KETJU Research

← The Register

tokenized-rwa

Franklin OnChain U.S. Government Money Fund (FOBXX), BENJI token

Favorable research; shelf not set
Research assessment
favorable with conditions
Firm shelf
research only
Model-client eligibility
eligible with conditions
Selection
not considered
Action and amount
Not set by research
Reviewed
2026-09-23 · v1
Next review
2026-12-22
Research basis
Individual research
Chains
Stellar · freezable, Ethereum · sovereign, Polygon PoS · hybrid, Arbitrum One · hybrid, Avalanche · crypto-backed, Base · hybrid, Solana · crypto-backed
Symbols
BENJI
Eligibility file
What the holder owns and who may hold it

Research, firm shelf, model-client eligibility, and advisor selection are recorded separately. The scheduled date is the outside bound; new evidence can reopen the file sooner.

BENJI is a share of an ordinary government money market fund. The Franklin OnChain U.S. Government Money Fund (FOBXX) is a series of Franklin Templeton Trust, registered under the Investment Company Act, run under Rule 2a-7 with at least 99.5 percent of assets in government securities, cash, and fully collateralized repos, and priced to hold $1.00. What is new is the record. Franklin Templeton Investor Services (FTIS), the fund’s registered transfer agent and a Franklin subsidiary, keeps the list of owners in a system that joins its own private database to public chains. Each share shows up on a chain as one BENJI token. The chain does not decide who owns a share; FTIS does. The prospectus says fund shares on its system ”are under the unilateral control of the transfer agent,” and on August 12, 2026 SEC staff gave Franklin a custody no-action position that rests on that control: FTIS can ”maintain, correct, freeze, migrate, or restore the official record.” We read every published contract on the seven chains Ketju can read, and the chain agrees. On each one the issuer can whitelist, freeze, and claw back, and on each one a single on-chain key, or one of a few, can change those rules. Franklin tells the SEC those keys sit behind multi-signature and multi-party computation controls, which the chain cannot show. For an advisor the product is plain. A U.S. client can open an account in the Benji app with $20, hold shares in a wallet on Stellar whose key FTIS keeps, send them to another whitelisted holder at any hour, and redeem through the app for dollars to a linked bank. The fund charges 0.20 percent after a waiver that runs to July 31, 2027. We read the research as favorable with conditions. The conditions are the account and the exit: the fund sells only direct, through its own app or portal, bars IRAs and every other retirement account, redeems only through that app, and had five holders with about 75 percent of its shares on July 1, 2026.

The research file

How a share gets onto a chain

An individual downloads the Benji app, passes Franklin’s anti-money-laundering and know-your-customer checks, and links a bank account. FTIS then creates a wallet for the investor on Stellar, the fund’s primary chain since it launched in April 2021, unless the investor has asked in advance to use another chain. For an individual, FTIS creates and secures the key pair; the investor instructs the wallet through the app. Only institutions may keep their own keys, and only with FTIS approval. Franklin’s Benji page lists Stellar as the one chain open to retail; Polygon, Arbitrum, Avalanche, Aptos, Ethereum, Base, and Solana are institutional.

A purchase is a dollar transfer from the linked bank. When it settles, FTIS mints shares to the wallet. The fund strikes a NAV each hour from 8 a.m. to its 5 p.m. Eastern close, and orders must arrive by 2 p.m. Pacific to trade that day. Dividends are paid daily as new tokens, which Franklin says are ”airdropped directly into shareholders wallets.” When shares move between holders mid-cycle, FTIS splits that day’s dividend by the hours each side held them, a method the prospectus calls patent pending.

Moving between chains does not create shares. FTIS burns the shares on one chain and mints the same number on the other; the prospectus gives the example of 100 shares burned on Stellar and minted on Polygon, with ”no new shares” created on the official record. Each chain carries its own minimum first purchase because fees differ: $20 on Stellar, $100 on Aptos, Base, and Solana, $1,000 on Polygon and Arbitrum, $20,000 on Avalanche, and $5,000,000 on Ethereum. The manager pays the network fees for any transaction made through the app or portal. FTIS picks chains under a written suitability framework (ten or more full nodes, 99.9 percent uptime, blocks under ten seconds, multi-signature support, and a required clawback or administrative balance control) and may move holders off a chain that fails it.

What the holder owns, and who keeps the record

The holder owns a fund share with the same claim as any other FOBXX share: a pro rata interest in a pool of Treasury bills, agency paper, and repurchase agreements, with a vote on matters that need shareholder approval. The token is not a separate security and not a claim on Franklin. Shares are not bank deposits, not FDIC insured, and not covered by SIPC.

The official record is FTIS’s. The prospectus says FTIS ”maintains the official record of share ownership via a proprietary blockchain-integrated system that utilizes features of traditional book-entry form and one or more public blockchain networks.” The no-action request describes the parts: an internal database with names and tax numbers, and the chains, which carry purchases, redemptions, dividends, and NAVs, ”automatically joined by FTIS on a real-time basis by referential data linkage to establish the master securityholder file.” So the chain is part of the record, but only as FTIS links it. That is why this file uses the issuer-indirect model: a token balance counts because FTIS says it does. The prospectus is blunt about the edge case: a person holding a wallet to which shares were sent in error ”would have no legal claim to such Fund shares.”

The fund is real and has run five years without a NAV break we could find. It reported 686.6 million shares outstanding for August 31, 2026 on Form N-MFP3, and $843.8 million of net assets at its March 31, 2026 year end. On September 23, 2026 we read about 427.5 million BENJI on Stellar, 59.7 million on Base, 48.2 million on Ethereum, 47.9 million on Arbitrum, 34.3 million on Avalanche, 32.2 million on Polygon, and 0.2 million on Solana, about 650 million in all; the Aptos balance is outside what Ketju reads. Ownership is concentrated. The SAI lists the Stellar Development Foundation at 27.30 percent, Franklin Distributors at 15.53, Franklin Advisers at 15.41, Ondo I LP at 9.45, and one family trust at 7.21, as of July 1, 2026. Western Asset became sub-adviser on May 18, 2026 under Franklin Advisers.

Who can freeze, claw back, or rewrite a balance, chain by chain

Franklin publishes every contract address on its Benji contracts page, which is how we could read the controls directly. On Stellar, BENJI is a classic asset issued by account GBHNGLLIE3KWGKCHIKMHJ5HVZHYIK7WTBE4QF5PLAKL4CJGSEU7HZIW5, Ketju’s first live Stellar file with a published issuer. Horizon shows all four issuer flags that matter: a holder needs the issuer’s authorization to hold (auth_required), the issuer can revoke it and so freeze a holder (auth_revocable), the flags can still be changed (auth_immutable is false), and the issuer can claw back (auth_clawback_enabled). The issuer’s own master key has weight zero. Fourteen other keys sign for it, ten with weight 3 and four with weight 1, against thresholds of 2 for low and medium operations and 6 for high ones. Revoking authorization is a low-threshold operation and clawback a medium one, so any one of the ten weight-3 keys can freeze a holder or claw back shares alone. Changing the signers takes two.

On the five EVM chains, the token is an upgradeable ERC-20 (Franklin’s MoneyMarketFund contract) that consults a module registry held in its storage. Its verified source requires both sides of every transfer to be authorized shareholders and neither to be frozen, checks it makes against the Authorization module. That module carries authorizeAccount and freezeAccount. The token itself lets an admin burn any holder’s shares (burnShares), move shares between holders (instantTransfer), and switch off all holder transfers (disableERC20Transfer). On Ethereum the Transfer Agent module adds adjustBalance and recoverAccount. The upgrade power is the one that matters most: the token’s upgrade function is gated by ROLE_TOKEN_OWNER, and on every EVM chain the same three plain addresses (0x42cc…, 0x64d4…, 0xb671…) hold that role, beside a contract on most chains and more plain addresses on Polygon and Arbitrum. On Polygon one plain address also holds the default admin role. Each can replace the token’s code alone. On Ethereum the authorization admin role sits with the contract Franklin names as its MultiSig Module. On Avalanche and Base the Authorization module’s source is not published, so whitelist and freeze there read as unverified, though the token source shows the same checks.

On Solana the mint is a Token-2022 account whose mint authority, freeze authority, and permanent delegate are all the mint address itself, an address no private key controls. Only Franklin’s program can sign for it. A transfer hook, program huk3EPrNreTdUUjVKVkGSGKF1WC4P9BiUKBkn2kFWnP, enforces the whitelist. All three Franklin Solana programs (the hook, the MultiSig module, and the MultiChain module) share one upgrade authority, AJyEpT8V17VniFmVhrUvegQJXy5g3qcRnqRe3joesXeJ, an ordinary wallet. One key can rewrite the code that holds every power over the Solana mint.

What stands behind these keys is the part the chain cannot show. Franklin represented to SEC staff that FTIS ”uses a layered wallet security architecture, including multi-signature and multi-party computation techniques, geographically and operationally distributed signers, and offline recovery capabilities.” A key split by multi-party computation signs as one address. We record what the chain shows, one key, and the representation next to it. None of this is hidden: the prospectus says FTIS can ”correct errors and unauthorized transactions in, and limit the transferability of, Fund shares,” and the suitability framework makes a clawback control a condition for using any chain.

Transfer, redemption, and the exit

Holders may send shares to each other. The prospectus allows peer-to-peer transfer ”within any approved blockchain network or between any two approved blockchain networks,” at any hour, with no minimum, but both wallets must be ”active, permissioned” and whitelisted with FTIS. Retail transfers went live in the app in May 2025. Neither the fund nor FTIS matches buyers and sellers, and the prospectus says the shares ”will not be listed for trading” on an exchange or an alternative trading system. The same prospectus says the shares trade on the Nasdaq under the ticker FOBXX; we read that as the Nasdaq fund symbol every mutual fund carries, not a listing. A transfer at a price other than NAV may raise securities-law questions for the parties, and Franklin says so.

The exit is a redemption through the app or portal, and only there. Orders are processed on business days at the next hourly NAV; the daily cutoff is 2 p.m. Pacific. Proceeds go by ACH or Fed wire to the linked bank ”within seven days”; ACH generally arrives in two to three business days. Requests over $250,000, or to a bank account changed in the last 15 days, may need a signature guarantee, and proceeds from shares bought by electronic transfer may wait up to ten calendar days for the funds to clear. Shares cannot be exchanged into other Franklin funds. The fund does not now intend to charge a liquidity fee, but its board may add one after notice.

The failure path is the fund’s, not the token’s. If large holders leave together, the fund sells short government paper to pay them, as any government money fund does. The concentration above makes that more than a formality: two Franklin affiliates held about 31 percent of shares on July 1, 2026. If a chain fails, FTIS says it can move holder records to another approved chain; if a wallet key is lost, FTIS can restore the record, though the prospectus warns the shares may be unavailable while it works.

What the August 12, 2026 staff letter does and does not do

The letter answers a narrow question for Franklin’s own funds. Rule 17f-2 governs a fund that keeps its own assets, and Franklin’s other mutual funds want to park cash in FOBXX with FTIS, an affiliate, as custodian. Staff said they would not recommend enforcement if those funds skip the rule’s vault, notation, and verification steps, relying on a 1992 letter about an affiliated transfer agent keeping book-entry fund shares. The conditions show what staff treated as custody: FTIS must keep the administrative controls to correct, freeze, migrate, and restore the record; keep a separate wallet and account for each investing fund; send confirmations; and, if it stops acting as transfer agent, hand the records and the administrative controls, ”including administrative control over any smart contracts,” to its successor.

For an advisor, the letter settles how staff see the record, not the adviser’s own custody duty. It does not interpret Rule 206(4)-2, the adviser custody rule, whose amendment is on the SEC’s agenda for an October 2026 proposal. Because the fund sells only direct, a client’s shares sit in the client’s own Benji account, outside the custodian that holds the rest of the portfolio. Whether an adviser with trading authority over that account has custody, and how it reports the position, is a question for the adviser’s compliance counsel.

The comparison

Against WisdomTree’s WTGXX, the only other registered money market fund on file, BENJI is the same kind of claim with better public evidence. Both are 1940 Act government funds whose affiliated transfer agent keeps the official record and can correct the chain. WTGXX costs $1 to start through WisdomTree Prime; BENJI costs $20 on Stellar. WisdomTree has not published its Stellar issuer, so only its Ethereum contract can be read; Franklin publishes every address on every chain, including the modules and the Solana programs. The control picture is similar where both can be read: whitelist, freeze, clawback, and an upgradeable contract. BENJI excludes retirement accounts outright.

Against BlackRock BUIDL, Circle USYC, and Ondo OUSG, the private tokenized Treasury funds on the Register, BENJI is open to a retail U.S. client with no accredited-investor or qualified-purchaser test, carries a registered fund’s disclosure and board, and redeems at a stable $1.00. It gives up what those funds sell to institutions: no approved on-chain venue, no stablecoin redemption named in the prospectus, and a transfer universe limited to other Benji holders. Against a conventional government money fund held at the client’s custodian, it offers round-the-clock transfer to other whitelisted holders and little else; a client who wants a money fund for cash has simpler ways to own one.

Open questions

Four things would change this reading. First, the state list: the prospectus says only that shares may be bought where eligible for sale, and we found no published list, so the file records the states as unconfirmed. Second, the keys: Franklin does not say which person or system holds each Stellar signer, each ROLE_TOKEN_OWNER address, or the Solana upgrade key, and a change to any of them reopens the file. Third, the unread chains: Aptos is outside Ketju’s reader, and the Authorization modules on Avalanche and Base are unverified. Fourth, the Benji app terms: Franklin serves them inside its apps, and we did not rely on them; the prospectus and SAI govern.

We found no public report of a NAV break, a redemption suspension, a record correction that touched a holder, or a contract exploit for FOBXX since its April 2021 launch. The daily monitor now reads the seven chains’ controls, module addresses, and supply against yesterday.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The most administered layer sets the position’s effective control grade; that is a control description, not a quality or suitability score.

ChainVerdictGradeControl constraint
StellarAdverse freezable freeze is native at every level: issuers hold revocation and clawback flags on their assets, and since Protocol 26 the validator quorum can vote to freeze specific accounts and trustlines on-chain (CAP-77).
EthereumFavorable sovereign No sequencer, no upgrade key, no operator who can be compelled — rule changes require social consensus.
Polygon PoSAdverse hybrid a public validator set orders transactions, but a 5-of-9 multisig can instantly upgrade staking and canonical bridge contracts, while a 5-of-8 controls custom child tokens.
Arbitrum OneFavorable with conditions hybrid a single sequencer orders >99% of transactions and admin keys can upgrade bridge contracts on a ~7-day timelock.
AvalancheFavorable with conditions crypto-backed no party can freeze or seize C-Chain funds, but one vendor writes the only production client and Messari measured over a third of stake hosted on AWS.
BaseFavorable with conditions hybrid Coinbase — one regulated US company — operates the only sequencer, and admin keys can upgrade bridge contracts within ~7 days.
SolanaFavorable with conditions crypto-backed no admin key can seize funds, but stake concentration and a sub-25 Nakamoto coefficient are the standing watch items.
The memo is public. Monitoring connects the research to positions clients actually hold and flags evidence changes for advisor review. $49 per advisor per month, first 14 days free. Start the trial.