Where EthSystems' private fund design fits among the ways Asian funds keep their register

A tokenised money market fund has two records that can differ: the legal register of who holds its units, and the ledger the tokens move on. The register decides whose record counts in law. The ledger decides who can see the fund’s holders.

The problem

A fund manager that tokenises a money market fund chooses three things at once: who keeps the register, which ledger records transfers, and who can read that ledger. On a public chain the third choice is made for it. Anyone can read each wallet’s balance and every subscription, redemption and transfer, so a fund on a public chain shows its shareholder book to anyone who finds the contract. On Ethereum, anyone can see that FundBridge Capital’s ULTRA fund has five holders, and that its contract minted 25 million units on 4 September 2026 and redeemed about the same five days later (pilot entry). One address holds nearly all of the token DigiFT issues against CMBI’s USD money market fund (pilot entry). Hiding balances inside the token does not fix this: a permissioned token such as one built to ERC-3643 checks the receiving wallet and the holder limits before each transfer, and EthSystems points out that “the token’s compliance rules read public state” (EthSystems, 23 October 2026).

The choice is live in all four markets this autumn. The Securities and Futures Commission (SFC) has allowed tokenised SFC-authorised funds to trade on licensed platforms since 20 April 2026, retail investors included (Wire). On 9 October 2026 the Monetary Authority of Singapore (MAS) said it is reviewing aspects of tokenisation that may need further legal clarification (Wire, para 11). Mitsubishi UFJ Asset Management set up Japan’s first domestic tokenised investment trust on 31 August 2026 (pilot entry). South Korea’s Financial Services Commission (FSC) is consulting until 11 November 2026 on the rules for token securities, which take effect on 4 February 2027 (FSC, 1 October 2026).

How it works

Some terms first. A register is the fund’s legal record of who holds how many units; a transfer is complete in law when the register changes. A registrar, called a transfer agent in some markets, keeps it. A ledger is the shared record that tokens move on. A node is a computer that keeps a copy of a ledger and can read it. A public chain such as Ethereum lets anyone run a node. A permissioned ledger admits only nodes its operator approves.

Model	Who keeps the legal register	Who can read holdings on the ledger	Example
Shielded pool on a public chain	Registrar, rebuilt from encrypted notes	The registrar reads all holdings; each holder reads only its own notes, and a custodian running a holder’s wallet only its clients’; the public sees daily totals	EthSystems design, proof of concept
Offchain register, token as a copy	Trustee or registrar, offchain	The registrar; anyone who finds the contract address, if the chain is public	CSOP, Bosera and ChinaAMC, Hong Kong
Platform-issued token linked to the fund	The fund’s own registrar; how the platform holds fund shares is not published	Anyone, for the platform’s token	CMBI USD fund through DigiFT, Hong Kong fund sold in Singapore
Token is the register, public ledger	The token record	Anyone	Franklin Templeton sgBENJI, Singapore; FundBridge Wellington ULTRA, Singapore, register status not confirmed
Register on the trust bank’s platform ledger	Trustee, on the ledger	Not published; the law puts holders’ names and addresses in the register	MUFG test fund on Progmat, Japan
Register on a depository-screened ledger	Account management institutions, on a ledger shared with the Korea Securities Depository	The ledger’s participants; rules on visibility not yet published	South Korea, from February 2027
Book-entry register mirrored on a need-to-know ledger	Book-entry institutions, offchain	Each party sees only its own trades	MUFG’s JGB repo test on Canton, Japan

Sources: the pilot entries linked under “In our markets”, the FSC releases of 4 September and 1 October 2026, and the EthSystems specification.

The shielded pool is the only model that keeps a public chain and hides positions on it, using cryptography. Canton gets a similar result on a permissioned ledger by sending each party only its own trades. The DigiFT model shares the pool’s structure, with investors holding an intermediary’s token rather than sitting on the fund’s register, but the token is public, so it hides nothing. The others rely on where the register sits and who may join the ledger. The walk-through below follows one subscription through the shielded pool. The steps follow the EthSystems specification, version 0.1.0, a draft for a proof of concept.

One subscription, transfer and redemption through a shielded pool

The fund token sees one holder, the pool. Inside the pool, amounts and owners are encrypted; only the registrar can read every note. Numbers match the steps below.

InvestorWallet and custodian signer
RegistrarRegister of record
Shielded poolEncrypted notes
Fund tokenWhitelisted

1From Investor to Registrar: Gives its keysPublic keys and its secret spending-detection key
From Registrar to Shielded pool: Attests the investorAttestation with an expiry date
2From Investor to Registrar: Pays cashOffchain
From Registrar to Shielded pool: Deposits the day's totalOne public amount for all orders
From Shielded pool to Fund token: Pulls fund shares
3From Registrar to Shielded pool: Splits the total into one note per order
4From Investor to Shielded pool: Proves and spends a note to another investorCustodian signs; recipient must be attested
From Shielded pool to Registrar: Encrypted copy of every new note
5From Investor to Registrar: Sends its note to the registrar
From Registrar to Shielded pool: Withdraws the day's redemptions
From Registrar to Investor: Pays cashOffchain

Encrypted message between the firms, offchain
Transaction on the blockchain

Source: EthSystems, Shielded notes specification v0.1.0, and Building private money market funds on Ethereum, 23 October 2026The Monsoon Ledger

Onboarding. The investor gives the registrar its public keys and its spending-detection key, which is secret; the registrar uses it to recognise when the investor’s notes are spent. The key that authorises spending stays in the custodian’s hardware security module or multi-party signer. The registrar records an attestation, a signed statement that the key belongs to an eligible investor, in an onchain registry. Attestations expire and are renewed each period.
Subscription. The investor pays cash to the registrar offchain. Once a day the registrar deposits the day’s total subscriptions into the pool in one public transaction, and the pool takes the matching fund tokens. Anyone can see the total, but not how it splits between investors.
Hand-out. The registrar divides the deposit into one note per order: a private record of units, published onchain only as a commitment that hides its contents. The investor’s wallet decrypts its own note.
Transfer. The investor sends units to a second attested investor. Its wallet builds a zero-knowledge proof, which shows the transaction follows the pool’s rules without revealing amounts or owners. The custodian rebuilds the transaction from its fields and signs it. The proof also shows that the transaction carries an encrypted copy of each new note for the registrar, which is how the register stays complete without asking holders.
Redemption. The investor transfers its note to the registrar, which withdraws the day’s redemptions from the pool and pays cash offchain.

Income needs no transaction. The fund reinvests into the pool’s token balance, and each note’s value rises with the pool’s balance per unit. The registrar can also freeze a note or move its value to a beneficiary through a separate path signed by its own key; onchain this looks like an ordinary transfer. A transfer costs about 3.2 million gas, the unit of Ethereum’s transaction fee (EthSystems).

In the Japanese model the same subscription ends with the trustee recording the new holder’s name and address in a register kept on the platform ledger. In the Hong Kong model it ends with the registrar’s offchain entry, and the token mint is a copy.

Why it is built this way

Each model puts the register with a party the fund already relies on: a trustee, a trust bank or a transfer agent. None of the live funds hands the legal record to a public chain alone. Where the token is the register, as at sgBENJI, the fund manager’s own platform writes it; at ULTRA the administrator keeps an offchain copy alongside it.

The models differ in how much the registrar’s role grows. In the offchain model it does what it did before tokenisation. In the Japanese and Korean models it runs or joins the ledger. In the shielded pool it becomes the only party that can read the fund’s holdings, and EthSystems lists the cost: it holds every investor’s spending-detection key, the key that decrypts the register and the key that freezes and seizes. If it stops, subscriptions and redemptions stop; if it is breached, every position is exposed.

The choice is driven by the holders. A treasury or fund that parks cash in a money market fund will not want a competitor or counterparty reading its position and every subscription and redemption from a public ledger. That pushes managers either off public chains, onto ledgers whose participants they admit, or towards designs like the shielded pool, which keep a public chain and hide positions on it. Live funds show a third route: an intermediary between the holder and the chain. Investors in CMBI’s tokenised fund are not on its register; they hold a DigiFT product linked to it (pilot entry). The holders of ULTRA and of DigiFT’s CMBI token on Ethereum are unnamed addresses and multisig wallets, so a 25 million unit position is public but not attributed (Blockscout: ULTRA holders). No fund manager or holder in Singapore, Hong Kong, Japan or South Korea has said so publicly, so this reading rests on inference.

In our markets

Singapore

MAS’s tokenisation guide asks issuers to disclose whether ownership records are kept on or off the ledger and, where there are two, which is definitive of legal ownership (MAS guide, 14 November 2025, para 3.7). It sets no rule on where the record must sit or who may read it.

Franklin Templeton sgBENJI: Franklin Templeton calls the register tokenised, and ADDX says the fund records ownership of units on a public blockchain. MAS authorised the fund for sale to the public.
UBS uMINT: Ethereum mainnet. UBS Asset Management has not said whether the token is the register.
FundBridge Wellington ULTRA: a Singapore unit trust sub-advised by Wellington Management, with units issued as tokens on Ethereum, Arbitrum and Avalanche to whitelisted wallets and a US$200,000 minimum. FundBridge Capital says its administrator keeps an offchain copy of the unitholder register, which points to the token as the register; the trust deed is not public.

Hong Kong

The SFC requires the product provider to ensure proper records of token holders’ ownership interests, and keeps it responsible for them even when it outsources the work. It says providers “should not use public-permissionless blockchain networks without additional and proper controls”, with a permissioned token as the example (SFC circular, 20 April 2026, paras 10, 11 and 13). It does not say where the register must sit.

Product Providers should not use public-permissionless blockchain networks without additional and proper controls.

SFC, Circular on tokenisation of SFC-authorised investment products, 20 April 2026, para 13

CSOP: HSBC, as trustee and registrar, keeps the official register offchain, and the chain holds a representation. The chain is not named.
Bosera: the custodian keeps the offchain register as registrar. Tokens sit on HashKey Chain, an Ethereum layer 2, behind a contract whitelist.
ChinaAMC: ChinaAMC does not say whether its token is the register. Like CSOP and Bosera, it has published no contract address.
CMBI USD money market fund: DigiFT issues a token linked to the fund and sells it to accredited investors in Singapore; CMBI says the token is DigiFT’s product, not its own. The token’s Ethereum and BNB Chain contracts are known, and its seven Ethereum holders can be read by anyone.

Japan

Japan has the most specific law of the four. Under the Trust Act, the trustee of a trust that issues beneficiary certificates must keep a register of beneficial interests recording each holder’s name and address, and a transfer binds the trustee and third parties only once the acquirer is entered in it (Trust Act, arts 186 and 195). A record on a blockchain alone does not bind third parties. The Industrial Competitiveness Enhancement Act, amended in 2021, lets a transfer notice given through an approved information system count as notice with a certified date. On 29 March 2022 the Minister of Justice and the Minister of Economy, Trade and Industry approved a test by Mitsubishi UFJ Trust and Banking of Progmat as such a system (Cabinet Secretariat, 29 March 2022).

MUFG tokenised money market fund: beneficiary certificates, with the register kept onchain. A register that must hold names and addresses cannot be readable by anyone unless those details are kept off the chain or encrypted; neither MUFG release says how the fund does this, or names the chain.
MUFG JGB repo test on Canton: the book-entry record stays the legal one, and each party sees only the trades it is party to (Canton privacy model).

South Korea

Korea writes the register into statute from 4 February 2027, when amendments to the Act on Electronic Registration of Stocks and Bonds and the Financial Investment Services and Capital Markets Act take effect. Token securities are then “legally recognized as a digitized form of securities” (FSC, 4 September 2026). No tokenised fund exists yet.

The first phase covers privately placed money market funds and bonds reserved for institutional investors, unlisted shares held in trust, and publicly offered fractional investment securities (FSC, 4 September 2026).
The Korea Securities Depository (KSD) is the registration entity, and screens and tests each distributed ledger before a securities firm connects to it.
Each ledger must be shared between the KSD and at least two account management institutions (FSC, 1 October 2026).
An issuer with at least KRW 4 billion of equity capital may manage its own investors’ accounts.
Neither release says whether a public chain can pass the screening, or who may read the ledger.

The case against

The shielded pool keeps a public chain’s reach, but its privacy is thin for a small fund. EthSystems’ own example is a fund with 40 holders: a US$2 million subscription on a quiet day shows as a public deposit of that size followed by one hand-out, and a short list of holders narrows quickly. The live funds are smaller still: ULTRA has five holders on Ethereum and DigiFT’s CMBI token seven (ULTRA; CMBI), so a pool over either would hide little. That is a deployment choice rather than a limit of the design. EthSystems says padding the hand-outs with dummy transfers, or netting redemptions against the next day’s hand-outs, would hide the counts, and a pool shared across funds would widen the set; none of them is built (EthSystems). The pool also depends on the token issuer not using its force-transfer or burn powers on the pool’s balance. The code is a proof of concept with no audit (EthSystems).

The Hong Kong model hides holders only while the contract address stays unpublished. Secondary trading on licensed platforms, allowed since April 2026, will put the tokens in more hands and make the address easier to find.

For Ethereum

ULTRA runs its redemptions in the token contract itself, which requests and then completes them (pilot entry). Progmat, which hosts MUFG’s fund, finished moving all its security tokens from a private Corda ledger to an Avalanche layer 1 in July 2026, with its contracts ported to Ethereum’s execution environment, according to Ava Labs, the developer of Avalanche (Avalanche blog, 10 July 2026). The post does not say who runs the validators or who can read balances.

Japan’s and Korea’s register rules leave room for Ethereum, if a design hides holdings and keeps the registrar’s record complete. Neither rules out a public chain. Korea’s releases are silent on it, and Japan’s Trust Act asks for a complete register with holders’ names and addresses, which a registrar in a shielded pool could keep in full while the chain shows only commitments. No regulator has assessed such a design. The KSD’s screening criteria, or a Japanese trust bank’s statement on whether its register could sit on a public chain, will show whether the room is real.

Once tokenised funds trade between institutions, the shielded pool, or a design like it, holds up best. It is the only model that keeps a public chain’s reach and hides positions on it: the offchain register leaves holdings readable by anyone who links the address, and a platform ledger reaches only the participants it admits. It holds up only if its anonymity set grows beyond a handful of holders: for a fund the size of ULTRA, with five holders on Ethereum, or DigiFT’s CMBI token, with seven, that means padding, netting or a pool shared across several funds. Two other things stand in its way: the code is unaudited, and no regulator in the four markets has said whether a register rebuilt from encrypted notes, or a pool that stands in for every holder, meets its rules.

What to watch

South Korea’s final rules after the consultation closes on 11 November 2026, the KSD’s ledger screening criteria, and the first tokenised private money market fund after 4 February 2027.
An offer of MUFG’s tokenised fund to institutional investors before the end of 2026, and a release naming its chain.
MAS’s tokenisation legal review, and whether it covers the definitive record of ownership.
A published contract address for CSOP, Bosera or ChinaAMC, or the first trade of a Hong Kong tokenised fund on a licensed platform.
A DigiFT document showing how it holds CMBI fund shares, and FundBridge’s trust deed stating which ULTRA record is binding.
An audit of the EthSystems contracts and circuits, or a test with a real fund token and registrar.