BCCILA key terms

A system in which identical records of transactions are held and updated across many independent nodes, with agreement on changes reached by a shared protocol rather than by one central administrator.

The rules by which network participants agree that a block of transactions is valid and should be appended, such as proof of work or proof of stake, replacing the approval role of a central intermediary.

A permissionless network lets anyone read, transact, and validate; a permissioned network restricts participation to identified, approved parties. The distinction drives most regulatory and AML treatment of a blockchain deployment.

A computer running ledger software that stores a copy of the transaction history and relays or validates new activity. Node operators can be individuals, institutions, or cloud providers, which raises questions about their legal role.

The property that recorded transactions cannot practically be altered without rewriting prior blocks and controlling most of the network. It supports evidentiary reliability but can conflict with data-erasure rights and error correction.

Cryptographic credentials where a public key identifies an address or verifies a signature and a private key authorises transfers. Control of the private key is generally treated as control of the assets.

A custodial wallet is held by a third party that controls the private keys and can move assets; a non-custodial wallet leaves key control with the user. Custody status often determines which licensing and AML duties apply.

The process of representing a real-world asset, right, or claim as a digital token on a ledger so it can be transferred and recorded programmatically, with legal effect depending on the underlying contract and applicable law.

Self-executing code deployed on a ledger that automatically carries out actions such as transferring value when predefined conditions are met. Its legal force depends on contract, consumer, and formalities rules.

The mistaken assumption that because code executes automatically it also overrides law. Courts still apply contract, consumer protection, insolvency, and regulatory rules to the underlying agreement and its effects.

Whether an automated arrangement forms a binding contract, judged by offer, acceptance, consideration, intention, capacity, and formalities. Several jurisdictions have enacted statutes confirming that electronic and code-based agreements can be enforceable.

Services that feed external data, such as prices or delivery confirmations, into a smart contract. Their reliability and trust model affect whether performance matches the parties' intent and who bears loss from faulty input.

An electronic authentication method using cryptography to link a signer to a document and detect later alteration. E-signature statutes generally give qualifying digital signatures the same effect as handwritten ones.

A digital representation of value that can be traded or transferred and used for payment or investment, but is not issued or guaranteed by a sovereign. Definitions vary, so the exact statutory wording controls each obligation.

The process of sorting a token into categories such as security, payment token, e-money, utility token, or commodity, because each category triggers different licensing, disclosure, and conduct requirements.

A security token represents an investment whose value depends on a promoter's efforts; a utility token grants access to a product or service. The label used by the issuer does not decide the legal category.

A US judicial standard asking whether there is an investment of money in a common enterprise with a reasonable expectation of profit derived from the efforts of others. It is widely referenced but is not a global test.

The European Union framework imposing authorisation, disclosure, and conduct rules on crypto-asset issuers and service providers, including stablecoin requirements, with passporting across member states for authorised firms.

A crypto-asset designed to hold a steady value, usually by reference to a fiat currency or basket of assets. Reserve quality, redemption rights, and issuer regulation are the central legal and prudential concerns.

The set of laws and controls requiring regulated firms to identify customers, monitor transactions, keep records, and report suspicious activity so that illicit funds cannot enter or move through the financial system.

A business that conducts regulated activities for others involving virtual assets, such as exchange, transfer, custody, or safekeeping. Registration or licensing usually brings the firm within AML and sanctions obligations.

The identification and verification of a customer and its beneficial owners, plus assessment of business relationship risk, performed before or during onboarding and refreshed on a risk-based schedule.

Additional scrutiny applied to higher-risk situations, such as politically exposed persons, high-value or cross-border relationships, or unhosted wallets, including source-of-funds checks and senior sign-off.

The requirement that a transferring institution pass originator and beneficiary information to the receiving institution alongside a transfer. In crypto, the threshold and data set differ from the banking rules.

A wallet where the user, not a regulated intermediary, controls the private keys. Transfers to or from such wallets raise questions about counterparty identification and are often treated as higher risk.

Blockchain forensic tools that cluster addresses and trace fund flows to support investigations, sanctions screening, and risk scoring. Results are probabilistic evidence, not conclusive proof of identity.

A confidential filing to the financial intelligence unit describing transactions or behaviour that may indicate money laundering or terrorist financing. Filing is typically protected, and tipping off the customer is prohibited.

A national body that receives, analyses, and disseminates suspicious activity and other reports, and often sets AML guidance. Cross-border cooperation between FIUs is central to tracing virtual asset flows.

Checking customers, counterparties, and wallet addresses against designated-persons lists before and during a relationship. Strict-liability regimes can make even inadvertent dealings with a listed party a breach.

A person entrusted with prominent public functions, plus close associates and family, whose position creates heightened corruption risk and therefore triggers enhanced scrutiny and source-of-wealth checks.

The European Union data protection law governing processing of personal data, giving individuals rights such as access, rectification, and erasure, and imposing lawful-basis, transparency, and security duties on controllers and processors.

An individual's right to have personal data deleted in specified circumstances. Applying it to an immutable ledger is difficult, so personal data is often kept off-chain with only a hash stored on-chain.

Keeping data outside the ledger while recording a reference or hash on-chain. This design supports confidentiality and deletion obligations but creates dependency on the availability and integrity of the external store.

A controller decides why and how personal data is processed and bears primary accountability; a processor acts on the controller's instructions. Decentralised projects struggle to allocate these roles clearly.

Moving personal data to another jurisdiction, which usually requires a lawful transfer mechanism such as adequacy decisions, standard contractual clauses, or derogations, plus supplementary safeguards where needed.

Taxing profit on disposal or exchange of a crypto-asset as a capital gain, with holding-period and rate rules varying by jurisdiction. Many systems also tax crypto-to-crypto swaps as disposals.

Cost basis is the acquisition cost used to compute gain or loss; fair market value is the price at arm's length on the relevant date. Both are needed for disposals, income events, and donations.

Determining the price used for tax, accounting, and financial reporting at a given time, drawing on exchange quotes or accepted pricing sources. Volatility and thin markets make the chosen methodology significant.

An independent accountant's report on an issuer's stated assets or liabilities at a point in time, commonly used for stablecoins. It is narrower than a full audit and usually gives no opinion on internal controls.

Allocating compliance resources in proportion to assessed risk, so that higher-risk customers and products receive more scrutiny. Regulators expect the methodology to be documented, applied consistently, and periodically reviewed.

The documented policies, procedures, controls, training, and monitoring a firm maintains to meet legal duties, overseen by an accountable person and tested for effectiveness rather than mere existence.

The natural persons who ultimately own or control a legal entity or arrangement, typically identified above a set percentage threshold. Transparency registers and CDD rules aim to expose concealed control.

An entity whose rules and decision-making are encoded and executed through smart contracts and token-holder votes. Its legal personality is uncertain, so members may face unlimited or unintended liability.

A contract term choosing which jurisdiction's law interprets the agreement. In cross-border digital asset deals it is paired with a dispute-resolution clause to reduce uncertainty about which courts or rules apply.

Cooperation between regulators, supervisors, and law enforcement through memoranda of understanding, supervisory colleges, or mutual legal assistance, essential where a single transaction touches several jurisdictions.

The ability of a firm authorised in one jurisdiction to provide services in another without separate local authorisation, typically under a regional framework. Absent passporting, local licensing is usually required.