Layered controls: identity screening → treasury governance → custody → attestation → data protection.
Compliance & Security
Compliance is front-loaded, not retrofitted. Below is the proposed control framework, subject to final legal advice.
KYC / AML
Mandatory identity & source-of-funds screening before funding; reject unclear or tainted funds.
Custody
Physical gold held by a Brink's-grade custodian, independent of the operator.
3/5 Multisig + Timelock
Treasury needs 3-of-5; large transfers forced through a 48-hour timelock; tech team holds no keys.
LGPD
Personal data hashed & anonymized, minimal retention, no raw storage.
Audit & Reserve Proof
On-chain audit and reserve attestation; coverage disclosed truthfully (mine-backed, not 100% vaulted).
Term Discipline
Ban on calling XAUg a futures, stablecoin, principal-guaranteed or risk-free product; no out-of-context yield figures.