Tokenized MBS (Private-Label RMBS)
Private-label residential MBS on-chain — Figure/Provenance pattern with eNote + MERS eRegistry + MISMO data.
CTR (USD 10,000+)TRAVEL-RULE (USD 3,000+)ENHANCED-DUE-DILIGENCE (USD 50,000+)
Step 1 · Mortgage Origination & Consumer CompliancePolicy-EnforcedBlockchain-Native
The loan officer's desk — the borrower applies for a mortgage, triggering the densest consumer-protection compliance in all of structured finance. Every disclosure is federally mandated, every timeline is statutory, and every misstep is litigation-worthy.
The densest consumer-protection gate in securitized finance fires here. TILA/RESPA integrated disclosure (TRID): Loan Estimate within 3 business days of application; Closing Disclosure at least 3 business days before consummation — statutory timelines with zero-tolerance rules for certain disclosed charges. HMDA reporting: 110+ data points submitted to CFPB on every application (loan type, property type, rate-spread, demographic information, denial reason). ECOA fair-lending: no discrimination on the protected classes — race, color, religion, national origin, sex, marital status, age, receipt of public assistance. QM/ATR: the lender has documented the borrower's ability to repay per the 43% DTI safe harbor (or the newer price-based safe harbor under the 2021 GSE Patch replacement). The loan closes as an eNote under UETA/ESIGN, registered on the MERS eRegistry (which identifies the current note controller) and mirrored on-chain via Figure's Provenance blockchain with the MIN (Mortgage Identification Number) as the on-chain identifier. L5 Application lit only — the on-chain eNote is a record, not a gate. Builder: the Provenance chain's asset-type framework models each eNote as a distinct scoped object with the MIN + MERS eRegistry anchor + a hash of the loan tape data as metadata; downstream services query the object for servicing updates, transfer events, and delinquency. For new integrations, pair the eNote registration with an IPFS CID of the TRID disclosure package + the ECOA-compliance attestation from the originator so the full compliance bundle is cryptographically retrievable per loan. Compliance officer: satisfies C5 (originator licensing — NMLS registration, state-lender licenses, QM safe-harbor eligibility), C8 (operational resilience — TRID timelines are zero-tolerance and the CFPB has extracted eight-figure settlements from lenders who missed them), and C14 (consumer protection — TILA, RESPA, HMDA, ECOA, QM/ATR form the core TradFi consumer-protection battery that has no DeFi analog). GENIUS §6 (AML/BSA) applies to the originator's CIP program. Honesty marker: Provenance is operated by Figure Technologies — the same entity that originates loans onto it — which is a material centralization risk for the 'on-chain registry' thesis; neutral multi-issuer blockchain venues for RMBS do not yet exist at production scale as of April 2026, so tokenized-RMBS adoption is effectively single-issuer adoption.
Step 2 · Borrower Identity & Property VerificationPolicy-EnforcedBlockchain-Native
The underwriter's file — every mortgage has a dual verification: the borrower (who are they? can they repay?) and the property (what is it worth? is the title clear?). No other securitized asset has this dual-axis diligence.
Dual-axis diligence, unique to mortgage finance. Borrower side: identity verification (CIP under BSA), OFAC sanctions screening, tri-merge FICO from Equifax/Experian/TransUnion, employment and income verification (VOE/VOI), asset verification via 4506-C tax transcripts and bank statements. Property side: AVM (CoreLogic, Black Knight) + USPAP-compliant independent appraisal, title search (confirms clear chain of title, no undisclosed encumbrances or liens), title insurance issuance, flood certification (Special Flood Hazard Area determination under FDPA), property tax verification. Underwriter issues clear-to-close when every condition is cleared. Both axes are policy-enforced end-to-end — no part of borrower or property diligence is meaningfully on-chain as of April 2026, because the underlying data sources (credit bureaus, VOE/VOI services, title insurers) do not expose on-chain interfaces. L5 Application only. Builder: for the subset of diligence data that can be tokenized (title insurance policy → NFT, flood determination → on-chain oracle read), write the data hash into the loan's Provenance object at clear-to-close so downstream investors can verify the diligence package without re-requesting the underlying documents. Compliance officer: satisfies C1 (borrower identity / CIP under 31 CFR §1020.220), C2 (OFAC sanctions screening on the borrower and any borrower-affiliated entities — SDN, SSI, non-SDN lists), and C14 (appraisal independence under TILA §129H and Interagency Appraisal & Evaluation Guidelines; title-insurance regulation under state insurance codes; flood-insurance mandatory purchase under FDPA). GENIUS §6 (AML/BSA) coverage on the originator applies; §9 (custody & recordkeeping) covers the 5-year retention floor on the HMDA LAR (Loan Application Register) per 12 CFR §1003. Honesty marker: the property-side diligence is where tokenization has the weakest on-chain presence — title is recorded at the county level in the US (3,000+ separate county registries, each with its own procedures) and the path from a signed title-insurance policy to an on-chain NFT representation involves manual data entry in every production pilot as of April 2026; county-level title digitization projects (TitleXchange, Propy, Figure's own title-insurance arm) are early-stage.
Step 3 · Pool Formation & MISMO Data StandardizationCode-EnforcedBlockchain-Native
The loan tape — hundreds of individual mortgages are assembled into a pool, each described in MISMO XML format. The pool's statistical profile (WA FICO, WA LTV, WA DTI, geographic diversification) determines its credit risk and tranche structure.
Hundreds of eNotes (typically $300M–$800M face) are assembled into a pool. MISMO v3.x XML is the wire format: every loan described by 270+ standardized fields (FICO, LTV, DTI, loan purpose, occupancy, documentation type, interest rate, term, geographic location, property type). Third-party due diligence (Clayton, AMC) re-underwrites a statistically significant sample per the Reg AB II Rule 193 due diligence standard. The pool's weighted averages (WA FICO, WA LTV, WA DTI) and distribution metrics determine the credit structure. On Provenance, the pool is created as a smart contract; each loan's MISMO data hash anchored on-chain with the full off-chain MISMO XML stored in decentralized storage (IPFS, Arweave) with permanent retention. The contract registers every loan's MIN as a pool asset, creating a cryptographically verifiable pool composition. L3 Execution (on-chain hash commitment + pool registration) and L5 Application (off-chain MISMO file generation) lit. Builder: the pool-formation transaction should include the IPFS CID of the full MISMO XML + the Rule 193 due-diligence report + the auditor's attestation that the loan tape matches the on-chain pool assets; expose `getPoolLoans()` as a view that iterates the registered MINs + their MISMO hashes for investor-side verification. For pools that will later be traded on a secondary market, structure the MIN registry so each loan can be independently queried + audited without touching the whole pool — this pattern supports future Reg AB-II asset-level surveillance. Compliance officer: satisfies C10 (Reg AB II asset-level disclosure — the MISMO 270-field schema IS the canonical regulatory-grade representation, and an on-chain hash commitment plus IPFS-backed XML outperforms the traditional SEC EDGAR Form ABS-EE filing for verifiability), C11 (recordkeeping — the pool composition is cryptographically verifiable without EDGAR cooperation), and C16 (programmable compliance — on-chain pool construction with hash commitment is the strongest-possible implementation of the 'pool composition lock' at closing). Dodd-Frank Rule 193 (third-party diligence for Reg AB-II registered offerings) applies; for private placements under Rule 144A, similar diligence is market practice. Honesty marker: Reg AB II asset-level disclosure requires EDGAR-formatted Form ABS-EE XML for SEC-registered offerings; the on-chain MISMO hash is a cryptographic improvement but does not substitute for the EDGAR filing — issuers still submit the XML to EDGAR, and the on-chain record is a parallel verification layer. For private-label RMBS under Rule 144A, the EDGAR filing is not required but the 144A offering-memorandum equivalent is.
Step 4 · Tranche Structure & Risk RetentionPolicy-EnforcedBlockchain-Native
The credit structuring meeting — Kroll, DBRS, or Fitch models the pool's expected losses, prepayment speeds, and default timing to determine how much subordination the AAA tranche needs, while the sponsor locks in its mandatory 5% skin-in-the-game.
Rating agencies (KBRA, DBRS Morningstar, Fitch — S&P withdrew from private-label RMBS after 2008 and has not returned at scale) run loss-given-default and prepayment models via Intex CDI, Bloomberg CLX, and each agency's proprietary RMBS criteria. Capital structure typically: AAA Senior (~85%, SOFR+120–180bps), AA (~6%), A/BBB mezzanine (~5%), BB/B/Equity (~4% residual). Dodd-Frank §941 / SEC Reg RR risk retention: the sponsor must hold 5% of credit risk — typically as an 'eligible vertical interest' (5% of every tranche pari passu) or 'eligible horizontal residual interest' (equity tranche ≥5% of fair value). Reg AB II Form SF-1 (SEC-registered) or Rule 144A offering memorandum (private placement) published. Asset-level data (one row per loan) disclosed on Form ABS-EE XML at issuance and monthly throughout the deal's life. L5 Application only. Builder: publish the rating letters + sponsor risk-retention attestation + Form SF-1 hash on-chain so the full offering package is cryptographically retrievable; expose `getSponsorRetention()` so any investor can verify the §941 compliance state without trusting the EDGAR filing. For issuers using the horizontal-residual option, code-enforce the 5-year holding-period prohibition on transfer under Reg RR §246.12 via the ERC-3643 transfer-restriction module on the equity tranche. Compliance officer: satisfies C8 (operational-resilience — the 5-year §941 holding period is a multi-year obligation that most tokenized issuers underestimate), C10 (Reg AB II disclosure — Form SF-1 offering package), and C13 (market-integrity — rating agencies under SEC Rule 17g-5 conflict-of-interest for structured products, plus post-2008 Dodd-Frank §932 rating-agency reforms). GENIUS §4 (reserve-backing) applies where USDC is used in subscriptions; §6 (AML/BSA) on the placement agent; §9 (custody & recordkeeping) for the indenture trustee. Honesty marker: the post-2008 private-label RMBS market has never returned to pre-crisis volume — 2024–2026 annual issuance is a small fraction of 2006's $1.2T peak — and the narrow rating-agency pool (KBRA, DBRS, Fitch, with Moody's selective and S&P absent) is a structural artifact of 2008's litigation + regulatory fallout; this constrains investor choice and concentrates rating-methodology risk.
Step 5 · Investor Qualification & Capital CommitmentCode-EnforcedBlockchain-Native
The subscription agreement — the investor signs, wires capital, and receives their tranche certificate. On Provenance the wire is USDC, the certificate is a token, and the subscription closes in seconds rather than the T+5 of traditional RMBS.
Investor qualifications verified via Figure transfer agent: QIB for 144A tranches, accredited investor for Reg D tranches, institutional (pension funds, insurance companies) for SEC-registered offerings. ERC-3643 identity registry gates every tranche token contract — different tranches can carry different qualification requirements (Equity often restricted to QP under §2(a)(51) of the 1940 Act for certain pools). On Provenance's settlement layer (or Ethereum for investors who prefer the public-chain audit surface), the investor transfers USDC to the pool contract; atomic execution: (1) whitelist pre-check per tranche, (2) amount equals committed order, (3) tranche cap not exceeded; failure reverts. Tranche tokens (AAA, AA, A, BBB, BB, B, Equity) minted to the investor's whitelisted wallet. ~6s Provenance finality; ~12 min Ethereum. L2 Consensus and L3 Execution lit. Builder: structure the subscription as a closing-bundle transaction so a partial close across tranches is impossible — either all tranches mint to their committed investors simultaneously or none do; use a timelock-expiry fallback for investor refunds if the closing fails. Emit per-tranche `Minted(tranche, investor, amount, price, blockNum)` events for the paying agent's future distribution indexing. Compliance officer: satisfies C1 (accreditation / QIB / QP identity verification gated on-chain), C6 (reserve-backing on USDC subscription — Circle's 1:1 reserves under GENIUS §4(a) apply during the in-transit window), and C16 (programmable compliance — the multi-tranche mint with per-tranche whitelist is the canonical pattern). Volcker §13 bank-affiliate eligibility applies to bank investors; for insurance investors, NAIC RBC treatment of tokenized RMBS tranches is still evolving as of April 2026. Honesty marker: several of Figure's early tokenized RMBS deals used a sequential-subscription pattern rather than an atomic closing bundle (sponsors close AAA first, then work down the stack), which introduces a partial-close window that institutional investors should audit for; the atomic closing-bundle pattern is newer and not yet standard across Provenance pools.
Step 6 · OFAC Screening & Transfer MonitoringCode-EnforcedBlockchain-Native
The compliance hold — before any secondary transfer of a tranche token, the system checks: is the buyer whitelisted? Is the seller under restriction? Is either party sanctioned? Did the §941 5-year holding period expire?
Every tranche-token transfer is mediated by the ERC-3643 compliance module. Pre-transfer checks executed atomically: (1) sender and receiver both on the pool's investor whitelist, (2) neither on OFAC SDN / SSI / non-SDN lists (sanctions oracle refreshed hourly), (3) no pool-level freeze in effect (issuer or regulator can trigger), (4) transfer does not violate any per-tranche holding restriction (§941 5-year lock-up on sponsor retained horizontal interest; any issuer-specific lock-up), (5) shareholder-count gate where applicable. Failure reverts — the token literally cannot move to a sanctioned or unqualified address. FinCEN SAR filing obligations fire off-chain if suspicious activity is detected. Chainalysis tracks every movement for clustering, sanctions exposure, and high-risk jurisdiction flags. Gate checkpoint (hexagon). L3 Execution and L4 Account lit, fully code-enforced. Builder: expose `canTransfer(from, to, amount, tokenId)` as a public view so market-making front-ends can filter ineligible counterparties before showing a price; revert errors should be typed so the failing check (sanctions, whitelist, holding period, pool freeze) is identifiable in the tx receipt. For §941 holding-period enforcement, encode the acquisition block + 5-year-in-blocks in the per-tranche retained-interest module. Compliance officer: satisfies C2 (sanctions screening at every transfer — 31 CFR Part 501, 31 CFR §501.605 blocked-property reporting), C11 (recordkeeping — every transfer logged immutably on-chain with the block-level audit trail), and C16 (programmable compliance — the on-chain transfer gate is the strongest-possible implementation of SEC Rule 144A resale restrictions + §941 risk-retention holding periods). GENIUS §6 (AML/BSA) re-fires on every transfer. Honesty marker: the strength of the transfer gate depends entirely on the quality of the identity claims + the freshness of the sanctions oracle — a compromised identity provider or a stale OFAC update window can let a sanctioned address briefly receive tokens; as of April 2026, the industry-standard oracle refresh cadence is hourly, which means a same-day OFAC SDN addition can settle into the on-chain registry with up to 59 minutes of lag.
Step 7 · Loan Servicing & Loss MitigationPolicy-EnforcedBlockchain-Native
The servicer's monthly cycle — collect borrower payments, manage escrow, handle delinquencies, execute loss mitigation, and remit to the trust. This is where MBS lives for 15–30 years, and where 2007–2012 foreclosure-crisis rules continue to govern every interaction.
The longest-lived step in all of structured finance — 15–30 year servicing obligations. Monthly cycle: P&I collection, escrow management (taxes + insurance), late-fee assessment (per state law), delinquency bucketing (30/60/90/120+ days past due), loss mitigation (forbearance, loan modification, short sale, deed-in-lieu), foreclosure (last resort, state-specific judicial/non-judicial process). CFPB RESPA servicing rules (12 CFR Part 1024 Subpart C) dictate every borrower interaction: notice-of-error procedures (30-day response), early-intervention requirements (live contact by day 36 of delinquency), single-point-of-contact for defaulted borrowers, loss-mitigation evaluation within 30 days of complete application. Servicing is overwhelmingly off-chain — Black Knight MSP and ICE Mortgage Technology Empower are the industry systems of record. The servicer submits monthly remittance data to the pool: aggregate P&I, prepayments, defaults, recoveries. Pool contract calculates NAV and prepares the waterfall. L3, L4, L5 all lit. Builder: the servicer's monthly remittance should flow through a signed attestation (EIP-712 typed message) so the pool contract can verify the remittance data's authenticity before running the waterfall; this prevents a compromised servicer backend from spoofing remittance numbers. For loss-mitigation events (forbearance, modification), emit `LoanModified(loanId, modType, modBlockNum)` events so rating agencies and investors can track modification activity without waiting for the monthly trustee report. Compliance officer: satisfies C8 (operational resilience — 15–30 year servicing obligations are the deepest-duration commitment in structured finance; servicer backup / transfer rights must be pre-negotiated in the pooling and servicing agreement), C11 (recordkeeping — the servicer's loan file retention is governed by the state-specific statute of limitations for the underlying note, which can extend 20+ years), and C14 (consumer-protection servicing rules — CFPB RESPA Reg X, TILA Reg Z servicing provisions, FDCPA for third-party servicers, state-level servicing statutes). GENIUS §9 (custody & recordkeeping) applies to the trustee's custody of the loan files; §6 (AML/BSA) continues to apply to the servicer's transaction monitoring. Honesty marker: the 15–30 year servicing horizon is longer than most tokenized-RMBS platforms have existed — the enforceability of on-chain pool governance against a 2045 credit event or a 2050 loan modification is untested legal territory, and every production pool relies on the off-chain PSA (pooling and servicing agreement) as the authoritative legal document that the on-chain record mirrors.
Step 8 · Reporting, Surveillance & Regulatory FilingPolicy-EnforcedBlockchain-Native
The trustee report — every month, 270+ data fields per loan are updated, the pool's performance metrics are recalculated, and the rating agencies decide whether the tranches still deserve their ratings, just as US Bank Corporate Trust and Wells Fargo Corporate Trust have produced for traditional RMBS for the past forty years.
Three parallel reporting streams. Monthly trustee report (Intex format): 270+ MISMO fields per loan refreshed — current balance, payment history, delinquency, modifications, credit score (if available), property value (AVM). Pool metrics: CPR (conditional prepayment rate), CDR (conditional default rate), severity, delinquency ladder, reserve fund balance. Rating agency surveillance: KBRA, DBRS, Fitch run pool performance against initial assumptions; upgrade/downgrade actions follow. Regulatory filings: Form 10-D (monthly distribution report), Form ABS-EE XML (asset-level data monthly), Form 10-K annual (SEC-registered); 1099-INT to investors + K-1 where applicable (IRS). EDGAR filing creates the public regulatory record; on-chain data creates an immutable parallel record — the Reg AB II loan-tape data literally lives on-chain via Provenance with cryptographic anchoring to the MISMO XML. Obligation checkpoint (diamond). L3, L4, L5 all lit. Builder: publish each monthly trustee report + Form 10-D + Form ABS-EE XML as an on-chain attestation (IPFS CID + trustee signature); tranche holders + rating agencies can verify authenticity cryptographically rather than trusting an email attachment. For tax reporting, index waterfall distributions by investor + month + tranche and auto-generate 1099-INT forms at year-end. Compliance officer: satisfies C10 (market-conduct / Reg AB II monthly asset-level disclosure — Form ABS-EE is the canonical schema), C11 (SEC Rule 17a-4 recordkeeping with 5-year retention for broker-dealer; longer for servicer under state statutes-of-limitations for the underlying notes), C12 (Form 10-D + Form ABS-EE + Form 10-K + IRS 1099/K-1 regulatory filings), and C13 (market-integrity — SEC Rule 17g-7 NRSRO disclosure on rated structured products). GENIUS §4(b) monthly attestation applies where stablecoin is used in distributions; §9 custody & recordkeeping for the trustee. Honesty marker: traditional RMBS investor reporting is Intex-format PDFs + monthly XLSX trustee reports + EDGAR XML; on-chain real-time MISMO data is a strict improvement for verifiability, but most institutional investors still consume the EDGAR + PDF as the official record because their internal portfolio systems (Bloomberg PORT, Aladdin) are wired to Intex and EDGAR and not yet to on-chain feeds — expect parallel reporting through 2027–2028. The enforceability question for a 2045 Reg AB II filing is untested: the SEC has not issued a general determination that an IPFS-pinned MISMO XML + on-chain hash commitment can substitute for the EDGAR Form ABS-EE filing standalone.
Resolved 8 steps across 1 chain(s). 3 threshold(s) triggered. Frameworks: Bank Secrecy Act, GENIUS Act, OFAC Sanctions Program, FATF Recommendation 16 (Travel Rule), Common Reporting Standard / FATCA.