Over the past quarter, a specific sentence has been repeated across RWA Telegram channels, family-office group chats, and at least two institutional research notes I reviewed: "Cardano just shipped a programmable token standard for regulated assets." That sentence is false in the only way that matters to a portfolio. CIP-113, the specification the Cardano Foundation has spent years shepherding toward ratification, has been merged into the CIP repository. That is the complete extent of what "shipped" means today. The document remains in Proposed status. There is no Preview activation, no mainnet activation, no published end-to-end test suite, and no wallet implementation. Based on my audit experience, the distance between "merged" and "live" is precisely where retail capital gets liquidated while institutions wait for a second confirmation. I have watched this movie before โ in 2017, I hand-audited ten small-cap tokens whose whitepapers described live systems that were still Solidity sketches in a private repository. The language of completion always arrives months before the code does. CIP-113 is following the same script, and the market is reading the press release instead of the deployment pipeline.
Context
CIP-113 is not a token, a chain, or a fund. It is a token standard โ a specification for how native assets on Cardano declare and enforce issuer-controlled transfer rules while remaining inside the extended UTXO (eUTXO) accounting model. If that sentence reads like compliance boilerplate, that is exactly the point. The standard exists to make Cardano legible to regulated issuers: stablecoin operators, tokenized treasuries, securities platforms, and RWA desks that need the ability to freeze a balance, maintain a denylist, or restrict transfers to a whitelist of verified counterparties. On Ethereum, that capability lives inside a token contract such as ERC-3643 or ERC-1400. On Solana, it lives in Token-2022 via transfer hooks and a freeze authority. On Cardano, the pitch is structurally different: because native assets are not contracts but ledger-level entries, the control logic is expressed through script-based transfer rules attached to an asset's policy, and the underlying eUTXO model is preserved rather than abandoned.
The contributors are not anonymous. The Cardano Foundation is driving the specification, and Matteo Coppola, CEO of Fluid Tokens, is named as a contributor โ a detail I will return to, because it matters that the principal author's commercial business is tokenization. The specification has been in development for years, which the ecosystem reads as rigor and I read as friction. A multi-year development cycle for a feature that Solana and Ethereum already run in production is not a maturity signal; it is a velocity signal, and it points the wrong way.
The strategic context is a bear market that has rewarded survival over speculation. Cardano's native-asset design was always elegant: unlike ERC-20s, native assets need no deployed contract, no gas-guzzling transfer logic, and no per-token attack surface. That elegance is a genuine advantage โ until you ask the ledger to enforce asset-level restrictions. The ledger does not store "token balances" the way an account-model chain does. It stores UTXOs โ discrete outputs โ and a single output can carry ADA, token A, token B, and token C simultaneously. This is efficient. It is also the source of every hard problem in this specification. On Ethereum, freezing token A is trivial and surgical: you mutate one mapping inside one contract, and no other asset notices. On Cardano, freezing token A means acting on the output that contains it โ and that output almost certainly contains something else. The control mechanism cannot be surgical, because the ledger gives it no scalpel. It has a hammer, and everything in the box is a nail. Every downstream consequence in this article flows from that single architectural fact.
Core
Let me be precise about the failure mode, because vagueness is how counterparty risk hides.
When an issuer attaches a restriction to token A, and a user holds an output containing A, B, and ADA, the restriction does not politely confine itself to A's portion of the output. The output is atomic. To enforce a block on A, the ledger must either prevent the output from being spent at all or invoke a separation procedure to split A away from everything else. The specification's answer to this is a mechanism the contributors call "unfracking" โ a reconstruction-and-separation process that theoretically allows a restricted token A to be detached from unrelated tokens B and ADA, preserving their spendability.
That word โ theoretically โ is doing enormous work, and it should make every risk officer sit up. The unfracking path is not a user right. It is a procedure that must satisfy rules the issuer registered in advance. Separation can require an additional signature, a script condition, or a full block. In plain terms: the right to unbundle your own assets from a frozen token is held by the party that froze the token, not by you. You do not control the key to your own escape hatch. This is a governance fact disguised as a technical footnote, and it is the single most under-discussed aspect of the standard.
The reference implementation recommends something called "single-policy outputs" โ constructing outputs so that each carries only one asset policy, which would eliminate the shared-output contamination problem at the source. If every output held exactly one asset, freezing A could never touch B, because B would live in its own output. Elegant. Also voluntary. The verifier does not enforce single-policy construction. The reference implementation calls it the "preferred" construction and stops there. That gap between "preferred" and "enforced" is where ecosystems fragment, and I have seen exactly this pattern before.
During DeFi Summer in 2020, I ran a $500k DAI/ETH pool on Uniswap V2 and lost 30% of principal to impermanent loss and gas erosion โ not because any single component failed, but because the composition of the position drifted from the model under stress. I recalculated the break-even points with stochastic calculus afterward, and the lesson was not "the protocol is bad." The lesson was that an unenforced convention is not a guarantee. If wallets and DApps do not uniformly adopt single-policy outputs, users will experience a fragmented, unpredictable landscape where the spendability of their assets depends on which wallet built the transaction. Some wallets will isolate policies; some will batch. The same holdings, in two different wallets, will carry two different risk profiles. That is not a UX inconvenience. That is a solvency-relevant ambiguity, because spendability is the substrate on which every liquidation engine runs.
Now trace that into DeFi, where the consequences stop being theoretical.
A lending protocol on Cardano that accepts token B as collateral must, under CIP-113, evaluate whether B shares outputs with any issuer-controlled asset that could be frozen. If it does, then during a sharp drawdown โ exactly when liquidators need to seize and sell collateral โ the issuer's restriction could block the output, the liquidation could fail, and the protocol could carry bad debt. The specification's authors are aware of this; the material notes that lending protocols must assess whether collateral can be frozen by an issuer, or they absorb liquidation risk. But "must assess" is a warning, not a solution. Most DeFi protocols are not structured to underwrite third-party issuer behavior as an ongoing counterparty exposure. They are structured to price volatility, not to price the discretion of a compliance officer at a stablecoin issuer.
Walk through the scenario concretely, because this is where a desk loses money. Suppose a user deposits tokenized treasury X as collateral to borrow stablecoin Y. X is CIP-113 compliant, issued by a regulated custodian with freeze authority. The user's collateral output, under a batched wallet, also carries a small balance of an unrelated regulated security token Z. The issuer of Z exercises a freeze โ perhaps for a legitimate compliance reason, perhaps by error. Under single-policy construction, X would be untouched. Under batched construction, X and the ADA in that output are now entangled with Z's frozen state. The liquidation engine fires during a drawdown, attempts to seize X, and discovers the output is not spendable. The protocol cannot liquidate. The debt goes bad. No contract was hacked. No oracle failed. The architecture simply transmitted one issuer's discretionary action into an unrelated position. That is contagion by output composition, and it is invisible on any dashboard until it triggers.
This is where my 2022 experience becomes directly relevant. In May 2022, I held 15% of my portfolio in algorithmic stablecoins, trusting the code over the incentives. When TerraUSD's peg broke, it broke in seconds, and the correlated assets broke with it. I liquidated into BTC and ETH within minutes and preserved 80% of capital, but the lesson was not about Terra specifically. The lesson was that correlated dependencies โ assets that appear independent but share a hidden common failure mode โ are the real tail risk. CIP-113 introduces a new correlation axis: any asset that shares an output with an issuer-controlled token now shares that issuer's freeze decision as a common failure mode. Two tokens that look uncorrelated on a returns chart become perfectly correlated the moment a single compliance action freezes the output they share. A portfolio built on the assumption of independence would be wrong in exactly the scenario it was designed to survive.
The ADA exposure deserves its own line, because it is the most underestimated part of this. Every output that carries a native asset also carries ADA โ that is how the eUTXO ledger works. Which means ADA itself can become temporarily inaccessible when it is co-located in an output with a frozen token. The market's mental model is "ADA is the base asset; it is always liquid." Under CIP-113, that model is incomplete. ADA is not frozen in the sense of being confiscated, but it can be stranded in an output whose spendability is gated by an issuer's rule. For a chain whose entire institutional pitch rests on ADA as the settlement asset, the idea that ADA can be transiently locked by a third party's compliance decision is a material disclosure that no one is making.
There is a further wrinkle that the specification addresses only by assertion. The material insists that "blocked does not equal confiscated" โ that an issuer's control over token A does not confer ownership of token B or the ADA in the same output. Legally, that boundary is important, and drawing it explicitly reduces litigation risk. But consider the long-duration case. If token A's policy permanently blocks separation, then token B and the ADA in that output are, in practice, inaccessible indefinitely. The owner retains legal title and loses practical use. The gap between "you still own it" and "you cannot move it" narrows to zero as the block persists. Freezing is not confiscation โ until it is permanent, at which point the distinction is a lawyer's comfort and an accountant's write-down. For a family office holding tokenized treasuries as collateral, the difference between title and access is the difference between a marked position and a frozen one.
Let me put a number on the complexity, because complexity is where audits fail. The reference implementation preserves unrelated token balances through the unfracking logic โ which means the underlying scripts must model, track, and reconstruct multi-asset outputs while respecting issuer-registered separation rules. That is a lot of state for a validator to reason about correctly. Every additional branch is an additional place where a script can be wrong. And here is what the source material does not contain: any mention of an independent security audit. Not a name, not a firm, not a scope document, not a formal verification effort. For a standard whose entire purpose is to govern who can move whose assets, the absence of disclosed audit information is not a neutral gap. It is a red flag, and it is the one I would raise first in any investment committee.
I have audited reentrancy in lending protocols by hand, before tooling caught up, and I can tell you the failure modes that matter are never the ones the documentation describes. They are the ones the documentation assumes away. Here the documentation assumes that single-policy outputs will be adopted, that unfracking will be available when needed, and that issuers will exercise freeze authority responsibly. All three are behavioral assumptions wearing technical clothing. Audits don't secure architecture; they price the risk of not reading it. And no amount of reading substitutes for a codebase that has actually been adversarially tested in public.
Contrarian
Here is the counter-intuitive claim, and it cuts against both the bulls and the reflexive critics.
The bulls say CIP-113 is a compliance feature that unlocks institutional capital for Cardano. The critics say it is a capitulation to surveillance and a betrayal of crypto's censorship-resistance ethos. Both are arguing about the wrong layer. The real story is that CIP-113 hands a discretionary control surface to issuers while the ledger architecture makes that control non-surgical โ and neither side has priced the second half of that sentence. The compliance capability is not the risk. The shared-output contagion is the risk, and it is a risk that exists precisely because Cardano chose an elegant accounting model that was never designed for asset-level control.
This produces a paradox the standard cannot resolve. To be attractive to regulated issuers, CIP-113 must offer credible freeze authority. To be safe for DeFi composability, it must confine that authority to single assets. But the eUTXO model makes confinement expensive and voluntary, so the standard optimizes for the former and hopes for the latter. The result is a standard that is maximally attractive to issuers and maximally fragile for the DeFi protocols that will be forced to integrate it as collateral. DeFi, in other words, does not get a vote โ it gets an exposure.
Now, the narrative gap. Coppola has described the standard as "production-ready." The official page lists it as Proposed, requiring Preview and mainnet activation, end-to-end testing, and wallet support before it can be considered live. When a principal contributor and the official status disagree about how finished a specification is, that disagreement is information. It tells you the ecosystem's internal estimates of readiness are not aligned, and it tells you that promotional language is running ahead of the deployment pipeline. I have seen this exact pattern in every cycle: the word "ready" is a marketing term, not a deployment state. A merge is not a mainnet. A standard is not adoption.
And the competitive frame matters more than Cardano loyalists admit. Solana's Token-2022 already ships transfer hooks, freeze authority, and transfer fees in production. Ethereum's ERC-3643 and ERC-1400 already serve securities-token issuance with the deepest institutional acceptance in the market. Cardano is not defining this category; it is arriving late to it. The eUTXO architecture is a genuine differentiator, but differentiation that increases integration cost is a tax on adoption, not a subsidy. The honest positioning is that Cardano is a catch-up participant with an unusual technical path โ not a first mover.
There is also the question of who ultimately governs the standard. The material is candid that the compliance rules are set by issuers, and that CIP-113's principal contributor, Fluid Tokens, runs a tokenization business that stands to benefit directly from the standard's adoption. That is not an accusation; it is an alignment fact. When the author of a standard has a commercial stake in its success, the standard's design will tend to favor the author's business model. Nothing in the disclosed material establishes how conflicts of interest are managed, how issuer authority is bounded, or how a holder remedies an abusive freeze. On Cardano โ a chain that markets itself on academic rigor and decentralized governance โ introducing an issuer-controlled asset layer with undefined accountability is a philosophical pivot, not a feature update. The community may not have fully reckoned with it, and the Voltaire governance era has not yet produced a mechanism to arbitrate the conflict between an issuer's freeze authority and a holder's property rights.
Consider what this means for capital efficiency, because it is the part institutions will discover last and resent most. If compliance assets and permissionless assets cannot freely co-mingle in a single output, the ecosystem will bifurcate into two liquidity zones: a controlled zone where issuance is clean but composability is constrained, and an open zone where DeFi is free but cannot touch the regulated assets. Two zones mean two sets of pools, two risk models, and a persistent friction at the boundary. Cardano's selling point to institutions was unified liquidity. CIP-113, as specified, tends to fragment it โ and fragmentation is a tax on capital that shows up as a lower real yield, which is the only metric a treasury desk ultimately cares about.
Takeaway
So here is what I am watching, and what I would tell any desk considering Cardano compliance exposure.
Do not trade the standard. Trade the adoption. The catalyst that matters is not the CIP merge, which is already priced at approximately zero because the market cannot price infrastructure it cannot use. The catalyst is a named, regulated issuer announcing that it will launch a stablecoin, a tokenized treasury, or a securities product on CIP-113. Until that announcement exists, CIP-113 is expected value, not realized value. And note the asymmetry: USDCx, Circle's reserve-backed stablecoin on Cardano, is already live and already delivers dollar liquidity and DeFi composability. Its contribution to Cardano's on-chain economy is immediate and measurable. CIP-113's contribution is contingent and unmeasured. If you must choose which to underwrite today, the answer is not close.
Then watch the wallets. The success or failure of CIP-113 will be decided at the wallet layer, where implementations must track which policies share an output, what permissions each asset currently carries, and whether a blocked token can be separated. If wallets do not converge on single-policy output construction, users will face fragmented spendability, and DeFi protocols will inherit collateral they cannot reliably liquidate. That is the systemic risk, and it is silent until it is not.
The question I keep returning to is the one the specification never answers: when an issuer freezes a token and the unfracking rules deny separation, who bears the loss โ the issuer who froze, the holder who is locked out, or the DeFi protocol that accepted the frozen collateral as safe? Until that liability is defined, CIP-113 is a compliance capability without an accountability model. In a bear market, that is not a feature. It is an open position against the people who trust it.