well they don’t have to be... tokens are just code running on the blockchain, so you can apply anything you like to them... you can block a transfer until the recipient is in a whitelisted KYC list so that real world identities are known, and then you have your ledger
worried that loses the “trustless” of blockchain? hash the KYC entry and store it on chain so you make certain that the off-chain real world ownership information hasn’t been tampered with