CMTA Token (CMTAT)

Latest audited release: v3.0.0

Latest release: v3.2.0

CMTAT is a blockchain-agnostic open-source security token framework. This repository provides the Solidity reference implementation for EVM-compatible blockchains such as Ethereum, Optimism, Arbitrum, and Polygon PoS. It is developed and maintained by the Capital Markets and Technology Association (CMTA).
It provides a modular implementation focused on regulated issuance and lifecycle management (transfer restrictions, enforcement, pause/deactivation, supply controls, documentation, and optional cross-chain features), with multiple deployment variants (standalone and upgradeable) to fit different product and jurisdiction requirements.

What is CMTAT?

CMTAT extends the standard ERC-20 token with compliance features required for regulated financial instruments:

| Feature | Purpose | Standards | Module Scope | |---|---|---|---| | Pause | Freeze all transfers globally (e.g., during corporate actions) | ERC-3643, ERC-7551 (eWpG profile) | Core | | Deactivate | Permanently disable token operations when required by lifecycle/governance decisions | ERC-8343 (draft, not yet merged) | Core | | Account Freeze | Block specific addresses from transferring | ERC-3643 enforcement model, ERC-7943 send/receive checks | Core | | Mint / Burn | Controlled issuance and redemption of tokens | ERC-3643, ERC-7551 (eWpG profile) | Core | | Batch Mint / Batch Burn | Process multiple mint or burn operations in a single transaction | ERC-3643 | Core | | Configurable Decimals | Define token decimals at deployment time | ERC-20-compatible behavior | Core | | Forced Transfer | Admins can move tokens from frozen accounts | ERC-3643, ERC-7551 (eWpG profile), ERC-7943 | Core/Extension | | Set Name / Symbol | Update token name and symbol after deployment (supported deployment versions) | ERC-3643 | Core | | Contract Versioning | Expose the contract's implementation version on-chain as a human-readable SemVer string via version() | ERC-8303 (draft, not yet merged), ERC-3643 | Core | | Freeze Partial Tokens | Freeze a specific amount of tokens on an address | ERC-3643, ERC-7551 (eWpG profile), ERC-7943 equivalent (setFrozenTokens/getFrozenTokens) | Extension | | Transfer Validation | Plug-in rule engine to restrict transfers by origin, receiver, or amount | ERC-3643, ERC-7551, ERC-7943 | Extension/Option | | Snapshots | Record balances at a specific point in time (e.g., for dividends) | CMTAT SnapshotEngine integration | Extension/Option | | Holder List | Maintain on-chain the set of addresses holding a non-zero balance (issuer reporting, corporate actions) | Fungible holder enumeration (draft) | Option | | Documents | Attach legal documents to the token on-chain | ERC-1643-compatible document model | Extension/Option | | Cross-Chain Mint/Burn | Cross-chain bridge-oriented mint/burn interface | ERC-7802 | Extension | | Permit | Signature-based approvals without on-chain approve transaction | ERC-2612 | Deployment-version specific | | Multicall | Execute multiple calls in one transaction | ERC-6357 | Deployment-version specific | | UUPS Upgradeability | Upgradeable proxy pattern support | ERC-1822 | Deployment-version specific | | Debt Features | Debt lifecycle and credit-event related capabilities | CMTAT Debt modules | Deployment-version specific | | ERC-1363 Payable Token Hooks | Token callbacks (transferAndCall / approveAndCall) | ERC-1363 | Deployment-version specific |

Document model note:

• CMTAT implements both the original ERC-1643 — only ever a GitHub issue (2018 draft), never a merged EIP — and its current rework, the draft proposal "Document Management for Security Tokens" (ethereum/ERCs PR #1754, open/draft).
• ERC-1643 document identifiers in CMTAT use bytes32 names.
• CMTAT tokenization terms keep the modified CMTAT document structure (IERC1643CMTAT.DocumentInfo) with string name.

Who uses CMTAT?

CMTAT is used in production by major financial institutions including UBS, Taurus SA, Zand Trust, Daura, Obligate, and Syz Group to tokenize equities, artwork, bonds, structured products, money market funds, and stablecoins.

Example Per Use Case

• Equities: Magic Tomato SA (2022), Qoqa Brew (2022), Cité Gestion SA (2023), CODE41 (2023).
• Debt / Bonds: UBS Project Guardian digital bond (2024), SCCF tokenized trade-finance notes (2023), Obligate
• Structured Products: UBS tokenized warrant on Ethereum (2024)
• Stablecoins: Zand Trust (2025) issued an AED stablecoin using CMTAT v3.0.0 via Taurus infrastructure; Zand Trust.
• Tokenized Market Funds: UBS uMINT (2024)
• Tokenized Artwork: Syz Art tokenization.
• Private DvP settlement: Seturion (2026) (Börse Stuttgart Group) achieved private delivery-vs-payment settlement of tokenized assets on a public blockchain while keeping sensitive data confidential, using CMTAT on Aztec, a zero-knowledge Ethereum Layer-2. Read more.

Supported Financial Instruments

| Product | Deployment Version | |---|---| | Equities | CMTAT Standard | | Equities / Bonds with balance snapshots (dividends, corporate actions) | CMTAT Snapshot, CMTAT Debt, CMTAT DebtEngine | | On-chain shareholder registry / holder enumeration | CMTAT HolderList | | Equities (Germany / eWpG) | CMTAT ERC-7551 | | Debt / Bonds | CMTAT Debt | | Debt / Bonds (external debt engine) | CMTAT DebtEngine | | Stablecoins | CMTAT Light | | Allowlist / Whitelist | CMTAT Allowlist or CMTAT Standard with RuleEngine | | Permit + Multicall | CMTAT Permit | | Payable token / DeFi callbacks | CMTAT ERC-1363 | | Any (UUPS upgradeable proxy) | CMTAT UUPS |

Most products come in a standalone (immutable) or upgradeable (proxy) variant. The UUPS variant (CMTATUpgradeableUUPS) is upgradeable only — no standalone counterpart exists.

Contract Sizes

Measured with solc 0.8.34, optimizer enabled (200 runs). EVM deployed bytecode limit: 24.576 KiB.

| Deployment Version | Deployed (KiB) | Initcode standalone (KiB) | Initcode upgradeable (KiB) | |---|---|---|---| | CMTAT Standard | 22.251 | 25.663 | 22.577 | | CMTAT Snapshot | 22.075 | 25.487 | 22.401 | | CMTAT HolderList | 23.825 | 27.255 | 24.151 | | CMTAT Light | 11.278 | 13.055 | 11.487 | | CMTAT Allowlist | 19.882 | 23.079 | 20.208 | | CMTAT Debt | 23.189 | 26.324 | 23.398 | | CMTAT DebtEngine | 23.799 | 26.934 | 24.008 | | CMTAT ERC-7551 | 22.812 | 26.224 | 23.138 | | CMTAT ERC-1363 | 23.813 | 27.267 | 24.139 | | CMTAT Permit | 23.341 | 26.650 | 23.550 | | CMTAT UUPS | 23.552 | — | 23.904 |

All variants are within the deployed bytecode limit. The deployed size is identical between standalone and upgradeable for the same variant; the initcode is larger for standalone contracts since it includes the full constructor logic rather than an initializer.

Key Standards

CMTAT impl