As we have discussed Problems in the current compliance, also discussed
about our system architecture design so lets move on to Privacy and
Security Frameworks
In Privacy and Security Frameworks the big idea for our compliance model
is to ensure transparency without exposing sensitive customer or
institutional data. This is what is the role of Cryptographic Hashing and
RBAC.
In cryptographic Hashing the data is not stored in plain text instead it is
stored in form of hashes. Now the question arises why hashes are used ?
It ensures immutability that is if there is any modification in any of the
hashes it detects immediately and change the hash value immediately.
secondly Regulators can also verify authenticity without seeing the raw
data
Further it also supports audit trials without violating data protection norms
(How? As the data is encrypted that is stored in [Link] when the auditor
request for the data it comes in form of hash. Auditors verify integrity by
matching off-chain data hashes with on-chain records, ensuring tamper-
proof verification.
This ensures that the data is verified by the authorities without actually
seeing and modifying it )
Now coming to Role based permission
In our compliance role based permission is defined as a security model
where access to data is granted based on users role and not on their
identity.
For eg instead of saying a user X can do the task in our model it will be
used as anyone with role y can do this
Since our model is based on financial institution system, these roles have
certain permissions and restrictions that is listed in our slide and overall
This is how RBAC ensures that customer data remains private
To explain this lets take real world example:-Of large loan disbursement
So firstly banks will submit loan transaction
Smart contracts will check Exposure limits and rules issued by different
authorities (SEBI,RBI)
whatever may be the result whether approved or flagged
Role based permission ensures that
Only bank sees the result and auditor sees the compliance proof
This is how RBAC ensures that customer data remains private
Lets come to Governance and upgradability Model
So our compliance model that is our blockchain model is not fully
decentralised. It will require some permission from regulators(SBI, RBI etc)
Now let me explain this flowchart
this flowchart shows how new regulations are added within the existing
model
First step is that New financial regulations are issued by regulators in the
form of official circulars or guidelines
Then by using smart contracts it is converted to machine readable code
Then it is followed by testing
This is approved by cryptographic signatures which ensures accountability
and then the new regulation is deployed slowly in a controlled manner
Now How existing rules are updated?
Since the rules are in the form of hashes we cannot edit or modify
directly on a blockchain so the idea here is to instead of changing the old
rule we create a new version of the rule and make it active from the
certain date .
Basically a new version of the smart contract is deployed instead of
modifying the old one
Coming to Handling Disputes and exceptional cases
Since our model is partially decentralised. Some disputes will
automatically arise
For eg A transaction may looks suspicious but is actually valid
first this case will be marked as exceptional case, now this
exceptional transaction are viewed by regulators or compliance
officers and The final decision and justification by these officers
are permanently recorded on-chain to ensure transparency.