I can see security tokens solutions like PolyMath keep the whitelist on the contract and allow transfer only after checking the sender and the receiver are on the whitelist.
What I'm not clear about is the process of clearing the address.
From what I gather, the issuer will conduct KYC\AML + REG D for the user and then
- If the user has his own wallet, how can we make sure the wallet is really his before we whitelist it?
- 2.How long does the address remain whitelisted. Is there an expiration?