Home Protocol Security Compliance Anti-Fraud AML Whitepaper ghostpaymesh.com

Compliance & Regulatory

How GhostPay Mesh achieves regulatory compliance while preserving user privacy — transaction limits, BACEN alignment, and cryptographic audit trails.

1. Overview

GhostPay Mesh is built on the principle that privacy and compliance are not mutually exclusive. The protocol is designed to meet regulatory requirements imposed by the Brazilian Central Bank (BACEN), international AML/CFT standards, and data protection laws (LGPD) — all without requiring users to surrender personal data for routine transactions.

Compliance is achieved through a layered approach:

  • Cryptographic accountability — every PLC carries an immutable, verifiable audit trail via its transfer chain
  • Enforceable limits — transaction and daily caps are enforced at the protocol level
  • Device-bound identity — pseudonymous keys tied to hardware provide traceability without exposing personal information
  • Regulatory reporting — the ledger supports structured reporting to authorities when legally required
Design Philosophy: GhostPay follows a “privacy by default, compliance by design” model. Personal data is never collected unless a regulatory threshold is crossed.

2. Privacy-First Compliance Model

Traditional payment systems require full KYC (Know Your Customer) upfront — collecting names, IDs, addresses, and biometrics before allowing any transaction. GhostPay inverts this model with a tiered identity approach:

Tier 0 — Anonymous

Default tier for all new devices. No personal data required. Transactions are limited to micro-payments. Identity is a device-bound Ed25519 public key.

Tier 1 — Pseudonymous

Device is registered with a phone number or email hash (not the actual value). Higher limits unlocked. The system can correlate activity to a pseudonymous identifier without knowing who the person is.

Tier 2 — Verified

Full KYC performed for high-value operations or when regulatory thresholds are crossed. CPF/CNPJ verified against BACEN databases. Required for merchant settlement accounts.

Tier Identity PLC Limit Daily Limit Requirements
Tier 0 Device key only R$ 200 R$ 500 None
Tier 1 Pseudonymous hash R$ 1,000 R$ 5,000 Phone/email hash
Tier 2 KYC verified R$ 10,000 R$ 50,000 CPF/CNPJ + document 
graph TD
    A[New Device] -->|Device key generated| B[Tier 0: Anonymous]
    B -->|Phone/email hash| C[Tier 1: Pseudonymous]
    C -->|CPF/CNPJ + docs| D[Tier 2: Verified]
    B -->|Exceeds Tier 0 limits| E{Upgrade Required}
    E -->|User upgrades| C
    E -->|User declines| F[Transaction Blocked]
    C -->|Exceeds Tier 1 limits| G{KYC Required}
    G -->|User verifies| D
    G -->|User declines| F

3. Transaction Limits

Transaction limits are enforced at multiple layers to prevent abuse while allowing legitimate micro-payments to flow without friction:

Per-PLC Limits

  • Maximum PLC value: R$ 1,000.00 (Tier 1) — enforced at issuance time
  • Minimum PLC value: R$ 0.01 — supports micro-transactions
  • Maximum expiration: 7 days from issuance
  • Maximum transfer chain depth: 10 hops

Per-Device Daily Limits

  • Tier 0: R$ 500/day cumulative issuance
  • Tier 1: R$ 5,000/day cumulative issuance
  • Tier 2: R$ 50,000/day cumulative issuance

Rolling Window Controls

Control Window Threshold Action
Velocity check 1 hour > 20 PLCs issued Temporary cooldown (15 min)
Daily aggregate 24 hours Tier limit exceeded Block until next window
Weekly aggregate 7 days 5x daily limit Require Tier upgrade
Monthly aggregate 30 days 20x daily limit Mandatory review
Offline Enforcement: When devices operate offline, limits are enforced locally based on cached state. Upon reconnection, the server reconciles and may retroactively flag violations.

4. BACEN Compatibility

GhostPay Mesh is designed to comply with Brazilian Central Bank (BACEN) regulations governing electronic payment instruments and arrangements:

Regulatory Alignment

  • Resolution 80/2021: PLCs operate as prepaid payment instruments. The protocol satisfies requirements for transaction logging, reversibility (via cancellation before transfer), and user limits.
  • Circular 3,978/2020 (AML): The tiered identity model meets progressive KYC requirements. Full identification is triggered at BACEN-defined thresholds.
  • LGPD Compliance: Minimal data collection by design. Personal data (when collected at Tier 2) is encrypted at rest with XChaCha20-Poly1305 and subject to data minimization and purpose limitation principles.
  • Pix Integration: Settlement via Pix follows BACEN’s DICT (Diretório de Identificadores de Contas Transacionais) standards. GhostPay acts as an indirect participant.

Reporting Obligations

The system generates BACEN-compatible reports automatically:

  • COAF Reports: Suspicious transactions above R$ 50,000 (or patterns matching COAF criteria) are flagged for reporting
  • Monthly Aggregate Reports: Transaction volumes, settlement summaries, and exception logs
  • On-Demand Audit Data: Structured data exports for regulatory inquiries, including full PLC lifecycle and transfer chain data
BACEN Report Structure
{
  "report_type": "BACEN_MONTHLY",
  "period": "2025-01",
  "institution_id": "GHOSTPAY_MESH",
  "summary": {
    "total_plcs_issued": 1284350,
    "total_volume_brl": 45230100.50,
    "total_settlements": 987420,
    "expired_plcs": 12340,
    "flagged_transactions": 47
  },
  "compliance_status": "COMPLIANT"
}

5. Audit Trail via Ledger

Every PLC in the GhostPay Mesh network carries its own immutable audit trail embedded in the transfer_chain. This chain, combined with the server-side ledger, provides a complete record of every value transfer.

Ledger Architecture

The audit system operates on two complementary layers:

  • On-PLC Audit Trail: The transfer_chain array embedded in every PLC records each transfer with cryptographic signatures, timestamps, and nonces. This trail is self-verifiable without server access.
  • Server-Side Ledger: Upon settlement or synchronization, the complete PLC history is recorded in an append-only ledger. This ledger supports regulatory queries, dispute resolution, and statistical analysis.
graph LR
    A[PLC Issued] --> B[Transfer 1]
    B --> C[Transfer 2]
    C --> D[Transfer N]
    D --> E[Settlement]
    E --> F[Ledger Record]

    subgraph On-PLC Trail
        A
        B
        C
        D
    end

    subgraph Server Ledger
        F --> G[Regulatory Reports]
        F --> H[Dispute Resolution]
        F --> I[Analytics]
    end

Ledger Record Fields

Field Description Retention
plc_id Unique PLC identifier 5 years
commitment_hash Immutable binding of PLC fields 5 years
transfer_chain Full cryptographic transfer history 5 years
settlement_tx Payment rail transaction reference 10 years
risk_flags Any flags raised during lifecycle 10 years
device_fingerprint Hardware-derived pseudonymous ID 5 years

6. Privacy-Preserving Traceability

A key innovation in GhostPay Mesh is the ability to provide full traceability of value flow without exposing personal identity data. This is achieved through several mechanisms:

Pseudonymous Key Graph

Every transfer is recorded as a movement between Ed25519 public keys. Authorities can trace the flow of value through the key graph without knowing who controls each key — unless a court order requires de-anonymization of a Tier 2 account.

Selective Disclosure

When regulatory authorities require identity information (e.g., for a criminal investigation), the system supports selective disclosure:

  1. Authority submits a formal request with a court order specifying the public key(s) of interest
  2. The system identifies whether the key corresponds to a Tier 2 (verified) account
  3. If verified, the minimal required personal data is disclosed — only what the court order specifies
  4. All disclosures are logged in an immutable disclosure audit trail

Zero-Knowledge Compliance Proofs

For routine compliance checks, GhostPay can generate zero-knowledge proofs that demonstrate:

  • A transaction is within legal limits (without revealing the exact amount)
  • A device has not exceeded daily thresholds (without revealing transaction history)
  • A PLC transfer chain is valid and unbroken (without revealing intermediate parties)
Privacy Guarantee: In normal operation, no GhostPay employee, server, or third party can link a public key to a real-world identity. De-anonymization requires a court order and only applies to Tier 2 accounts.

7. International Standards

Beyond Brazilian regulations, GhostPay Mesh aligns with international compliance frameworks:

  • FATF Recommendations: The tiered identity model aligns with FATF’s risk-based approach (Recommendation 10). Low-value transactions are permitted with simplified due diligence; high-value transactions trigger enhanced due diligence.
  • EU MiCA Regulation: PLC design is compatible with the Markets in Crypto-Assets regulation framework for electronic money tokens.
  • PCI DSS: No card data is ever processed or stored. PLCs are a separate payment instrument, but the infrastructure follows PCI DSS Level 1 standards for network security and encryption.
  • ISO 20022: Settlement messages are structured in ISO 20022-compatible formats for interoperability with traditional financial messaging systems.