Who may hold it
Every holder account starts frozen. A wallet is let in only when its investor profile passes the registry: approved, KYC in date, allowed jurisdiction, sufficient tier. The profile can come from a KYC provider's attestation, so an investor verified once is admitted everywhere that provider is trusted. When an approval lapses, anyone can freeze that wallet.
On Solana: Token-2022 default-frozen accounts, Token ACL asking AssetFlow's gate before any thaw or freeze, and profiles from Solana Attestation Service attestations.