--- a/pallets/nonfungible/src/lib.rs
+++ b/pallets/nonfungible/src/lib.rs
@@ -380,8 +380,7 @@
 		let token_data =
 			<TokenData<T>>::get((collection.id, token)).ok_or(<CommonError<T>>::TokenNotFound)?;
 		ensure!(
-			&token_data.owner == sender
-				|| (collection.limits.owner_can_transfer() && collection.is_owner_or_admin(sender)),
+			&token_data.owner == sender,
 			<CommonError<T>>::NoPermission
 		);
 
@@ -665,10 +664,8 @@
 
 		let token_data =
 			<TokenData<T>>::get((collection.id, token)).ok_or(<CommonError<T>>::TokenNotFound)?;
-		// TODO: require sender to be token, owner, require admins to go through transfer_from
 		ensure!(
-			&token_data.owner == from
-				|| (collection.limits.owner_can_transfer() && collection.is_owner_or_admin(from)),
+			&token_data.owner == from,
 			<CommonError<T>>::NoPermission
 		);
 
@@ -976,8 +973,12 @@
 			// `from`, `to` checked in [`transfer`]
 			collection.check_allowlist(spender)?;
 		}
+
+		if collection.limits.owner_can_transfer() && collection.is_owner_or_admin(spender) {
+			return Ok(());
+		}
+
 		if let Some(source) = T::CrossTokenAddressMapping::address_to_token(from) {
-			// TODO: should collection owner be allowed to perform this transfer?
 			ensure!(
 				<PalletStructure<T>>::check_indirectly_owned(
 					spender.clone(),