investor identity. There is no standard equivalent to ERC-3643's on-chain identity. You need a KYC provider, a hook or a gate program, and a way to link each wallet to a person.
- The legal register. For a Spanish security, the ERIR identifies the holders and records corporate events and encumbrances (art. 8.4 of Law 6/2023). The network stores balances; the ERIR is accountable for the register. More in Law 6/2023 and securities tokenization.
- Payments. Scaled UI Amount and Interest-Bearing change what is displayed; the coupon or dividend is paid separately.
- Your own program. A hook or gate program has to be audited, and it stays upgradeable while its upgrade authority exists. Verified builds let you show that the deployed binary matches the published code.
- Integrations. A token with a hook needs wallets and apps that pass its extra accounts; according to the Token ACL documentation, many DeFi protocols do not accept them.
- Availability. Token ACL and its reference gate are on mainnet, but they are upgradeable programs: who controls their upgrade authority belongs in your risk analysis.
How we approach it. At Unknown Gravity we choose the extensions from the issuance's obligations, write and audit the hook or gate program when one is needed, and design how authorities are split and how the token reconciles with the ERIR. We are a Spanish tokenization technology company: we are not an ERIR, an investment firm or a law firm.
How to configure a mint for a tokenized security (CLI)
This example creates a Token-2022 mint with frozen-by-default accounts, a permanent delegate, pause, metadata and a transfer hook. We checked every option against the source code of spl-token CLI version 5.6.1 (June 12, 2026). The hook program has to be deployed first, and its extra accounts are initialized separately.
# 1. Token-2022 mint with compliance controls (spl-token CLI 5.6.1)
spl-token --program-2022 create-token
--decimals 0
--enable-freeze
--default-account-state frozen
--enable-permanent-delegate
--enable-pause
--enable-metadata
--transfer-hook <HOOK_PROGRAM_ID>
# 2. Metadata on the mint itself: name, symbol and document URI
spl-token initialize-metadata <MINT> "Example Bond 2027" "EXB27" https://example.com/bond.json
# 3. Onboard an investor after KYC: create their account and thaw it
spl-token create-account <MINT> --owner <INVESTOR_WALLET>
spl-token thaw <TOKEN_ACCOUNT>
# 4. Emergency pause and resume
spl-token pause <MINT>
spl-token resume <MINT>Two CLI details: --default-account-state requires --enable-freeze, and --interest-rate cannot be used together with --ui-amount-multiplier. Commands that take the mint or the account detect the token program on their own.
Frequently asked questions
What is the difference between SPL Token and Token-2022?
They are Solana's two main token programs. Token-2022 adds optional extensions, such as a transfer hook, a permanent delegate, frozen-by-default accounts or pause, which the original program does not have. For a regulated asset, the official tokenization documentation uses Token-2022.
Is Token-2022 equivalent to ERC-3643?
Partly. It covers freezing, pausing, forced transfers and logic on every transfer. It has no investor identity registry and, in the official solana.com map, no wallet recovery or partial freeze: those are built with a custom program.
Can an extension be added to a token that already exists?
Generally not: the documentation says most extensions cannot be added after the account is initialized. If the token already exists without the extension you need, the usual route is to issue a new one and migrate holders.
Can the issuer recover an investor's tokens under a court order?
Technically yes, if the token has a permanent delegate: it can transfer or burn from any account, and the holder cannot revoke it. That power must be disclosed in the issuance documents, and for a Spanish security the operation has to match what the ERIR records.
Do confidential transfers work on Solana today?
Yes, for tokens created with the extension. They were disabled in June 2025; the proof program they depend on was re-enabled on mainnet on June 4, 2026, and the Token-2022 version that turns them back on has been on mainnet since June 17, 2026. They hide amounts and balances, not addresses, and support an auditor key.
Sources
- Solana: Token Extensions
- Solana: Default Account State
- Solana: Transfer Hook
- Solana: Permanent Delegate
- Solana: Pausable Mint
- Solana: Scaled UI Amount
- Solana: Interest Bearing Tokens
- Solana: Metadata Pointer and Token Metadata
- Solana: Confidential Balances
- Solana Foundation: June 25, 2025 post-mortem
- Solana Foundation: privacy on Solana
- Solana: Permissioned Tokens with Token ACL (sRFC 37)
- Solana Foundation: Token ACL repository (GitHub)
- Token-2022 11.0.0 release notes (GitHub)
- Solana: Delivery vs Payment
- Solana: What is ERC3643 on Solana?
- ERC-3643: T-REX, Token for Regulated EXchanges
- spl-token CLI 5.6.1 (GitHub)
- Law 6/2023 on Securities Markets and Investment Services (BOE, in Spanish)
Framework verified as of October 16, 2026. Need to translate your issuance's obligations into Token-2022 extensions? Talk to us.