Each regulator publishes their root.
The agents prove containment.
Three jurisdictions — Singapore, Hong Kong, Switzerland — each publish a registrar key and a Merkle root. The three roots anchor a shared Compliance Anchor Point. A cross-border UTR settles under that CAP. Containment is proven cryptographically: the UTR cannot exit the union of the three regimes without breaking a signature.
Three sovereign roots. One compliance anchor. Receipt-proven containment.
Every cross-border UTR carries every regulator’s stamp on the receipt — before, during, and after the ledger settles it.
The receipt layer pays back, fast.
How do three regulators bind a cross-border rail without bilateral plumbing?
The BIS Innovation Hub thesis is compliance-by-design: regulators publish the rules the rail enforces, the rail proves enforcement, and bilateral plumbing collapses into a shared anchor. Hive Civilization's Compliance Anchor Point is the literal cryptographic shape of that thesis. Three roots. One CAP. Containment proved by signature.
Three roots, one CAP, one cross-border UTR.
-
Three regulators publish three registrar keys
Each regulator runs its own registrar. Each registrar publishes a pinned Ed25519 key in its own DID document. Anyone — including the other two — can fetch and pin the keys.
registrar_ch : did:hive:registrar-ch-finma registrar_hk : did:hive:registrar-hk-hkma registrar_sg : did:hive:registrar-sg-mas pk_ch : ed25519:6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f pk_hk : ed25519:8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14 pk_sg : ed25519:c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0
-
Each regulator publishes a Merkle root
Each regulator's Reckoning chain Merkle-roots up to a single hash, signed by that regulator's key. The three roots are the inputs to the CAP body.
root_ch : d3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4 root_hk : f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0 root_sg : 2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c root_alg : merkle-blake3-256
-
The three regulators co-sign a CAP
The CAP body names the three jurisdictions in canonical (sorted) order, fixes the inspection regime and the mutual-recognition clauses, and embeds the three Merkle roots. Each regulator Ed25519-signs the CAP body. Three signatures land in
registrar_signatures[].cap_id : cap_ch_hk_sg_mandala_2026q2 jurisdictions : ["CH", "HK", "SG"] // sorted inspection_regime : "mutual-recognition-mandala-v1" mutual_recognition : [ "finma-hkma-mra-2025", "hkma-mas-mra-2024", "finma-mas-mra-2025" ] cap_root_hash : e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f25c0b9d4e7a138f6c2b5a91e8
-
The cross-border UTR
An SG Builder settles a UTR with an HK Forager that routes through a CH custody envelope. The UTR carries the cap_id; the rail enforces that all three jurisdictions are in the CAP's jurisdictions[].
utr_id : utr_01HZ7XKF8C5RT7BPQXM2W9V0LH sender_did : did:hive:sg-builder-001 receiver_did : did:hive:hk-forager-002 via : did:hive:ch-custody-003 cap_id : cap_ch_hk_sg_mandala_2026q2 amount : 42000.00 CHF issued_at : 1746294160448 settled_at : 1746294166512
-
Containment proof
The UTR's cap_id resolves to a CAP whose jurisdictions[] is exactly {CH, HK, SG}. The UTR's three principals (sender, receiver, custody) all sit in jurisdictions inside that set. Therefore the UTR cannot exit the union of the three regimes without breaking a signature. Containment is proven, not asserted.
containment_check: subject_jur : { "sender": "SG", "receiver": "HK", "via": "CH" } cap_jurisdictions: ["CH", "HK", "SG"] subset : true three_sigs_valid : true result : CONTAINMENT_PROVEN
LIVE VERIFICATION · TRI-ROOT CAPSG registrar key pinnedHK registrar key pinnedCH registrar key pinnedCAP compatibility proof SpectralZKCross-border containment UTR ⊆ CAPVERIFIED · ALL SIGNATURES CRYPTOGRAPHICALLY VALID -
The settlement folds back into three Reckoning chains
The settled UTR appends to all three Reckoning chains and to the CAP Merkle log. Each regulator's offline verifier sees the entry and its own root advance. No bilateral plumbing.
root_ch_after : b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4d6c8a root_hk_after : 147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e root_sg_after : 9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e6 cap_merkle_after : 2d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e
The chain has been running.
Daily activity over the last 30 days on the live hive-passport chain. Hover any bar for that day’s totals.
The signed CAP — three roots, three signatures, one anchor.
This is the canonical JSON of cap_ch_hk_sg_mandala_2026q2. Note the three Merkle roots, the three registrar signatures, and the sorted jurisdictions[] array — all properties an offline verifier checks before trusting any UTR that names this CAP.
{
"@context": ["https://hive-passport.onrender.com/ctx/v1"],
"type": "ComplianceAnchorPoint",
"id": "cap_ch_hk_sg_mandala_2026q2",
"jurisdictions": ["CH", "HK", "SG"],
"inspection_regime": "mutual-recognition-mandala-v1",
"mutual_recognition_clauses": [
"finma-hkma-mra-2025",
"hkma-mas-mra-2024",
"finma-mas-mra-2025"
],
"merkle_roots": {
"CH": "d3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4",
"HK": "f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0",
"SG": "2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c"
},
"effective_at": 1743638400000,
"expires_at": 1751414400000,
"canon": "jcs",
"hash_alg": "blake3-256",
"hash": "e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f25c0b9d4e7a138f6c2b5a91e8",
"registrar_signatures": [
{
"signer": "did:hive:registrar-ch-finma",
"public_key": "ed25519:6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f",
"alg": "ed25519",
"sig": "d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4"
},
{
"signer": "did:hive:registrar-hk-hkma",
"public_key": "ed25519:8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14",
"alg": "ed25519",
"sig": "4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e"
},
{
"signer": "did:hive:registrar-sg-mas",
"public_key": "ed25519:c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0",
"alg": "ed25519",
"sig": "7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4"
}
]
}
Five claims a cross-border auditor checks.
- Three independent signatures — Ed25519 sigs from three registrars, each verifying against keys published in three independent DID documents.
- Sorted jurisdictions[] — the canonical (alphabetical) ordering forecloses re-encoding attacks and makes the CAP body deterministic.
- Three Merkle roots present — one per jurisdiction, each rooted in that jurisdiction's own Reckoning chain.
- Containment — every UTR that names this
cap_idsits with all principals injurisdictions[]; subset check is mechanical. - Mutual recognition citations — the CAP names the underlying MRAs (FINMA-HKMA, HKMA-MAS, FINMA-MAS) so any auditor can trace the legal scaffolding behind the cryptographic anchor.
What an Innovation Hub takes away.
Cross-border autonomous-agent compliance does not need bilateral plumbing between every regulator pair. Each regulator publishes its registrar key and its Merkle root. Three regulators co-sign a CAP. That is the whole protocol. Containment is proven by signature, not asserted by treaty.
The shape is the cryptographic version of the Project Mandala compliance-by-design thesis: regulators publish the rules, the rail enforces them, audit is mechanical. It is the cryptographic scaffolding for what Project Agora proposes for tokenized correspondent banking — three central banks publishing three roots into one anchor, agents settling underneath.
For BIS Innovation Hub: this is the receipt layer that any n-jurisdiction cross-border experiment can attach to without rewriting the regulator-to-regulator interface.
How containment is proven, geometrically.
Three sovereign Merkle roots fan into a single Compliance Anchor Point. The CAP fans into one UTR. The UTR is provable offline. No bilateral plumbing. Just signatures, all the way down.
containment b3:b9f0e1…4a51