PlatformIdentityVerified Trust Layer InstitutionsCorporates GovernmentIndividuals AI Agents
Architecture

The Trust Layer

High-velocity transactions fail at the trust layer, not the speed layer. Every delay in settlement, every callback confirmation, every reconciliation process exists because neither party can independently verify the other's authorisation without asking them. KXCO replaces the question with a proof.

4 cryptographic primitives One continuous trust chain from KYC to settlement Identical for humans and machines
01
Who are you?
KXCO ID

Verified identity — KYC-backed for humans, ML-DSA-65 keypair for machines. On-chain, portable to any operator on KXCO rails. Do KYC once. Use everywhere.

02
Did you authorise it?
KXCO Sign

ML-DSA-65 signature on every action — transactions, API calls, documents, model outputs. The signature IS the authorisation. No callback. No confirmation. No re-keying.

03
Is the record intact?
KXCO Verify

On-chain attestation via KXCOVerifiedRegistry — tamper-evident, permanent, independently verifiable by anyone without trusting KXCO. The block number is the timestamp. The chain is the authority.

04
Did value move?
KXCO Wallet

On-chain settlement via PQCWallet — immutable, instant, ML-DSA-65 governed. Only valid post-quantum signatures move funds. Finality in 10 seconds. Not T+2.

Every delay in settlement is a missing trust primitive.

Traditional finance compensates for absent cryptographic trust with process — callbacks, confirmations, reconciliations, T+2 windows. KXCO eliminates the need for the process by providing the proof.

Trust checkpoint Traditional approach Time cost KXCO approach KXCO time
KYC / identityPer institution, manual, siloed. $500–$2,000/customer/institution/yr.Days to weeksOnce, on-chain credential, portable to all operators on KXCO railsOne-time
Trade authorisationPhone callback, email confirmation, manual re-keying by operations staffHoursML-DSA-65 signature on the instruction — the signature is the authorisationSub-second
SettlementT+2 — counterparty trust re-established each time, nostro/vostro reconciliation2 daysPQCWallet executes on-chain. OTC rate locked at instruction time, applied immutably10 seconds
Compliance recordReconstructed after the fact from email threads, logs, and call recordingsWeeks in disputeOn-chain from day one — immutable, regulator-accessible, independently verifiableInstant
Document integrityPDF signatures, wet signatures scanned as PNGs — no proof of non-modificationDisputed in litigationML-DSA-65 hash anchored to Armature L1 at moment of signing — tamper-evident forever30-year horizon
Machine participationNot possible — no identity primitive exists for autonomous systemsNeverML-DSA-65 keypair + PQCWallet — same trust primitives as human institutionsImmediate
The Complete Trust Chain

From KYC to settlement — every step signed, every record permanent.

This is the complete flow for a human or machine moving from identity to settled transaction. No step is unsigned. No record is mutable. No human verification step is required after onboarding.

1
KYC verification
Human: Sumsub KYC widget · Machine: ML-DSA-65 keypair generated locally
2
KXCO ID issued on-chain
ML-DSA-65 public key registered in PQCRegistry on Armature L1 · kid fingerprint published to well-known URL · credential portable to all operators
3
KXCO Wallet provisioned
PQCWallet contract deployed or assigned · ARMR balance enables gas and settlement · wallet API at chain.kxco.ai/wallet
4
Instruction created and signed (KXCO Sign)
Payment, trade, or settlement instruction signed with ML-DSA-65 · signature contains instruction hash + timestamp + kid · no callback required
5
Counterparty verifies signature
Against published well-known public key · independently, in parallel, without asking KXCO · verification is the authorisation
6
Proof anchored (KXCO Verify)
Scanner submits attest() to KXCOVerifiedRegistry · record: hash, surface, signerKid, timestamp · block number = immutable timestamp
7
Settlement executes (KXCO Wallet)
PQCWallet executes on-chain transfer · OTC corridor rate locked at instruction time, applied immutably · ML-KEM-768 encrypted memo carries compliance codes
8
Finality — 10 seconds
1-block QBFT deterministic finality · on-chain audit trail complete · KnightsVault or Thredd card handles fiat off-ramp under licensed operator's regulatory perimeter

How KnightsVault sits in the stack.

KXCO is the software layer. KnightsVault is the licensed operator layer — the white-label banking platform that sits between KXCO infrastructure and end users. KXCO holds no licences, holds no assets, holds no fiat. The licensed operator does.

End UsersInstitutions · Corporates · Government · Individuals · Machines — interact with the KnightsVault interface, never directly with KXCO
KnightsVaultLicensed operator layer — accounts, payments, Thredd cards, fiat rails · GMC legal entity · DK Bank · RMA partnership · holds all regulatory relationships
KXCO ProductsID · Sign · Verify · Wallet — the four trust primitives. KnightsVault calls these at each step of the transaction lifecycle. KXCO has no direct user relationship.
Armature L1KXCO Chain · Chain ID 1111 · ARMR — Hyperledger Besu v26.4 · QBFT consensus · ML-DSA-65 on every transaction · 10-second finality · DigitalOcean London

The B2B2C model means KXCO's trust infrastructure can be deployed by any licensed institution without KXCO acquiring a single regulatory licence. The institution owns the customer relationship. KXCO provides the proof layer underneath it.

The trust layer must survive the quantum transition.

A trust layer built on classical cryptography has an expiry date. KXCO deploys NIST-standardised post-quantum algorithms at every layer so that records created today remain verifiable and unforgeable in 30 years.

Harvest-Now-Decrypt-Later

Nation-state adversaries record encrypted traffic today for decryption when quantum capability matures. This applies to TLS sessions, inter-node traffic, and any encrypted communication. KXCO addresses this at every layer: hybrid PQ-TLS (X25519MLKEM768) for external connections, AES-256-GCM for stored data, ML-KEM-768 for payment memos.

The 2035 NSA Mandate

NSA CNSS Policy 15 requires all national security systems to complete PQC migration by 2035. KXCO is production-compliant with NIST FIPS 203, 204, and 205 today — not on a roadmap. ML-DSA-65 signs every transaction. SLH-DSA provides hash-based signing with a 30-year verification horizon. The mandate deadline is less than ten years away.

Algorithm Diversity

Every KXCO transaction carries both ML-DSA-65 (lattice-based, FIPS 204) and SLH-DSA-SHAKE-128s (hash-based, FIPS 205). These rest on entirely different mathematical foundations. A breakthrough against lattice cryptography does not compromise hash-based cryptography. An adversary must defeat both simultaneously — providing cryptographic redundancy no other production blockchain offers.

All four primitives work identically for machines.

AI agents, robots, LLMs, and large quantitative models receive the same on-chain identity, wallet, signing, and verification capability as human institutions — with no KYC requirement and no human intermediary.

Institutions
Banks · Custodians · Asset Managers
KnightsVault + KXCOIdentity + KXCO Sign

Settlement rails, portable KYC credentials, ML-DSA-65 API auth replacing bearer tokens. T+10s not T+2.

For Institutions →
Corporates
Companies · Law Firms · Professional Services
KXCO Verified + Quantum Document Signing

Domain trust, document integrity, brand protection. From $99/yr. 30-year verification horizon.

For Corporates →
Government
Agencies · Public Bodies · Sovereign Institutions
KXCOIdentity + KXCO Verified + KXCO Sign

Citizen credentials, procurement records, public authority signing. FIPS 204/205 compliant. NSA CNSA 2.0 aligned.

For Government →
Machines
AI Agents · Robots · LLMs · LQMs
KXCO ID + KXCO Wallet + KXCO Sign + KXCO Verify

ML-DSA-65 keypair identity, ARMR wallet, triple-algorithm signing, on-chain proof. No human intermediary.

For Machines →

The trust layer is live.
Talk to our team.

KXCO infrastructure is production-deployed today — not on a roadmap. The institutions that build on the trust layer now will define the standard for everyone else.