> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Compliance Gate
> Turn a screening decision into a signed, no PII compliance receipt: a categorical ALLOW, REFER or DENY verdict that verifies offline. Commercial OEM SDK.
**Included in the [Verifiable Compliance Suite](/verifiable-compliance-suite).** One commercial licence installs this component together with the whole compliance estate, self-hosted and air-gap capable. It ships inside the suite, not as a standalone product.
**Compliance Gate for Substrate 2 (v2)** — the commercial, packaged version of the compliance gate
that runs in the AlgoVoi production gateway. The open A2A *Compliance Gate Extension* protocol
specification is published separately as v1.
## What it is
**Compliance Gate** turns a screening decision into a **signed, no-PII compliance receipt**. You screen
a payer through *your own* sanctions / PEP / AML provider; the Gate maps the result to a categorical
**ALLOW / REFER / DENY** verdict and emits a **Falcon-1024-signed** receipt whose payer reference is a
content hash — never the cleartext.
*Last updated: 21 August 2026.*
It is the **same compliance gate that runs in the AlgoVoi production gateway**, packaged for Substrate 2
as a standalone OEM SDK you can embed in your own product.
It is the **origination side of [Proofs](/proofs)**: the receipt the Gate produces is exactly the one
Proofs binds and proves. Use the Gate to *make and sign* the compliance decision; use Proofs to
*prove it privately* downstream.
It does **not** perform the sanctions lookup itself — that's your provider's data. The Gate is the
certification, privacy, and provability layer on top: it takes a verdict and turns it into auditable,
shareable, post-quantum-signed evidence.
The address goes in (you have to screen it); only `sha256(network:address)` comes out. The signed
receipt is shareable with a regulator or partner with nothing personal in it.
`ALLOW / REFER / DENY` is a closed enumeration — a `REFER` (e.g. a Suspicious Activity Report
obligation) is byte-distinct from a `DENY`, and the verdict is post-quantum signed.
Inject any provider — Chainalysis, TRM, Elliptic, an internal list — behind a small interface. The
Gate orchestrates and certifies; it never holds sanctions data.
The receipt format and content hash match Proofs exactly, so a Gate verdict drops straight into a
privacy-preserving proof.
## What you get
* **A verdict you can share.** A signed compliance receipt you can hand a regulator or counterparty
with **no customer PII in it** — not the raw, data-laden output of a screening provider.
* **Provider-agnostic.** Keep your existing screening vendor; bolt the Gate on top to certify its
verdicts. No switching cost, and we never compete with the data providers.
* **A complete compliance pipeline.** Gate (make + sign the decision) → Proofs (prove it privately) is
an end-to-end story: produce the verdict, then prove it without exposing the data.
* **Quantum-resistant, offline-verifiable.** Every receipt is Falcon-1024 signed and verifies from the
public key alone — no callback, no shared infrastructure.
* **Optionally Substrate 2-bound.** Fold each compliance verdict into the broader
[Substrate 2](/substrate-2) evidence chain.
## How it works
| Step | What happens |
| ------------------ | -------------------------------------------------------------------------------- |
| **Screen** | Your injected provider checks the payer (sanctions / PEP / AML). |
| **Map** | The result becomes a categorical `ALLOW / REFER / DENY`. |
| **Certify** | Bind a content-addressed payer reference and sign the receipt (Falcon-1024). |
| **Verify / prove** | Verify the receipt offline, or feed it to Proofs to prove the verdict privately. |
## Cryptography
* **Post-quantum signing.** The ALLOW/REFER/DENY verdict is a Falcon-1024-signed (NIST Level 5),
no-PII, offline-verifiable receipt. The gate performs no zero-knowledge proof itself — it produces the
categorical verdict that [Proofs](/proofs) can later prove privately.
## Stateless admission, not a reputation score
Every Compliance Gate verdict is a **stateless, deterministic, rules-based** decision over the disclosed request fields — the same inputs always yield the same **ALLOW / REFER / DENY**, bound in a signed, recomputable receipt. It is **not** an accumulated behavioural score.
That keeps the blocking decision reproducible and auditable, and it sidesteps the profiling / automated-decision exposure (GDPR Art. 22, EU AI Act) that stateful reputation systems take on at volume. Where AlgoVoi *does* express reputation — the [ATB Pass Certificate](/atb-reputation-credential) — it is a signed, recomputable, agent-held credential used for pricing, never for blocking.
## Why commercial
The certification and verifier layer was never published as open source — there is no free tier to
fall back on. It is offered as a **commercial product** because the value is in a maintained,
privacy-preserving compliance-evidence capability:
* **Embed without attribution overhead.** A commercial OEM licence lets you ship it inside your own
product with no open-source notice obligations.
* **Enterprise terms.** Support, warranty, and a defined relationship — for a compliance-critical
dependency.
* **Maintained crypto suite.** Post-quantum primitives and the receipt format are ongoing work,
bundled into the licence.
## Who it's for
* **Regulated PSPs, VASPs, and exchanges** that must evidence screening to a regulator or partner
**without exposing customer PII**.
* **Crypto platforms already paying a screening vendor** that want a signed, shareable, provable
verdict on top of raw provider output.
* **Compliance / MLRO teams** that need an audit trail of `ALLOW / REFER / DENY` decisions.
* Anyone who needs to **certify a compliance decision without disclosing the data behind it**.
## Frequently asked questions
### What is Compliance Gate?
Compliance Gate turns a screening decision into a signed, no-PII compliance receipt. You screen a payer through your own sanctions, PEP, or AML provider, and the Gate maps the result to a categorical ALLOW, REFER, or DENY verdict and emits a Falcon-1024-signed receipt whose payer reference is a content hash, never the cleartext. It is the same compliance gate that runs in the AlgoVoi production gateway, packaged for Substrate 2.
### Does Compliance Gate perform the sanctions screening itself?
No. It does not perform the sanctions lookup itself, because that is your provider's data. You inject any provider, such as Chainalysis, TRM, Elliptic, or an internal list, behind a small interface, and the Gate orchestrates and certifies the verdict. It is the certification, privacy, and provability layer on top, and it never holds sanctions data.
### How does Compliance Gate relate to Proofs?
The Gate is the origination side of Proofs. The receipt the Gate produces, including its content-addressed payer reference, is exactly the one Proofs binds and proves. You use the Gate to make and sign the compliance decision, then use Proofs to prove it privately downstream. Together they form an end-to-end produce-then-prove pipeline.
### Is a Gate verdict a behavioural risk score?
No. Every verdict is a stateless, deterministic, rules-based decision over the disclosed request fields, so the same inputs always yield the same ALLOW, REFER, or DENY, bound in a signed, recomputable receipt. It is not an accumulated behavioural score, which keeps the decision reproducible and auditable and sidesteps the profiling exposure that stateful reputation systems take on at volume.
## Get Compliance Gate
Compliance Gate ships inside the [Verifiable Compliance Suite](/verifiable-compliance-suite). One
commercial licence installs the whole compliance estate. It pairs with [Proofs](/proofs) as a
"produce → prove" compliance pipeline. It binds to Substrate 2 (it is not part of Substrate 2 itself),
is included in the AlgoVoi Enterprise and [On-premise](/on-premise) plans, and is not distributed on
public package registries. Install is token-gated from the AlgoVoi private index; set
`ALGOVOI_LICENSE_KEY` to run. See the [Verifiable Compliance Suite](/verifiable-compliance-suite) for
licensing, or [email us](mailto:hello@algovoi.co.uk) for Enterprise / OEM.