BalanceID and Compliance Passport (next layer)#
Status: a separate, future layer. This page summarises a working reference specification (version 0.1, 26 October 2026, a first structured architecture document). It is not an implementation protocol, not legal advice and not a certification standard. Nothing on this page is built. The directory and the circles described elsewhere on this site never hold identity documents or bank data.
What it is for#
Balanced wallets live in circles and need no bank. But a bank or an electronic-money institution (an EMI, an authorised payment company) that wants to connect a person's euro account to their balanced wallet must know who that person is and who vouches for it. The BalanceID layer is a portable, signed structure for claims, evidence, independent checks and permissions, so that a person keeps one living profile and many providers see only what they are allowed to see. It would be called Bank 3 in the journey: newcomer, member, wallet, bank.
The one principle#
A signature proves authorship. A check proves a specific finding.
A photograph or a statement by a user is not proof of authenticity by itself. Credibility appears when a verifier that the recipient accepts signs the result, method, scope and time of the check of one specific claim. What is signed is not the same as what is true. Each recipient (each bank) decides whom it trusts; trust in a verifier is never global.
The pieces#
| Piece | Meaning |
|---|---|
| BalanceID | The person's public key. The same 64-character HEX key as in the circles. It is the identifier; private keys stay under the person's control |
| Compliance Passport | A private, living, structured profile: identity, economic profile, source of funds, a log of changes. Encrypted; shared by permission |
| KYI, Know Your Impact | A separate assessment of the effect of a subject's activity on people, society and nature. It is not a replacement for the legal identity and anti-money-laundering checks (KYC, AML) |
| Bank / provider | A separate regulated relationship. The bank makes its own compliance decision and authorises payments; the bank's own strong customer authentication stays separate |
| Relays | Transport and storage of signed events. They carry no identity and arbitrate no truth |
Event objects (all conceptually signed Nostr events): a profile/state, a claim (a statement by the subject), evidence (an encrypted, immutable document or record), a verification (an independent verifier's signed result for one claim and one piece of evidence), a human attestation (for example three verified physical persons who know the subject in person), an economic/impact journal, an access request and grant (a bank asks, the subject approves a narrow scope), an access revocation and a status/supersession (append-only corrections). The kind numbers and tag names are not decided.
How a statement is labelled#
Every important statement shows its provenance: self-declared (the subject said it), verified (a verifier ran a named method and signed a result), attested (a third person or source vouched), contradicted or inconclusive. Methods such as document checks, chip reads, face match and liveness are recorded separately, each with its own result and limits. A plain "verified: true" is not enough.
How it would meet the circles#
- A newcomer makes a key and a profile (KIND 0). No identity data is public.
- In parallel, and by choice, the person builds a Compliance Passport; evidence goes encrypted to a vault; verifiers sign narrow findings. Publicly the person may show only a badge such as "verified by X, method Y, valid until Z".
- The person joins a circle: the member home links the same key to the circle. The directory then knows "this key is a member of that circle since block h". It never holds KYC data.
- The wallet is an account line in the circle's ledger. Anyone, including a bank, can get a proof of the balance from the circle's daily seal (a Merkle proof), without the circle's server. See the AI guide.
- A bank (Bank 3) asks for access to the passport; the person approves a narrow, time-limited scope. The bank learns: this key is verified at a verifier I accept, and the same key is a member of circle Y with a provable balance. The fiat payment stays separate.
Limits that matter#
- Revoking access stops new distribution; a copy already lawfully disclosed cannot be taken back, and the interface must not promise deletion of a recipient's copy.
- Public tags must never reveal names, birth dates, document numbers, tax numbers, biometrics or unnecessary business relations.
- Before any real KYC data is handled, a security review, a privacy assessment and contracts with providers are required.
- Release 1 aims only at a thin vertical path: one test identity, one piece of evidence, one verifier, one approved bank and one simple impact claim.
Open decisions of the specification#
The kinds and tags; key wrapping and encryption (NIP-44 integration); verifier trust registries and revocation feeds; event size limits and chunking; a fair, repeatable KYI process; the legal basis in the EU and the UK. The next specifications planned are: an event protocol, crypto and access, verification and trust, a KYI standard, and provider integration.
Back to the two layers.