The evidence engine
that refuses.

The refusal is the product

Most compliance software is built to produce an output. This is built to withhold one.

What is real, and what is not

Every component carries one of four labels. Nothing is described as finished when it is not — and the gaps below are stated as plainly as the wins.

Five conditions, encoded as executable checks

Why condition 5 behaves differently

Conditions 1–4 are prerequisites — they need an affirmative record. Condition 5 is a veto: it asks whether a problem is open, so on an empty chain it passes. That asymmetry is deliberate and pinned by a test, because the failure mode it prevents is ugly — a firm with no evidence at all appearing to be one step from compliant.

Proof of control, without moving assets

The proof signs a random challenge, never a serialised transaction. It carries no TransactionType, no Account, no Fee, no Sequence. A leaked proof cannot move anything — and a test asserts the signature fails to decode as a transaction.

Exactly when possession may be asserted

The gate's real logic. Four of the seven terminal paths are not an assertion.

Three decisions worth arguing with

• A 1-of-1 local key is rejected as an institutional control. A single key on one machine is not what "protected consistent with industry best practices" contemplates. Configurable; defaults to strict.
• Third-party custody is routed to 15c3-3(c), not (b)(1). If a custodian holds the keys, the firm does not have physical possession — it has control at a good control location. Different legal test, different evidence. The gate refuses to conflate them.
• Refusals are recorded, not swallowed. A firm that tried to assert and was stopped has created evidence that the control operated.

One definition, two rails

EVM carries transfer logic needing arbitrary computation. XRPL carries settlement and membership — putting the eligibility check in the ledger itself rather than an application server.

Reproduce every claim on this page

No screenshots. Every green label above corresponds to a command you can run in about four minutes.

$ git clone https://github.com/FTHTrading/BD-New.git
$ cd BD-New && npm install

$ npx hardhat test                                 # 17 passing — ERC-3643
$ node --test possession/test/possession.test.js   # 31 passing — possession
$ node xrpl/validate.js                            # offline conformance
$ node possession/demo.js                          # end-to-end

What the demo actually prints

Stage 1  no evidence on record      REFUSED
Stage 2  third-party custodian      routed to 15c3-3(c), not (b)(1)
Stage 3  incomplete procedures      REFUSED — names the 3 missing contingencies
Stage 4  procedures completed       ASSERTED
Stage 5  reorg observed             REFUSED ← condition 5 kill switch
Stage 6  concern investigated       ASSERTED

Independent re-verification from disk
  PASS  chain re-verifies from the written file
  PASS  tampering detected at receipt 3 (content does not match its hash)

What this is not

• It is not a broker-dealer and confers no registration.
• It does not custody anything and has never held customer assets.
• No component has been audited.
• No component is deployed to any mainnet.
• The staff statement it implements is not a rule and confers no safe harbour. It should be cited to a client's counsel, never around them.
• Passing the gate is necessary, never sufficient. It checks that required determinations exist, are current and are affirmative. It cannot judge whether a policy is any good — that is for the firm's counsel, its FINOP and its independent accountant.
• Every generated document is full of [TO BE COMPLETED BY THE FIRM] markers. They are deliberate. A policy with plausible filler is more dangerous than an obviously incomplete one.

Regulatory basis