A new class of proof for financial institutions — one that is mathematical, not contractual. Demonstrate solvency and regulatory compliance to any authority, without exposing a single customer record, balance, or transaction.
The FTX collapse was audited by a licensed firm. The audit didn't catch it. The financial industry needs a fundamentally different class of guarantee — one that is mathematical, not contractual.
$8 billion in customer funds were missing from an exchange whose solvency was certified by licensed auditors. A traditional audit cannot detect deliberate concealment — it verifies only the data it is given, by the party being audited. No procedure could have caught it.
TRUST FAILUREVARA, CBUAE, and DFSA are actively mandating cryptographic Proof of Solvency for all licensed virtual asset service providers. These are not hypothetical requirements. Regulatory deadlines are real — institutions face license revocation for non-compliance.
REGULATORY MANDATEProving compliance conventionally means exposing customer balances, transaction records, and treasury positions to auditors and regulators. Institutions face an impossible choice between satisfying regulators and protecting customer data under UAE PDPL and GDPR.
DATA EXPOSURE RISKBoth services run on the same underlying proof infrastructure — purpose-built for GCC financial institutions, with native support for every major regulator.
A cryptographic proof that your total assets exceed your total customer liabilities — without revealing any individual balance, wallet address, or treasury position. The proof is independently verifiable by your regulator, your auditor, or any member of the public.
A proof that your institution's transaction patterns satisfy specific regulatory rules — without exposing individual transaction amounts, counterparty identities, or customer records to any external party, including the regulator receiving the proof.
These are not contractual promises or best-effort commitments. They are properties enforced by mathematics — independent of the institution, the auditor, and us.
Producing a false proof that passes verification is computationally impossible — even for the institution that generated it. This is not a policy or a contractual claim. It is a mathematical property of the proof system. An auditor can be coerced. A mathematical proof cannot.
✓ Mathematically enforcedCustomer account identifiers are irreversibly anonymised inside your own hardware before any computation begins. No balance, no account number, no transaction appears in the proof bundle. The regulator receives a cryptographic attestation — not a data file.
✓ Cryptographic guaranteeThe proof snapshot timestamp is set by the regulator's own dedicated device — not by the institution. The institution cannot choose a favourable date, pre-arrange asset positions for a known audit window, or generate multiple proofs and submit only the best one.
✓ Regulator-controlled ceremonyThe verifier is open-source and requires no account, no licence, and no contact with us. Any regulator, auditor, Big 4 firm, or member of the public can run verification independently and reach the same result. The proof is the authority — not the vendor.
✓ Open-source · MIT licenceUnlike some other zero-knowledge systems, VeraZK requires no secret ceremony, no shared parameters, and no "toxic waste" that must be destroyed. There is no secret that, if stolen or compromised, would allow false proofs to be created. The system is fully transparent from day one.
✓ Fully transparentEvery step of the proof pipeline — from raw liability data to the final submission bundle — produces a signed, chained record. Any tampering between stages is cryptographically detectable. Regulators and Big 4 firms receive a complete, independently verifiable chain of custody.
✓ End-to-end signed chainA mathematical guarantee — not a contractual one. No sensitive data leaves your infrastructure at any point in the process.
Before any institution data is processed, the regulator independently designates the exact snapshot timestamp using their own ceremony device — a secure appliance we supply but the regulator owns and controls. The institution cannot see this time in advance, cannot modify it, and cannot generate a valid proof for any other moment.
✓ Institution has no control over the snapshot timeThe VeraZK engine runs entirely within your own systems. Customer account identifiers are irreversibly anonymised inside your hardware security module before any computation begins. Raw customer data, balances, and transaction records never leave your trust boundary — not to us, not to the regulator, not anywhere.
✓ No PII in any proof artifact — everEach third-party custodian holding your assets — Fireblocks, BitGo, or any licensed institution on the regulator's approved list — independently signs an asset attestation with a current timestamp. The institution cannot substitute an unapproved counterparty, and the regulator can revoke any custodian from the approved list at any time.
✓ Self-attestation is impossible by designA cryptographic proof is computed over your liability data, asset attestations, and the regulator's timestamp — all without embedding any raw data in the output. The resulting proof bundle is compact and tamper-evident. Every step in the generation pipeline produces a signed record, forming a complete chain of custody from input to proof.
✓ Complete signed audit trail from data to proofThe regulator, your auditor, your Big 4 firm, or any member of the public runs the open-source verifier against the proof bundle. Verification requires no account, no call to our systems, and no data access. The result — including the solvency determination — is computed entirely from the proof. It completes in under 2 seconds on any standard laptop.
✓ Open-source · no trusted intermediaryMerkle tree "proof of reserves" — used by several exchanges — shows that a list of balances sums to a claimed total. It does not prove that the assets actually exist, that the liability list is complete, or that the snapshot was taken at a regulator-designated time. VeraZK addresses all three.
"A proof cannot be forged. An auditor can be compromised, negligent, or coerced. A mathematical proof cannot."
Each regulator has its own configuration embedded in the proof engine — not a generic template adapted after the fact. Requirements, thresholds, approved custodian lists, and submission formats are native to each jurisdiction.
When a regulator updates their requirements, most changes are a configuration update — not a rebuild. The engine was designed from day one to evolve alongside regulatory frameworks.
Prove compliance with any combination of these frameworks simultaneously — in a single proof, with no transaction data or customer records shared with any external party.
We publish the verification software under an open licence. Any regulator, auditor, or individual can run independent verification without contacting us, without a licence, and without trusting us.
Each stage produces real, usable output. The pilot is a genuine end-to-end proof run on your infrastructure — not a simulation, not a presentation.
The same proof infrastructure powers every use case. Each new service reuses the existing engine — reducing build time and maintaining consistent security guarantees.
Cryptographic solvency proof for exchanges and custodians. GCC-native configurations for VARA, CBUAE, DFSA, SAMA, QFMA, and CBB. 50,000 accounts under 97 seconds.
34 pre-built rules across AML/KYC, Sanctions, GDPR, HIPAA, SOX, and UAE AML frameworks. Zero transaction data exposure. Extensible for new rules and frameworks.
Prove to tax authorities that intercompany transaction prices fall within arm's-length range under OECD-approved methods — without revealing pricing strategy, margin, or individual transaction amounts to any authority.
Prove to regulators that trading algorithms satisfy MiFID II, Dodd-Frank, and UAE SCA non-manipulation rules — without disclosing the strategy, algorithm parameters, or individual order data. Designed for firms under regulatory review.
An institution with multiple custodians generates a single aggregate proof without any custodian revealing their individual holdings to the institution or to each other. The strongest solvency guarantee available for complex custody structures.
Hourly proof generation and publication, giving depositors a live cryptographic solvency guarantee. A competitive trust differentiator for exchanges in the post-FTX environment — not just a compliance obligation, but a customer-facing feature.
Questions from compliance officers, CFOs, CTOs, and regulators evaluating zero-knowledge infrastructure for the first time.
See a genuine end-to-end proof run on your own infrastructure before any commercial commitment. We bring the engine — you bring your technical team.