Non-Custodial Pre-Clearance Authorization Layer

Executive Summary

JIL's pre-clearance layer inserts a required, independently-produced compliance co-signature into a custodial egress transaction without JIL ever taking possession of the underlying asset. An egress request from a client's own custodian is evaluated by a compliance pipeline; only if every stage passes does JIL contribute its own share of a composite threshold signature - the custodian's own signing quorum still produces its share independently, and a valid, broadcastable transaction requires both.

The compliance pipeline runs as parallel evaluation stages - endpoint and address provenance, KYC/AML status, sanctions and watchlist screening, and behavioral/graph risk scoring - whose combined findings are rolled up and, on a pass, signed by a pre-settlement attestation. That attestation is itself produced by a quorum of independently-keyed validators rather than a single signer, and bound by hash into the same signature domain as the transaction it authorizes, so the attested parameters cannot drift from the broadcast parameters without invalidating the signature.

Because JIL's role is limited structurally to contributing a required signature share - never custody - the legal and operational posture is that of a compliance-attestation and signing service layered on top of a custodian's own infrastructure, not a money-transmission or custodial relationship: the custodian's quorum retains all material custody of the asset for the entire transit window.

Core Innovation: A required, independently-produced compliance co-signature bound by hash to the exact transaction it authorizes, contributed by a party that never takes custody of the asset at any point.

Problem Statement

Institutional custodians protect assets strongly while at rest inside their own signing quorum, but that protection does not extend to the transit window between the custodian's quorum and an external destination - the window in which a compromised operator, a poisoned destination address, or a coerced approval can redirect funds, and which is not covered by the custodian's own at-rest protections or SLA. Third-party transaction-monitoring tools address part of this gap by screening and alerting, but a screening alert is advisory: it cannot itself withhold the signature needed to broadcast a non-compliant transaction, because the monitoring tool holds no signing role in the transaction.

Technical Architecture

Compliance Pipeline

Stage	What It Checks	Timing
Endpoints	Source and destination address consensus/provenance	Parallel with stages 2-4
KYC/AML	Both counterparties' verification status	Parallel
Sanctions	Multi-list, multi-hop graph screening	Parallel
Risk	Behavioral and graph-based anomaly scoring	Parallel
Attest	Signs and seals the pre-settlement attestation once the four findings above roll up	After all four findings are collected

Pre-Settlement Attestation Signing

The attestation payload is serialized with its keys sorted before hashing and signing, so signature verification is independent of how the payload object happened to be constructed by the caller. The signing operation fronts a validator roster with a BFT quorum-aggregation design, fanning the canonical payload out to independently-keyed signers and returning once a configured signature threshold is collected. This is a target design topology; the attestation service's own reported metadata discloses which mode actually produced a given attestation - a fully-distributed mode with independently-operated external validators, or a bootstrap mode using in-process keys on a single host - so the attestation's provenance is self-disclosing rather than asserted.

Non-Custodial Structural Boundary

JIL's contribution is exactly one additional required signature share alongside the custodian's own independently-operated signing quorum. JIL's infrastructure at no point holds a private key, a wallet balance, or transaction-broadcast authority over the asset - only the compliance decision and its corresponding signature share.

Domain-Separation Binding

Every issued signature and attestation is bound to identifiers including the custodian, the client account, and a single-use request ID, so an attestation issued for one specific egress request has no validity if presented against a different request.

Prior Art Differentiation

Model	Can Actually Block a Non-Compliant Broadcast?	Custody Held by the Compliance Layer?	Attestation Independently Multi-Signed?
Post-hoc transaction monitoring (Chainalysis KYT, TRM Labs, Elliptic)	No - alerts after the fact	No	No - a single vendor's own finding
Custodian's own internal policy engine used alone	Yes, but only within that one custodian's own infrastructure and controlled by that same custodian	Yes - the custodian already holds the asset	Depends on the custodian's own internal design
JIL Pre-Clearance	Yes - the required co-signature is withheld on failure, so no composite signature exists to broadcast	No - JIL never holds the asset	Yes - the attestation is produced by an independently-keyed validator quorum, with its own attestation mode self-disclosed

Patent Claim

Independent Claim 22: A computer-implemented method for gating a custodial egress transaction without taking custody of the transacted asset comprising: receiving, from a custody provider's own signing infrastructure, an egress request identifying a source, a destination, an asset, and an amount; evaluating the request across a plurality of parallel compliance-finding stages comprising at least endpoint-provenance verification, identity-verification status, sanctions and watchlist screening, and behavioral risk scoring; rolling up the findings from the plurality of stages into a single pass-or-fail determination; upon a pass determination, producing a pre-settlement attestation by collecting independently-keyed signatures from a validator quorum over a canonically-serialized attestation payload, until a configured signature threshold is met; contributing the resulting attestation as a required additional signature share to a composite threshold signature scheme in which the custody provider's own signing quorum independently contributes its own share, such that neither the custody provider's share alone nor the attestation share alone is sufficient to produce a broadcastable transaction; and binding the attestation, by cryptographic hash, to the exact transaction parameters evaluated, such that any deviation between the evaluated parameters and the broadcast transaction invalidates the composite signature.