Compliance

Edge screening and association sets

Every shield and unshield is screened against sanctions and risk lists, and every withdrawal can prove it isn't associated with tainted deposits.

Status: pre-launch. Noirpay is being built. This page describes the design as specified in the whitepaper; nothing on it is live on Robinhood Chain yet, and details can change before launch. See What's live today.

Screening on entry

Before a deposit becomes a note, its source is checked:

• Sanctions lists (OFAC SDN and equivalents) for the depositing address and, via the ramp, the identity behind a fiat deposit.
• Risk scoring of the on-chain source: known exploit proceeds, mixers flagged as high-risk, and similar.
• Refusal at the edge. A deposit that fails is refused before anything is shielded. The pool never contains it.

Screening on exit

A withdrawal destination is checked the same way. Withdrawals to sanctioned or high-risk addresses are refused.

Association-set proofs

Screening keeps bad deposits out; association-set proofs let a good withdrawal show it. When you unshield, your proof can state, in zero knowledge, that the notes being withdrawn descend from a deposit in a named association set (for example, "all deposits that passed screening" or a stricter set published by a compliance provider) without revealing which deposit.

• A bank or issuer receiving the withdrawal can verify the proof.
• You reveal membership in a clean set, nothing about which member you are.
• Sets are published and versioned so a verifier knows exactly what was proven.

Reporting

Where the law requires it, Noirpay files reports about screening outcomes at the pool boundary. Those reports cover the edge event (a refused deposit, a flagged destination); they cannot cover the inside of the pool, because Noirpay can't read it. See What Noirpay sees.