When issuers think about Reg D compliance, they typically focus on the federal layer: file Form D within 15 days of the first sale, verify accredited investor status, avoid general solicitation for 506(b) offerings. That federal checklist is correct as far as it goes. What many compliance teams discover six to twelve months later is that their state-level transfer restriction obligations have been running separately, largely untracked.
Transfer restrictions under Reg D are not exclusively a federal construct. The National Securities Markets Improvement Act of 1996 preempts state registration requirements for covered securities, which includes 506 offerings. What NSMIA does not preempt is state notice filing requirements, secondary-market resale exemption conditions, and transfer agent instructions that must reflect state-specific holding periods or investor qualification standards. Those obligations remain fully active.
What the Federal Layer Covers, and What It Does Not
Under Rule 144, restricted securities acquired in a Reg D offering carry a minimum one-year holding period before resale absent registration. For reporting companies, that drops to six months. That is the federal floor. States can and do set different conditions for secondary-market resales within their own borders.
A secondary transfer of a Reg D token that is perfectly compliant under Rule 144 can still expose an issuer to state enforcement if the receiving investor has not been qualified under that state's applicable resale exemption, or if the transfer agent failed to obtain a required state notice filing before facilitating the transfer. The enforcement risk here is not theoretical: state securities administrators have examined tokenized securities programs specifically looking at whether issuers are enforcing transfer restrictions at the state level or relying exclusively on the federal exemption as a backstop.
We are not saying the federal exemption is insufficient for most transfers. What we are saying is that issuers who assume state obligations automatically flow from federal compliance are leaving significant gaps in their documentation and monitoring programs.
How 506(b) and 506(c) Differ in State-Level Exposure
The distinction between 506(b) and 506(c) matters at the state level for a specific reason. Under 506(c), issuers must take reasonable steps to verify accredited investor status, and that verification standard has a documentation component that some states expect to see reflected in the issuer's transfer restriction procedures. When a 506(c) issuer subsequently facilitates a secondary transfer, several states treat the receiving investor's accreditation status as independently relevant, not simply carried forward from the primary offering records.
Under 506(b), the combination of self-certification and sophisticated investor standards gives issuers more flexibility. However, the 35-purchaser limit for non-accredited sophisticated investors creates its own secondary-transfer complexity: if a transferee is not accredited, that transfer may affect the issuer's ongoing compliance with the 506(b) purchaser count and investor qualification requirements.
For tokenized securities, this creates an operational problem. The smart contract governing the token must be programmed with transfer restriction logic, but that logic needs to reflect the actual legal conditions for each potential receiving investor's home state, not just the federal accreditation standard.
The 18 States with Highest Compliance Exposure
Based on the complexity of their securities notice filing requirements, secondary-market resale exemption conditions, and historical enforcement patterns, these 18 states consistently create the highest compliance burden for Reg D tokenized offerings: California, Texas, New York, Massachusetts, Florida, Washington, Pennsylvania, Illinois, Ohio, North Carolina, Georgia, New Jersey, Virginia, Maryland, Colorado, Arizona, Oregon, and Connecticut.
That list is not arbitrary. California's securities law retains merit-review elements and imposes specific conditions on secondary transfers of restricted securities. New York's Martin Act gives the Attorney General broad investigative authority that extends to digital asset transactions. Massachusetts and Texas maintain active enforcement programs and have issued specific guidance on digital asset securities. Florida, Georgia, and North Carolina have growing issuer populations and correspondingly active state securities divisions.
The remaining states on the list are high-exposure because of a specific combination: a meaningful population of investors receiving secondary transfers, plus notice filing requirements that are triggered at transfer rather than only at the original offering level. A transfer restriction monitoring program that does not flag these jurisdictions in real time is incomplete.
The Documentation Stack for Secondary Transfer Compliance
The documentation requirements for a compliant secondary transfer in a Reg D tokenized offering have four distinct layers.
First, the holding period calculation. The transfer cannot occur before the Rule 144 holding period has run, and some states impose additional holding period conditions. The compliance record needs to show the original purchase date, the holding period calculation methodology, and any adjustments for tacking or tolling.
Second, the receiving investor qualification. For 506(c) offerings, this means current documentation of accreditation, typically no more than 90 days old. For 506(b) offerings, the issuer needs documentation that the receiving investor meets the purchaser qualifications required under the offering exemption.
Third, state resale exemption confirmation. For each state associated with the receiving investor, the compliance record needs to identify the applicable secondary-market resale exemption and the conditions satisfied. In some states, this requires an attorney opinion letter. In others, it requires a state notice filing by the transfer agent.
Fourth, the transfer agent instruction. The transfer agent needs a written instruction that references the applicable exemptions, the documentation reviewed, and the compliance conclusion. For tokenized securities using a smart contract transfer restriction layer, that on-chain action needs to correspond to the off-chain compliance record.
Where Tokenized Securities Add Operational Complexity
Consider a situation we have seen in practice: a Washington, DC-based issuer running a Reg D 506(c) token offering completes its primary offering in early 2025 with investors in six states, including California and Texas. By mid-2026, several investors want to transfer their positions. The issuer has a smart contract with transfer restriction logic, but the logic checks only the federal one-year holding period and the receiving investor's accreditation self-attestation on a connected investor portal.
What the smart contract does not check: whether the receiving California investor has submitted current income or net worth documentation to support their accreditation claim under California's interpretation of reasonable verification; whether the Texas-based transfer agent has filed the required state notice for the California leg of the transfer; or whether the receiving investor in Connecticut satisfies Connecticut's specific resale exemption conditions.
When we build transfer restriction monitoring programs with issuers, the first thing we map is the gap between what the smart contract enforces and what the legal transfer restriction documentation actually requires. Those are almost never identical, and the gap is almost always in the state layer.
Closing the Gap Before an Exam Request
State securities administrators do not typically give advance notice before requesting records. The standard exam request pattern is a letter asking for documentation of all transfers of the offering that occurred in the prior 12 to 24 months, along with the compliance records supporting each transfer. If the issuer's records exist only at the federal level, and the state notice filings were not tracked or were handled inconsistently, the response to that letter is going to be difficult to assemble.
The compliance team that has mapped all 50 states, maintained a current view of which states require notice filings for secondary transfers, and built the documentation stack for each transfer as it occurs, is the compliance team that answers an exam request in two weeks rather than two months. For a tokenized securities program running any real volume of secondary transfers, the cost of building that system is substantially lower than the cost of reconstructing records under a deadline.
Monitoring state transfer restrictions is not a one-time setup task. States update their exemption rules, fee schedules, and notice filing procedures on rolling timelines that do not align with issuer calendars. A program that was compliant in 2024 may have gaps by 2026 if no one is tracking the updates.