MAINNET· live since 2020BLOCK #33,887,550FINALITY 6.00sOPS / BLOCK 0VALIDATORS 11 · 5 ORGSTOTAL XBN 369B XBNCIRCULATING 74.10B XBNHFBA CONSENSUS · 3–5s FINALITYMAINNET· live since 2020BLOCK #33,887,550FINALITY 6.00sOPS / BLOCK 0VALIDATORS 11 · 5 ORGSTOTAL XBN 369B XBNCIRCULATING 74.10B XBNHFBA CONSENSUS · 3–5s FINALITY
Bantu
Contents01 · Compliance controls

The control register.

Twelve protocol-level controls, each an addressable reference. Seven of them govern who may hold a regulated asset and under what conditions; the remaining five govern custody and operational risk and are documented in chapter 02. None of them require a smart contract.

Edition 1Last reviewed July 2026bantufoundation.org/institutions
Issuer model

Every regulated asset has an identifiable issuer.#

The asset code identifies the instrument — NGN, KES, USD, cNGN, cKES or a bond or security identifier. The issuing account cryptographically identifies the institution responsible for issuance and redemption. This is what allows multiple institutions to issue similarly named assets while keeping them unambiguously distinct, and it is the anchor on which every control below depends.

NGNKESUSDcNGNcKES
Register

Twelve controls, one table.#

The reference view. Each row names the protocol mechanism, whether the action can be reversed, whether it requires issuer consent, the governance an institution should apply, and the circumstance it exists for.

ControlMechanismReversibleIssuer consentTypical governancePrimary use
Holder opt-inTrustline—Not requiredCustomer termsExposure control
Allow-listingAUTHORIZATION_REQUIREDYesRequiredCompliance key, low thresholdKYC gate
Account freezeAUTHORIZATION_REVOCABLEYesRequiredCompliance + risk + legalSanctions, fraud
Limited authorizationAuthorization downgradeYesRequiredCompliance keyControlled wind-down
Per-transaction approvalAtomic authorise → pay → de-authorisen/aRequiredTreasury + complianceHigh-value corridors
ClawbackAUTH_CLAWBACKNoRequiredCompliance + risk + legal + treasuryCourt order, fraud recovery
Irrevocable commitmentAUTH_IMMUTABLENevern/aBoard-level decisionOpen-asset guarantee
Signing governanceN-of-M multisignatureYesn/aWeighted thresholdsDual control, four eyes
Account separationIssuer / distribution / compliance / treasury / liquidityn/an/aKey ceremonyBlast-radius limitation
AtomicityMulti-operation transactionn/an/aChange managementDvP, PvP, FX
Conditional settlementClaimable balancesYesn/aOperations + treasuryEscrow, disbursement
Reserve sponsorshipSponsored reservesYesn/aTreasury policyZero-balance onboarding
Rows 08–12 are custody and operational-risk controls, documented in full in chapter 02. Reversibility describes the protocol action, not the underlying legal position.
Participation

How an account is admitted to a regulated asset.#

A trustline is the holder's explicit opt-in. Authorization is the issuer's explicit admission. Both must be present before a regulated asset can move — which is what makes the allow-list an enforcement point rather than a policy document.

Figure 3 · Trustline authorization gate
Holder
Account requests a trustline to the issuer and asset
Institution
Off-chain KYC, sanctions and risk screening
Issuer
Compliance account authorises the trustline
Result
Account may hold and transact the asset
Enforcement point
AUTHORIZATION_REQUIRED
  • Full
    Payments and trading
  • Limited
    Existing obligations only
  • Revoked
    Position frozen
Full authorization permits normal payments and trading. Limited authorization allows a holder to maintain existing market obligations but prevents broader transactions. Revocation freezes the position entirely.
In detail

Seven controls for regulated participation.#

Each control below states what it does, what it exists for, and the governance an institution should place around it. The governance notes are not disclaimers — they are the conditions under which these controls hold up in front of a supervisor.

01

Trustline

Explicit holder consent

Before an account can receive an issued asset it must establish a trustline to that issuer and asset. This is an explicit opt-in by the holder and the protocol-level mechanism through which issuers apply access control. A holder may set a maximum trustline limit, capping exposure to a particular issuer or currency.

Applies to
  • Customer opt-in
  • Exposure limits
  • Unapproved-wallet exclusion
  • Policy tiering by wallet type

Governance—The trustline limit is a holder-side control. Where an institution needs to constrain who may hold the asset at all, it must be paired with Authorization Required — a trustline on its own does not gate participation.

02

Authorization Required

AUTHORIZATION_REQUIRED

When an issuer enables this flag, an account cannot hold the issuer's asset until the issuer approves its trustline. This supports a regulated, allow-listed currency environment in which only KYC-approved customers hold the asset, only licensed institutions reach an interbank settlement asset, and merchants, agents, corporates and retail customers can be placed in distinct policy tiers.

Applies to
  • KYC-gated assets
  • Interbank-only settlement assets
  • Merchant, agent and retail tiers
  • Central-bank distribution through approved institutions

Governance—Authorisation is an operational load as well as a control — every new customer requires an approval transaction. Delegate it to a dedicated compliance account with a low signing threshold so customer onboarding is never queued behind treasury approvals.

03

Authorization Revocable

AUTHORIZATION_REVOCABLE

An issuer can revoke a previously authorised trustline, freezing that holder's position in the issued asset. The affected holder cannot transfer or trade the asset, and open orders involving it can be cancelled.

Applies to
  • Sanctions enforcement
  • Fraud investigation
  • Court and regulatory orders
  • Compromised wallets
  • Lost-device remediation
  • AML escalation
  • Insolvency administration
  • Temporary risk holds

Governance—A freeze is a customer-facing action with legal consequences. Require independent compliance approval rather than a single operations key, and record the authorising instruction off-chain alongside the on-chain evidence so the two can be reconciled under examination.

04

Limited authorization

Authorization downgrade

A trustline can be reduced from full authorization to limited authorization. The holder cannot make ordinary transfers but can still manage existing liabilities and open offers in a controlled way. This is the difference between stopping new activity and disorderly unwinding of a live position.

Applies to
  • Orderly position wind-down
  • Market-abuse containment
  • Pending-investigation holds
  • Managed offboarding

Governance—Limited authorisation is frequently the proportionate response where a full freeze would be punitive or would disrupt third parties holding matched positions. Document the escalation ladder from limited authorisation to full revocation before you need it.

05

Transaction-by-transaction approval

Atomic authorise → pay → de-authorise

The issuer may authorise the sender and recipient, execute the payment, then return both trustlines to limited authorization inside a single atomic transaction. This allows a regulated issuer to inspect and approve one particular transfer without granting indefinite free-transfer rights to either party.

Applies to
  • Institutional settlement
  • High-value cross-border transfers
  • Restricted corporate treasury movements
  • Securities settlement
  • Controlled foreign-exchange conversion
  • Sanctions-sensitive corridors
  • Regulatory approval workflows

Governance—This is the highest-friction, highest-assurance mode available. Reserve it for corridors or counterparties where per-transaction review is a supervisory expectation; applied broadly it will not scale operationally.

06

Clawback

AUTH_CLAWBACK

An optional issuer control allowing tokens to be recovered from a holder where the issuer is legally compelled to act. Properly governed, it supports recovery of fraud proceeds, correction of mistaken issuance, execution of valid court orders, recovery of misdirected institutional funds and cancellation of stolen or illicitly obtained assets.

Applies to
  • Fraud proceeds
  • Mistaken issuance
  • Court orders
  • Misdirected institutional funds
  • Stolen or illicitly obtained assets

Governance—Clawback must be governed carefully. Disclose it in the legal terms of the currency or asset, control it through multisignature approval, document it in auditable policy, and confine it to defined legal, compliance, fraud or operational circumstances. An undisclosed clawback capability is a reputational liability, not a control.

07

Authorization Immutable

AUTH_IMMUTABLE

Permanently prevents the issuer's authorization flags from being changed. It allows an issuer to make a credible, irreversible commitment that an asset will remain open and cannot later be converted into a freezeable, revocable or permissioned token.

Applies to
  • Open-asset guarantees
  • Public commitment to holders
  • Removing issuer discretion

Governance—For central-bank or commercial-bank money this flag should be set only after a deliberate policy decision at board level. It removes issuer flexibility permanently — including the ability to comply with a future legal instruction requiring a freeze.

Chapter 02

Controls are only as good as the keys behind them.

Every control on this page is exercised by a signing key. Chapter 02 documents how those keys are separated, weighted and governed — multisignature thresholds, issuer and distribution separation, atomicity, conditional settlement and reserve sponsorship.

Chapter 02 →Request an institutional briefing →