Whitepaper · 09
Regulatory Compliance
How A-REX Core maps to the regimes that govern agricultural lots and the tokens that represent them. Dates and legal references were verified in September 2026; where a statement is an inference rather than a verified fact, it is marked. Nothing here is legal advice.
The position of the standard
A-REX Core does not classify the token. Whether a batch token is a security, a commodity, a crypto-asset under MiCA, an electronic warehouse receipt or a receivable depends on how it is offered, to whom, and what rights it carries — not on the interface. The standard's job is to make every one of those outcomes implementable: it ships the enforcement surface all of them require (freeze, forced transfer, eligibility, pause, auditable events), keeps personal data off-chain, and leaves policy to hooks and to the issuer's counsel.
This is a deliberate rejection of the argument "commodities, not securities, therefore no compliance stack". That argument is wrong as a matter of law and is discussed below.
Food traceability
FSMA 204 — FDA Food Traceability Rule (United States)
| Fact | Status (Sept 2026) |
|---|---|
| Rule | 21 CFR Part 1 Subpart S, final rule of November 2022 |
| Compliance date | 20 July 2028 (FDA extended the original 20 January 2026 date by 30 months; final rule of 7 August 2025; the Continuing Appropriations Act of 2026 bars enforcement before that date) |
| Scope | foods on the Food Traceability List (leafy greens, fresh-cut produce, tomatoes, peppers, cucumbers, melons, herbs, sprouts, shell eggs, nut butters, finfish, crustaceans, molluscs, soft cheeses, deli salads) |
| Obligation | maintain key data elements (KDE) at each critical tracking event (CTE): harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, transformation; produce an electronic sortable spreadsheet within 24 hours of an FDA request |
| Recommended format | GS1 EPCIS 2.0 (FDA guidance and GS1 US mapping of CTEs to EPCIS events) |
How A-REX maps:
| FSMA element | A-REX Core |
|---|---|
| Traceability lot code (TLC) | traceabilityLotCode in the metadata document, assigned by the packer — never derived from the token id |
| Product description, quantity, unit | commodity, totalSupply(id), unit |
| Location description of the TLC source | GLN in metadata; originRef commits to the record |
| Harvest / cooling / packing dates | producedAt plus dated events in metadata |
| Shipping / receiving | events of a traceability or delivery hook (TraceabilityHook, DeliveryHook), which record the physical movement; an ERC-1155 transfer on its own is a change of ownership |
| Transformation CTE (inputs → outputs with quantities) | transform → BatchTransformed(inputIds, inputAmounts, outputIds, outputAmounts, processRef); parentsOf |
| 24-hour production of records | events are indexable; the metadata schema fields are named after EPCIS/KDE so an exporter can emit the spreadsheet or an EPCIS document directly |
What A-REX does not do: it does not itself produce the FDA spreadsheet, and it does not hold the KDEs that are personal or commercial (addresses, contact names). Those are in the metadata document or in the restricted pointer.
EUDR — Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650
| Fact | Status (Sept 2026) |
|---|---|
| Application | 30 December 2026 for medium and large operators and traders; 30 June 2027 for micro and small operators. The Commission has stated there will be no third postponement. |
| Scope | cattle, cocoa, coffee, oil palm, rubber, soya, wood and listed derived products |
| Obligation | due-diligence statement (DDS) in the EU Information System with geolocation of plots; the 2025 amendment introduces a simplified declaration for primary operators and lighter duties for downstream operators, who keep DDS reference numbers for five years |
| Penalties | up to 4 % of EU turnover, confiscation, exclusion from public procurement |
How A-REX maps:
- The DDS reference number is what downstream operators must keep: it goes into metadata (
origin.eudr.ddsReference) and is committed byoriginRef. Precise plot geolocation stays in the EU Information System and in the operator's restricted storage, not on-chain. AttestationHookcan require an attestation with topicEUDR:DDSfrom a trusted issuer (the operator's compliance function or a verifier) before a coffee or cocoa batch can be transferred.transformpreserves the link from a roasted or processed batch back to the batches whose DDS references cover it.
GS1 EPCIS 2.0 and identifiers
The metadata schema uses EPCIS/CBV vocabulary (bizStep, disposition, readPoint, bizLocation) and GS1 identifiers (GTIN, LGTIN, SSCC, GLN, Digital Link). The standard's informative EPCIS mapping turns on-chain events into EPCIS events as follows:
| A-REX event | EPCIS 2.0 |
|---|---|
BatchCreated | ObjectEvent (ADD), bizStep = creating_class_instance for a lot, or commissioning when the issuer also assigns instance ids |
TransferSingle / TransferBatch | ObjectEvent (OBSERVE) with the owning parties; shipping / receiving only when the metadata or a traceability hook says the goods moved |
BatchTransformed | TransformationEvent (inputQuantityList, outputQuantityList, transformationID = processRef); bizStep = repackaging for a re-batch (split or merge of one product), creating_class_instance for processing |
BatchCreated with upstream references | TransformationEvent when the goods were processed from another token's batch, otherwise an ObjectEvent whose source is the supplier |
BatchStatusChanged | ObjectEvent with disposition change |
Attested | ObjectEvent (inspecting or sampling) with the certificate reference |
Fields that rules add under extensions (ADR-017, Proposed) travel in the lot master data (ilmd) of the creating event; a declared carbon footprint becomes arex:declaredFootprint and is never copied to the outputs of a transformation.
An indexer can therefore emit an EPCIS document from chain data without bespoke logic.
The legal nature of the token
United States
- Securities law. SEC v. W.J. Howey Co. (1946) concerned interests in citrus groves sold to passive investors with a service contract; the Supreme Court held them investment contracts. The test still governs. The SEC's interpretive release of 17 March 2026 (Release 33-11412) classifies crypto assets by the substance of the transaction and stresses issuer promises and marketing; it does not create a safe harbour for tokenized physical commodities. A batch token sold to investors expecting profit from the operator's efforts is likely a security; the same token held by a buyer who will take delivery likely is not.
- Commodities law. Spot commodity transactions between commercial parties are outside the Commodity Exchange Act's registration regime; forward contracts with intent to deliver are excluded; retail leveraged transactions require actual delivery within 28 days (CEA §2(c)(2)(D)). A pre-harvest batch (
producedAt == 0) is naturally a forward; how it is marketed determines the regime. The market-structure bill that would give the CFTC exclusive jurisdiction over "digital commodities" (CLARITY Act) failed cloture in the Senate on 15 September 2026 and is not law. - Warehouse receipts. Under the U.S. Warehouse Act electronic warehouse receipts are issued through USDA-authorized providers (7 CFR Part 869). A batch token may reference an EWR (
documents[].registry), not replace it. - UCC Article 12. More than thirty states have enacted the 2022 amendments on controllable electronic records; New York's took effect on 3 June 2026. "Control" of the token can perfect a security interest;
forcedTransferand freezing are compatible with that framework when documented. - GENIUS Act (July 2025). Applies to payment stablecoins, not to batch tokens, but it made "technological capability to comply with lawful orders to seize, freeze, burn or prevent the transfer" the market's baseline expectation for any token with a real-world claim. ERC-7943 provides exactly that surface.
European Union
- MiCA (fully applicable since 30 December 2024). A fungible batch token offered to the public in the EU is an "other crypto-asset" under Title II unless an exemption applies (fewer than 150 persons per member state, less than €1 million over 12 months, or qualified investors only); Recital 11 states that fractions of a unique asset are not "unique and non-fungible", so the NFT exclusion does not apply to lot fractions. If the token carries a right to income or is a share in a vehicle, ESMA's December 2024 guidelines push it toward MiFID II, where the DLT Pilot Regime applies.
- GDPR and the EDPB. Guidelines 02/2025 on blockchain, final version 2.0 adopted 7 July 2026: on-chain content and metadata are personal data in principle, hashing and encryption do not guarantee anonymisation, controllers should avoid storing personal data on-chain and should justify a public chain over a permissioned one. A-REX's
originRefrule and therestrictedpointer in the metadata schema exist because of this. - Digital Product Passport (ESPR). Food, feed and live plants and animals are excluded from the ESPR; A-REX makes no DPP claim for food. Fibres and wood may fall under future delegated acts. Where a buyer asks for a passport anyway, for example for a cotton lot, the standard's informative mapping to the UN Transparency Protocol 0.7.0 publishes the batch as a UNTP Digital Product Passport with its traceability events. That passport is evidence about the batch, signed by its issuer; it does not say that a regulation is met, and under the ESPR the manufacturer, not the token, issues a passport.
Latin America
- Argentina. CNV General Resolution 1150/2026 (June 2026) established the definitive regime for tokenized securities on real-world assets through registered virtual-asset service providers, after the 2025 sandbox. Grain tokens that represent certificates of deposit and warrants (Law 9.643) operate under the warehouse regime; a token that pools lots for investors is a security. The structure of the offer decides.
- Brazil. The electronic CPR (Cédula de Produto Rural, Law 8.929/1994 as amended by Law 13.986/2020) is registered with entities authorized by the Central Bank and is the dominant tokenized agricultural instrument. Tokenized CPR issuance exceeded R$ 400 million in January 2026. CVM is revising Resolution 88 (public consultation closed January 2026) to admit cooperatives and rural producers as issuers. A batch token in Brazil should reference the registered CPR-e or CDA/WA, not replace it.
- Paraguay adopted the UNCITRAL Model Law on Electronic Transferable Records (2021), which is the legal basis for electronic warrants; its securities regulator is evaluating the recognition of livestock tokens as digital warrants.
- Chile regulates virtual financial assets under the Fintech Law (21.521) with no commodity-specific regime yet.
Electronic transferable records
Where a jurisdiction has adopted UNCITRAL's MLETR (Singapore, United Kingdom via the Electronic Trade Documents Act 2023, France, Bahrain, Paraguay, ADGM, among others), an electronic bill of lading or warehouse receipt is valid if a reliable system ensures exclusive control. A batch token can satisfy the "exclusive control" test — the holder of the units controls them, and forcedTransfer provides the court-ordered transfer such laws contemplate — but only within MLETR jurisdictions; elsewhere the paper document still governs and the token references it.
Sanctions and anti-money-laundering
A-REX provides the mechanism, not the list: EligibilityHook (or any hook) answers canSend/canReceive; the source of truth is the issuer's screening provider. The token's forcedTransfer and setFrozenTokens give the issuer the means to comply with blocking orders. Every enforcement action is an event, which is what an examiner asks for.
Carbon and sustainability claims
Carbon credits and carbon footprints are different things, and A-REX keeps them apart.
Verra prohibits tokens on retired credits and accepts only immobilised credits as the basis for tokens; Gold Standard follows a similar policy. A carbon claim attached to a batch is therefore an attestation (AREX:CARBON:IMMOBILIZED, reference = hash of the registry record and immobilisation proof) written by CarbonImmobilizationWrapper, which records immobilisations, links tonnes to batches and mirrors retirements and releases; it never mints credits. The previous-generation carbon module, which generated its own serial numbers, has been replaced by it. In the EU, Directive 2024/825 on empowering consumers for the green transition treats unsubstantiated environmental claims as unfair commercial practices.
A product carbon footprint is a measurement, not a credit. ADR-018 (Proposed) lets a batch carry a footprint that a named third party calculated, copied from its PACT 3.0.3 ProductFootprint into extensions.pact_pcf of the metadata with an explicit verification status, and the verifier's name when it is verified. The footprint is never calculated, summed or passed on to the batches made from the lot, never netted against credits, and never described as "carbon neutral" or offset.
Privacy by design in the standard
| Rule | Where |
|---|---|
| No raw coordinates or natural-person identifiers on-chain | IARexBatch.originRef MUST NOT contain them (normative); the draft proposed with ADR-019 (Proposed) adds that it MUST NOT be derived from location either |
| Metadata document split into public and restricted parts | standard/schema/batch-metadata.schema.json (restricted pointer to geolocation and personal data held under access control) |
| Hash commitments instead of content | metadataHash, attestation ref |
| Permissioned deployment as a first-class option | chain-agnostic standard; EDPB-recommended |
| Erasure | on-chain data is hashes and references; the personal data they point to can be deleted, breaking the link |
Checklist for an issuer
- Determine the legal nature of the offer with counsel in each target jurisdiction (security / commodity / crypto-asset / warehouse receipt / receivable).
- Configure eligibility (KYC/KYB, sanctions) as a hook; keep the identity provider outside the token.
- Assign
ENFORCER_ROLEto a multisig with a documented procedure for lawful orders. - Publish the status table and the metadata schema version; assign TLCs at packing.
- For EUDR commodities, require the
EUDR:DDSattestation before transfer. - Keep plot geolocation and producer identity in restricted storage; put references on-chain.
- Reference — do not replace — legal instruments (EWR, CPR-e, CDA/WA, bills of lading) until the jurisdiction recognizes the token itself.
- Do not attach carbon or sustainability claims that are not registry-backed attestations; a declared footprint names who calculated it and whether it was verified, and claims nothing beyond that.
Sources
FDA compliance-date extension (Federal Register, 7 Aug 2025) · Regulation (EU) 2025/2650 and Council press release of 18 Dec 2025 · EDPB Guidelines 02/2025 v2.0 (7 Jul 2026) · SEC Release 33-11412 (17 Mar 2026) · GENIUS Act, P.L. 119-27 · UCC Article 12 enactment tracking (ABA, Wolters Kluwer 2026) · UNCITRAL MLETR and UK ETDA 2023 · CNV RG 1150/2026 (Boletín Oficial, 11 Jun 2026) · Brazil Law 13.986/2020 and CVM regulatory agenda 2026 · Verra statement on crypto instruments and tokens · ERC-7943 (Final, 27 May 2026) · GS1 US EPCIS recommendations for FSMA 204 CTEs · Regulation (EU) 2024/1781 (ESPR), Article 1(2) · UN Transparency Protocol 0.7.0 (UN/CEFACT, tag v0.7.0) · WBCSD PACT Technical Specifications 3.0.3. Full links in docs/history/REVISION-ESTANDAR-2026.md.