Not every token behaves the same way once it's in your wallet. Some move as freely as sending an email — to anyone, anywhere, with no one's approval required. Others are locked down from the start, restricted to a small list of pre-approved addresses, unable to go anywhere the issuer hasn't explicitly allowed.
This distinction — permissionless versus permissioned — doesn't show up in a token's price chart or its ticker symbol. It's built into the smart contract itself, and it quietly determines what you can actually do with an asset once you hold it. Understanding which kind of token you're dealing with matters for anyone interested in self-custody, using DeFi, or holding tokenized stocks.
This article is for educational purposes only and does not constitute financial advice. Always conduct your own research before participating in any onchain financial product.
Jump To:
- Terms to Know
- What Makes a Token Permissionless
- What Makes a Token Permissioned
- Why Permissioned Tokens Exist
- The Trade-Offs
- How This Shows Up in Practice
Terms to Know (HTML Accordion)
- Permissionless token: A token that can be sent to any wallet and used in any smart contract without requiring approval from a central authority.
- Permissioned token: A token with built-in restrictions, typically requiring an address to be added to an approved list before it can send or receive the asset.
- Allowlist / whitelist: A list of approved wallet addresses that a permissioned token's smart contract checks before allowing a transfer.
- KYC (Know Your Customer): The process of verifying the identity of a user, commonly required before an address can be added to an allowlist.
- Composability: The ability of a token to be used as an input into other onchain protocols — such as being deposited as collateral or paired in a liquidity pool. Composability is generally unavailable for permissioned tokens.
- Self-custodial wallet: A crypto wallet where the user holds their own private keys and has full control over their assets, without relying on a centralized exchange or custodian. Why self-custody matters →
What Makes a Token Permissionless
A permissionless token is one that can be sent to any crypto wallet, used in any smart contract, and traded on any exchange, without needing approval from anyone. There's no gatekeeper checking who's allowed to hold it or transfer it. The token's rules are enforced purely by code, and that code doesn't discriminate based on who's asking.
This is the default behavior most people associate with crypto. Ether, Bitcoin, and most tokens on Ethereum and other compatible blockchains are permissionless. If you have a wallet address, you can receive them. If you hold them, you can send them to anyone else, deposit them into a lending protocol, provide them as liquidity, or use them as collateral — all without requiring clearance from any institution.
This attribute is a big part of why self-custodial wallets work the way they do. Because permissionless tokens don't rely on a central party to approve each transaction, a wallet holder has genuine, unrestricted control over their assets.
What Makes a Token Permissioned
A permissioned token has built-in restrictions written directly into its smart contract. Typically, this means an address must be added to an approved list — often called an allowlist or whitelist — before it can send or receive the token at all. Attempt to transfer a permissioned token to an address that isn't on the list, and the transaction will simply fail, regardless of whether you have the funds or the gas to pay for it.
This isn't a bug or an oversight. It's a deliberate design choice, and it shows up most commonly in tokenized securities and other regulated real-world assets. A tokenized stock or bond, for example, may need to restrict transfers to addresses belonging to verified, KYC'd investors, because the underlying security is subject to securities law that doesn't disappear just because the asset moved onchain.
Why Permissioned Tokens Exist
The restrictions aren't arbitrary — they typically trace back to a handful of real obligations that issuers can't simply opt out of.
Securities law compliance. Many jurisdictions restrict who can hold certain securities. For example, this can limit an offering to accredited investors, or exclude investors from certain countries entirely. A permissioned token can enforce these restrictions directly at the contract level, rather than relying on manual checks after the fact.
AML and KYC obligations. Anti-money-laundering regulations often require financial institutions to know who they're transacting with. Permissioned tokens let an issuer maintain that visibility even as the asset moves between wallets.
Issuer risk management. Some issuers restrict transfers simply to reduce their own regulatory or reputational exposure, keeping their token within a known, vetted set of participants rather than allowing it to circulate freely to addresses they have no visibility into.
None of this is unique to crypto — it mirrors restrictions that already exist in traditional finance, like the transfer restrictions on private securities or funds limited to qualified purchasers. Permissioned tokens are, in effect, an attempt to bring those existing rules onchain rather than eliminate them.
The Trade-Offs
Neither structure is simply "better" — each comes with a different set of trade-offs depending on what the token needs to do.
Permissionless tokens offer full DeFi composability. They can move freely between wallets, be deposited into lending markets, paired in liquidity pools, or used as collateral without any friction. They preserve genuine self-custody and global access, since no one can be excluded from holding or using them. The trade-off is that this same openness makes it harder for an issuer to enforce any kind of regulatory restriction after the token is live — which is part of why permissionless design is not always well suited to regulated securities.
Permissioned tokens can satisfy real regulatory requirements, which makes them a more natural fit for institutional-grade tokenized securities. The trade-off is a meaningful reduction in composability and user autonomy. A permissioned token generally can't be freely used across DeFi protocols, and holders’ access depends on whoever controls the allowlist. In practice, this can recreate some of the same friction associated with a centralized platform, just wrapped in onchain infrastructure — sometimes described as a "walled garden" version of tokenization.
How This Shows Up in Practice
The clearest real-world example of this distinction is in the tokenized stock space. Not all tokenized stocks are built the same way, and permissionlessness is one of the core factors that separates them. Some platforms issue tokens that move freely across DEXes, wallets, and smart contracts. Others require KYC for every transfer and restrict movement to whitelisted addresses only — meaning the token, despite technically living onchain, doesn't behave much differently from a traditional brokerage holding. We cover this in detail, along with the other factors that distinguish tokenized stock platforms, in our article Are All Tokenized Stocks the Same?
Stablecoins offer another useful comparison point. Most major stablecoins are permissionless by default, moving freely like any other native crypto token — though some issuers do reserve the ability to freeze specific addresses under certain circumstances, which is its own, narrower form of restriction. For a broader look at how stablecoins work, see our overviews and comparisons of popular stablecoins.
Thank you for checking out our article on Permissioned vs Permissionless Tokens! Make sure to follow us on X(Twitter) and let us know your thoughts. Sign up for our newsletter to stay up to date with MEW releases, and check out our weekly podcast Crypto Currents for the latest news in crypto. on how these concepts apply to real-world assets, check out our articles on Are All Tokenized Stocks the Same? and What are Real-World Assets (RWAs).