Why is a whitelist necessary?
How often is the whitelist updated?
Can a token be removed from the whitelist?