diff --git a/src/ripple/app/tx/impl/CFTokenIssuanceSet.cpp b/src/ripple/app/tx/impl/CFTokenIssuanceSet.cpp
index f0fa1546f60..a892a9c5970 100644
--- a/src/ripple/app/tx/impl/CFTokenIssuanceSet.cpp
+++ b/src/ripple/app/tx/impl/CFTokenIssuanceSet.cpp
@@ -46,6 +46,11 @@ CFTokenIssuanceSet::preflight(PreflightContext const& ctx)
     else if (!(txFlags & tfCFTLock & tfCFTUnlock))
         return temINVALID_FLAG;
         
+    auto const accountID = ctx.tx[sfAccount];
+    auto const holderID = ctx.tx[~sfCFTokenHolder];
+    if (holderID && accountID == holderID)
+        return temMALFORMED;
+
     return preflight2(ctx);
 }
 
@@ -53,20 +58,55 @@ TER
 CFTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
 {
     // ensure that issuance exists
-    auto const sleCFT =
+    auto const sleCftIssuance =
         ctx.view.read(keylet::cftIssuance(ctx.tx[sfCFTokenIssuanceID]));
-    if (!sleCFT)
+    if (!sleCftIssuance)
         return tecOBJECT_NOT_FOUND;
 
-
+    auto const holderID = ctx.tx[~sfCFTokenHolder];
+    
+    // issuer wants to lock/unlock a specific holder
+    if (holderID && !ctx.view.exists(keylet::cftoken(ctx.tx[sfCFTokenIssuanceID], holderID)))
+        return tecOBJECT_NOT_FOUND;
+    
     return tesSUCCESS;
 }
 
 TER
 CFTokenIssuanceSet::doApply()
 {
+    auto const cftIssuanceID = ctx_.tx[sfCFTokenIssuanceID];
+    // auto const sleCftIssuance =
+    //     view().peek(keylet::cftIssuance(cftIssuanceID));
+    // if (!sleCftIssuance)
+    //     return tecINTERNAL;
+
+    auto const txFlags = ctx_.tx.getFlags(); 
+    auto const holderID = ctx_.tx[~sfCFTokenHolder];
+
+    if (holderID){
+        auto const sleCft = view().peek(keylet::cftoken(cftIssuanceID, holderID));
+        if (!sleCft)
+            return tecINTERNAL;
+
+        std::uint32_t const flagsIn = sleCft->getFieldU32(sfFlags);
+        std::uint32_t flagsOut = flagsIn;
+
+        if (txFlags & tfCFTLock){
+            flagsOut |= lsfCFTLocked;
+        }
+        else if (txFlags & tfCFTUnlock){
+            flagsOut &= ~lsfCFTLocked;
+        }
+
+        if (flagsIn != flagsOut)
+            sleCft->setFieldU32(sfFlags, flagsOut);
 
+        view().update(sleCft);
+        return tesSUCCESS;
+    }
 
+    
     return tesSUCCESS;
 }
 
diff --git a/src/ripple/protocol/LedgerFormats.h b/src/ripple/protocol/LedgerFormats.h
index e81bd2d808d..1a95cd729ff 100644
--- a/src/ripple/protocol/LedgerFormats.h
+++ b/src/ripple/protocol/LedgerFormats.h
@@ -317,7 +317,7 @@ enum LedgerSpecificFlags {
     lsfSellNFToken = 0x00000001,
 
     // ltCFTOKEN_ISSUANCE
-    lsfCFTLocked = 0x00000001,
+    lsfCFTLocked = 0x00000001, // Also used in ltCFTOKEN
     lsfCFTCanLock = 0x00000002,
     lsfCFTRequireAuth = 0x00000004,
     lsfCFTCanEscrow = 0x00000008,