Deploying a Real World Asset (RWA) startup from concept to mainnet in six months is an ambitious but achievable goal—if you use existing compliant infrastructure and target the right regulatory exemptions. This playbook provides founders and CTOs with a week-by-week execution plan, including vendor selection, budget estimates, team composition, and go/no-go gates.
The RWA startup roadmap compresses what traditionally takes 12-18 months into 24 weeks by leveraging platforms like Securitize, Tokeny, or Polymesh for legal wrapper and compliance, Fireblocks or Anchorage for custody, and Chainlink for oracle infrastructure. The critical path runs through legal wrapper formation (Weeks 1-4), smart contract audit (Weeks 7-10), and KYC/AML pipeline validation (Weeks 10-14). Everything else runs in parallel.
Why 6 Months Is the New Baseline
Three market shifts collapsed the timeline:
- Compliance-as-a-Service platforms (Securitize, Tokeny, Polymesh) handle legal wrapper, KYC/AML, and transfer restrictions out of the box. Hamilton Lane tokenized a fund in 4 months using Securitize.
Reality check from Messari: Pure custom builds still take 9-18 months. The 6-month path only works if you (a) use an existing platform, (b) target Reg D 506(c) or Reg S exemptions, and (c) have experienced legal counsel from Day 1.
Phase 1: Foundation (Weeks 1-4)
Week 1: Legal Wrapper & Jurisdiction Decision
Decision matrix for legal structure:
| Structure | Best For | Setup Time | Cost | Investor Access |
|---|---|---|---|---|
| Delaware LLC + SPV | US Reg D 506(c) | 2-3 weeks | $15-25K | Accredited US only |
| Cayman/BVI SPV | International Reg S | 3-4 weeks | $20-35K | Global non-US |
| Singapore VCC | Asia-focused MiCA passporting | 4-6 weeks | $30-50K | Global + EU via passport |
| Luxembourg SCSp | EU MiCA authorization | 8-12 weeks | $50-80K | Full EU retail |
Recommendation: Start with a Delaware LLC + SPV for Reg D 506(c). Fastest to market, cleanest precedent. Add a Cayman feeder later for international investors.
Action items:
- Engage securities counsel (RWA experience required – ask for 3 recent tokenization deals)
Week 2: Regulatory Strategy & Compliance Architecture
Choose your exemption path:
| Exemption | Max Raise | Investor Type | Continuous Reporting | Timeline Impact |
|---|---|---|---|---|
| Reg D 506(c) | Unlimited | Accredited only | Form D+ State Notice | Baseline (0 weeks) |
| Reg S | Unlimited | Non-US persons | None in the US | +1 week for offshore wrapper |
| Reg A+ | $75M | Retail + accredited | On-going SEC reporting | +8-12 weeks |
| MiCA ART | Unlimited | EU retail | Full MiCA compliance | +12-16 weeks |
Compliance architecture (built on the platform):
Week 3: Technical Architecture & Vendor Selection
Core stack decisions (make these in Week 3, don't revisit):
| Layer | Decision | Rationale |
|---|---|---|
| Blockchain | Ethereum mainnet + Polygon/Arbitrum L2 | Liquidity, tools, institutional trust |
| Token Standard | ERC-3643 (T-REX) | Built-in compliance, audited, platform support |
| Custody | Fireblocks (MPC + Policy Engine) | WaaS for investors, compliance rules, CCIP ready |
| Oracle | Chainlink Proof of Reserve + CCIP | Reservation verification, cross-chain, industry standard |
| KYC/AML | Onfido + Persona (reduced redundancy) | Global coverage, API-first, webhook support |
| Smart Contract Framework | OpenZeppelin + T-REX library | Audited components, upgradeable proxy pattern |
| Frontend | React + WalletConnect + Fireblocks WaaS SDK | Investor self-custody option, embedded wallet |
Vendor evaluation criteria (score 1-5 each):
Week 4: Token Design & Economics
Token parameters to finalize:
`solidity // Example ERC-3643 configuration contract MyRWA is ERC3643, AccessControl { // Asset backing uint256 public constant ASSET_VALUE_USD = 10_000_000; // $10M property uint256 public constant TOKEN_SUPPLY = 1_000_000; // 1M tokens // $10 per token = 1 token = $10 of underlying asset
// Compliance address public complianceContract; // T-REX compliance address public identityRegistry; // ERC-735 identity address public trustedIssuersRegistry; // KYC providers
// Economics
Key design decisions:
- Fractionalization granularity: $10-100/token for retail accessibility; $1,000+ for institutional investors
Phase 2: Build (Weeks 5-12)
Weeks 5-6: Smart Contract Development
Contract suite to build:
| Contract | Purpose | Complexity | Audit Priority |
|---|---|---|---|
RWAToken.sol | ERC-3643 token with compliance hooks | Medium | Critical |
| 'Compliance.sol' | Transfer rules, investor qualification, country restrictions | High | Critical |
AssetRegistry.sol | Oracle integration, NAV updates, proof-of-reserve verification | Medium | High |
Distribution.sol | Yield calculation, claim mechanism, tax reporting | Medium | High |
Governance.sol | Voting, proposal execution, timelock | Low | Medium |
ProxyAdmin.sol | Upgradeable proxy administration | Low | Medium |
Development practices:
- Use OpenZeppelin upgradeable contracts (UUPS proxy)
- 100% test coverage for compliance logic (foundry/forge)
- Property-based testing for
canTransferedge cases - Fuzzing for arithmetic overflows in distribution math
- Static analysis: Slither, MythX, Solhint
Code organization:
contracts/ ├── interfaces/ # ERC-3643, ERC-1400, custom interfaces ├── tokens/ # RWAToken, mock tokens for testing ├── compliance/ # Compliance, IdentityRegistry, TrustedIssuers ├── oracle/ # AssetRegistry, PriceOracle, ProofOfReserve ├── distribution/ # YieldDistributor, ClaimManager ├── governance/ # Governor, Timelock, ProposalExecutor ├── proxy/ # ProxyAdmin, UUPSUpgradeable ├── libraries/ # Math, Validation, BytesUtils
Weeks 7-8: Custody Integration & Wallet Infrastructure
Fireblocks integration checklist:
- [ ] Workspace created, team members onboarded with least-privilege roles
Investor wallet options:
| Approach | UX | Control | Compliance | Dev Effort |
|---|---|---|---|---|
| Fireblocks WaaS (embedded) | Seamless, email login | Platform Custodies | Built-in policy engine | Low (SDK) |
| WalletConnect + Self-custody | Familiar (MetaMask, Rainbow) | User controls keys | On-chain only | Medium |
| Hybrid: WaaS → Self-custody migration | The best of both | Starts platform, migrates | Both | High |
Recommendation: Launch with Fireblocks WaaS for compliance simplicity. Offer a migration path to self-custody after a 12-month lockup.
Weeks 9-10: Oracle Integration & Reserve Verification
Chainlink Proof of Reserve (PoR) setup:
`solidity // AssetRegistry.sol - PoR verification function verifyReserves() external view returns (bool) { // 1. Fetch the latest PoR report from Chainlink (uint80 roundId, int256 answer, , uint256 updatedAt,) = AggregatorV3Interface(chainlinkFeed).latestRoundData();
// 2. Verify report freshness (< 24 hours)
// 3. Verify reserve ratio >= 100% uint256 totalSupply = rwaToken.totalSupply(); uint256 reserves = uint256(answer); // USD value of reserves uint256 nav = reserves / totalSupply; // NAV per token
// 4. Update on-chain NAV for distribution calculations
return true;
Price feed configuration:
- Primary: Chainlink ETH/USD + custom asset feed (if available)
Cross-chain (if multi-chain launch):
Weeks 11-12: KYC/AML Pipeline & Investor Onboarding
Automated onboarding flow:
Investor lands on the portal ↓ Email verification + wallet connection (WalletConnect/WaaS) ↓ KYC questionnaire (accreditation, source of funds, jurisdiction) ↓ Document upload (ID, proof of address, accreditation docs) ↓ Onfido/Trulioo verification (2-5 minutes typical) ↓ Sanctions screening (Chainalysis KYT, TRM) ↓ On-chain identity mint (ERC-735 claim on IdentityRegistry) ↓ Compliance contract approves investor (canTransfer returns true) ↓ Investor whitelisted → can receive tokens
Edge cases to handle:
- Jurisdiction blocks: Auto-reject OFAC, FATF high-risk, local restricted lists
Testing protocol: Run 50 test investors through the full flow. Measures: drop-off rate, false positive rate, time-to-complete. Target: median of <15 min, <5% false positive, <10% drop-off.
Phase 3: Validation (Weeks 13-20)
Weeks 13-14: Smart Contract Audit
Audit process:
| Phase | Duration | Deliverable |
|---|---|---|
| Pre-audit prep | 1 week | Clean codebase, documentation, test coverage report, threat model |
| Audit engagement | 2-3 weeks | Audit report (critical/high/medium/low findings) |
| Remediation | 1-2 weeks | Fix, re-test, and re-audit critical findings |
| Final report | 1 week | Public audit report, audit certificate |
Auditor selection (pick 2 for dual audit):
Critical audit areas: 1. canTransfer logic – every path must be reverted for non-compliant transfers 2. Upgradeability – proxy admin controls, timelock delays, emergency pause 3. Oracle manipulation – stale data, flash loan resistance, circuit breakers 4. Distribution math – rounding, overflow, pro-rata accuracy 5. Access control – role separation, multisig requirements, renounce paths
Gate 3 criteria: Zero critical/high findings. Medium findings documented with risk acceptance or fix timeline.
Weeks 15-16: Testnet Deployment & Integration Testing
Testnet checklist (Sepolia + Polygon Amoy):
- [ ] All contracts deployed via script (forge script, verified on Etherscan) - [ ] Proxy admin transferred to 3-of-5 multisig (Gnosis Safe) - [ ] Custody integration: deposit/withdraw/rebalance flows tested - [ ] Oracle: PoR feed updates, price feed failover, NAV calculation - [ ] KYC pipeline: 10+ test investors through full flow - [ ] Distribution: yield accrual, claim, tax report generation - [ ] Governance: proposal creation, voting, execution, timelock - [ ] Frontend: all user flows, error states, mobile responsive - [ ] Monitoring: alerts for failed transactions, oracle deviations, compliance blocks - [ ] Load test: 100 concurrent users, 1000 transfers/hour
Testnet success metrics:
- Transaction success rate: >99.5%
- KYC completion rate: >90%
- Average onboarding time: <15 minutes
Weeks 17-18: Security Hardening & Penetration Testing
Infrastructure security:
- [ ] AWS/GCP: WAF, DDoS protection, VPC isolation, private subnets
Smart contract hardening: - [ ] Emergency pause tested (multisig → pause → unpause) - [ ] Upgrade path tested (new implementation → timelock → execute) - [ ] Oracle circuit breaker: price deviation >10% → pause distributions - [ ] Reentrancy guards on all external calls - [ ] MEV protection: commit-reveal for large redemptions
Weeks 19-20: Mainnet Deployment & Soft Launch
Deployment sequence (single maintenance window):
`bash
forge script script/DeployImplementations.s.sol --rpc-url mainnet --broadcast
forge script script/DeployProxies.s.sol --rpc-url mainnet --broadcast
forge script script/ConfigureSystem.s.sol --rpc-url mainnet --broadcast
forge verify-contract --chain mainnet --etherscan-api-key $KEY ...
forge script script/TransferAdmin.s.sol --rpc-url mainnet --broadcast
forge script script/InitialMint.s.sol --rpc-url mainnet --broadcast
Soft launch (Week 20):
Phase 4: Launch & Operate (Weeks 21-24+)
Week 21: Public Launch
Launch day checklist:
- [ ] Marketing site live with legal disclaimers - [ ] Investor portal: onboarding, dashboard, documents, support - [ ] Compliance: all KYC/AML flows production-ready - [ ] Custody: Fireblocks production workspace, policies enforced - [ ] Oracle: PoR feed live, price feeds redundant - [ ] Monitoring: Datadog/Sentry/PagerDuty alerts configured - [ ] Support: Intercom/Zendesk, FAQ, dedicated email - [ ] Legal: PPM accessible, subscription agreements executable - [ ] Banking: Fiat on-ramp (MoonPay/Transak) + off-ramp tested
Launch metrics to track:
Weeks 22-24: Operations Stabilization
Weekly operations cadence:
| Day | Activity | Owner |
|---|---|---|
| Monday | NAV calculation, distribution prep, compliance report | Compliance Officer |
| Tuesday | Investor onboarding review, pending KYC, support triage | Product Manager |
| Wednesday | Oracle health check, reserve verification, gas optimization | CTO/DevOps |
| Thursday | Smart contract monitoring, upgrade planning, security review | Lead Dev |
| Friday | Weekly metrics review, investor communications, retros | CEO |
First 90 days post-launch priorities:
- Investor experience: <24hr support response, self-serve dashboard, tax documents
Budget Estimate: Complete 6-Month Breakdown
| Category | Low End | High End | Notes |
|---|---|---|---|
| Legal & Compliance | |||
| Securities counsel (200 hrs @ $500) | $100,000 | Reg D+ wrapper | |
| Platform setup (Securitize/Tokeny) | $25,000 | $50,000 | Revenue share 0.5-1% |
| Regulatory opinions | $15,000 | $30,000 | State blue sky, tax |
| Legal Subtotal | $140,000 | $180,000 | |
| Technical Development | |||
| Smart contract developer (2 developers × 12 weeks) | $96,000 | $144,000 | $150-200/hr |
| Frontend + investor portal | $40,000 | $80,000 | React, WaaS SDK |
| Audit (dual, Tier 1 + Tier 2) | $70,000 | $150,000 | Includes remediation |
| DevOps, CI/CD, monitoring | $20,000 | $40,000 | |
| Technical Subtotal | $226,000 | $414,000 | |
| Infrastructure & Operations | |||
| Custody (Fireblocks, 6 months) | $15,000 | $30,000 | $2.5-5K/month |
| Oracle (Chainlink PoR + CCIP) | $12,000 | $36,000 | $2-6K/month |
| KYC/AML (Onfido + Persona) | $5,000 | $15,000 | ~$2/verification × 5K |
| Hosting, monitoring, domains | $6,000 | $12,000 | AWS/GCP, Datadog |
| Insurance (D&O, cyber, E&O) | $15,000 | $30,000 | Annual premiums |
| Subtotal Infrastructure | $53,000 | $123,000 | |
| Team & Overhead | |||
| Compliance Officer (0.5 FTE × 6 months) | $30,000 | $60,000 | $10-20K/month |
| Product manager (1 FTE × 6 months) | $60,000 | $90,000 | |
| Contingency (20%) | $101,800 | $173,400 | |
| TOTAL | $610,800 | $1,040,400 |
Cost optimization levers: - Single audit (Tier 1 only): -$70K risk: higher residual risk - Junior dev + senior review: -$40K risk: slower, more bugs - Self-hosted KYC (open source): -$10K risk: maintenance burden - No insurance first year: -$22K risk: personal liability
Team Composition: Minimum Viable RWA Team
| Role | FTE | When Needed | Key Skills | Source |
|---|---|---|---|---|
| Founder/CEO | 1.0 | Week 1 | Fundraising, strategy, partnerships | Internal |
| Securities Counsel | 0.3 | Week 1 | Reg D, tokenization, blue sky | External ($500/hr) |
| CTO/Lead Blockchain Dev | 1.0 | Week 3 | Solidity, architecture, DeFi | Internal/Contract |
| Smart Contract Developer | 1.0 | Week 5 | Solidity, testing, OpenZeppelin | Contract |
| Frontend/Full-stack Dev | 1.0 | Week 5 | React, WalletConnect, APIs | Contract |
| Compliance Officer | 0.5→1.0 | Week 8 | KYC/AML, sanctions, BSA | Contract → Hire |
| Product Manager | 1.0 | Week 3 | Vendor management, timeline, UX | Internal |
| DevOps/SRE | 0.3 | Week 10 | AWS, monitoring, CI/CD | Contract |
Total peak headcount: 5.1 FTE (3 internal, 2.1 contract/external)
Hiring timeline:
- Weeks 1-2: Founder, Counsel, CTO, PM
Vendor Selection: Decision Matrix
Custody
| Vendor | Monthly Min | Txn Fees | WaaS | Policy Engine | CCIP Ready | Best For |
|---|---|---|---|---|---|---|
| Fireblocks | $2,500 | $0.05-0.15 | ✅ | ✅ | ✅ | Most RWA startups |
| Anchorage | $5,000 | Custom | ❌ | ✅ | ✅ | Institutional, qualified custody req |
| Coinbase Custody | $5,000 | Custom | ❌ | Limited | ❌ | Coinbase ecosystem |
| BitGo | $1,000 | $0.01-0.05 | ✅ | ✅ | ✅ | Cost-sensitive, self-custody option |
Recommendation: Fireblocks. Best WaaS, policy engine, CCIP integration, and RWA track record.
Oracle
| Vendor | PoR | Price Feeds | CCIP | Cost/Month | Integration |
|---|---|---|---|---|---|
| Chainlink | ✅ | ✅ | ✅ | $5-20K | SDK, extensive documentation |
| Pyth | ❌ | ✅ | ❌ | $1-5K | SDK, pull model |
| RedStone | ✅ | ✅ | ❌ | $2-10K | SDK, modular |
| Custom (API3) | ✅ | ✅ | ❌ | Development cost | High effort |
Recommendation: Chainlink. The only provider with PoR + CCIP + battle-tested RWA integrations.
KYC/AML
| Vendor | Countries | Speed | Accuracy | Cost/Check | API Quality |
|---|---|---|---|---|---|
| Onfido | 195 | 90 sec | 99.2% | $1.50-3.00 | Excellent |
| Trulioo | 195 | 2 min | 98.8% | $1.00-2.50 | Good |
| Person | 180 | 60 sec | 99.0% | $0.50-2.00 | Excellent |
| Sumsub | 220 | 45 sec | 98.5% | $0.30-1.50 | Good |
Recommendation: Onfido primary + Persona fallback. Best accuracy, global coverage, and webhook reliability.
Compliance Platform
| Platform | Token Standard | KYC Built-in | Transfer Restrictions | Investor Portal | Revenue Share |
|---|---|---|---|---|---|
| Securitize | ERC-1400, ERC-3643 | ✅ | ✅ | ✅ | 0.5-1% |
| Tokeny | ERC-3643 (T-REX) | ✅ | ✅ | ✅ | 0.5-1% |
| Polymesh | Native (Substrate) | ✅ | ✅ | ❌ | Chain fees |
| Custom | Any | Build | Build | Build | None |
Recommendation: Tokeny for ERC-3643 native, fastest integration. Securitize if you need ERC-1400 or US broker-dealer rails.
Milestone Gates: Go/No-Go Criteria
| Gate | Week | Criteria | Decision Authority |
|---|---|---|---|
| Gate 1: Legal Foundation | 4 | Wrapper formed, jurisdiction locked, Reg D/Reg S strategy approved, counsel engaged | CEO + Counsel |
| Gate 2: Technical Freeze | 8 | Smart contracts feature-complete, audit firm engaged, custody contract signed, oracle config finalized | CTO + CEO |
| Gate 3: Audit Pass | 12 | Zero critical/high findings, testnet stable for 2 weeks, KYC pipeline >90% complete | CTO + Counsel |
| Gate 4: Mainnet Ready | 20 | Contracts deployed/verified, multisig admin, 10+ test investors processed, monitoring live | CEO + CTO + Counsel |
| Gate 5: Launch | 21 | Soft launch metrics hit, support runbook tested, legal disclaimers live, banking rails tested | CEO |
If a gate fails: Document the root cause, adjust the timeline, and communicate to stakeholders. Do not proceed until the criteria are met.
Risk Register & Mitigation
| Risk | Probability | Impact | Mitigation |
|---|---|---|---|
| Regulatory action (SEC, state) | Medium | Critical | Experienced counsel, Reg D compliance, state notice filings |
| Smart contract exploit | Low | Critical | Dual audit, bug bounty, upgradeable proxy, emergency pause |
| Custody provider outage | Low | High | Fireblocks SLA 99.9%, disaster recovery runbook, backup custodian |
| Oracle manipulation | Low | High | Chainlink PoR, circuit breakers, multi-source price feeds |
| KYC vendor failure | Medium | Medium | Dual vendor (Onfido + Persona), manual review fallback |
| Bank account closure | Medium | High | Multiple banking partners (Mercury, Juno, Column), crypto-friendly |
| Key team member departure | Medium | High | Documentation, knowledge sharing, contractor bench |
| Market crash (asset value drop) | Medium | Medium | Conservative LTV, stress testing, reserve buffers |
| MiCA compliance gap (EU investors) | Low | High | Geo-blocking in the EU until the MiCA passport, or partnering with an EU entity |
Vietnam-specific considerations
For founders operating from or targeting Vietnam:
Legal & Regulatory
- No domestic RWA framework: Vietnam bans crypto payments; securities tokenization is unregulated
KYC/AML
- Local providers: Viettel Cyber Security, VNPT SmartID, FPT.AI eKYC
Custody & Banking
- No qualified custodians: Must use Fireblocks/Anchorage via API
Tax
- Token sale proceeds: 20% corporate income tax (CIT) on gains
Talent
- Blockchain developers: ~200 experienced Solidity developers in Vietnam (Ho Chi Minh City, Hanoi)
FAQ
Q: Can I really launch in 6 months without cutting corners?
A: Only with existing compliance infrastructure (Securitize/Tokeny/Polymesh), Reg D 506(c) exemption, and experienced counsel. Custom legal + custom tech = 12-18 months minimum.
Q: What is the minimum budget for a compliant launch?
A: ~$275K if you use the Tokeny platform, single Tier 2 audit, Fireblocks custody, and contract development team. Realistic buffer: $400-500K.
Q: Do I need a broker-dealer license?
A: Not for Reg D 506(c) issuer direct. You need one if: soliciting non-accredited investors, operating an ATS, or receiving transaction-based compensation. Platform (Securitize) has a BD subsidiary.
Q: How do I handle secondary trading?
A: ERC-3643 enforces compliance on every transfer. For ATS listing: tZERO, Securitize Markets, or OpenFinance. Expect a 6-12 month listing process.
Q: What if the underlying asset loses value?
A: NAV updates via Chainlink PoR. Distribution pauses if reserves <100%. Token holders vote on restructuring (extend, liquidate, inject capital). Document in PPM.
Q: Can I accept Vietnamese investors?
A: Only via Reg S (offshore) through a Vietnamese licensed securities intermediary. Direct solicitation is prohibited by Vietnamese law. Consult local counsel.
Q: What are the ongoing compliance costs post-launch?
A: $50-100K/year: KYC re-verification, sanctions screening, audit, legal counsel, insurance, platform fees.
Q: How do I prove reserves to investors?
A: Chainlink Proof of Reserve provides cryptographic verification. Publish monthly attestation reports. Annual third-party audit (Big 4 or crypto-specialist).
Next Steps: Your 6-Month Journey Starts Today
This week: 1. [ ] Interview 3 securities attorneys with RWA experience 2. [ ] Schedule demos: Securitize, Tokeny, Fireblocks, Chainlink 3. [ ] Draft token economics model (supply, price, yield, fees) 4. [ ] Build financial model with 3 scenarios (base, bear, bull) 5. [ ] Recruit CTO or lead blockchain developer
Month 1 deliverable: Signed engagement letters (counsel, platform, custody), jurisdiction decision, regulatory strategy memo, technical architecture document, budget approved.
The clock starts when you sign the first engagement letter. Every week of delay compounds – legal opinions take 3-4 weeks, audit firms book 8-12 weeks out, custody onboarding is 4-6 weeks. Parallelize everything after Week 3.
This playbook is based on market conditions, vendor offerings, and regulatory frameworks as of 2024. Verify all assumptions with your counsel and vendors before committing capital. Regulations evolve rapidly, especially MiCA in the EU and potential US stablecoin/RWA legislation.