Compliance

Privacy and auditability are usually sold as opposites. They are not, and this is the part institutions ask about first.

Proving a clean origin

Every note carries a blinded label of the deposit it descends from — its lineage — and every spend proves that label was passed on correctly. Add a published set of approved deposits and a proof that your note descends from one of them, and you have something you can hand someone: my money is clean, and here is the proof — without saying which deposit it came from.

Deposits are screened on arrival against sanctions and known theft, by established screening providers. The set itself is kept by an association set provider, which republishes it as it learns more: a theft traced in May can drop a deposit that looked ordinary in March.

If a deposit is dropped

You lose the crowd, not the money. A dropped deposit can no longer be spent privately, but you can always ragequit — withdraw it by publishing which deposit was yours. The link becomes public, the funds come out, and no list can stop that. Nobody at Sombra, and nobody running a list, holds a key to your money.

Each pool names its own list

The list is published by the pool's ASP authority, not by us. Separate pools are what make that useful: the open pool stays as it is, and a pool built for funds can name an authority its auditors accept, admit only deposits that authority has cleared, and ask for a current proof on the way out. Same protocol, same privacy inside, a different front door.

Choosing a pool is choosing whose policy you live under. Stricter entry is a smaller crowd, so take the loosest pool your counterparties accept.

Opening your own books

Viewing keys are issued per week, so you can open one tax year to an auditor and nothing else. See Keys.

The honest limit

Whoever keeps a pool's list knows which deposit each label belongs to. You choose by choosing a pool, but inside it the secret sits with that one party. It does not disappear.