Tokenized Assets on Arc Need Documents That Cannot Change

Arc settles a tokenized fund share in under a second with finality that cannot be reversed. If the fund's offering document can be edited quietly afterwards, the weakest link in the system is now a PDF.
Arc was designed for capital markets. Its founding validators include BlackRock, DTCC, ICE, Standard Chartered and Sumitomo Corporation. Circle lists asset tokenization, capital markets settlement, treasury management and onchain credit among Arc's primary use cases, and the chain combines USDC gas, deterministic finality and opt in privacy for exactly that audience.
Institutional tokenization lives or dies on documentation. This post covers the document layer for tokenized assets on Arc and how Lighthouse makes it verifiable, durable and private where it needs to be.
Why Institutions Care About the Document Layer
In traditional markets, the integrity of documents is enforced by institutions: transfer agents, custodians, auditors and registrars who keep the canonical copy. Tokenization moves ownership and settlement onchain, but usually leaves the canonical documents on the issuer's systems.
That creates an odd split. Ownership is public, final and verifiable by anyone. The terms that define what is owned are private, mutable and verifiable by no one outside the issuer.
| Onchain on Arc | Usually offchain |
|---|---|
| Who holds the token | What the token entitles them to |
| When it moved | Which version of the terms applied |
| Settlement price in USDC | The NAV report that justified the price |
| Compliance flags on transfers | The KYC evidence behind them |
Closing that gap does not mean putting PDFs onchain. It means putting commitments to PDFs onchain.
Content Addressing, Explained for Capital Markets
A CID is a fingerprint computed from a file's bytes. Two important properties:
- The same file always produces the same CID, on any machine.
- Any change, even one character, produces a different CID.
Record a CID on Arc and you have a timestamped, final, publicly verifiable commitment to one exact document. Anyone can later fetch the file, recompute the CID and confirm it matches, without trusting the issuer, Lighthouse or anyone else. What Is a CID? Content Identifiers, v0 vs v1, and How to Read One covers the format.

The Documents, and Where Each Belongs
| Document | Visibility | Lighthouse storage path | Why |
|---|---|---|---|
| Offering memorandum, fund terms | Public | IPFS with Filecoin deals | Long retention, provable storage |
| Daily or weekly NAV reports | Public or holders | Walrus | Read constantly by apps and lenders |
| Custody and reserve attestations | Holders, auditors | Filecoin, encrypted | Restricted, retained for years |
| Corporate actions and notices | Public | Walrus or IPFS | Must reach every integrator fast |
| Subscription agreements | Named parties | Filecoin, encrypted | Private, legally significant |
| KYC and accreditation evidence | Transfer agent, regulator | Filecoin, encrypted | Personal data, revocable access |
Mixing paths is normal. Lighthouse puts both behind one interface, with the same CIDs, so choosing Walrus for NAV reports and Filecoin for agreements is a per file decision, not a platform decision. Walrus vs Filecoin: Erasure Coding or Replication? has the tradeoffs.
Publishing a NAV Report on Arc
A daily NAV publication that anyone can verify:
import lighthouse from "@lighthouse-web3/sdk";
// 1. Store the signed NAV report
const report = await lighthouse.upload("./nav/2026-09-18.pdf", process.env.LIGHTHOUSE_API_KEY);
// 2. Publish NAV and document CID together on Arc (chain ID 5042)
await walletClient.writeContract({
address: FUND_ORACLE,
abi: fundOracleAbi,
functionName: "publishNav",
args: [
fundId,
1_000_432_100n, // NAV per share, 6 decimals, in USDC terms
report.data.Hash, // CID of the full report
],
chain: arc,
});
A lending protocol that accepts fund shares as collateral now reads a number and a CID from the same transaction. If the number is ever disputed, the report behind it is one fetch away and cannot have been edited.
Private Documents Without a Private Server
Arc is adding confidential transfers with view keys, so institutions can hide amounts while granting auditors visibility. Documents need the same model: private by default, readable by specific parties, revocable.
Lighthouse encrypts files on the client before upload. The key is split with BLS threshold cryptography across independent key nodes, and no single node, including Lighthouse, holds a complete key. Storage providers only ever see ciphertext.
Then you grant access:
// Upload a subscription agreement encrypted
const { data } = await lighthouse.uploadEncrypted(
"./agreements/sub-2026-0418.pdf",
process.env.LIGHTHOUSE_API_KEY,
issuerAddress,
signedMessage
);
const cid = data[0].Hash;
// Share with the investor and the fund administrator
await lighthouse.shareFile(issuerAddress, [investorAddress, administratorAddress], cid, signedMessage);
The public CID can go onchain as a commitment, even though the contents stay private. An auditor with access can confirm the decrypted agreement matches the committed CID. Everyone else can confirm only that a commitment exists and has not changed.
Chain support note. Lighthouse can also gate decryption on onchain conditions such as token holdings or a custom contract's return value, for chains on its Chains Supported list. Arc is not on that list yet. Named address sharing and revocation work today. For conditions evaluated against Arc contracts, such as "holds fund shares" or "is on the allowlist contract," request Arc support on Discord.
Retention and Proof of Storage
Regulated records often have retention periods measured in years. "We still have it" is a claim; a storage proof is evidence.
On the Filecoin path, documents sit in storage deals where providers submit ongoing proofs that they hold the data. You can check deal status for any CID, and How to Verify Your File Is Actually Stored on Filecoin explains how to confirm it independently. Deals have terms and Lighthouse manages renewal; What Happens When a Filecoin Deal Expires? explains the lifecycle.
An Issuer Checklist for Arc
- Every public document uploaded, its CID recorded onchain alongside the event it supports.
- Document history kept as an append only list of CIDs, never overwritten.
- NAV and pricing reports published with their CIDs in the same transaction as the value.
- Private documents encrypted client side, shared with named parties, with revocation owners assigned.
- Retention on the Filecoin path for records with regulatory lifetimes.
- A public page listing current document CIDs so integrators can verify independently.
Frequently Asked Questions
Is Arc built for tokenized assets? Yes. Circle lists asset tokenization, capital markets settlement and treasury management among Arc's primary use cases, and its founding validators include BlackRock, DTCC, ICE and Standard Chartered.
How do you prove a tokenized asset's documents have not changed? Record each document's CID onchain. A CID is derived from the file's content, so any edit produces a different CID and is detectable.
Can private fund documents be stored on decentralized storage? Yes, if encrypted client side. Lighthouse uses threshold encryption so only named parties can decrypt, and access can be revoked.
Where should NAV reports be stored? Somewhere fast to read and verifiable, with the CID published next to the NAV value. Lighthouse's Walrus path suits frequently read reports.
Get Started
Background on the chain: What Is Arc by Circle and How Lighthouse Adds the Storage Layer. Tokenizing assets on Arc? Talk to our team.
Stay in Touch
Learn more at the website, docs, or GitHub. Join the community on Discord, X, Telegram, and LinkedIn.






















































































