Short answer
ATCE, the Adaptive Trust, Compliance and Execution Engine, rules on the amount of every transfer against a limit for that asset: a site default, or an override set for the asset. A limit of zero permits nothing. For a Digital Currency Platform currency, ATCE also weighs identity level, both jurisdictions and risk. ATCE enforces every transfer on jil-mainnet-2, and each sovereign site writes its own limits and pins them.
How does ATCE limit the amount of a transfer?
ATCE compares the amount of each ruled act with a per-act limit and refuses the act when the amount is over the limit or is zero. The limit comes from the site profile, the set of values a sovereign site pins on chain for its own rulings.
The site profile carries a default per-act limit (per_tx_limit). It also carries a list of per-asset overrides (asset_limits). When ATCE rules an act it loads the profile, then applies the override for the asset being moved if one is pinned. An asset that is not listed uses the default.
The check sits in a fixed order, so every validator reaches the same first failing reason. The order is: profile well-formed, required attestation present, identity level, sanctions, risk, origin jurisdiction, destination jurisdiction, then amount. Amount is the last deterministic check. After it come the account-level restrictions of either party (freeze and zone) and then the agentic review, which can hold an act the rules passed and cannot release one the rules denied. ATCE's outcome is allow or deny; a deny that waits for a person is called a hold. A refusal on amount carries reason code 4, amount over limit.
How do per-asset overrides work?
A per-asset override replaces the site default for that one asset, in both directions. An asset can be given a tighter limit than the default or a looser one. The override does not add to the default and does not take the lower of the two.
| Item | Rule |
|---|---|
| Site default | per_tx_limit, one unsigned 128-bit integer, used for every asset with no override |
| Override list | asset_limits, each entry an asset (asset code or token id, 1 to 64 bytes) and a per_tx_limit |
| Uniqueness | An asset may appear once in the list. A duplicate is rejected |
| Validation | Entries are validated before anything is staged. A rejected list stages nothing that counts |
| Zero | A limit of 0 permits no transfer of that asset. It does not mean unlimited |
| Size of the list | The ACL chain caps it at 256 entries |
| Who sets it | A ConfigureAtce transaction. On the ACL chain it is valid only inside an envelope sent by the governance account jil1atce |
Zero is deliberate: an unconfigured currency or corridor moves nothing until someone opens it. A worked illustration in the InterOp design makes the point. A consortium called OIL01 sets its limit for USDC to 0. A direct payment of USDC by OIL01 is then refused with reason 4 before the agentic review is reached, and nothing moves.
Status, 2026-11-02: ATCE is deployed and enforcing every transfer on jil-mainnet-2, and per-asset limits are part of that ruling. Each sovereign site writes its own limits and policy, and a site goes live when its policies are pinned. This page describes the limit mechanism as the design and code write it.
What does ATCE check on a Digital Currency Platform transfer?
ATCE checks the identity level presented, the jurisdiction of the sender and of the recipient, the amount against a ceiling, a live risk score, sanctions status and, where the profile demands it, a supporting attestation. It returns a verdict, a reason code and a hash.
The Digital Currency Platform (DCP) is the JIL service that defines a regulated currency, such as a fiat-referenced stablecoin or a tokenized deposit, as a managed instrument. Every ordinary transfer of a DCP currency is evaluated before it executes. The engine reads a profile attached to that currency and a context that travels with the transaction.
| Input | Where it comes from | Reason code if it fails |
|---|---|---|
| Profile well-formed | The pinned profile. An empty jurisdiction list is malformed | 7, profile malformed |
| Attestation | Required if the profile says so | 8, missing attestation |
| Identity level, None(0) to Institutional(4) | The identity record of the party, signed by the attester | 1, identity below required |
| Sanctions hit | The screening result in the context | 6, sanctions hit |
| Risk score | Denied at or above the profile threshold | 5, risk too high |
| Origin jurisdiction | Sender registration | 2, origin blocked |
| Destination jurisdiction | Recipient registration | 3, destination blocked |
| Amount | The act, against the per-act limit | 4, amount over limit |
The design document for the currency gate also names further context fields, such as the zones of both parties, a rolling 24-hour outflow for the sender and the recipient's balance after the transfer. It describes that gate as a roadmap item in one document and as a transfer path in another. Treat the extra fields as design.
The result is a verdict (allow or deny), a reason code, and a SHA-256 commitment that binds the profile, the context and the outcome. The commitment is attached to the transfer event, so a regulator can recompute it.
What is a Currency Object?
A Currency Object is a managed instrument whose record names, in consensus, its issuer, its reserves, its mint and burn authority, its identity and jurisdiction rules and its ATCE policy profile. It is a currency with its law attached, not a loose token contract.
The fields the platform design lists for a Currency Object include the currency code (the native denomination), the issuer of record (a licensed local entity), the issuing authority, the reserve model, the mint and burn authorities, decimals, settlement rules, identity requirements, jurisdiction, audit requirements, proof-of-reserve settings and the ATCE policy profile. Settlement rules, identity requirements and the policy profile are the fields ATCE reads.
ATCE stores the profile under the currency's code. A rule change is a governance setting, not a code deployment. A monetary authority can raise a required identity level, tighten a ceiling or add a jurisdiction, and the change governs the next transfer.
Two limits on this claim apply. A DCP currency issues through a local licensed entity, never through the technology company. And a currency that carries no policy is not ruled by its own profile; the Digital Currency Platform page says the engine rules currencies that carry a policy.
No currency described on this page is legal tender. A demonstration unit is not legal tender, and issuance stays off on a demonstration until a licensing event.
What is the currency site?
The currency site is the single Tier 2 site on which JIL holds the rules of engagement for outside assets. Each layer 1 and each stablecoin has its own rule there. A new asset is another rule on the same site, not another hostname.
A layer 1 is a base blockchain with its own native asset, such as Ethereum or Solana. A stablecoin is a token pegged to a currency, such as USDC. The currency site has no hubs and no annexes of its own. The public site says it can hold on the order of 100 stablecoins and on the order of 1,000 layer 1s. JIL does not charge to put a rule on it.
How does a sovereign enable an asset?
A Tier 1 root enables the currency site and requests one layer 1 or one stablecoin. The request is a one-time setup of the ATCE corridor rules for that asset. After it, every hub and every annex under that Tier 1 may use the asset.
- The Tier 1 root enables the currency site.
- The Tier 1 requests one layer 1 or one stablecoin.
- JIL sets up the ATCE corridor rules for that asset once.
- Every hub and annex under that Tier 1 may use the asset.
- The buyer is a Tier 1 as well, and registers and enables the same asset. One Tier 1's setup does not enroll the other.
The amount of the setup fee is not printed on the public site, and this page does not state one. Each settled hop is published at 5 basis points of that leg's settled gross, paid by the initiating sovereign. Movement inside a hub stays at 0.
Status, 2026-11-02: supported means the asset is named on the shared resources page and a Tier 1 may request it. It does not mean a live connection. The Ethereum bridge corridor is deployed on mainnet and its deposit path has been exercised in production, as of 2026-11-01. Its threshold-approval withdrawal path awaits a key ceremony. No other listed network is a live connection, the InterOp router is designed, and every adapter refuses a lock and a release.
Which networks are supported?
The shared resources page lists 18 layer 1 networks and 29 named stablecoins as supported, which means a Tier 1 may request them. Arbitrum, Base and Polygon are settlement rails, not layer 1s. Governance tokens, wrapped assets and the JIL token are not listed.
What may a leaf store locally?
A leaf, an annex at the edge of a Tier 1, may store the local allow and the local limits. It does not rewrite the currency rule and does not open a corridor. An annex does not send on the corridor. The Tier 1 root does.
What happens when a limit is exceeded?
The transaction reverts and no value moves. Gas is still charged, and the rejection log carries the reason code and the commitment.
Frequently asked questions
Does a limit of zero mean unlimited?
No. In ATCE a limit of zero permits no transfer of that asset. An unconfigured currency or corridor moves nothing until its limit is deliberately set.
Can an asset have a looser limit than the site default?
Yes. A per-asset override replaces the default in both directions, so an asset can be tighter or looser than the default. An asset with no override uses the default.
Is the amount checked before or after identity and jurisdiction?
After. ATCE checks the profile, attestation, identity level, sanctions, risk and both jurisdictions first, and checks the amount last among the deterministic checks. The fixed order means every validator reports the same first failing reason.
Is a currency on the currency site legal tender?
No. A row on the currency site names an instrument and says nothing about legal tender or whether a payment is lawful in a given place. A demonstration unit is not legal tender, and issuance stays off on a demonstration.
Does JIL charge to put an asset on the currency site?
JIL does not charge to put a rule on the currency site. The setup for an asset is one-time. The amount of the setup fee is not printed on the public site.
Can an annex open a corridor for an asset?
No. An annex may store the local allow and local limits, but the Tier 1 root sends on the corridor. The annex does not rewrite the currency rule.