Executive Summary
JIL Sovereign's multi-severity bad-actor registry is a cross-foundation, cross-engagement registry of confirmed bad actors - UBOs, entities, premises, and bank fingerprints - gated behind a due-process inclusion workflow rather than unilateral flagging. Every actor is classified into one of three severity tiers - watch, restricted, or excluded - each carrying a deterministic statutory review period auto-set at inclusion, and each coupled to a different downstream visibility and score-weight.
Inclusion is gated by a notice period, an entity response window, and, for inclusions deemed material, a council vote requiring quorum and a two-thirds supermajority, with the final inclusion anchored to an immutable ledger. The registry doubles as the substrate for a pre-settlement block mechanism: a confirmed bad actor can be flagged to block a pending settlement before funds move.
watch tier lets an organization track a weak signal without publicly labeling an entity, while excluded hits convert into differently-weighted hard-block evidence, so due process and operational consequence scale together instead of being bolted on separately.
Problem Statement
Cross-organization "bad actor" registries face a structural tension: acting too slowly on a confirmed bad actor lets fraud recur across engagements, while acting too aggressively - immediate, unappealable, permanent exclusion on a single unverified signal - exposes the registry operator to due-process and defamation risk and discourages legitimate participants from ever being removed once flagged. Federal grant programs alone reported tens of billions of dollars in improper payments in recent fiscal years (Payment Integrity Information Act reporting), a material share attributable to repeat bad actors the underlying program had no cross-engagement memory of.
Why Existing Solutions Are Insufficient
- Single-organization blocklists: a bad actor confirmed by one program can freely re-engage a different program with no cross-engagement memory.
- Binary "banned / not banned" registries: collapse weak internal signal and confirmed hard-block evidence into the same public state, either over-exposing unverified suspicion or under-weighting confirmed fraud.
- Ungated inclusion: registries that add an entity on a single report with no notice, response window, or governance vote create due-process exposure and no defensible removal path.
Technical Architecture
Registry Schema
Each registry row is keyed (actor_kind, actor_id) - actor kind spanning UBO, entity, premise, and bank fingerprint - and carries: a display label, an array of confirming engagement identifiers, first- and last-confirmed timestamps, JSON confirmation evidence (which signals plus anchor references), a recidivism count, a pre-settlement-block-active flag with its scoping engagement, and a cross-customer-visibility flag with an explicit opt-in scope listing which customer identifiers may see cross-customer intelligence for that entry.
Due-Process Inclusion Workflow
| Stage | Mechanism |
|---|---|
| Tier classification | Watch / restricted / excluded, each auto-assigned a deterministic statutory review period at inclusion |
| Notice | Fixed notice period issued to the entity before inclusion is finalized |
| Response window | Entity may respond within a fixed window before the inclusion proceeds |
| Council vote | For inclusions deemed material, a defined quorum votes, requiring a two-thirds supermajority to confirm |
| Anchoring | Confirmed inclusion is anchored to an immutable, publicly-verifiable ledger |
The watch tier is deliberately internal-only: the public lookup surface filters it out entirely, so an organization can track a developing signal without publicly labeling an entity before due process concludes. An excluded-tier hit converts into hard_block evidence carrying a different score-weight than a restricted- or watch-tier hit inside downstream risk-scoring signals, so the severity tier changes not just visibility but quantitative consequence.
Pre-Settlement Block & Escalation Path
A confirmed registry entry can be escalated into an active pre-settlement block: an append-only block event is recorded referencing the triggering engagement and a supporting attestation, the registry row's pre_settlement_block_active flag is set, and the block scope is recorded against the specific engagement it applies to. Every block, unblock, or scope-extension action is written as its own append-only event row rather than mutating history in place, preserving a complete audit trail of when and why a settlement was interdicted on bad-actor grounds.
Prior Art Differentiation
| Approach | Cross-organization scope? | Multiple severity tiers? | Notice + response + vote? | Settlement-blocking integration? |
|---|---|---|---|---|
| Single-organization blocklist | No | No | No | Varies |
| Binary banned/not-banned registry | Varies | No | Rarely | Varies |
| Sanctions-list style watchlists | Yes | Partial | Governmental process only | No |
| JIL Multi-Severity Bad-Actor Registry | Yes | Yes | Yes | Yes |