Zero-knowledge compliance

AURA is built for regulated money. The hard part is staying compliant without putting identity on a public ledger. The answer is to prove the claim, not publish the person.

Prove the rule, not the identity

AURA Guard remains the off-chain engine that performs KYC, KYB, sanctions, and risk screening. What reaches the chain is a zero-knowledge proof of its result.

flowchart LR
    U["User"] --> ID["SBX ID<br/>KYC / KYB credential"]
    ID --> ZK{"ZK circuit"}
    ZK --> P["Proof: KYC true · not sanctioned ·<br/>jurisdiction eligible · within limit"]
    P --> C["AuraComplianceVerifier<br/>checks the proof"]
    G["AURA Guard<br/>off-chain screening"] -. signed attestation .-> ZK

The chain is asked to verify "this sender passed KYC, is not sanctioned, is in an eligible jurisdiction, and is within their limit", never "this sender is a named person with this passport." Identity stays with the user and SBX ID; only the claim travels, and only as a proof.

What is never on-chain

Names, passport numbers, dates of birth, addresses and nationality never touch the public chain. The compliance contracts hold verification state and proofs, not personal data:

Contract	Holds
AuraIdentityRegistry	Which account is linked to a valid, unexpired credential (as a commitment)
AuraComplianceVerifier	Verifies the ZK proof a transfer carries
AuraRiskRegistry	Coarse risk band and transaction policy, never the underlying detail

The AI boundary holds here too

The assistant may explain a requirement or pre-fill a review, but it cannot authorise anything. The order is always: AI proposes, deterministic policy validates, the human approves, the contract enforces, the chain settles. The compliance proof is checked in execution, not taken on trust from a model. See AI architecture.

Why this is the institutional unlock

A bank, an RWA platform or an asset manager can transact confidentially while still demonstrating, cryptographically and to a supervisor, that every payment met the rules. That is a stronger position than either a transparent chain (which leaks everyone's business) or an anonymous one (which no regulator will accept). It is the difference between private and anonymous, and it is the whole point. See Rails and chain strategy for where the proofs are verified.

Status

Planned The compliance circuits and the identity and verifier contracts are designed, building on the Guard engine and SBX ID. They are not live in the demo.