Provable compliance ensures clear evidence and decision context for transactions
Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific Decisioning
Cryptography and SecurityComputers and Society
Summary
Financial institutions must follow many rules for each transaction, but the evidence they use to prove compliance can get outdated or unclear. The authors present a system that records all relevant facts, policies, and decisions with timestamps and signatures, so that everyone can see exactly what was true when a decision was made. This helps automate and verify compliance for specific transactions without allowing payments without final approval. It also manages privacy and risk carefully.
What this means in practice
- •For bank compliance teams: Provide clear, signed evidence and context for each compliance decision during client transactions to support audits and regulators.
- •For workflow software developers: Integrate decision tokens that prove compliance freshness and policy adherence into transaction workflows for automated risk control.
Authors
Jeremy Blackburn, Tim Hines, Matthew Koepp, Russell Lessard, Jason Patrick
Abstract
Regulated institutions already perform onboarding, screening, monitoring, and review, but compliance evidence ages, and whether it supports a decision depends on the institution, product, subject, counterparty, transaction, jurisdiction, risk tier, and purpose. A relying party therefore often cannot obtain compact, attributable proof of which evidence, policy, authority, and transaction context were current when a decision was made, a gap that grows as authority is delegated to software agents and scheduled workflows. We describe ChainIT Provable Compliance, the compliance-side layer of the ChainIT Authority Protocol. Each sourced or institution-generated fact is represented as a separate Evidence Assertion VDT with provenance, freshness, confidence, permitted purpose, and privacy classification; a versioned Compliance Policy Profile selects the applicable rules; a Business Rules Engine returns deterministic, reason-coded predicate results; and the organization's configured Workflow Engine composes them into a signed, time-bounded Compliance Decision VDT for one reliance event. The decision contributes a single predicate, Compliance Decision Permits, to session-eligibility and transaction-policy decisions. It never independently authorizes payment: only a final Allow together with an exact transaction digest, atomic capacity reservation, and a single-use execution credential can commit value. The paper specifies point-of-reliance freshness, scoped propagation of evidence changes, decision states, evidence domains (AML, sanctions, PEP, background, identity, and licensing), the U.S. and FATF regulatory context as of August 2026, privacy and disclosure controls, and residual risks.