Wall Street Is Putting Its Safest Funds Onchain. That Makes Them Faster and More Flexible — and Quietly Changes One Thing Investors Have Always Taken for Granted: Whether the Rules Can Change.

Some of the biggest names in finance — BlackRock, Franklin Templeton, WisdomTree, JPMorgan — now issue their money-market and Treasury funds as tokens on public blockchains. BlackRock alone added two more onchain funds this month. This is not a novelty. A traditional fund lives inside a web of intermediaries — transfer agents, custodians, settlement systems — reconciling records with one another, mostly on business days, mostly slowly. Putting the fund onchain collapses much of that: the token is the record, it can settle in seconds and move around the clock, and — this is the part that matters here — it can carry its own rules inside it as software.

That is a real advance, and it explains why the category has grown so fast. For the issuer, rules written into the asset mean compliance can travel with it: the token can restrict who is allowed to hold it, enforce transfer conditions, freeze a wallet when a court orders it, or update itself when the law changes — without reissuing anything. For the holder, it means near-instant settlement, all-hours access, the ability to post the fund as collateral elsewhere, and a live, auditable record. The same mechanism that delivers all of that is the one worth understanding — because it also means the rules of a tokenized fund are not fixed the way a traditional fund's terms are.

Reading the contracts behind the 28 largest rated tokenized Treasury and gold funds directly, the pattern is clear: in 26 of the 28, the issuer keeps the ability to change how the token works — its mint rules, transfer restrictions, redemption logic. And in all but one, there is no built-in delay, so an authorized change takes effect onchain the moment it is made. There is no window in which a holder would see it coming.

What “upgradeable” actually means

When a fund is issued as a token, its logic sits in a contract the issuer deploys. Most of these use an upgradeable design — a standard, widely-used pattern that lets the issuer replace the contract's code later without moving anyone's balances. That is not a scandal; it is often necessary. A bug needs patching, a regulator changes a rule, a sanctioned wallet needs freezing — an upgradeable contract lets the issuer respond without winding the fund down and starting over. The traditional funds these modernize change their terms too. The difference is the mechanics: here, the change is a single onchain action.

It also matters who holds that ability. In these funds it is not a lone anonymous key: the upgrade authority sits with multi-signature arrangements run by regulated institutions — BlackRock with Securitize and BNY Mellon behind BUIDL, Franklin Templeton behind BENJI, and so on. “The issuer can change it” is not “one person can change it.” The question the onchain record surfaces is narrower and more precise: once an authorized change is decided, how long before it is live — and is there any delay at all?

The delay is the thing that's missing

In traditional fund administration, a change to a fund's terms arrives with notice — a filing, a period before it takes effect, a window in which a holder can act on the new information. That notice period is a piece of investor protection so ordinary it is easy to forget it is there. Onchain, it has to be rebuilt deliberately, as a timelock: a coded delay between when an upgrade is authorized and when it goes live. The mechanism is well understood elsewhere in the space — Polygon's protocol council, for instance, requires a ten-day timelock on a routine contract change. Across these 28 funds, exactly one has it.

That fund is Ondo's USDY, whose upgrade path runs through a multi-signature approval and a timelock before any change takes effect. Two others — Arca's ArCoin and the Janus Henderson Anemoy Treasury fund — sit at the opposite end: their contracts are immutable, meaning the rules cannot be changed at all, by anyone. The rest, including the largest and most-cited funds in the category, are upgradeable with no delay. The point is not that those funds are unsafe — nothing here suggests any issuer has misused the ability, and the admins are serious institutions. The point is that the predictability investors take for granted in the off-chain version is, onchain, a design choice each issuer is making — and most have not yet made it.

The property that travels with tokenization

This is bigger than money-market funds. As more of the financial system moves onchain — and it is moving — more assets become programmable by default. That is mostly the upside: programmability is what makes these instruments faster, cheaper, and more useful than the paper-and-intermediary versions they replace. But the same property means “what are the rules, who can change them, and how fast” stops being a settled assumption and becomes a live characteristic of every tokenized asset — one a holder now has to be able to read. The IMF has made the same point at the level of the system: moving trust from institutions to code, it argues, puts a premium on the governance of smart-contract logic — the very thing an upgrade path and a timelock define.

Understanding that is not a reason to hesitate; it is the literacy that separates a well-built tokenized asset from one that merely resembles the thing it replaces. The funds already adding a delay, or forgoing the ability to change the rules at all, are setting the reference point the rest of the category will be measured against — keep the speed and flexibility that make the format worth adopting, and rebuild the predictability institutions expect on top of it. The open question is which becomes the norm as the money gets more serious: the instant-change default that dominates today, or the restraint that a handful of issuers have started to code in. The ledgers will show which way it goes, fund by fund, the day it changes.