An address allowlist with a waiting period is a control that lets only approved addresses send or receive funds, and makes every newly approved address wait a set amount of time before it can be used. During the wait, the pending address is visible but inactive, so the people responsible for the account have time to spot and cancel an approval that should not have happened.
Last updated: November 9, 2026.
How does the waiting period work?
The control has two parts. The allowlist is a list of addresses that are permitted to transact. The waiting period, sometimes called a cooling-off period or timelock, is a delay between adding an address and that address becoming active.
The sequence usually looks like this:
- An authorized person or role requests that an address be added.
- The address enters a pending state, and a timer starts.
- During the delay, an authorized party can review and cancel the request.
- When the timer ends without a cancellation, the address becomes active and can transact.
Removing an address usually takes effect at once, because blocking a destination is the safe direction.
What does a waiting period add to a plain allowlist?
| Approach | When a new address can be used | What it protects against |
|---|---|---|
| No allowlist | Immediately, for any address | Nothing at the address level |
| Allowlist | As soon as it is approved | Transfers to addresses no one approved |
| Allowlist and waiting period | After the delay ends | Time to catch an address approved by mistake or by an attacker |
A plain allowlist relies entirely on the approval step being correct. If an attacker gains access to the approval key, or someone adds the wrong address, funds can move at once. The waiting period turns that single moment into a window in which the change is visible before it matters.
Where are these controls used?
Wallets, custody accounts, and treasury tools use allowlists to restrict where funds can be withdrawn. Token contracts use allowlists to restrict who can hold or receive an asset, which is common for tokens limited to verified holders. The guide to stablecoin transfer restrictions explains how allowlists, blocklists, and freezes work at the token level.
The waiting period can sit in either place. It can be enforced by a smart contract, which applies the delay onchain, or by a platform's own policy engine before a transaction is signed.
Questions we get asked
Is a waiting period the same as a withdrawal delay?
No. A withdrawal delay holds each transfer for a time. An allowlist waiting period applies once, when a new address is approved. After that, transfers to the address go through normally.
Can the waiting period be skipped in an emergency?
That depends on the design. Some systems let a separate role shorten or skip the delay, which gives that role the power to bypass the control.
Does each chain need its own allowlist?
Usually yes. Each deployment keeps its own state, and address formats can differ between networks, so a change has to be applied on each one.
Bring address controls across chains
To discuss address controls for an asset across chains, request a custom briefing.