What ATCE is
The Adaptive Trust, Compliance and Execution Engine sits in the path of every regulated action inside a Sovereign Cell: issuance, mint and burn, treasury transfers, cross-border settlement, redemptions, emergency controls. It is not a sidecar dashboard. It is how the chain decides whether an act may exist.
Fail-closed
If identity is below the required level, a sanctions match fires, a limit is exceeded, or an attestation is missing, the transfer is not settled. The refusal is reason-coded and hash-committed. A regulator can open the reason. A bypassed off-chain gatekeeper cannot rewrite that history.
Before, not after
Public chains settle first and hope compliance catches up. ATCE inverts that. Proof is produced before value moves. That ordering is the difference between an audit trail and a control.
What ATCE actually evaluates
Two things meet at the moment of movement. The first is the policy profile, which lives on-chain as part of the cell's state, not in a document held somewhere else. It pins the identity level a counterparty must hold, the jurisdictions the cell will accept value from and send value to, the per-transaction ceiling, the risk score at which the cell stops, the sanctions posture, and the attestation that must be present.
The second is the context that travels with the transaction itself: the counterparty's identity level and its supporting attestation, the origin and destination jurisdiction, the amount, a live risk score, and whether a sanctions screen fired. Because that context is carried by the transaction and signed, every validator sees the same facts.
ATCE takes those two inputs and returns three things: a verdict, a reason code for that verdict, and a single SHA-256 commitment binding the profile, the context and the outcome together.
KYC and KYB are a condition of settlement
This is the part institutions usually ask about twice, because on other chains it is not true. Identity is not checked at an application's front door and then trusted for the rest of the journey. The required identity level and its attestation are evaluated inside consensus, on the transfer itself. A counterparty that has not satisfied KYC, or a business that has not satisfied KYB, does not generate a failed compliance report. It generates a transaction that never settles.
The same evaluation runs on the receiving side. When value crosses from one cell to another, the sending cell's policy is enforced on departure and the receiving cell's on arrival. Neither jurisdiction has to trust the other's onboarding, because each one re-runs its own rulebook against facts that travelled with the value.
One engine, two borders
ATCE is a single primitive with two callers, which is why it is a keystone rather than a feature. The federation arrival gate calls it when value crosses between cells. The Digital Currency Platform calls the identical evaluation on every transfer of a Currency Object, which is what that currency's Financial DNA means in practice.
One engine means one rulebook, one verdict format and one commitment scheme. A supervisor who has learned how a cross-border release is judged has also learned how a domestic transfer of the national currency is judged.
The verdict is part of the block
ATCE is deterministic and runs in consensus. Every validator re-runs the same evaluation over the same inputs and reaches the same answer, so the decision becomes part of the application state hash rather than a log line written afterwards. Three consequences follow, and each one matters to a supervisor.
- It is replayable. Anyone holding the block can re-derive the verdict and get the same result.
- It is attributable. The commitment is anchored to CourtChain and resolves through a public verify link.
- It is not discretionary. No operator can approve a transfer the published policy refuses, because the refusal is reached independently by every node.
Fail-closed is a deliberate default rather than a safety net. A missing input, an unset limit or an empty jurisdiction list denies. A misconfigured cell moves nothing; it does not quietly move everything.
Why this is built the way a supervisor would want it built
Most compliance technology is reconciliation. Value moves, and a second system tries to reconstruct afterwards whether it should have. That model produces findings months later, drawn from records the supervised firm controls.
ATCE moves the control to the only point at which refusing is still possible, and produces evidence as a by-product of the decision rather than as a later report. The supervisor is not asked to trust an attestation the operator wrote. They are handed a commitment they can re-compute themselves.
It also leaves sovereignty where it belongs. JIL does not author anyone's rulebook. The cell operator publishes the policy profile, and ATCE guarantees only that the published policy is the policy that actually executed.
Why the consensus layer is called ACL
ACL stands for the Attested Consensus Layer, and the name is a design statement rather than branding. On a conventional chain, consensus answers one question: do the nodes agree on the ordering of these transactions? Identity, policy and jurisdiction are somebody else's problem, handled above the protocol or beside it.
ACL answers a second question in the same pass: is each act attested, carrying an identity, a policy verdict and a jurisdiction that the network itself evaluated? Agreement on ordering and agreement on admissibility are produced together, by validators that are named rather than anonymous.
That is the property regulated finance has always needed and general-purpose chains were never built to provide. It is also why the layer earns its own name: this is not a ledger with a compliance product bolted on, it is a consensus layer whose output is an attested record.
Honest note. The ATCE engine is built and tested, both as the federation arrival gate and as the Digital Currency Platform's per-transfer gate. Arming it in live consensus is opt-in per cell and requires a coordinated validator upgrade: deployment work carried out with the cell operator, not something already switched on for every deployment. ATCE is patent pending. Nothing here is a claim of a granted patent.
In practice
- KYC and KYB travel with the transfer
- Jurisdiction zones and sanctions are evaluated in consensus
- Per-transaction limits and reserve policy are live state, not PDFs
- The virtual machine can ask the protocol whether a transfer is permitted
Questions people actually ask
Does ATCE replace a compliance officer?
No. It enforces the rules the cell operator publishes. Local law and the Statement of Authority still govern.
Can a contract talk around ATCE?
No. Policy is evaluated in consensus. A contract that would violate the rulebook does not settle.
Who writes the policy ATCE enforces?
The cell operator does, under its own law and its Statement of Authority. JIL supplies the engine that makes the published policy binding; it never supplies the rulebook.
What happens when a rule changes?
The profile is on-chain state, so a change is a governed transaction with its own record. The policy in force at the time of any past transfer stays re-derivable from the block that carried it.
Keep reading
The white paper and a briefing are the next step if you are evaluating a cell.