THE CANON
The build strategy, whole
An investor arrives with one primitive, a BVN or a bvndle tag, and leaves three minutes later with a live trading wallet. The substrate mints or retrieves one identity object carrying verified fields, hash-chained provenance and armed consent hooks. A broker from the designated panel, pre-authorised by contract, attests at Level 1 in seconds; a VBank account is issued against the tag, BVN-linked at birth; and the SEC's own tier caps bound everyone's exposure until full screening completes, so instant is underwritten by the regulator, not by hope. The shape is Ikechukwu's tiered-access direction carried through the build team's constraints. Above this substrate sit two layers with their own canon: the exchange platform (PRD v2.0, including its hard launch gate) and the credit layer (VBank × CSCS), joined to it by seven interface contracts. Three laws cross-cut everything, humans and models alike: record every touch, tell the truth about every state, and under stress shed speed, never legality. Everything below is this canon at working depth; the five companion volumes are how it is governed, built, run, resolved and reviewed.
STATUTORY & REGULATORY REFERENCE
The instruments this canon stands on
▸Investments and Securities Act 2025 · the governing statute; repeals the 2007 Act, so all prior legal advice is checked against it.
▸SEC Rules and Sundry Amendments, June 2017 · Three-tiered KYC Framework · mandates the tier ladder for all CMOs for financial inclusion; supplies the caps that make instant onboarding safe and the migration duty that makes progressive enrichment law.
▸SEC Rule 67 (as amended 2021) · Digital Sub-broker · the licence category for platform-designated brokers; the operating precedent for the panel. Registration precedes launch.
▸SEC AML/CFT Regulations · third-party reliance · KYC reuse is regulated reliance, not portability: each broker remains ultimately responsible, evidence producible on demand. The attestation and evidence-API design enforces this.
▸NDPA 2023 + NDPC GAID (in force Sep 2025) · explicit, specific, per-purpose consent; the consent hook and read ledger are its machinery; withdrawal coexists with the five-year AML retention by encoding legal basis per grant.
▸Market structure · CSCS/CHN and DvP · no trade without a broker-of-record; CSCS records created through broker rails; settlement is delivery-versus-payment. The designated panel and the honest T+ gate exist because of these.
PART A · THE WHOLE BUILD
One platform, three layers, three canonical owners
This page is the substrate layer in full. The layers above it are owned elsewhere and summarised here only to show the joins. The complete governance map and launch plan is Volume 01.
Credit layerCANONICAL · YINKA / VBANK
Securities-backed lending on CSCS lien rails. Canonical: VBank × CSCS Partnership. The lien is the third attestation type on the identity object below.
⇅ lien attestation · pre-trade lien checks · disbursement via cash rails
Exchange platformCANONICAL · IKECHUKWU / BVNDLE TEAM
Ten product domains, nine-ledger money architecture, clearing, settlement and surveillance. Canonical: NASD Digital Exchange Platform PRD v2.0, including its hard launch gate.
⇅ attestation service · grant-gated evidence API · Bvndle SSO · panel allocation · VBank cash node · read ledger · hot-path inference
Substrate + local AI · this documentCANONICAL · KABELO / GTPP
The identity object, tiered attestation under the SEC caps, consent hooks, the panel, the VBank rail, and in-jurisdiction inference for every model in a regulated decision path (hot path close to the data; model decisions on the provenance ledger; deterministic fallbacks).
BOUNDARY RULE · a change that crosses a layer boundary is a change to an interface contract, reviewed by both owners plus the law questions (Gate Series 04). Everything below this line is substrate scope.
PART B · TWO WAYS IN
New investor and returning tag, same destination
Both paths end at the same event: a panel broker attesting over the investor's identity object (unpacked in Part D). Neither path ever waits on the user choosing a broker, because one is allocated at second zero and can be swapped at any time.
Mint
FIRST-TIME INVESTOR · NO TAG YET
1Enter BVN, one consent tapNIBSS verifies · fields hydrate · eligibility passes
2Tag minted@name reserved · object sealed · provenance begins
3Panel broker attestsclient agreement, one tap · broker signs over the evidence · VBank number issued
Verify
RETURNING · TAG IN HAND
1Enter @tag, prove it's youbiometric / device key · object retrieved
2Consent hook firesone explicit tap shares evidence with this broker · NDPA satisfied
3Broker re-attests, nothing re-collectedreliance over existing provenance · seconds, not days
↓BOTH PATHS LAND HERE: BROKER-OF-RECORD ATTACHED · WALLET OPENS · VBANK NUMBER LIVE
PART C · WALLET STATES
Four states, three gates
Access is earned in the background and arrives as an upgrade, never withheld as a wall. Only one gate is hard, and it is the market's, not ours.
OPENBROWSE
Market, watchlist, prices. Requires nothing. Entered at second zero.
→
ATTESTEDFUND & BUY
A panel broker has signed over the object. VBank number live; funding by transfer from any bank; any admitted security.
→
SETTLINGCHN PENDING
CSCS number resolving via broker rails. Holdings accrue and display accurately. Live countdown shown, never a dead end.
→
FULLSELL & WITHDRAW
Unlocks when CHN is live and settlement clears. Cash-out lands in VBank instantly; external banks via NIBSS. The one hard gate, owned by market plumbing (T+).
GATES: none consent hook + attestation CHN + T+ settlement (external, honest countdown)
FAIL-SAFE FLOOR · any held-for-review state (name mismatch, ambiguous match, screening pending) opens as a Level 1-attested account: a panel broker auto-attests instantly under panel-agreement authority, and the SEC caps, ₦20k a deposit · ₦200k cumulative · ₦30k daily redemption, bound everyone's exposure until full screening completes. The regulator's own inclusion tier is the product's safety valve · SEC Rules and Sundry Amendments, June 2017, Three-tiered KYC Framework for Capital Market Operators
REVISION NOTE · v8 · what changed and why. Earlier versions described this fail-safe as opening a standalone Level 1 account. The build team's confirmed constraint, no wallet without a broker KYC account behind it, makes that impossible as written. Corrected: attestation itself is tiered. A panel broker auto-attests at Level 1 instantly under panel-agreement authority (the SEC requires no documentary evidence at Level 1, and BVN-verified data exceeds that bar); full attestation follows the broker's screening; the caps bound everyone's exposure in between. Full treatment: Gate Series 02, module O2.
PART D · THE OBJECT
One identity object, addressed by tag
Everything above hangs off this. It is not a form and not a profile. It is a portable evidence container with its chain of custody written on it.
The tag is the address
Minted at first KYC, or presented on return. It replaces the CSCS lookup that does not exist: recognition happens on our rail, not the registry's.
Fields are hydrated once
BVN verification fills identity fields. Idempotent: nothing already held is ever asked again, on any surface, for any broker.
Consent is a hook, not a form
NDPA consent for sharing with a new broker is pre-programmed as a hook on the object. Adding a broker fires it as a single explicit tap, captured with timestamp and scope.
BVNDLE RAIL
IDENTITY OBJECT · ov.v1
@ada.okafor
minted 22 Jul 2026 · 14:02:11
bvn•••••••3841 NIBSS ✓
nameAda Okafor MATCHED
dob / age1994 · 18+ ELIGIBLE
cash nodeVBank ••••8812 ISSUED
cscs / chnpending VIA BROKER
classretail DAY-ONE
kyc levelLevel 1 · migrates up SEC 3-TIER
PROVENANCE · producible on demand
14:02:08BVN verified against NIBSS#a41f…
14:02:11Tag minted, object sealed#c07b…
14:02:40ID document captured + hashed#e2d9…
14:03:02Broker Alpha attests over evidence#f610…
14:03:04VBank virtual account issued to tag#0b3e…
CONSENT HOOKS
⚓ Broker Alpha · granted 14:02:55
⚓ next broker · armed, unfired
any relying broker may pull the full evidence trail · SEC reliance conditions (a)–(c)
Provenance is the product
Every verification event is stamped and hash-chained. This is what makes broker attestation a seconds-long decision: they are signing over evidence, not gathering it.
VBank is the cash node
A VBank virtual account is issued against the tag at attestation. It is BVN-linked at birth, so the funding-source-must-match-BVN rule is satisfied by construction, not by checking.
Attestation stays per broker
The law keeps each broker ultimately responsible for its own CDD. So brokers do not share a KYC; they each attest over the same object. Data shared, liability never.
PART E · THE THREE MINUTES
What the user does, over what the system does
The user's whole journey is three actions. Everything regulated runs underneath, already resolved or already in motion, never in front of them.
CLOCK
0:00 – 0:40
0:40 – 1:20
1:20 – 2:10
2:10 – 3:00
USERwhat they see
Open & browseMarket is visible before any identity is asked. no gate
One primitiveBVN (mint) or @tag (verify). Single field, single consent tap.
ConfirmClient agreement with Broker Alpha, one tap. Swap anytime. Wallet appears live with your VBank number.
Fund & buyTransfer to your VBank number from any bank, place first order.
SUBSTRATEtag + VBank rail
Session opens, device key ready.
NIBSS verify → hydrate fields → mint or retrieve object → provenance stamps written.
Consent hook fires · panel broker allocated by rule · VBank virtual account issued against the tag.
Inbound credit lands on the BVN-linked VBank account · source rule satisfied by construction · order routed.
REGULATEDbroker · CSCS
Panel brokers standing by on pre-agreed terms.
Allocated broker's screening runs against the evidence trail (AML / PEP).
Broker-custody wallet created. CSCS/CHN application submitted via broker rails.
Buy executes with broker-of-record from birth. CHN resolves in background.
Nothing on this track is broker-less at any moment, so it fits the confirmed data model without schema surgery.
PART F · THE PANEL
Not an assignment problem, a broker incentive programme
An exchange steering clients to a favourite would be an SRO neutrality problem. This is the opposite: an earned distribution channel that any Participating Institution can join, allocated by a rule every member can read.
QUALIFYOpen enrolment
Any PI in good standing joins by meeting the bar: attestation inside the SLA, evidence-trail reliance capability, and compliance standing. No invitations, no favourites.
ALLOCATEBy published rule
New investors are allocated across the panel by a transparent formula: a round-robin baseline weighted by service performance. Every member can read the rule and audit their share.
ATTESTSpeed is the sport
The allocated broker attests over the object in seconds. Attestation speed, rejection quality and service scores feed the weighting, the same telemetry as the Broker Service Rating already on the Q3 roadmap. One build, two initiatives.
EARNLifetime brokerage
Attestation makes the PI broker-of-record: 1.35% a side on every trade until the client swaps. Distribution is the prize; service is how you keep it.
The flywheel: better service earns more allocation; more allocation builds bigger lifetime books; bigger books justify investing in faster attestation; faster attestation shortens onboarding for everyone; shorter onboarding grows the volume NASD's own 0.25% is paid on. Fairness is not the absence of assignment, it is a rule all 59 owner-members can read, audit, and win under.
Panel governance to be socialised with the PI community · allocation formula published as a market notice · swap rights preserve client choice throughout
PART G · THE COMMERCIAL LAYER
Who earns, and only after the path completes
Per the fee schedule circulated to the group (VAT recomputed at 7.5%). A ₦100,000 round trip pays out ≈ ₦4,027 across the stack, and not one naira of it is earned while a user is stuck at a bank-selection screen.
Where a ₦100,000 round trip goes
buy ≈ ₦2,004 (2.00%) · sell ≈ ₦2,023 (2.02%) · total ≈ ₦4,027 (4.03%) + ₦8 trade alerts
BROKERAGE ₦2,700
NASD ₦500
VAT
SEC
CSCS
ST
Brokerage 1.35% × 2 sides
NASD 0.25% × 2 sides
VAT 7.5% on fees ₦259
SEC 0.20% (buy)
CSCS 0.20% (sell)
Stamp 0.08% × 2
Trade alerts ₦4 × 2
AT BROWSE
Nobody earns. No fee in the schedule fires before a funded trade. Every funnel death is the whole stack's loss, including FIRS.
AT FUND & BUY
The buy stack fires: broker 1.35%, NASD 0.25%, SEC 0.20%, stamp, VAT. NASD's 0.25% a side makes its revenue a pure volume game.
AT SELL
The sell stack fires: broker again, NASD again, CSCS 0.20%. Full-state users are the only users who ever pay the second half.
VFD RAIL
VBank earns off-schedule: the funding rail, balances held between trades, and instant cash-out. The tag rail drives the volume everyone above is paid on.
Fee lines as per the circulated schedule; the source sheet's VAT arithmetic corrected where it slips. Market data, API subscription and listing income sit outside this per-trade schedule and compound the same volume argument.
PART H · WHY THIS HOLDS
The enabler, then each condition and its mechanism
Reuse across brokers is lawful as regulated reliance, not automatic portability, and platform-designated brokers are an already-licensed pattern. Counsel to confirm before this leaves the group.
THE ENABLER
SEC Rule 67 (2021): the digital sub-broker category
The SEC's 2021 amendment to Rule 67 defines the “sub-broker serving multiple brokers through a digital platform”, with its own capital, documentation and conduct requirements. This is the licence category under which platform-designated brokers already operate at scale in Nigeria: Chaka held the first digital sub-broker licence, Bamboo trades Nigerian equities through Lambeth Capital as partner broker, and Risevest offers NGX trading on Chaka's licence. Users on those platforms never choose a broker; the platform's designated broker is accepted at signup. The construct on this page is that same licensed pattern, upgraded with a panel, a published allocation rule, and an explicit client-agreement tap. Registration comes before launch: the 2021 enforcement action against unregistered platforms is the other half of the precedent.
THE FRAMEWORK
SEC three-tiered KYC (Rules and Sundry Amendments, June 2017)
The tier ladder this design runs on is not ours; it is the Commission's. The June 2017 rules adopt a three-tiered KYC framework for all Capital Market Operators, expressly for financial inclusion: Level 1 opens with basic details and no documentary evidence, capped at ₦20,000 a deposit and ₦200,000 cumulative; Level 2 lifts the caps with verification; Level 3 is uncapped under full KYC. Two clauses do real work here. Operators shall migrate accounts upward once balances exceed a cap, which is this object's progressive enrichment written as regulation. And the framework exists to reach exactly the first-time investors this build targets, so the strategy aligns with the rules rather than asking around them. One clause needs counsel: Level 3 speaks of face-to-face opening, so whether BVN plus biometric remote verification satisfies it, or the uncapped tier needs an agent touchpoint or an SEC no-objection, is a named open question, with Level 2 caps as the graceful fallback.
SEC AML/CFT · RELIANCEEach broker remains ultimately responsible for its own CDD.
Per-broker attestation. Brokers never inherit a KYC; each signs its own attestation over the shared evidence. Liability never moves.
SEC AML/CFT · EVIDENCEIdentification data must be producible to a relying party on request, without delay.
Provenance ledger. The hash-chained trail on the object, documents, timestamps, sources, is pullable by any attesting broker at any time.
NDPA 2023 · CONSENTSharing with a new controller needs explicit, specific, informed consent.
The consent hook. Armed on the object at mint, fired as one explicit tap per broker added, captured with scope and timestamp. Withdrawal as easy as grant.
CONTRACT · MANDATEA broker-client relationship needs both parties' consent, not platform fiat.
Standing offer + two acceptances. The panel agreement is the broker's standing offer; the client-agreement tap is the user's acceptance; attestation is the broker's acceptance of this specific client, preserving their right to refuse.
SEC 3-TIER KYC · LEVEL 1 FLOORSimplified accounts may open with basic details and no documentary evidence, under caps.
The fail-safe floor. Every held-for-review state opens as a capped Level 1 account instead of a dead end. Nobody-is-blocked stops being our principle and becomes the Commission's mechanism.
SEC 3-TIER KYC · MIGRATION DUTYOperators shall migrate accounts to the next level once balances exceed the cap.
Progressive enrichment. The object starts thin and grows richer as it is used, because the rules require it to. Tier, class and evidence all deepen on the same object.
OPEN ITEMS · counsel pass on reliance conditions, GAID 2025 consent mechanics, and the digital sub-broker registration posture · panel allocation formula and governance to be socialised with the PI community · commercial terms for the bvndle rail and VBank node inside NASD's platform (related-party governance included) · CSCS engagement on the BVN lookup (roadmap, not launch) · corporate-action elections for SETTLING-state users during the live rights issue · counsel question on Level 3 face-to-face opening versus remote BVN plus biometric (Level 2 caps as the graceful fallback) · Level 1 rails on the VBank node (no outward transfers, no foreign remittance credits, one Level 1 account per person declaration) · a threshold-review ask to the SEC, the 2017 caps in 2026 naira, alongside the existing engagement
