A product of Arbiter · Finance
Tollgate
Sanctions screening decisions an examiner can replay offline.
Tollgate is the evidence layer for sanctions and AML screening at stablecoin issuers and virtual-asset service providers. It runs read-only alongside the screening system a firm already uses, and turns each screening decision into a signed, tamper-evident receipt pinned to the sanctions list exactly as it stood at that moment. Months later, an examiner can take that receipt and re-derive the same verdict on their own machine, offline, without calling back to Arbiter and without taking any vendor’s word for it. The scope today is the exact-match path; fuzzy-match reproducibility is out of scope and is labelled as such everywhere the product is described.
A new class of regulated entity is entering bank-secrecy supervision for the first time, and it is inheriting an evidentiary standard it cannot yet meet. When an examiner asks a firm to show why a particular counterparty was blocked six months ago, the honest answer is usually that the sanctions list has changed since, the screening vendor’s system has been updated since, and the decision can no longer be reproduced. An audit export records what a system said it did. It does not let anyone independently re-derive that decision from the inputs that produced it. So a firm’s evidence is only ever as strong as its vendor’s word, held in the vendor’s format, checkable only by asking the vendor. Tollgate exists so that the record stands on its own.
The list is pinned to the decision
Every screening decision is recorded against a specific, hash-identified snapshot of the sanctions list rather than against whatever the list happens to say today. The exact state of the world at decision time becomes part of the evidence, so a later re-check compares like with like instead of quietly drifting.
A receipt that verifies itself
Each decision is emitted as a signed, hash-chained receipt. Anyone holding it can re-derive the canonical bytes, check the signature, and re-walk the chain in a plain browser with no network calls and no account. Change a single byte anywhere in the record and verification fails visibly.
Read-only, next to what you already run
Tollgate observes rather than intervenes. It sits alongside the incumbent screener in shadow mode, never becoming the block-of-record, so adopting it requires no rip-and-replace and does not pull Tollgate into the firm’s own compliance program.
Tollgate is referenced by the PPSI or VASP compliance team on one side and the examiner or regulator on the other. Any feature only one side of the transaction can see is a step away from the rail position. Both parties must be able to verify the same record independently, without asking Tollgate to vouch for it.
Tollgate is priced as a ladder rather than a seat. The entry rung is a flat fee per certified decision: an unproven, independent rail is not handed basis points on a firm’s flow on day one, so the flat fee buys the right to become load-bearing in the firm’s own compliance program. Once the record is load-bearing, pricing converts to basis points on the attested flow itself. The rung after that is a data network, where the corpus of signed decisions prices something no single firm could price alone. Arbiter does not sell seats at any rung: the engine is deterministic and near zero marginal cost per attestation, and seat pricing would discard that advantage.
The company’s aim is stated plainly: the neutral, cryptographically-attested decision rail for regulated money-movement and risk-transfer, metering basis points on every bind, payment, and credit decision that must be proven rather than trusted. Tollgate is one rail toward that aim, built for sanctions and AML evidence.
Tollgate is early and deliberately narrow. The offline verifier is live and can be exercised right now, including its tamper toggle, which is the whole claim demonstrated rather than asserted. The engine underneath is working, tested software, and the product is pre-commercial: no customers, revenue, or funding are claimed anywhere. Reproducibility is offered only on the exact-match path, and that limit is stated on the verifier itself rather than buried, because a confident green check over a match the system cannot actually reproduce would defeat the point of the product.