<!--
Sitemap:
- [Welcome to Kakushi 隠し](/index): Kakushi is a private execution layer for institutions building on stablecoin rails.
- [What is Kakushi](/introduction/what-is-kakushi): Money is private.
- [Using Kakushi with AI](/introduction/using-kakushi-with-ai): Every page in these docs is available as plain markdown for use with language models.
- [Quickstart](/quickstart): This is the ten minute path.
- [Zones and the trust model](/concepts/zones-and-trust): A zone is a private blockchain only you can see inside, with a public chain's proofs underneath.
- [The portal](/concepts/the-portal): Money walks in as public USDC and becomes private the moment it crosses.
- [Accounts and custody](/concepts/accounts-and-custody): Your existing wallet address is already a Kakushi account. Nothing to deploy, nothing to enroll.
- [Bring your own address](/concepts/bring-your-own-address): A zone account is just an address, the one an auth key recovers to, with nothing deployed.
- [Virtual addresses](/concepts/virtual-addresses): Hand every customer their own address, the way a bank hands out virtual account numbers.
- [Private transfers](/concepts/private-transfers): Pay fifty thousand people and publish zero salaries.
- [Settlement and composability](/concepts/settlement-and-composability): Two institutions settle in real time without sharing a ledger or seeing each other's books.
- [Private deposits and withdrawals](/concepts/private-deposits-and-withdrawals): Soon, even the edges go dark.
- [Proofs and the verifier](/concepts/proofs-and-the-verifier): You cannot fake a balance, and you can prove you are solvent without showing a single customer.
- [Fees and gas](/concepts/fees-and-gas): Your users never hold ETH and never see gas. They pay in the dollars they are already sending.
- [Privacy and disclosure](/concepts/privacy-and-disclosure): The public sees nothing, you see everything, the regulator sees what the law entitles them to.
- [Zone policies](/concepts/zone-policies): Compliance is built into the zone. You configure your program; the substrate enforces it on every transfer.
- [Onboard a customer](/guides/onboard-a-customer): Two calls and a webhook, and your customer has a private on-chain account.
- [Accept deposits](/guides/accept-deposits): Anyone with funds on the host chain can pay into your zone, and it lands as a private balance for your user.
- [Make private transfers](/guides/private-transfers): One call moves money privately. One call pays a whole payroll.
- [Process withdrawals](/guides/withdrawals): Burn inside, release canonical USDC outside, in one call.
- [Settle between zones](/guides/settle-between-zones): Send money to another institution's zone like it is a withdrawal. It is interbank settlement.
- [Handle webhooks](/guides/webhooks): React to money moving. Do not poll for it.
- [Reconcile](/guides/reconcile): Two numbers that must always match. Assert it on a schedule.
- [Non-custodial integration](/guides/non-custodial-integration): The user signs on their device. You never hold the key, and you still cannot move their money.
- [Compliance and disclosure](/guides/compliance): You hold the whole record. Disclosure is an export, not a negotiation with the protocol.
- [SDK reference](/sdk-reference): The look-it-up layer.
- [Connect and EVM reference](/connect-and-evm-reference): The chain-level integration detail.
- [Run a zone](/run-a-zone): Most operators never run any infrastructure.
- [Protocol spec](/protocol-spec): The deep technical layer, for auditors and engineers integrating below the SDK.
- [Resources](/resources): See Key concepts for the working vocabulary, expanded throughout Core concepts.
-->

# Compliance and disclosure

Because you see your entire zone, compliance is something you produce, not something you extract from the protocol under pressure. A regulator asks who funded an account; you answer with an export.

![The operator producing a disclosure export from the full zone record](/images/guides/compliance.svg)

```ts
// who funded this account, for a regulator
const attribution = await kakushi.deposits.getAttribution(depositId);

// a complete activity export for an account over a period (account by address; from / to are dates)
const trail = await kakushi.compliance.exportAuditTrail({
  account: "0xAliceZoneAddress", from: "2026-01-01", to: "2026-03-31",
});
```

Solvency attestation is backed by the proof system: you can show an auditor that representation supply is fully backed by locked canonical assets without revealing any individual account. Confidentiality toward the public and full disclosure to the entitled party live side by side, which is exactly how regulated finance is supposed to work.

:::note
V1 enforcement is limited to host-chain token freezes, which are the issuer's mechanism. Operator-level enforcement (`freezeAccount`, policies) arrives in V2. Disclosure reads are available today.
:::

## Configure compliance policies

Disclosure answers "who did what." Policies decide "what is allowed" in the first place. Your zone has a built-in policy system, so you configure your compliance program instead of building enforcement yourself: KYC whitelists, AML blacklists, per-token rules, and instant account freezes, all enforced by the substrate on every transfer.

```ts
// (V2) KYC-gate USDC, then freeze a flagged account
const kyc = await kakushi.policies.create({ type: "whitelist" });
await kakushi.policies.addToWhitelist(kyc, kycdCustomers);
await kakushi.policies.setTokenPolicy("USDC", kyc);

await kakushi.compliance.freezeAccount("flagged_user");
```

See [Zone policies](/concepts/zone-policies) for the full model: policy types, per-account flags, delegating a list to your compliance team, and how issuer freezes flow through automatically.

:::warning
The operator-controlled policy system is a V2 capability. In V1, run KYC and AML out of band; the zone honors host-chain issuer freezes at the deposit and withdrawal boundary.
:::