Investor Onboarding and Eligibility

AI-assisted manuscript. The rules and people below are fictional, not a statement of who may invest in a real product.

Learning objectives

• Separate identity verification from product eligibility.
• Model review, expiry, rejection and correction states.
• Trace an admission decision to a rule and dated evidence.

One approval cannot answer every question

Identity verification asks whether information sufficiently establishes a person or entity under the relevant process. Product eligibility asks whether that identified participant is allowed to enter a particular arrangement. Residency, investor category, product restrictions, agreement acceptance and payment conditions can require separate decisions. A successful identity check should not silently answer them all.

FATF provides international standards and implementation guidance for virtual assets, including information collection and transfer obligations in its Travel Rule work. Jurisdictions implement requirements through their own systems; this is not one globally identical, automatically effective threshold. FATF: Virtual Assets

A tokenization design must connect these decisions to transfer and servicing rules without treating a wallet address as a complete legal identity. The BIS framework's connection between representations and governance is relevant here. BIS

Worked example: verified identity, expired permission

Imagine fictional fund Cedar Income permits only participants satisfying its assumed residency rule and a completed suitability review. These are invented teaching rules. Mina's identity is verified on day 1; a reviewer records the required residency evidence and grants permission through day 90.

On day 95 Mina requests a transfer. Her identity has not automatically become false, but the product permission is expired. The decision should be “review required under the stated expiry rule,” not “identity fraud” and not unconditional approval. Keeping separate states makes the reason explainable.

Now suppose Mina corrects an address typo. A correction request should not erase the prior record or grant a fresh permission without review. Retain the previous decision, replacement evidence, rule version and authorized reviewer action. The software should avoid storing more personal information than its defined purpose needs.

Identity: unverified → pending → verified / rejected → update required
Product permission: not assessed → review → eligible / ineligible
                                             ↓
                                     expired / suspended
Transfer decision = current permission + relevant transaction rules

The diagram is a proposed control model. It does not establish a legal retention period or a universal onboarding process.

Design decisions that can be audited

Represent an eligibility decision with a participant reference, product scope, evidence reference, policy version, decision time, expiry if applicable and authorized decision maker. A wallet association can change, so do not use an address alone as a permanent person identifier. Separate whether a credential exists from whether it is current and applicable to this transaction.

Explain failure states in user language: awaiting evidence, evidence expired, jurisdiction unsupported or human review required are different states. An automatic technical error should not label someone legally ineligible. Provide a correction route without promising acceptance.

Revocation requires propagation. If a permission is suspended, the transfer control must read the current state or a deliberately bounded cache. A record of suspension that no consumer checks is not an effective control. Test expired, revoked, mismatched-product and unknown participants, as well as the accepted case.

Common misconceptions

“KYC passed means every product is available.” Identity and product eligibility have different scopes.

“The wallet is whitelisted forever.” Permission can expire or be revoked under the arrangement.

“A standard guarantees legal compliance.” Technical enforcement applies specified rules; the rule choice and legal basis still require authority.

Risks and limits

This chapter does not supply legal eligibility criteria, residency advice or a global compliance determination. Do not infer eligibility from website access, citizenship, a card logo or a successful token transfer. Sensitive identity material requires controlled access and appropriate retention; a public ledger should not become an unfiltered document store.

Exercise and answer

Exercise: Mina's identity remains verified, but her product permission expired five days ago. What is the bounded decision on a new transfer?

Answer: Hold or route the transaction for the required permission review. Do not automatically deny her identity or approve the product transaction. Preserve the specific rule and expiry evidence.

Related learning

Continue in product architecture with subscription and issuance. The engineering phase later distinguishes an identity registry from its policy consumer.

Source map

fatf-virtual-assets: FATF's international standards and implementation guidance, not one jurisdiction's automatic eligibility law. bis-tokenisation: international research on arrangements and governance. Both were directly read by the source-analysis role on 2026-10-18. Mina, time limits and fund rules are original teaching assumptions; no identity documents or real applicant were processed.