> For the complete documentation index, see [llms.txt](https://docs.usegimbal.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usegimbal.app/compliance/boundary.md). # Compliance at the boundary Eligibility is enforced where value enters and leaves the contracts, by attestations that carry a role and an expiry but no personal data. This page sets out each entry point, the record behind it, an Gimbal enforces eligibility in code, where participants enter the contracts. {% hint style="info" %} Code, not law: nothing here is legal advice. {% endhint %} ## The three things Gimbal never does * It never holds user funds anywhere but the escrow contracts. * It never converts fiat. * It never applies discretion to a loan. Origination, repayment, rollover and liquidation follow rules, and anyone eligible can trigger them. They underpin the money-transmission and "managerial discretion" reasoning on [Jurisdictions](/compliance/jurisdictions.md). ## Why the checks belong to the protocol On chain a Stock Token is a plain ERC-20 with no transfer restriction. Robinhood applies eligibility in its own app and at KYC'd issuance or redemption; once out, anyone can hold the token. A protocol taking it as collateral inherits none of those checks. Being non-custodial, Gimbal runs its own at the boundary, wherever a participant enters, where `RoleRegistry` answers; see [Eligibility and attestations](/architecture/eligibility.md). ## Entry points and the role each one needs | Action | Check in code | Who passes | | -------------------------------------------- | --------------------------------------------------------------- | --------------------------------------------------------- | | Borrowing | `requireRole(borrower, BORROWER)` at origination | A KYC'd wallet in a non-restricted jurisdiction | | Relaying a borrow request | `requireRole(msg.sender, RELAYER)` and the borrower's signature | An attested relayer | | Lending, at origination and at rollover fill | `requireLender(maker)` | `LENDER_PROFESSIONAL`, or `LENDER_RETAIL` where permitted | | Buying collateral in an auction | `requireRole(msg.sender, LIQUIDATOR)` on `buy` | An attested liquidator | | In-kind collateral to a lender | Lender role, already checked on the slice | A lender who set `selfLiquidate` | | Receiving a slice by transfer | `requireLender(to)` in the transfer hook | A wallet holding a lender attestation | | Opening the platform | Geo-fencing at the front end | Anyone outside a restricted jurisdiction | ## How an attestation works **A record, not an allowlist entry.** After identity, sanctions and residency checks, the KYC provider writes an EAS attestation for the wallet. In the bundled `AttestationLedger` that record is a role, a two-byte jurisdiction class, an investor class, an issue time and an expiry. Nothing in it identifies a person. **Expiry and revocation.** Records expire and are renewed with a fresh `attest`. A `revoke` takes effect in the same block, and removing an issuer from policy disables every record it wrote. **Two layers of screening.** Screening by the KYC provider happens at issuance and at every renewal. The sequencer adds an independent layer, with TRM Labs integrated on the chain. **A policy engine that can be swapped.** The registry holds no rules. Every question goes to the adapter named in the PolicyBoard, so the engine (EAS, ONCHAINID, Chainlink ACE or the bundled ledger) and the approved issuers change through the timelocked `setEligibilityAdapter` and `setAttestationIssuer` with no redeploy of the core. Tighter rules from a regulator land quickly. **Open reads.** Every view is public, so indexers, explorers and aggregators can read everything. ## Personal data Nothing personal goes on chain; it stays with the KYC provider. An optional zero-knowledge credential lets a wallet prove eligibility without revealing which provider checked it or any underlying attribute. ## Following the issuer Borrower jurisdictions track the eligibility list for Stock Tokens; when Robinhood narrows it, the attestation issuer follows. If Stock Tokens later add transfer hooks under ERC-7943 or ERC-3643, escrow will call those hooks and be allowlisted itself. [Collateral still to come](/collateral/next-markets.md) tracks that possibility. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.usegimbal.app/compliance/boundary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.