XRP Ledger nears approval of PermissionDelegationV1_1, enabling delegated compliance actions

Token issuers utilizing the XRP Ledger (XRPL) could soon gain a new tool for managing compliance tasks, as the upcoming PermissionDelegationV1_1 amendment advances toward approval by the network’s validators.

Delegated controls for issuers

Jake Claver, a recognized investor and Web3 expert, described how PermissionDelegationV1_1 will allow issuers to assign specific permissions to delegated accounts, while maintaining tight control over their primary account keys. This advancement is expected to streamline compliance operations for companies issuing tokens on XRPL.

Currently, token issuers must use a single account to oversee all critical functions, such as managing trust lines, freezing holders, minting new tokens, and burning supply. Employees with regular key access can perform nearly any action, creating significant operational risk if wide-reaching permissions are mistakenly granted or abused.

Although multi-signature solutions offer one way to increase security, Claver noted that these processes can slow down day-to-day compliance activities due to the need for multiple approvals on routine transactions.

Token issuers on the XRP Ledger can soon let their compliance teams freeze flagged holders without exposing the issuer’s keys. With 29 of 35 validators in support, October 8 is the earliest date for possible activation, but the loss of one supporting vote could delay the process.

The new approach, PermissionDelegationV1_1, is designed to address these limitations by allowing issuers to delegate up to 10 specific permissions to another account using a process called DelegateSet. The delegate then uses its own keys to perform only the actions it has been authorized for, improving separation of duties and reducing risk.

Mini dictionary: XRP Ledger (XRPL), created by Ripple, is a decentralized blockchain designed for fast and efficient transfers of digital assets, supporting both cryptocurrency and tokenized assets.

Granular permission assignment

Under PermissionDelegationV1_1, issuers can grant specific trust line, freezing, minting, and burning permissions to compliance or treasury account delegates. For instance, a compliance team could receive authority to freeze flagged accounts, while treasury staff could be assigned PaymentMint permission. Claver specified that PaymentBurn requires the fixCleanup3_4_0 update to function. Additional permissions include Multi-Purpose Token lock/unlock as well as control over certain account fields such as domain, email hash, message key, transfer rate, and tick size.

A major benefit is the ability for issuers to quickly revoke permissions from employees or departments without rotating their core keys, simply by submitting a new DelegateSet transaction. This reduces the operational risks associated with employee transitions.

If a delegated employee leaves the company, their privileges can be removed immediately. The delegate cannot move XRP out of the issuer’s wallet or change the issuer’s account keys, maintaining a clear distinction of authority.

Security testing and update process

During development, community feedback identified a security flaw in the original PermissionDelegation version. On September 15, 2025, a developer found that permissions checks occurred before signature verification, which could allow an unauthorized actor to submit invalid transactions, incurring a high fee for the issuer even though the action would fail.

Validators responded by rejecting that proposal. In the revised implementation, if an account lacks permissions, it returns a terNO_DELEGATE_PERMISSION error and no fee is charged for the failed transaction. Claver also noted that BatchV1_1 required a similar revision, and an emergency upgrade to version 3.4.1 applied another update, fixBatchV1_2.

The revision ensures transactions without appropriate permissions will not result in unnecessary fees, addressing a critical security concern raised during community testing.

Timeline and adoption requirements

Activation of PermissionDelegationV1_1 requires support from more than 80% of XRPL validators for two consecutive weeks. With 35 validators on the network, at least 29 must vote in favor. As of Claver’s latest update, exactly 29 validators had approved, meaning a single vote reversal could delay activation beyond the earliest target date of October 8.

Claver encouraged issuers to assess their compliance responsibilities in advance and prepare to assign appropriate permissions to delegate accounts. The amendment’s arrival coincides with increased tokenization activity, as around $1.1 billion in RLUSD and approximately $4.1 billion in tokenized real-world assets are now issued or tracked via XRP Ledger, based on data reported in late September.

Claver highlighted that mapping out responsibilities and considering which tasks can be delegated will be crucial, especially with growing institutional use of the technology.