An identity record becomes an account

T-REX Network and OpenZeppelin have rebuilt ONCHAINID, the identity layer used by regulated token issuers, as version 3. It keeps the registry of verified claims that compliance checks read, and adds the capabilities of a modular smart account, so one identity can hold assets, execute transactions and manage its own recovery rather than acting only as a record something else consults.

Keys, claims and execution now live in installable modules that can be added, reviewed and changed independently. Through ERC-7913 an identity can be controlled by secp256r1, RSA or WebAuthn credentials alongside ordinary ECDSA keys, which is closer to how institutions and people already authenticate. Recovery becomes a module with guardians and thresholds instead of depending on the issuer to re-link a new wallet, and a single identity can be verified across chains rather than re-established on each.

Two permission models in one account

The design joins ERC-734, where each key carries a purpose that defines its authority, with ERC-7579, which governs how a transaction is validated and executed. OpenZeppelin is direct about why that is the risky part: a record only has to be read correctly, while an account has to decide what each key may do and stay consistent across every path a call can take. The firm audited the redesign, including the interaction between the two models.

The work sits inside a longer effort around ERC-3643, the standard behind most regulated token issuance. ERC-3643 is being brought into the OpenZeppelin Contracts library as an audited component, and support is being extended beyond EVM chains, with native support on Stellar named.

The stated next step is confidentiality: using Zama's fully homomorphic encryption so that regulatory checks can run on encrypted data without revealing identities or amounts. That is the unresolved tension in tokenised securities, where every participant can currently see positions that in traditional markets only a transfer agent would.